2665 Commits

Author	SHA1	Message	Date
Esben Sparre Andreasen	9c2ca9a7fa	JS: make js/unused-local-variable flag import statements	2018-10-18 11:49:45 +02:00
Tom Hvitved	58a0815033	Merge remote-tracking branch 'upstream/master' into mergeback-2018-10-17	2018-10-17 13:24:37 +02:00
semmle-qlci	1da873e819	Merge pull request #315 from esben-semmle/js/conditional-bypass-early-return ... Approved by xiemaisi	2018-10-17 08:25:55 +01:00
Esben Sparre Andreasen	ffbbb807f4	JS: avoid flagging early returns in js/user-controlled-bypass	2018-10-16 08:39:59 +02:00
semmle-qlci	16b29b2d08	Merge pull request #299 from asger-semmle/nosql-sinks ... Approved by xiemaisi	2018-10-12 07:12:05 +01:00
Tom Hvitved	b29b314f4e	Merge remote-tracking branch 'upstream/master' into mergeback-2018-10-11	2018-10-11 14:36:44 +02:00
Asger F	9b10254cd4	JS: support label-specific sanitizer guards	2018-10-10 18:27:14 +01:00
Asger F	5e720486d5	JS: recognize req.query.x as deep object taint	2018-10-10 17:15:56 +01:00
Asger F	d72d7345b8	JS: make NosqlInjection use object taint	2018-10-10 17:05:59 +01:00
Esben Sparre Andreasen	6687dfd558	JS: improve model of express' req.sendFile	2018-10-10 15:46:43 +02:00
Esben Sparre Andreasen	358b6c3413	JS: change "remote request" to "network request"	2018-10-10 15:34:39 +02:00
Esben Sparre Andreasen	3b2440e850	JS: remove useless externs definitions for tests	2018-10-10 12:12:54 +02:00
Esben Sparre Andreasen	b00aa36cdc	JS: polish HttpToFileAccess.ql	2018-10-10 12:12:54 +02:00
Esben Sparre Andreasen	d261915598	JS: polish FileAccessToHttp.ql	2018-10-10 12:12:54 +02:00
Asger F	74f115fa40	JS: add test case	2018-10-10 10:46:40 +01:00
Asger F	030bae9454	JS: Canonicalize ThisNode	2018-10-09 08:53:41 +01:00
Tom Hvitved	ccebd5eb11	Merge remote-tracking branch 'upstream/master' into mergeback-2018-10-08	2018-10-08 16:23:29 +02:00
Asger F	d2af4ab94a	Merge pull request #227 from xiemaisi/js/taint-kinds ... JavaScript: Add support for state-based taint tracking.	2018-10-08 15:09:12 +01:00
Tom Hvitved	49644bfb47	Merge remote-tracking branch 'upstream/master' into mergeback-2018-10-08	2018-10-08 11:48:56 +02:00
Esben Sparre Andreasen	a668f906bc	JS: recognize binding decorators on classes	2018-10-08 07:58:12 +02:00
semmle-qlci	98254e87e1	Merge pull request #132 from denislevin/denisl/js/HttpToFileAccessTest ... Approved by xiemaisi	2018-10-04 14:06:46 +01:00
Max Schaefer	017ae4990d	JavaScript: Use custom flow labels in ClientSideUrlRedirect.	2018-10-03 15:49:02 +01:00
semmle-qlci	e9adc63d91	Merge pull request #260 from xiemaisi/js/confusing-precedence ... Approved by esben-semmle, mc-semmle	2018-10-03 09:07:18 +01:00
Denis Levin	e147e690ee	Merge branch 'master' into denisl/js/HttpToFileAccessTest	2018-10-02 15:13:35 -07:00
Max Schaefer	425d2bfba7	Merge pull request #266 from esben-semmle/js/improve-dead-store-of-local ... JS: support noop parentheses in js/useless-assignment-to-local	2018-10-02 16:19:56 +01:00
semmle-qlci	b35f450b01	Merge pull request #162 from asger-semmle/partial-calls ... Approved by esben-semmle, xiemaisi	2018-10-02 11:24:02 +01:00
