hohn/codeql
1
0
Fork 0
mirror of https://github.com/github/codeql.git synced 2025-12-17 09:13:20 +01:00
Code Issues Packages Projects Releases Wiki Activity
83,868 Commits 1,671 Branches 157 Tags
codeql-cli-2.23.4
Commit Graph

5024 Commits

Author SHA1 Message Date
Asger F
36e18c2a89 JS: Enable inline expectations in BuildArtifactLeak 
The tests already have the annotations, it just seems to have been disable by accident
 2025-09-10 10:56:34 +02:00
Asger F
d575d3c9e4 Merge pull request #20374 from asgerf/js/typescript-5.9 
JS: Support TypeScript 5.9 and support 'import defer' syntax
 2025-09-09 20:50:04 +02:00
Asger F
0752dbea9b Merge pull request #20360 from asgerf/js/remove-angularjs-string-special-case 
JS: Remove special treatment of strings in AngularJS code
 2025-09-08 22:48:23 +02:00
Napalys Klicius
8c34b7eaea Merge pull request #20146 from Napalys/js/move-cors-query-from-experimental 
JS: Move cors-misconfiguration query from experimental to Security
 2025-09-08 09:32:38 +02:00
Napalys Klicius
b2feaaceea Merge branch 'main' into js/move-cors-query-from-experimental 2025-09-05 12:11:09 +02:00
Asger F
bab2a79055 JS: Add parsing support in JS parser 2025-09-05 11:57:34 +02:00
Asger F
215602c963 JS: Preserve information about 'defer' keyword 2025-09-05 11:57:33 +02:00
Asger F
76ca1a576f JS: Add basic test for 'import defer' syntax in TypeScript 2025-09-05 11:57:31 +02:00
Arthur Baars
5d3ec35e29 Remove non-breaking spaces from code 2025-09-05 09:41:15 +02:00
Napalys Klicius
c4c8dbcf7d Merge remote-tracking branch 'origin/main' into js/move-cors-query-from-experimental 2025-09-04 15:24:44 +02:00
Napalys Klicius
d3d608fa33 Updated query description and added a sanitizer 2025-09-04 13:16:37 +00:00
Napalys Klicius
4dac80a998 Replace complex wrapper classes with MaD 2025-09-04 12:19:22 +00:00
Asger F
4926d278a2 JS: Update test output 2025-09-04 13:59:19 +02:00
Michael Nebel
8009ddebce Merge pull request #20329 from michaelnebel/javascript/ql4ql 
JS: Fix some Ql4Ql violations.
 2025-09-04 13:01:37 +02:00
Napalys Klicius
8fc81f4263 Merge branch 'main' into js/remote-property-injection-update 2025-09-03 14:02:19 +02:00
Michael Nebel
8b10ad49d7 JS: Fix some Ql4Ql violations. 2025-09-01 15:17:53 +02:00
Asger F
0d0eaa21a1 Merge pull request #20302 from asgerf/js/simpler-locations 
JS: Remove synthetic locations
 2025-09-01 09:46:13 +02:00
Asger F
57b4534d30 JS: Avoid overriding Expr predicates in xUnit.qll 2025-08-29 13:06:05 +02:00
Asger F
cc8fe10801 JS: Update locations in expected files 2025-08-29 12:03:11 +02:00
Napalys Klicius
bafe22c50c Merge pull request #20048 from Napalys/js/xml_bomb_sinks 
JS: Exclude patched libraries from `xml-bomb` sink
 2025-08-29 08:10:55 +02:00
Napalys Klicius
32606584ea JS: add enumeration taint flow to Remote Property Injection query 2025-08-27 10:23:03 +00:00
Napalys Klicius
c39c04cb86 JS: added new test case for remote prop injection via Object.keys 2025-08-27 10:20:57 +00:00
Napalys Klicius
10c10c7d30 JS: fixed typo in folder name 2025-08-27 10:17:39 +00:00
Napalys Klicius
b19d1e0f57 Merge pull request #20151 from Napalys/js/command-line-libs 
JS: Enhance command injection detection for CLI argument parsing libraries
