Max Schaefer
70cf32c889
JavaScript: Add a few more tests.
2019-06-11 08:44:14 +01:00
Max Schaefer
3097037a6f
Merge pull request #1290 from esben-semmle/js/semver-lib
...
JS: add SemVer library
2019-05-31 08:09:24 +01:00
semmle-qlci
0fa06e5c8d
Merge pull request #1180 from asger-semmle/tainted-path-squashed
...
Approved by xiemaisi
2019-05-30 17:20:19 +01:00
semmle-qlci
bd15994bb4
Merge pull request #1367 from xiemaisi/js/configuration-api-consistency
...
Approved by esben-semmle
2019-05-28 12:26:58 +01:00
Asger F
6617747185
JS: Update DataFlowTracking output for booleanOps.js
2019-05-28 11:19:23 +01:00
Max Schaefer
86e96c6dc3
JavaScript: Introduce is{Barrier,Sanitizer}Edge predicate.
...
This name is more intuitive than the previous binary
`is{Barrier,Sanitizer}` predicates, and is consistent with the other
languages.
2019-05-28 08:08:14 +01:00
Max Schaefer
d9b3e461ba
Merge pull request #1351 from asger-semmle/js-incomplete-nodes
...
JS: Mark some more nodes as incomplete
2019-05-28 07:59:23 +01:00
Max Schaefer
bad5465aad
Merge pull request #1360 from asger-semmle/customize-window-document
...
JS: Make some DOM concepts customizable
2019-05-28 07:58:44 +01:00
Esben Sparre Andreasen
0660db37f6
JS: introduce SemVer matching library
2019-05-27 22:32:32 +02:00
Max Schaefer
1bf7bcf010
Merge pull request #1356 from asger-semmle/tainted-path-cherry-picked
...
JS: Refactor LabelledBarrierGuard
2019-05-23 12:26:35 +01:00
Asger F
1ec3475457
JS: All of TaintedPath
2019-05-23 09:23:47 +01:00
Asger F
8b7dbf8b0f
JS: Align DOM::locationRef with isDocumentURL
2019-05-23 08:45:08 +01:00
Asger F
8590042a7e
JS: customizable window, document, DOM value
2019-05-22 15:49:56 +01:00
Asger F
6246eb2fe3
JS: Refactor LabeledSantizerGuard
2019-05-22 12:08:03 +01:00
Asger F
180b5443ba
JS: Update output of incomplete.ql
2019-05-21 17:02:43 +01:00
Asger F
de2f323172
JS: Mark unused parameter nodes as incomplete
2019-05-21 16:53:39 +01:00
Asger F
69dbbcf1c8
JS: Mark destructuring nodes as incomplete
2019-05-21 16:52:35 +01:00
Asger F
faa47029d5
JS: Mark exceptional nodes as incomplete
2019-05-21 13:51:59 +01:00
Asger F
68ae409947
JS: Test for mismatch between taint and type inference
2019-05-21 13:26:02 +01:00
semmle-qlci
8cd3cb501a
Merge pull request #1346 from xiemaisi/js/revert-1078
...
Approved by esben-semmle
2019-05-21 12:19:57 +01:00
Max Schaefer
924664afcf
JavaScript: Manually revert #1078 .
...
In its present form, `getAnUndefinedReturn` does not handle `finally`
blocks correctly. For example, in this snippet
```
try {
return 42;
} finally {
cleanup();
}
```
the call to `cleanup` is erroneously considered an undefined return.
We currently don't use the predicate anywhere, so it seems best to back
it out for the time being.
