hohn/codeql
1
0
Fork 0
mirror of https://github.com/github/codeql.git synced 2025-12-18 18:10:39 +01:00
Code Issues Packages Projects Releases Wiki Activity
83,868 Commits 1,671 Branches 157 Tags
codeql-cli-2.23.4
Commit Graph

2313 Commits

Author SHA1 Message Date
Asger F
c583b480af JS: Add pragma[nomagic] just to be safe 
The DIL is unchanged
 2025-10-30 15:31:51 +01:00
Asger F
a5819a14be JS: Fix bad join order in getNextToken() 2025-10-30 15:31:51 +01:00
Nora Dimitrijević
a0975e7e19 Constrain location overrides to actual sources/sinks 2025-10-28 09:42:20 +01:00
Nora Dimitrijević
bcdbe0b50a JS/PolynomialReDoSQuery 
javascript/ql/src/Performance/PolynomialReDoS.ql
 2025-10-28 09:40:16 +01:00
Nora Dimitrijević
94343254e3 JS/ShellCommandInjectionFromEnvironmentQuery 
javascript/ql/src/Security/CWE-078/ShellCommandInjectionFromEnvironment.ql
 2025-10-28 09:40:14 +01:00
Nora Dimitrijević
71cf042607 JS/IndirectCommandInjectionQuery 
javascript/ql/src/Security/CWE-078/IndirectCommandInjection.ql
 2025-10-28 09:40:11 +01:00
Nora Dimitrijević
2a30ea923a JS/CommandInjectionQuery 
javascript/ql/src/experimental/heuristics/ql/src/Security/CWE-078/CommandInjection.ql

