Asger F
48f7a58d01
JS: Update IncompleteHostnameRegExp test to match reality
2025-01-10 14:18:24 +01:00
Asger F
a83508a828
JS: Port IncompleteHostNameRegExt test
2025-01-10 14:18:23 +01:00
aegilops
da68a04cd1
Merge branch 'angular-sources-sinks' of https://github.com/aegilops/codeql into angular-sources-sinks
2025-01-09 18:03:39 +00:00
aegilops
b07e801c10
Add new test for new XSS sink, update expected to match
2025-01-09 18:02:45 +00:00
Asger F
fd5a3dad90
JS: One more test
2025-01-09 10:46:45 +01:00
Asger F
138b000891
JS: Coerce the local export node to an Identifier
2025-01-09 10:42:25 +01:00
Asger F
db98880163
JS: Add crash reproduction to test case
2025-01-09 10:39:30 +01:00
Asger F
b2d62a080b
JS: Move a test failure explanation into the test suite
...
We have an issue for fixing the underlying problem
2025-01-09 09:57:44 +01:00
Asger F
942ba189f7
JS: Minor test output change in nodes/edges
...
I suspect this is due to some fixes in the DeduplicatePathGraph module
2024-12-19 15:25:49 +01:00
Asger F
f8dc7eb25b
JS: Update output from tests that changed on main
2024-12-19 15:25:47 +01:00
Asger F
4a6030c592
JS: Update expected with some absent result sets
2024-12-19 15:25:46 +01:00
Asger F
cd6ebb103e
JS: Make test not assume implicit through for maps
2024-12-19 15:25:45 +01:00
Asger F
dc2f39c399
JS: Add model of Map#groupBy
2024-12-19 15:25:43 +01:00
Asger F
de5e6ddeed
JS: Update with changes in TaintTracking test
2024-12-19 15:25:42 +01:00
Asger F
c204527c08
JS: Update Array test output (new tests added on main)
2024-12-19 15:25:41 +01:00
Asger F
33e8bd5032
JS: Update testUtilities import
2024-12-19 15:25:39 +01:00
Asger F
3acd4814de
Merge branch 'main' into js/shared-dataflow-merge-main
2024-12-19 10:14:38 +01:00
Asger F
db00dad033
JS: Avoid deprecation warnings in some tests
2024-12-16 15:35:49 +01:00
Asger F
cf6d166d29
JS: Also update tutorial code
2024-12-16 15:35:47 +01:00
Asger F
69b361ae70
JS: Migrate a test to use flow state
2024-12-16 15:35:42 +01:00
Asger F
14ca1c134b
JS: Update TaintedUrlSuffix test
2024-12-13 10:08:07 +01:00
Michael Nebel
c3fe3e468c
Javascript: Update all test util paths to point to the new location.
2024-12-12 13:54:25 +01:00
Michael Nebel
0f146f1486
Javascript: Move test utilities into the query pack.
2024-12-12 13:54:23 +01:00
Asger F
66eb458134
JS: Handle match/matchAll and unknown regexps
2024-12-09 15:38:36 +01:00
Asger F
6e7c5a3707
JS: Slightly more general getRoot()
2024-12-09 15:05:45 +01:00
Asger F
be617cee4a
JS: More precise handling of .exec()
2024-12-09 15:03:51 +01:00
Asger F
703cad9e95
Expand test case
2024-12-09 15:00:56 +01:00
Asger F
2a2a4d2b67
JS: Add TaintedUrlSuffixCustomizations
...
Importing TaintedUrlSuffix.qll causes the flow label to materialised in unrelated queries, so:
- Renames TaintedUrlSuffix.qll to TaintedUrlSuffixCustomizations.qll
- Make the flow label class abstract
- Adds a new TaintedUrlSuffix.qll that re-exports the above file and also materialises the flow label
- Import the *Customizations.qll file from contexts where we don't want to materialise the flow label
2024-12-09 14:59:29 +01:00
Asger F
d1694013ff
JS: Update test showing accidental flow label materialisation
...
This wouldn't be an issue once FlowLabel is completely deprecated but it will cause perf issues in the interim, so this is fixed in the next commit
2024-12-09 14:59:28 +01:00
Asger F
8fe39bdd38
JS: Update query's own output after test changes
2024-12-09 14:59:27 +01:00
Asger F
71a6a47713
JS: Fix issue with new RegExp().exec()
2024-12-09 14:59:25 +01:00
Asger F
f6d0835c64
JS: Show problem with new RegExp().exec()
2024-12-09 14:59:24 +01:00
Asger F
ef833de60e
JS: Replace DocumentUrl with TaintedUrlSuffix
2024-12-09 14:59:23 +01:00
Asger F
e2b2d1c9ab
JS: Allow arbitrary comments in ConsistencyChecking
...
Because line comments cannot be used inside JSX elements
2024-12-09 14:59:21 +01:00
Asger F
712c69ebc8
JS: Fixup the test expectations
2024-12-09 14:59:19 +01:00
Asger F
f8ff504f5c
JS: Add ClientSideUrlRedirect test consistency
...
Update Consistency.ql again
2024-12-09 14:59:18 +01:00
Jeroen Ketema
3d8493757e
JS: Update expected test results
2024-12-03 19:19:01 +01:00
Asger F
3f0d0e3a05
JS: Deprecate DataFlow::BarrierGuardNode
2024-12-03 14:30:50 +01:00
Asger F
62c17d3f4e
JS: Update SanitizerGuardNode use in BasicTaintTracking test
2024-12-03 14:30:34 +01:00
Asger F
2ef652da2c
JS: Add more deprecation annotations in tests
2024-12-03 14:30:31 +01:00
Asger F
08d25c122d
JS: Deprecate more uses of ConsistencyConfiguration
2024-12-03 14:30:27 +01:00
Asger F
75ab4856b8
Remove unsupported features from PoI
2024-12-03 14:30:25 +01:00
Asger F
e6680dec8f
JS: Avoid use of LabeledSanitizerGuardNode in TaintedObject
...
Drive-by bugfix: Rename sanitizes -> blocksExpr.
This fixes a bug that caused the sanitizer guard not to work in df2.
The test output reflects the fact that the barrier guard works now.
2024-12-03 14:30:24 +01:00
Asger F
0ce1fe767d
JS: Deprecate ConsistencyChecking to avoid deprecation warnings
2024-12-03 14:30:23 +01:00
Asger F
834d35bc42
JS: Port experimental DecompressionBombs to ConfigSig
2024-12-03 14:30:21 +01:00
Asger F
871bc3b84a
JS: Port experimental CorsPermissiveConfiguration to ConfigSig
...
The tests show a new (source, sink) pair for an already-flagged sink.
Not sure why it was not flagged originally since the data flow path seems valid, given the steps provided by our models.
2024-12-03 14:30:20 +01:00
Asger F
f5a6485ef2
JS: Port experimental decodeJwtWithoutVerificationLocalSource
2024-12-03 14:30:19 +01:00
Asger F
72e522631d
JS: Port experimental jwtDecodeWithoutVerification to ConfigSig
2024-12-03 14:30:18 +01:00
Asger F
7e162f5451
JS: Port experimental EnvValueInjection to ConfigSig
2024-12-03 14:30:17 +01:00
Asger F
4f839070a0
JS: Port experimental EnvValueAndKeyInjection to ConfigSig
2024-12-03 14:30:16 +01:00
