Asger F
dacde5da12
JS: restrict ClassMemberAsPropWrite to static members
2019-01-28 15:40:25 +00:00
Asger F
3245142203
JS: Dont flag empty string as hardcoded username
2019-01-28 13:01:52 +00:00
semmle-qlci
962416ffc2
Merge pull request #805 from asger-semmle/callback-taint-source
...
Approved by xiemaisi
2019-01-28 08:45:37 +00:00
semmle-qlci
8b029a2d9f
Merge pull request #827 from xiemaisi/js/duplicate-toplevel-percent
...
Approved by esben-semmle
2019-01-28 08:40:23 +00:00
Esben Sparre Andreasen
ef3b107cc1
JS: sharpen the js/trivial-conditional whitelist
2019-01-25 18:19:45 +01:00
semmle-qlci
d8947a71a5
Merge pull request #735 from asger-semmle/string-ops
...
Approved by xiemaisi
2019-01-25 15:15:19 +00:00
Max Schaefer
254fafc6ce
JavaScript: Round down percentage in DuplicateToplevel.ql.
...
All the other duplication queries already do this.
2019-01-25 22:44:07 +08:00
Max Schaefer
39191ed6f1
JavaScript: Add more statements to test cases for DuplicateToplevel.
...
Now both `a.js` and `b.js` have ten (non-block) statements, which allows for more interesting tests.
2019-01-25 22:42:51 +08:00
Max Schaefer
e6672aaf70
Merge pull request #804 from esben-semmle/js/sharpen-unneeded-defensive
...
JS: better handling of nested expressions in js/unneeded-defensive-code
2019-01-25 11:23:51 +08:00
Esben Sparre Andreasen
00ef80dfc5
Merge pull request #741 from asger-semmle/this-access-path
...
JS: support 'this' as the root of an access path
2019-01-21 16:48:34 +01:00
Asger F
77d748aa00
JS: "return" flow through callbacks
2019-01-21 10:39:35 +00:00
Esben Sparre Andreasen
9e4613094a
JS: sharpen js/unneeded-defensive-code for negations and sequences
2019-01-21 09:00:35 +01:00
Asger F
4b4daa645f
JS: handle accessors separately
2019-01-18 15:42:05 +00:00
Asger F
e18b635314
JS: add getADirectSuperClass()
2019-01-18 15:42:05 +00:00
Asger F
5b7675d972
JS: introduce DataFlow::ClassNode
2019-01-18 14:46:38 +00:00
Asger F
cf3dfcae21
JS: recognize A.substr(0, B.length) == B
2019-01-18 10:40:48 +00:00
Asger F
f9951f67fe
JS: add simple variants of StringOps::EndsWith
2019-01-18 10:40:48 +00:00
Asger F
b6626995cf
JS: bugfix in indexOf-based include test
2019-01-18 10:40:48 +00:00
Asger F
d603824feb
JS: add StringOps::StartsWith and StringOps::Includes
2019-01-18 10:40:18 +00:00
Asger F
107ec3b687
JS: add test with self=this variable
2019-01-18 10:39:02 +00:00
Asger F
78bd76048a
JS: add test with closures
2019-01-18 10:39:02 +00:00
Asger F
0bb6692c19
JS: add 'this' as possible access path root
2019-01-18 10:39:02 +00:00
semmle-qlci
5e712b3ff6
Merge pull request #784 from asger-semmle/dedup-promiseTaintStep
...
Approved by esben-semmle
2019-01-18 08:52:09 +00:00
Asger F
7a344c8546
JS: Add resolved promise taint test case
2019-01-17 13:08:55 +00:00
Asger F
9aaea40719
JS: address comments and support TrackedNode
2019-01-16 11:12:38 +00:00
Asger F
6d1eab8a4b
JS: support flow out of "this" in constructor call
2019-01-16 11:09:38 +00:00
Max Schaefer
4a7e0fe104
Merge pull request #766 from asger-semmle/ts-compiler-3.2
...
