Asger F
8354909d46
JS: add closure library in globalObjectRef
2019-02-25 16:45:47 +00:00
Asger F
fab0afd755
JS: model string functions from closure library
2019-02-25 16:08:47 +00:00
semmle-qlci
58cc8d0ecc
Merge pull request #936 from xiemaisi/js/revive-electron-support
...
Approved by esben-semmle
2019-02-25 15:23:20 +00:00
Esben Sparre Andreasen
4dc147d506
JS: rename CapturedSource -> LocalObject (files)
2019-02-25 16:09:07 +01:00
Asger F
050626aca0
JS: remove audit alerts from package.json
2019-02-25 15:04:47 +00:00
Esben Sparre Andreasen
66367987af
JS: rename CapturedSource -> LocalObject
2019-02-25 16:04:37 +01:00
Esben Sparre Andreasen
65fb1423b7
JS: format test case (update expected output)
2019-02-25 15:55:44 +01:00
Esben Sparre Andreasen
1150f4c02b
JS: add documentation to test case
2019-02-25 15:52:23 +01:00
Esben Sparre Andreasen
46a1c75549
Merge pull request #973 from xiemaisi/js/remove-package-json
...
JavaScript: Delete an unused `package.json` in a test.
2019-02-25 14:05:22 +01:00
Asger F
7d14429dce
JS: handle deeper access paths in Closure::moduleImport
2019-02-25 12:31:18 +00:00
Asger F
2f6496f6bd
JS: add test with undeclared nested access
2019-02-25 12:27:36 +00:00
Asger F
b31d7d1f5f
JS: add test case
2019-02-25 11:31:09 +00:00
Esben Sparre Andreasen
4ce7ec1661
JS: add XSS vector for Vue's v-html
2019-02-25 12:17:56 +01:00
Esben Sparre Andreasen
da1ffcfd1b
JS: introduce Vue Template Element
2019-02-25 12:17:33 +01:00
Esben Sparre Andreasen
9f4f945975
JS: introduce Vue::InstanceHeapStep
2019-02-25 12:17:33 +01:00
Asger F
614ba92fac
JS: add ClassContainsTwo.expected
2019-02-25 09:51:40 +00:00
semmle-qlci
014d4b9ed0
Merge pull request #934 from asger-semmle/module-import
...
Approved by xiemaisi
2019-02-25 09:46:52 +00:00
Max Schaefer
d4dbe3bfb6
JavaScript: Back out parsing of qualified XML identifiers.
...
Their syntax conflicts with the proposed function-bind operator, which is more important to support.
2019-02-24 21:30:59 +00:00
Max Schaefer
e7c95bae49
JavaScript: Add flow steps modelling Electron IPC.
2019-02-23 21:43:13 +00:00
Max Schaefer
a4e4957f31
JavaScript: Model webContents property.
2019-02-23 21:43:13 +00:00
Max Schaefer
ff83e600dc
JavaScript: Track Electron browser objects inter-procedurally.
2019-02-23 21:43:13 +00:00
Max Schaefer
d59c12e6eb
JavaScript: Recognise Electron browser objects based on TypeScript types when available.
2019-02-23 21:43:13 +00:00
Max Schaefer
20d41b85de
JavaScript: Delete an unused package.json in a test.
...
While this file is part of the project used in the tutorial, it isn't necessary for the queries to work. It also specifies a dependency on a vulnerable version of Express, causing it to be (spuriously) flagged by security scanners.
2019-02-23 13:59:18 +00:00
Max Schaefer
db9ac72e7a
Merge pull request #957 from esben-semmle/js/another-autobinder-model
...
