Napalys
e3f1720f9c
RenamedDecodeLike to Decode and updated propagatesFlow
2025-04-11 10:04:09 +02:00
Napalys
2c4b3527b4
Added change note
2025-04-11 09:42:12 +02:00
Napalys
678eccb417
Added searchParams.get as potential source for SSRF
2025-04-11 09:42:07 +02:00
Napalys
6e09a65da0
Added support for NextRequest middleware SSRF.
2025-04-11 08:43:36 +02:00
Asger F
719456e27d
JS: Fix missing flow into rest pattern lvalue
2025-04-11 08:37:09 +02:00
Napalys Klicius
43bf0beae9
Merge pull request #19263 from Napalys/js/make-dir-lib
...
JS: Add support for `make-dir` package
2025-04-10 15:09:43 +02:00
Napalys
86b64afa13
Added NextResponse to the ResponseCall class it models similar near idential behaviour.
2025-04-10 15:06:44 +02:00
Napalys
63a3953b0c
Enhance Next.js API endpoint handling for compatibility with both Pages and App Router structures.
2025-04-10 14:48:17 +02:00
Asger F
eac14b9837
Merge pull request #19200 from asgerf/js/web-response
...
JS: Add sinks for calls to 'new Response()'
2025-04-10 14:41:32 +02:00
Napalys
5243f90c90
Brought back old methods and marked them as deprecated
2025-04-09 14:56:24 +02:00
Napalys
5ec71ab9af
Added change note
2025-04-09 14:42:34 +02:00
Napalys
ce2fc25cdb
Added make-dir model as data
2025-04-09 14:42:29 +02:00
Napalys Klicius
2dca95af92
Update javascript/ql/lib/change-notes/2025-04-07-websocket.md
...
Co-authored-by: Asger F <asgerf@github.com >
2025-04-09 14:26:00 +02:00
Napalys
0c52b5ad95
Added summary flow for StringFromCharCode
2025-04-09 14:24:43 +02:00
Napalys Klicius
f02783a9c6
Merge pull request #19210 from Napalys/js/mkdirp
...
JS: Modeling of `mkdirp` functions
2025-04-09 13:43:37 +02:00
Napalys
a3e4e62eac
Removed taint from ArrayBuffer constructor as it accepts length
2025-04-09 13:27:13 +02:00
Napalys
4bc3e9e736
Addressed comments
...
Co-authored-by: Asgerf <asgerf@github.com >
2025-04-09 12:31:45 +02:00
Napalys
4a4d78bbde
Added change note
2025-04-08 08:12:42 +02:00
Napalys
b8802a29f4
Added open package model as data.
2025-04-08 08:12:30 +02:00
Napalys
873db7c121
Added change note
2025-04-07 18:15:24 +02:00
Napalys
b97c61864e
Add flow summaries and entry points for TextDecoder
2025-04-07 18:15:19 +02:00
Napalys
f4277204b7
Add flow summaries and entry points for ArrayBuffer and SharedArrayBuffer
2025-04-07 18:12:35 +02:00
Napalys
ff07ec8d8c
Add flow summaries for TypedArray methods set and subarray
2025-04-07 18:06:40 +02:00
Napalys
e23ff9cf3e
Add TypedArrays flow summaries for Uint8Array and buffer property
2025-04-07 15:15:24 +02:00
Napalys
c4fa417680
Added change note
2025-04-07 12:11:33 +02:00
Napalys
6fb5376c5f
Refactor ReceivedItemAsRemoteFlow to handle data from both client and server WebSocket sources
2025-04-07 11:44:40 +02:00
Napalys
6bcfd8c91d
Updated getAServer with API graphs.
2025-04-04 12:31:29 +02:00
Napalys
c5860e92ec
Updated WebSocketReceiveNode to match bind functions.
2025-04-04 12:28:53 +02:00
Napalys
49194b0340
Updated WebSocketReceiveNode with API graphs.
2025-04-04 12:26:52 +02:00
Napalys
0dbf951291
Updated ClientSocket and SendNode with API graphs.
2025-04-04 09:14:54 +02:00
Napalys
e16a20e69f
Updated SocketClass to use API Graphs.
2025-04-04 08:47:27 +02:00
Asger F
6c33013788
JS: Enable association with headers without needing a route handler
...
Previously it was not possible to associate a ResponseSendArgument with its header definitions if they did not have the same route handler.
But for calls like `new Response(body, { headers })` the headers are fairly obvious whereas the route handler is unnecessarily hard to find. So we use the direct and obvious association between 'body' and 'headers' in the call.
2025-04-03 11:08:10 +02:00
Asger F
db2720ea5b
JS: Initial model of Response
2025-04-03 11:08:05 +02:00
Napalys
0e7bff0f81
Added change note.
2025-04-03 10:45:17 +02:00
Napalys
04a39eb735
Removed old mkdirp modeling and replaced it with MaD.
2025-04-03 10:45:16 +02:00
Napalys
3fa24d6026
Add sink model for mkdirp and update tests for path injection alerts.
2025-04-03 10:45:14 +02:00
Napalys Klicius
5c42c0ba4c
Merge pull request #19196 from Napalys/js/rimraf
...
JS: Modeling of `rimraf` functions
2025-04-03 09:51:52 +02:00
Asger F
6c3bc941c5
Merge branch 'main' into js/name-resolution-independent-fixes
2025-04-02 14:15:44 +02:00
Napalys
390d9ffe66
Added change note
2025-04-02 12:50:53 +02:00
Napalys
b16b407f89
Add rimraf model and update tests for path injection vulnerabilities
2025-04-02 12:49:48 +02:00
Asger F
46f88e7ce7
JS: Updates to DOM model
2025-04-02 10:14:03 +02:00
Asger F
887942e3e9
Merge pull request #19108 from asgerf/js/api-graph-spread-rest
...
JS: Handle spread/rest in API graphs
2025-04-01 17:48:36 +02:00
Asger F
4746cfddf2
JS: Add clarifying comment
2025-04-01 16:26:07 +02:00
Asger F
e1784bb10c
JS: Fix handling of spread args on a bound function
2025-04-01 16:20:57 +02:00
github-actions[bot]
10205cb990
Post-release preparation for codeql-cli-2.21.0
2025-04-01 11:30:43 +00:00
github-actions[bot]
84f6564cc0
Release preparation for version 2.21.0
2025-03-31 17:35:15 +00:00
Arthur Baars
cd9ccef8b2
Javascript, add missing * to changenote
2025-03-31 18:45:01 +02:00
Asger F
149ec20758
JS: Add comment about internal edge
2025-03-31 15:39:09 +02:00
Asger F
f64bdccd6d
Update javascript/ql/lib/semmle/javascript/ApiGraphs.qll
...
Co-authored-by: Erik Krogh Kristensen <erik-krogh@github.com >
2025-03-31 15:30:59 +02:00
Napalys Klicius
4572376e9a
Merge pull request #19143 from Napalys/js/fs-extra-missing
...
JS: Modeling of `fs-extra` functions
2025-03-31 10:35:45 +02:00