2019-05-21 08:26:58 +01:00
Asger F
d4880540e8
JS: Update .expected after rebasing
2019-05-20 11:21:50 +01:00
Asger F
9989fcee21
JS: Add DataFlow::Configuration test
2019-05-20 09:22:02 +01:00
Asger F
87e0831872
JS: Fix flow for nested destructurings
2019-05-20 09:22:02 +01:00
Asger F
a3cf07af7e
JS: Add flow steps through iteration callback
2019-05-07 13:52:31 +01:00
Asger F
e7bf485807
JS: Add another interprocedural flow test case
2019-05-07 10:33:01 +01:00
Asger F
3cbd6d3786
JS: Test case for nested statements
2019-05-07 10:26:30 +01:00
Asger F
f3a4acf0b2
JS: Add async functions to test
2019-05-07 10:11:42 +01:00
Asger F
1f897b4b63
JS: step through Error constructor and accept the potential FP
2019-05-07 10:11:41 +01:00
Asger F
b0090c2fe6
JS: Add test case for flow through new Error()
2019-05-07 10:11:41 +01:00
Asger F
36cefd8fc6
JS: Track taint through exceptions
2019-05-07 10:11:41 +01:00
Asger F
5c8dd7eedd
TS: Add workaround for 'globalThis' getProperties() crash
2019-04-30 12:44:58 +01:00
Asger F
686d72c356
TS: Fix handling of 'export ='
2019-04-30 12:41:59 +01:00
semmle-qlci
3f70d91a11
Merge pull request #1288 from xiemaisi/js/fix-end-node-labels
...
Approved by asger-semmle
2019-04-30 07:32:29 +01:00
Asger F
e9fcb670ff
JS: Provide source locations for JSDocTypeExpr
2019-04-26 16:56:04 +01:00
Asger F
cf8c327a10
JS: make TypeAnnotation extend Locatable
2019-04-26 16:56:04 +01:00
Asger F
e295c3a224
JS: Add JSDoc test
2019-04-26 16:56:04 +01:00
Asger F
6b2b64cb2e
JS: test case with unresolved types in TS
2019-04-26 16:56:04 +01:00
semmle-qlci
3231b60e6b
Merge pull request #1272 from asger-semmle/access-path-capture
...
Approved by xiemaisi
2019-04-25 11:32:54 +01:00
Max Schaefer
a8470a984a
JavaScript: Generalise ConstantComparison sanitisers.
...
In addition to treating comparisons with literals as sanitisers, we now
also treat comparisons with variables that have a single assignment as
sanitisers.
Proving that such a variable is actually a constant is not easy, but for
this use case a simple approximation works fine.
2019-04-25 07:38:31 +01:00
Max Schaefer
7faa4fd938
JavaScript: Add test case exposing two bugs in data flow library.
...
This test case exposes two bugs in our data flow library (fixed by the
two previous commits):
- the charpreds of `SourcePathNode` and `SinkPathNode` only ensured
that they were on a path from a source to a sink, not that they
actually were the source/sink themselves;
- function summarization would allow for non-level paths; in the
test case, this meant that one of the summaries for `source`
represented the path returning from `source` on line 13 and then
flowing back into the call on line 15, in the process transforming
the parity of the flow label and hence causing a spurious flow.
2019-04-23 13:16:30 +01:00
Asger F
f3c80c738e
JS: Unify access paths for captured variables
2019-04-18 11:27:15 +01:00
Asger F
e543097c45
JS: Add test
2019-04-18 11:26:39 +01:00
semmle-qlci
ff25a3ee5a
Merge pull request #1243 from asger-semmle/access-path-refinements
...
Approved by xiemaisi
2019-04-16 09:57:51 +01:00
Max Schaefer
ce53a7d575
Merge pull request #1175 from psygnisfive/NullSensitiveContext
...
[JS] Null Sensitive Context (new library)
2019-04-15 08:50:14 +01:00
Rebecca Valentine
fb40548be5
fixes semicolon issues
2019-04-12 10:56:31 -07:00
Rebecca Valentine
a66d1c0e09
fixes test errors
2019-04-12 10:39:34 -07:00
Asger F
b8ec7083d4
JS: Update isBarrier test output
2019-04-12 16:35:01 +01:00
Asger F
b36075ca46
JS: step through refinements in AccessPaths
2019-04-12 11:12:50 +01:00
Asger F
720555be45
JS: Add test case
2019-04-12 11:11:26 +01:00