Max Schaefer	768368498f	JavaScript: Introduce new query UnclearOperatorPrecedence.	2018-10-02 08:46:51 +01:00
Max Schaefer	a63b7fc215	JavaScript: Introduce new library predicate for computing whitespace around binary operators.	2018-10-02 08:46:11 +01:00
semmle-qlci	829a5cc451	Merge pull request #259 from asger-semmle/open-redirect-expr ... Approved by xiemaisi	2018-10-02 08:32:48 +01:00
Esben Sparre Andreasen	595fe217dd	JS: support noop parentheses in js/useless-assignment-to-local ... The syntatic recognizer `isNullOrUndef` did not handle expressions that were wrapped in parentheses. This eliminates some results here: https://lgtm.com/projects/g/vuejs/vue/alerts?mode=tree&ruleFocus=7900088	2018-10-02 09:31:32 +02:00
Denis Levin	9c487bc6d9	Merge branch 'master'	2018-10-01 14:51:56 -07:00
Denis Levin	82d8b4e371	Adding the source link to the test case samples	2018-10-01 11:45:38 -07:00
Asger F	9f07b1011d	JS: bugfix in server-side redirect query	2018-10-01 12:34:13 +01:00
Asger F	46336a5643	JS: Add HostHeaderPoisoningInEmailGeneration query	2018-09-27 10:20:35 +01:00
Aditya Sharad	75680dbfef	Merge branch 'next' into qlucie/master	2018-09-26 12:08:33 +01:00
Esben Sparre Andreasen	7c006d4530	Merge pull request #222 from xiemaisi/js/identity-replacement ... JavaScript: Add new query flagging identity replacements.	2018-09-26 09:25:19 +02:00
Max Schaefer	0e63ea1b51	JavaScript: Update tests.	2018-09-25 11:27:12 +01:00
Max Schaefer	1ab11109f9	JavaScript: Add new query flagging identity replacements.	2018-09-25 11:27:11 +01:00
Asger F	269bbc9a1a	JavaScript: add flow steps through partial function application	2018-09-25 10:16:40 +01:00
Denis Levin	1438cae362	Correction to the test's expected file as the test was modified.	2018-09-24 10:45:54 -07:00
semmle-qlci	7f56be6fe2	Merge pull request #216 from asger-semmle/lusca-csrf ... Approved by esben-semmle	2018-09-24 11:34:24 +01:00
semmle-qlci	46178271d1	Merge pull request #213 from asger-semmle/sendfile ... Approved by xiemaisi	2018-09-24 11:32:46 +01:00
Denis Levin	8152cefa60	Squished changes for HttpToFileAccess commint	2018-09-21 16:44:01 -07:00
Asger F	4797924bea	JS: review comments	2018-09-21 14:46:21 +01:00
Asger F	5f467d2fc5	JS: recognize CSRF middleware from lusca package	2018-09-21 13:15:40 +01:00
Asger F	6f109a742f	JS: add a test case for res.sendfile	2018-09-21 11:04:33 +01:00
alexet	b94df82833	JavaScript: Fix expected output due to qltest change.	2018-09-20 15:56:20 +01:00
semmle-qlci	f146e34e26	Merge pull request #207 from dave-bartolomeo/dave/JSNewlines ... Approved by esben-semmle	2018-09-20 14:49:54 +01:00
Dave Bartolomeo	b12c739915	JavaScript: Normalize line endings of .js and .html files ... Added .gitattributes files for the two directories where we intentionally have line endings other than LF	2018-09-19 21:33:27 -07:00
semmle-qlci	4aca8f4fd3	Merge pull request #201 from asger-semmle/string-concatenation-squashed ... Approved by esben-semmle	2018-09-19 21:59:17 +01:00