JS: model one more 'autobind' for js/unbound-event-handler-receiver
2019-02-22 20:58:17 +00:00
Esben Sparre Andreasen
6c1b29e4b6
JS: add missing flowstep for unused parameter field initializers
2019-02-21 21:44:28 +01:00
Esben Sparre Andreasen
6766716867
JS: add PropWrite tests for parameter field initializers
2019-02-21 21:44:28 +01:00
Esben Sparre Andreasen
bdd8691e65
JS: add type inference for the return value of captured method calls
2019-02-21 21:44:28 +01:00
Esben Sparre Andreasen
8af501d4d5
JS: avoid double reporting dead code with js/unused-variable
2019-02-21 21:44:28 +01:00
Esben Sparre Andreasen
91dccc3356
JS: add query js/unused-property
2019-02-21 21:44:28 +01:00
Esben Sparre Andreasen
0cf2eaec5e
JS: introduce CapturedSource
2019-02-21 21:44:28 +01:00
Esben Sparre Andreasen
305a249280
JS: add taint steps for fs.realpath and fs.realpathSync
2019-02-21 09:48:35 +01:00
Esben Sparre Andreasen
27cae0c190
JS: model one more 'autobind' for js/unbound-event-handler-receiver
2019-02-21 08:23:54 +01:00
semmle-qlci
f5e419e774
Merge pull request #933 from xiemaisi/js/createContextualFragment
...
Approved by asger-semmle
2019-02-20 12:42:27 +00:00
Asger F
e7e29101e4
JS: add StringOps::Concatenation
2019-02-15 16:57:26 +00:00
Asger F
c115451b9d
JS: Fix copy-pasta bug
2019-02-15 16:48:42 +00:00
semmle-qlci
26525fc1b5
Merge pull request #929 from asger-semmle/typescript-no-expansion
...
Approved by xiemaisi
2019-02-13 18:20:41 +00:00
semmle-qlci
92a6e7e04c
Merge pull request #932 from asger-semmle/cookbook-prepare
...
Approved by xiemaisi
2019-02-13 18:20:09 +00:00
Asger F
dfe3f254de
JS: generalize to include default imports
2019-02-13 18:03:57 +00:00
Max Schaefer
5b2df068d3
Merge pull request #921 from asger-semmle/class-node-absval
...
JS: use type inference to back up function-style classes
2019-02-13 10:12:20 +00:00
semmle-qlci
c422ade739
Merge pull request #927 from xiemaisi/js/ambiguous-id-attr-templates
...
Approved by esben-semmle
2019-02-13 08:35:41 +00:00
Asger F
be10f24de7
JS: make moduleImport() work for named imports
2019-02-12 17:22:06 +00:00
Max Schaefer
2fce626c3a
JavaScript: Add Range.prototype.createContextualFragment as an XSS sink.
2019-02-12 16:32:30 +00:00
Max Schaefer
25f95d9fb1
JavaScript: Be more conservative about templates in AmbiguousIdAttribute.
...
Previously, we only excluded attributes where the value of the attribute itself suggests templating happening. Now we exclude all attributes in documents where _any_ attribute value suggests templating.
2019-02-12 16:31:01 +00:00
Anders Schack-Mulligen
15a6044445
Javascript: Autoformat qlls
2019-02-12 14:41:31 +01:00
Asger F
3290c174c3
JS: Add DataFlow::Node.getAFunctionValue
2019-02-12 13:38:46 +00:00
Asger F
2fd1ee60a2
JS: add DataFlow::Node.getIntValue()
2019-02-12 13:38:46 +00:00
Anders Schack-Mulligen
1182fca665
Javascript: Autoformat qls
2019-02-12 14:38:42 +01:00
semmle-qlci
c133362660
Merge pull request #910 from xiemaisi/js/regexp-taint
...
Approved by esben-semmle
2019-02-12 13:15:16 +00:00
Asger F
0444fa307d
TS: update test expectations
2019-02-12 12:33:09 +00:00
semmle-qlci
ac3f413b87
Merge pull request #920 from xiemaisi/js/field-as-prop-write
...
Approved by asger-semmle
2019-02-12 10:48:13 +00:00