 2025-08-18 09:32:29 +02:00
Napalys Klicius
b2346183d6 Merge pull request #20148 from Napalys/js/reg-exp-env-variable-threat-model 
JS: Exclude environment variables from `js/regex-injection` query by default
 2025-08-18 09:32:15 +02:00
Tom Hvitved
eb3c054b0f JS: Generate legacy flow steps for all flow summaries 2025-08-06 09:38:49 +02:00
Napalys Klicius
ae4077db72 add taint flow for arg/command-line-args with custom argv option 2025-08-01 13:34:08 +02:00
Napalys Klicius
d6508f34b6 Add taint flow for Commander.js direct property access and action callbacks 2025-08-01 13:24:19 +02:00
Napalys Klicius
39170f327c Added couple more test cases for commander js 2025-08-01 13:14:39 +02:00
Napalys Klicius
6b4e34dd39 Added a step from parse to opts for commander js 2025-08-01 13:12:43 +02:00
Napalys Klicius
e980798ede Added step through yargs/yargs constructor and chained methods. 2025-08-01 12:01:30 +02:00
Napalys Klicius
e8eb9be3f6 Add command injection tests for CLI argument parsing libraries 2025-08-01 11:02:59 +02:00
Napalys Klicius
d28a6e6352 Added new test cases for regexp injection with enviromental variable threat model enabled 2025-07-31 13:20:37 +02:00
Napalys Klicius
8583257574 Created new folder for test with threat models disabled 2025-07-31 13:20:30 +02:00
Napalys Klicius
5f538209c9 Exlucde environmental variables from default detection in regexp injection 2025-07-31 12:09:30 +02:00
Napalys Klicius
95743d7109 Added inline test expectations for cors permissive config 2025-07-30 10:42:55 +00:00
Napalys Klicius
358617f533 Move CORS misconfiguration query from experimental to Security 2025-07-30 10:22:59 +00:00
Napalys Klicius
1851deb929 Removed libxmljs from being marked as sink for xml-bomb. 2025-07-15 09:33:11 +02:00
Asger F
47a90c8b32 Merge branch 'main' into js/no-type-extraction 2025-07-02 13:18:05 +02:00
Asger F
7c38c48fd7 Merge pull request #19769 from trailofbits/VF/Nest-improvements 
Improve NestJS sources and dependency injection
 2025-06-30 10:42:18 +02:00
Asger F
3247babfa5 Merge pull request #19762 from trailofbits/VF/type-orm-model-improvements 
Improve TypeORM model
 2025-06-30 10:40:38 +02:00
Asger F
c8b2674206 JS: Add support for index expressions 2025-06-25 14:31:22 +02:00
Asger F
b1d4776b17 JS: Handle name resolution through dynamic imports 2025-06-25 14:31:20 +02:00
Asger F
7cc248703a JS: Add test for dynamic imports 2025-06-25 14:31:17 +02:00
Napalys Klicius
3d9e2f5438 Merge pull request #19858 from Napalys/js/execa 
JS: moved `execa` out of experimental
 2025-06-25 10:34:52 +02:00
Asger F
d39b68cd41 Merge pull request #19849 from asgerf/js/remove-legacy-actions-queries 
JS: Remove legacy actions queries
 2025-06-25 09:18:33 +02:00
Asger F
853fc1a7cf Merge pull request #19852 from asgerf/js/react-use-server 
JS: Model React 'use' and 'use server'
 2025-06-25 09:13:56 +02:00
Napalys Klicius
0902ca0605 JS: address copilot suggestions 2025-06-24 11:37:07 +02:00
Asger F
d428eaeef8 Merge pull request #19655 from GeekMasher/js-clientrests-axios 
JS: ClientRequests Axios Instance support
 2025-06-24 10:35:51 +02:00
Napalys Klicius
d05de1ba4e JS: moved execa test cases outside experimental 2025-06-24 09:08:13 +02:00