javascript/ql/src/Security/CWE-078/CommandInjection.ql
 2025-10-28 09:40:09 +01:00
Asger F
8d49f26f3d Merge pull request #20397 from asgerf/js/build-artifact-leak-fp 
JS: Fix FP in js/build-artifact-leak when keys come from an array of constants
 2025-10-28 06:40:13 +01:00
Asger F
c6577c8590 JS: Avoid magic and improve a join in type resolution 2025-10-15 11:54:28 +02:00
Asger F
10c9b747a5 Merge pull request #20586 from asgerf/js/api-graphs-block-this 
JS: Restrict receiver-flow in API graphs
 2025-10-08 08:41:56 +02:00
Asger F
587ad5c600 JS: Refine criteria so that explicit this-passing is not affected 2025-10-06 11:43:18 +02:00
Asger F
4d33190241 JS: Restrict this-argument passing in API graphs 2025-10-06 11:42:36 +02:00
Simon Friis Vindum
26aa938acc Merge pull request #20452 from paldepind/rust/mad-source-parameter 
Rust, shared: Support `Parameter` in source MaD models
 2025-09-24 09:37:25 +02:00
Asger F
2e8091f0fb Merge pull request #20419 from asgerf/js/express-json-send 
JS: Model Express json and jsonp methods
 2025-09-24 09:25:32 +02:00
Simon Friis Vindum
7d6e2060e5 Adapt all languages to changes in shared library 2025-09-22 14:18:58 +02:00
Asger F
7670a2bd77 Merge pull request #20375 from asgerf/js/promise-try 
JS: Support Promise.try and Array.prototype.with
 2025-09-16 14:44:07 +02:00
Napalys Klicius
97a11de1e3 Merge pull request #20435 from Napalys/js/promisification_modeling 
JS: Promisification library modeling and enhance flow
 2025-09-16 14:07:53 +02:00
Asger F
0b900711bf Update javascript/ql/lib/semmle/javascript/frameworks/Express.qll 
Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>
 2025-09-16 13:48:26 +02:00
Napalys Klicius
49ccb8ce2b JS: Simplify exist clause to use Promisify::PromisifyAllCall instead of DataFlow::SourceNode 2025-09-16 13:13:15 +02:00
Asger F
429c4eac96 JS: Add support for Array.prototype.with 
Note: This was authored by Copilot
 2025-09-16 13:06:59 +02:00
Asger F
ee78b7dc96 JS: Add support for Promise.try 2025-09-16 13:06:57 +02:00
Asger F
45eff3dac8 Merge pull request #20399 from asgerf/js/default-interop2 
JS: Refactor handling of ambiguous default imports
 2025-09-16 13:02:22 +02:00
Asger F
65102a073a Merge pull request #19770 from trailofbits/VF/async-package-improvements 
Improve data flow in the `async` package
 2025-09-16 08:55:52 +02:00
Asger F
f587273828 Merge pull request #19768 from trailofbits/VF/lodash-group-by 
Add lodash GroupBy as taint step
 2025-09-16 08:55:13 +02:00
Napalys Klicius
0d23ab07db JS: Add data flow modeling for promisified user-defined functions 2025-09-15 17:13:13 +02:00
Napalys Klicius
2c6db00cbc JS: Add modeling for util promisify* 2025-09-15 17:09:28 +02:00
Napalys Klicius
e002f2088f JS: Add modeling for es6-promisify 2025-09-15 17:04:34 +02:00
Napalys Klicius
35c75c00ba JS: Add modeling for @gar/promisify 2025-09-15 16:58:11 +02:00
Napalys Klicius
312471e9db JS: Add modeling for @google-cloud/promisify 2025-09-15 16:55:27 +02:00
Napalys Klicius
d37425ae3e JS: Treat promisify(obj).member as obj.member 2025-09-15 16:51:19 +02:00
Napalys Klicius
22b61852a1 JS: Add modeling for thenify-all 2025-09-15 16:31:14 +02:00
Asger F
132a8b8b53 JS: Model json and jsonp methods 2025-09-12 08:51:23 +02:00
Asger F
7a2391f848 JS: Deprecate Portals and delete tests 
This is a super old attempt at model generation, from before MaD even existed. It's obsolete and just have to be removed.
 2025-09-11 11:05:36 +02:00
Asger F
d39263dcac Merge pull request #20317 from asgerf/js/xunit 
JS: Avoid overriding Expr predicates in xUnit.qll
 2025-09-10 13:41:21 +02:00
Asger F
dacc9e26e9 JS: Refactor 'default' import interop 2025-09-10 13:03:36 +02:00
Asger F
2a4d6830ec JS: An array of constants should be considered "filtered" 2025-09-10 11:07:32 +02:00
Asger F
09edc29979 Merge pull request #20322 from asgerf/js/react-no-override 
JS: Do not override AST methods in React model
 2025-09-10 10:42:59 +02:00
Asger F
d575d3c9e4 Merge pull request #20374 from asgerf/js/typescript-5.9 
JS: Support TypeScript 5.9 and support 'import defer' syntax
 2025-09-09 20:50:04 +02:00
Asger F
d8e943ea05 Update javascript/ql/lib/semmle/javascript/frameworks/React.qll 
Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>
 2025-09-09 08:36:25 +02:00
Asger F
0752dbea9b Merge pull request #20360 from asgerf/js/remove-angularjs-string-special-case 
JS: Remove special treatment of strings in AngularJS code
 2025-09-08 22:48:23 +02:00
Asger F
b5045b3407 Merge pull request #20363 from asgerf/js/remove-fallback-type 
JS: Remove unused getFallbackTypeAnnotation()
 2025-09-08 22:48:07 +02:00
Napalys Klicius
b2feaaceea Merge branch 'main' into js/move-cors-query-from-experimental 2025-09-05 12:11:09 +02:00
Asger F
215602c963 JS: Preserve information about 'defer' keyword 2025-09-05 11:57:33 +02:00
Napalys Klicius
d8c4d6deb4 Rename cors-misconfiguration to cors-origin. 2025-09-05 11:30:07 +02:00
Napalys Klicius
c4c8dbcf7d Merge remote-tracking branch 'origin/main' into js/move-cors-query-from-experimental 2025-09-04 15:24:44 +02:00
Napalys Klicius
d3d608fa33 Updated query description and added a sanitizer 2025-09-04 13:16:37 +00:00
Napalys Klicius
6c751ce934 Merged config classes 2025-09-04 12:31:24 +00:00
Napalys Klicius
4dac80a998 Replace complex wrapper classes with MaD 2025-09-04 12:19:22 +00:00
Asger F
d8346ef106 JS: Remove unused getFallbackTypeAnnotation() 
This private predicate was unused, but due to its recursive self-reference it was not reported as an unused predicate.
 2025-09-04 13:40:49 +02:00
Michael Nebel
8009ddebce Merge pull request #20329 from michaelnebel/javascript/ql4ql 
JS: Fix some Ql4Ql violations.
 2025-09-04 13:01:37 +02:00