TS: Support TypeScript 3.2
2019-01-16 08:49:45 +00:00
semmle-qlci
5bc17923b1
Merge pull request #665 from asger-semmle/js-property-concat-sanitizer
...
Approved by esben-semmle, xiemaisi
2019-01-16 08:44:55 +00:00
semmle-qlci
cf3a4ac956
Merge pull request #767 from esben-semmle/js/unknown-bound-event-handler-receiver
...
Approved by xiemaisi
2019-01-16 08:36:11 +00:00
semmle-qlci
8655e5ae17
Merge pull request #768 from xiemaisi/js/call-summaries
...
Approved by asger-semmle
2019-01-16 08:35:31 +00:00
Asger F
3ed9575529
TS: add support for bigints
2019-01-14 18:26:09 +00:00
Asger F
1c6deb65cd
TS: update test expectation
2019-01-14 18:15:30 +00:00
Asger F
f4c89601ff
JS: fix typo
2019-01-14 15:34:01 +00:00
Asger F
ad6add383c
JS: improve concatenation-sanitizer for property injection
2019-01-14 15:34:01 +00:00
semmle-qlci
955bad0618
Merge pull request #640 from asger-semmle/lodash-case
...
Approved by esben-semmle
2019-01-14 07:59:59 +00:00
Esben Sparre Andreasen
b35c4b2a9a
JS: support FP pattern for js/unbound-event-handler-receiver
2019-01-14 08:47:37 +01:00
semmle-qlci
9c41b214ee
Merge pull request #748 from esben-semmle/js/fix/js/useless-assignment-to-property
...
Approved by xiemaisi
2019-01-13 21:40:35 +00:00
semmle-qlci
04c15028ab
Merge pull request #750 from aschackmull/javascript/autoformat
...
Approved by xiemaisi
2019-01-11 16:35:38 +00:00
Anders Schack-Mulligen
db9407bae5
Javascript: Update .expected files.
2019-01-11 14:27:16 +01:00
semmle-qlci
b0dd3dfeb1
Merge pull request #502 from xiemaisi/js/summaries
...
Approved by asger-semmle
2019-01-11 10:27:03 +00:00
Max Schaefer
f9d704bdcf
JavaScript: Add example of indirect command injection.
2019-01-11 10:24:41 +00:00
Anders Schack-Mulligen
e58094c732
Javascript: Autoformat.
2019-01-11 11:02:42 +01:00
Max Schaefer
7d2d33840a
JavaScript: Track flow through forwarding higher-order calls.
2019-01-11 09:15:58 +00:00
Max Schaefer
edc5117dfd
JavaScript: Track flow into (simple) higher-order function calls.
...
The only case we support for now are functions that invoke one of their arguments, passing another argument as input.
2019-01-11 08:11:15 +00:00
Esben Sparre Andreasen
d3543b74c0
JS: fixup: use the basic block of the actual write (ODASA-7636)
2019-01-11 08:34:17 +01:00
Max Schaefer
583734a4e2
JavaScript: Fix semantic merge conflict.
...
https://github.com/Semmle/ql/pull/698 removed `document.cookie` as a remote flow source, which some of the tests relied on. We now use `location.search` instead.
2019-01-09 16:09:06 +00:00
Max Schaefer
97e6c75b94
JavaScript: Remove a few other deprecated predicates and classes.
2019-01-09 09:23:59 +00:00
Max Schaefer
8f1c5db8be
JavaScript: Change encoding of member and parameter portals for readability.
2019-01-09 09:10:45 +00:00
Max Schaefer
8e36c60326
JavaScript: Add a few examples that cause cyclic portals.
2019-01-09 09:09:58 +00:00
Max Schaefer
132570940a
JavaScript: Add support for annotation comments specifying additional sources and sinks.
2019-01-09 09:09:58 +00:00
