11884 Commits

Author	SHA1	Message	Date
Asger F	c2e0c8cb39	JS: Do not extract string literal types as regexps	2019-11-15 09:27:20 +00:00
Asger F	57a9cad721	JS: Fix offsets of octal and unicode escape	2019-11-15 09:27:20 +00:00
Asger F	4680e3a89a	JS: Simplify charpred of Match	2019-11-15 09:27:20 +00:00
Asger F	c01005a610	JS: Remove outdated comment	2019-11-15 09:27:20 +00:00
Asger F	e01a9846d8	JS: Update test annotations	2019-11-15 09:27:20 +00:00
Asger F	153d34638b	JS: Fix a FP	2019-11-15 09:27:20 +00:00
Asger F	8c5b9b9195	JS: Add missing post-anchor case to MissingRegExpAnchor	2019-11-15 09:27:20 +00:00
Asger F	17ad97812e	JS: Fix FPs from TLDs without a domain name	2019-11-15 09:27:20 +00:00
Asger F	20fb7717d8	JS: Use type inference to refine regexp string tracking	2019-11-15 09:27:20 +00:00
Asger F	e45c361d64	JS: Port IncompleteHostnameRegExp	2019-11-15 09:27:20 +00:00
Asger F	9ecab1b5d5	JS: Port unanchored RegExp query but for hostnames only	2019-11-15 09:27:20 +00:00
Asger F	e5f2f9e43e	JS: Do not flag semi-anchored regexps in .replace()	2019-11-15 09:27:20 +00:00
Asger F	cae09a447b	JS: Update test case	2019-11-15 09:27:20 +00:00
Asger F	3e37950170	JS: Whitelist one more FP case	2019-11-15 09:27:20 +00:00
Asger F	2b151cd587	JS: Include anchor direction in message	2019-11-15 09:27:20 +00:00
Asger F	3e952cf564	JS: Restrict semi-anchored regex query more	2019-11-15 09:27:19 +00:00
Asger F	0726bd8cac	JS: Add double semi-anchored test case	2019-11-15 09:27:19 +00:00
Asger F	9fa9729470	JS: Shift line numbers in SemiAnchoredRegExp testcase	2019-11-15 09:27:19 +00:00
Asger F	8bc89ee254	JS: Update semi-anchored regex query	2019-11-15 09:27:19 +00:00
Asger F	c21d095d38	JS: Restrict RegExp queries to actual regular expressions	2019-11-15 09:27:19 +00:00
Asger F	b8711fc642	JS: Extend RegExpTerm in ReDoS	2019-11-15 09:27:19 +00:00
Asger F	b6c1c174a9	JS: Deabstractify RegExpTerm classes	2019-11-15 09:27:19 +00:00
Asger F	e0bdc777b9	JS: Make ReDoS check string-based regexes	2019-11-15 09:27:19 +00:00
Asger F	97e5da1046	JS: Update ReDoS query	2019-11-15 09:27:19 +00:00
Asger F	57de6382cd	JS: Update QL API	2019-11-15 09:27:19 +00:00
Asger F	d3302c39c0	JS: Fix offsets in regexes parsed from strings with escapes	2019-11-15 09:27:19 +00:00
Asger F	2901b5e8bd	JS: Add OffsetTranslation table (preserving behavior)	2019-11-15 09:27:19 +00:00
Asger F	c327ee5d4f	JS: Update TRAP	2019-11-15 09:27:19 +00:00
Asger F	591fffc5cc	JS: Add test case for wide constants in char class	2019-11-15 09:27:19 +00:00
Asger F	68d23bcf8c	JS: Extract surrogate pairs as one constant node	2019-11-15 09:27:19 +00:00
Asger F	6e1c995f2f	JS: Merge consecutive constants in RegExps	2019-11-15 09:27:19 +00:00
Asger F	0e1246c0e5	JS: Extract RegExp ASTs from string literals	2019-11-15 09:27:18 +00:00
Asger F	0cf191f70d	JS: Bump extractor version string	2019-11-15 09:27:18 +00:00
Esben Sparre Andreasen	8e6a19b3d3	JS: add DefaultParsedCommandLineArgumentsAsSource	2019-11-15 08:42:02 +01:00
Esben Sparre Andreasen	2ea7d141c8	Merge pull request #2310 from max-schaefer/js/insufficient-url-scheme-check ... JavaScript: Add query `IncompleteUrlSchemeCheck`	2019-11-14 22:13:02 +01:00
semmle-qlci	0638907825	Merge pull request #2324 from esbena/js/torrent-as-remote-source ... Approved by max-schaefer	2019-11-14 20:28:07 +00:00
Max Schaefer	3b1e6c362c	JavaScript: Address review comments.	2019-11-14 17:11:59 +00:00
Erik Krogh Kristensen	e49b5e4afc	up precision from low to medium, and fix tab/spaces	2019-11-14 17:42:16 +01:00
Erik Krogh Kristensen	7137a64b7d	Added query for detecting XSS that happens through an exception	2019-11-14 17:04:00 +01:00
Esben Sparre Andreasen	cc768345d0	JS: add security tests for malicious torrents	2019-11-14 13:54:19 +01:00
Esben Sparre Andreasen	bea59ec8ad	JS: add some parsed torrent properties as remote flow sources	2019-11-14 13:54:19 +01:00
semmle-qlci	67963a5b9d	Merge pull request #2258 from asger-semmle/js-ignore-codesql-databases ... Approved by esbena	2019-11-14 08:34:23 +00:00
Dave Bartolomeo	e89ecc19e3	Merge pull request #2302 from max-schaefer/test-qlpacks ... Add `qlpack.yml` files for test folders.	2019-11-13 12:21:19 -07:00
Erik Krogh Kristensen	538690eee6	remove duplicate reflectiveCallNode method, and removing redundant getExpr() method	2019-11-13 15:53:21 +01:00
semmle-qlci	b11a7427c2	Merge pull request #2270 from erik-krogh/reflectiveExpr ... Approved by max-schaefer	2019-11-13 13:08:40 +00:00
Max Schaefer	f804d316d7	Update javascript/ql/src/Security/CWE-020/IncompleteUrlSchemeCheck.ql ... Co-Authored-By: Esben Sparre Andreasen <esbena@github.com>	2019-11-13 12:24:19 +00:00
Max Schaefer	ab583b7994	JavaScript: Add query IncompleteUrlSchemeCheck.ql.	2019-11-13 10:27:18 +00:00
Max Schaefer	155cea7b5b	Revert "JavaScript: Improve double-escaping query"	2019-11-12 22:54:12 +00:00
semmle-qlci	6c9f92666e	Merge pull request #2285 from asger-semmle/dataflow-syntax-examples ... Approved by max-schaefer	2019-11-12 16:50:29 +00:00
Max Schaefer	5b2e32b051	Add qlpack.yml files for test folders.	2019-11-12 15:03:02 +00:00