CodeQL CI
8f8621f82c
Merge pull request #8022 from asgerf/js/url-parse-qs
...
Approved by esbena
2022-02-15 09:34:21 +01:00
Asger Feldthaus
8b55a24e7c
JS: Add url-parse.qs as an alias for the querystringify library
2022-02-14 15:29:50 +01:00
Chuan-kai Lin
9b4dbb9dd8
Merge pull request #7895 from github/cklin/upgrades-initial-dbscheme
...
Upgrade scripts testing: set initial dbschemes
2022-02-11 11:06:12 -08:00
Erik Krogh Kristensen
a1c5724be7
fix most ql-for-ql warnings in JS
2022-02-11 17:57:37 +01:00
github-actions[bot]
21bf29353f
Post-release preparation for codeql-cli-2.8.1
2022-02-11 11:07:31 +00:00
Taus
327e0dad72
Merge pull request #7674 from erik-krogh/dbTypeInNonLib
...
QL: Use of db-type outside language core.
2022-02-11 12:00:14 +01:00
Erik Krogh Kristensen
36e02ae9ac
Merge pull request #7912 from erik-krogh/moarApi
...
JS: convert more type-trackers to API-graphs
2022-02-11 10:32:45 +01:00
Erik Krogh Kristensen
3791b159fb
Merge pull request #7892 from erik-krogh/nanSan
...
JS: Add a `isNaN` sanitizer, and use it in queries that already had a typeof check
2022-02-11 10:13:06 +01:00
Erik Krogh Kristensen
2ffd79d451
Merge pull request #7921 from erik-krogh/snapdragon
...
JS: add model for the snapdragon library
2022-02-11 10:10:55 +01:00
Esben Sparre Andreasen
a4447ce372
Update javascript/ql/lib/semmle/javascript/frameworks/Snapdragon.qll
2022-02-11 08:20:02 +01:00
github-actions[bot]
f25fc70b7c
Release preparation for version 2.8.1
2022-02-10 22:08:24 +00:00
Arthur Baars
61ba896343
Javascript: move change note
2022-02-10 20:58:49 +01:00
Erik Krogh Kristensen
eb56a5aef3
support more patterns that recognize valid numbers
2022-02-10 19:50:35 +01:00
CodeQL CI
9ebbd9efa1
Merge pull request #7591 from asgerf/js/mysql-sinks
...
Approved by esbena
2022-02-10 12:50:36 +00:00
CodeQL CI
1a91a79b5b
Merge pull request #5841 from erik-krogh/libCode
...
Approved by esbena, ethanpalm
2022-02-10 11:36:45 +00:00
Erik Krogh Kristensen
d55920ad27
add model for the snapdragon library
2022-02-10 11:32:59 +01:00
Erik Krogh Kristensen
12d31d750a
convert more type-trackers to API-graphs
2022-02-10 09:54:52 +01:00
Stephan Brandauer
a73cdf3527
Merge pull request #7911 from kaeluka/javascript/add-getFlowLabel-to-PathNode
...
JS: add a getFlowLabel method to the PathNode class
2022-02-10 09:10:08 +01:00
Stephan Brandauer
3e88d46e0f
add a getFlowLabel method to the PathNode class
2022-02-09 17:28:25 +01:00
Erik Krogh Kristensen
5340530cb7
use the number guard in existing queries that contained typeof checks
2022-02-09 09:51:57 +01:00
Erik Krogh Kristensen
d6721ec574
implement a isNaN guard for unsafe-shell-command-construction
2022-02-09 09:51:57 +01:00
Tom Hvitved
9440a45015
Merge branch 'main' into post-release-prep/codeql-cli-2.8.0
2022-02-09 09:40:33 +01:00
Chuan-kai Lin
a7f1ee574c
Upgrade scripts testing: set initial dbschemes
...
This commit sets initial dbschemes for cpp, csharp, java, javascript, and
python so that automated testing for upgrade scripts would also cover legacy
upgrades.
2022-02-08 11:11:41 -08:00
Erik Krogh Kristensen
4bbb7ad320
Merge pull request #7876 from erik-krogh/zipRelative
...
