2976 Commits

Author	SHA1	Message	Date
erik-krogh	a6c9af4182	add the html argument to the jQuery functions as an XSS sink	2023-03-03 11:09:53 +01:00
erik-krogh	a928f4c9ef	add change-notes	2023-03-03 09:23:10 +01:00
erik-krogh	f96d6accbb	delete old deprecations	2023-03-03 09:23:02 +01:00
Erik Krogh Kristensen	64dad3db8a	Merge pull request #12333 from kaspersv/kaspersv/fix-join-order ... ReflectedXss: Prevent bad join order	2023-03-01 12:48:30 +01:00
Kasper Svendsen	86925646f3	ReflectedXss: Prevent bad join order	2023-02-28 12:06:27 +01:00
Erik Krogh Kristensen	50aa5e072a	Merge pull request #12177 from erik-krogh/alias-html ... JS: More precise type-test sanitizer guards in unsafe-html-construction	2023-02-27 18:16:11 +01:00
Erik Krogh Kristensen	927c322b7b	Merge pull request #11769 from erik-krogh/moreSan ... JS: Sanitizer for `sanitizer(x) === true`	2023-02-27 15:48:34 +01:00
Alex Ford	7c85448cba	Merge pull request #12080 from alexrford/js-use-shared-cryptography ... JS: Use shared `CryptographicOperation` concept	2023-02-27 12:26:38 +00:00
erik-krogh	0e60fc5512	Merge branch 'main' into alias-html	2023-02-27 09:16:25 +01:00
Erik Krogh Kristensen	f8f926ad50	Merge pull request #12175 from erik-krogh/reg-input ... JS: add process.env and process.argv etc. as source for `js/regex-injection`	2023-02-27 09:12:02 +01:00
Erik Krogh Kristensen	4ffe20ae75	Merge pull request #12189 from erik-krogh/more-export ... JS: also consider relative exports when finding library inputs	2023-02-27 09:02:55 +01:00
github-actions[bot]	8eb8daa4d4	Post-release preparation for codeql-cli-2.12.3	2023-02-16 17:23:25 +00:00
github-actions[bot]	b0315119c6	Release preparation for version 2.12.3	2023-02-16 11:49:06 +00:00
Alex Ford	9cfd0f5f46	JS: fix qldoc	2023-02-16 11:00:37 +00:00
Alex Ford	1556b1a728	Merge branch 'main' into js-use-shared-cryptography	2023-02-15 17:13:53 +00:00
Alex Ford	1958b9dcd5	JS: add missing qldoc	2023-02-15 16:59:03 +00:00
Alex Ford	43af306d60	dynamic: more detailed qldoc for CryptographicOperation#getBlockMode()	2023-02-15 16:55:18 +00:00
Alex Ford	e8cbf7287d	JS: breaking change note for CryptographicOperation sync	2023-02-15 16:50:24 +00:00
Alex Ford	925b4a3fa8	JS: improve documentation on deprecated CryptographicOperation#getInput() predicate	2023-02-15 16:23:46 +00:00
Alex Ford	d4d0b91085	dynamic: switch CryptographicOperation::Range#getBlockMode() back to being an abstract predicate	2023-02-15 16:23:46 +00:00
Alex Ford	c7aaad9ed0	JS: avoid adding a deprecated CryptographicOperation#getInput to py/ruby	2023-02-15 16:23:46 +00:00
erik-krogh	51ddb55d7b	use tainted-object to precisely model that plain object are fine, but their properties are not	2023-02-15 15:02:03 +01:00
erik-krogh	09794fa836	delete PrefixStringSanitizer	2023-02-15 14:55:02 +01:00
Rasmus Wriedt Larsen	c72dbc49fc	Merge pull request #12165 from RasmusWL/crypto-updates ... Python/Ruby/JS Crypto: Add a few algorithms + block modes	2023-02-15 14:35:40 +01:00
erik-krogh	bec8dc6775	add explicit this	2023-02-15 10:44:57 +01:00
erik-krogh	b7305fd229	also consider relative exports when finding library inputs	2023-02-14 21:08:13 +01:00
erik-krogh	de4f5017e1	add change-note	2023-02-14 18:36:07 +01:00
Alex Ford	8d90c02a67	JS: remove unused field	2023-02-14 15:24:22 +00:00
erik-krogh	393649b7ce	don't call environment variables for command-line arguments	2023-02-14 14:27:41 +01:00
erik-krogh	36478124ae	add process.env and process.argv etc. as source for js/regex-injection	2023-02-14 14:21:53 +01:00
erik-krogh	943bdeca6d	make appliesTo recursive	2023-02-14 14:16:45 +01:00
erik-krogh	9549cac3e5	add an additional barrier guard that finds "=== true" versions of previous barrier guards	2023-02-14 14:15:23 +01:00
erik-krogh	3f0fe96f85	add getBoolValue() as a utility predicate on BooleanLiteral	2023-02-14 14:12:35 +01:00
Erik Krogh Kristensen	2f8c9a5a2c	Merge pull request #12171 from erik-krogh/reg-dot ... JS: dont recognize regexps that match dot as sanitizers	2023-02-14 14:10:44 +01:00
Erik Krogh Kristensen	e3e2df3247	Merge pull request #12166 from erik-krogh/more-html-san ... JS: add `HtmlSanitizer` as a sanitizer DOMBasedXss	2023-02-14 14:09:56 +01:00
Erik Krogh Kristensen	028fcc7edf	Merge pull request #11959 from erik-krogh/ssrfSan ... JS: add encodeURIComponent as a sanitizer for request-forgery	2023-02-14 13:39:53 +01:00
Erik Krogh Kristensen	a498936f16	Merge pull request #12170 from erik-krogh/more-lib ... JS: More library inputs	2023-02-14 13:38:00 +01:00
erik-krogh	c17d057520	default to index.js when no main: is specified in package.json, and recognize more classes as library inputs	2023-02-13 21:24:41 +01:00
erik-krogh	68656274f4	dont recognize regexps that match dot as sanitizers	2023-02-13 17:36:51 +01:00
erik-krogh	b85bfc8ba6	add HtmlSanitizer as a sanitizer for DOMBasedXss	2023-02-13 11:57:29 +01:00
Rasmus Wriedt Larsen	5235964b07	sync files	2023-02-13 10:44:12 +01:00
erik-krogh	91393a7bc8	add change-note	2023-02-12 23:28:01 +01:00
erik-krogh	6474cfd4c8	add support for express-ws	2023-02-12 23:25:27 +01:00
erik-krogh	ecafce8191	improve the CryptoJS model by using API::Node	2023-02-03 21:44:23 +01:00
Alex Ford	7768026e70	Merge branch 'main' into js-use-shared-cryptography	2023-02-03 15:18:30 +00:00
Alex Ford	6c35feaa98	ConceptsShared: add a default implementation of BlockMode CryptographicOperation#getBlockMode() for compatibility with external code	2023-02-03 14:39:32 +00:00
Alex Ford	b968b59afc	CryptoAlgorithms: make CryptographicAlgorithm#matchesName hold only if that algorithm is the most specific match	2023-02-03 14:15:32 +00:00
Alex Ford	e17b3d975d	JS: pick up CryptographicKeys used in asmCrypto encrypt/decrypt calls	2023-02-03 12:16:25 +00:00
github-actions[bot]	faf21f3edb	Post-release preparation for codeql-cli-2.12.2	2023-02-02 23:01:04 +00:00
Alex Ford	1435ef1862	CryptoAlgorithms: make CryptographicAlgorithm#matchesName split on underscores	2023-02-02 20:30:30 +00:00