JS: recognize more startswith sanitizers for path-injection queries
2022-02-08 15:22:39 +01:00
Erik Krogh Kristensen
28ba78cb76
add explicit this
2022-02-08 12:20:21 +01:00
Erik Krogh Kristensen
d73b2effa0
rename maybeGetJoinArg maybeGetPathSuffix
2022-02-08 10:42:06 +01:00
Erik Krogh Kristensen
cc3f9bf2a8
fix performance issue by inlining a simpler version of getASourceProp
2022-02-08 00:22:01 +01:00
Erik Krogh Kristensen
ca5f91e587
recognize more startswith sanitizers for path-injection queries
2022-02-07 14:19:13 +01:00
Erik Krogh Kristensen
d1d4ebb3b5
add values written to the global scope as exports
2022-02-07 13:34:18 +01:00
Erik Krogh Kristensen
91b03f56ad
move .qll files from src to lib
2022-02-07 13:34:18 +01:00
Erik Krogh Kristensen
955ad8c458
add JSON.stringify as a code-injection sanitizer
2022-02-07 13:34:18 +01:00
Erik Krogh Kristensen
68a5c1f5b5
add code-injection sink for calls to node
2022-02-07 13:34:18 +01:00
Erik Krogh Kristensen
0584a6acaf
recognize a nodejs re-exports in a loop
2022-02-07 10:12:38 +01:00
github-actions[bot]
b4ab86c020
Post-release preparation for codeql-cli-2.8.0
2022-02-06 23:34:07 +00:00
Erik Krogh Kristensen
ab2d3a7ca0
Merge pull request #7828 from Naman-ntc/main
...
JS: Adding model for `.get` function of `Map` in Unvalidated Dynamic Method Call
2022-02-04 20:19:02 +01:00
Erik Krogh Kristensen
edcb3ba902
add file sources from jszip to js/zip-slip
2022-02-04 14:39:49 +01:00
Erik Krogh Kristensen
35999a7f8f
add support for fs-extra methods in insecure-temporary-file
2022-02-02 15:14:43 +01:00
Naman Jain
aea7054938
modified query and added tests
2022-02-02 19:39:08 +05:30
Erik Krogh Kristensen
573f17dc63
fix typos in documentation
...
Co-authored-by: Stephan Brandauer <kaeluka@github.com >
2022-02-02 15:00:38 +01:00
Arthur Baars
33b97f3e0c
Update synchronized files
2022-02-02 13:30:45 +01:00
Erik Krogh Kristensen
7aa59ca233
Merge pull request #7633 from erik-krogh/CWE-300
...
JS: add js/http-dependency query
2022-01-28 12:10:14 +01:00
Erik Krogh Kristensen
b5198bdaca
apply suggestions from doc review
...
Co-authored-by: mc <42146119+mchammer01@users.noreply.github.com >
2022-01-28 10:46:27 +01:00
github-actions[bot]
634134f283
Release preparation for version 2.8.0
2022-01-27 10:40:20 +00:00
Stephan Brandauer
b7690e5e6b
Merge pull request #7734 from kaeluka/js-add-node-prefix-to-module-import
...
js: add support for the 'node:' prefix for importing internal modules
2022-01-26 10:15:08 +01:00
Edoardo Pirovano
662675ebf0
Merge pull request #7739 from github/edoardo/3.4-mergeback
...
Merge `rc/3.4` into `main`
2022-01-25 17:44:13 +00:00
Edoardo Pirovano
1b539eb4dc
Merge branch rc/3.4 into main
2022-01-25 16:22:01 +00:00
Erik Krogh Kristensen
cc527bdecd
Merge pull request #7721 from erik-krogh/CWE-1275
...
JS: add a js/samesite-none-cookie cookie
2022-01-25 13:28:08 +01:00
Erik Krogh Kristensen
caaee5e4e5
make a utility predicate for extracting sameSite values
2022-01-25 12:32:04 +01:00
Stephan Brandauer
9825136e58
add support for the 'node:' prefix for importing internal modules
2022-01-25 10:55:34 +01:00
Stephan Brandauer
35cc5ff0e2
Merge pull request #7715 from kaeluka/recognize-fs-extra-path-args
...
JS: add a predicate to recognize path arguments in calls to the fs-extra lib
2022-01-25 09:36:59 +01:00
