Erik Krogh Kristensen
|
e01d4b104e
|
update expected output
|
2020-11-10 23:42:38 +01:00 |
|
Erik Krogh Kristensen
|
6b7f8dd505
|
fix parse errors related to char escapes and char ranges
|
2020-11-10 21:02:29 +01:00 |
|
Erik Krogh Kristensen
|
5ecae55e77
|
add keys used by jsonwebtoken as CredentialsExpr
|
2020-11-10 10:41:39 +01:00 |
|
Erik Krogh Kristensen
|
e75259d3a6
|
model the verify function in jsonwebtoken
|
2020-11-10 10:41:39 +01:00 |
|
Erik Krogh Kristensen
|
6732493377
|
add model for jwt-decode
|
2020-11-10 10:41:36 +01:00 |
|
CodeQL CI
|
1e048d8045
|
Merge pull request #4609 from asgerf/js/destructuring-export
Approved by erik-krogh
|
2020-11-09 15:47:00 +00:00 |
|
Asger Feldthaus
|
32c5bc4836
|
JS: Update test case output (new flow is correct)
|
2020-11-09 11:19:47 +00:00 |
|
Erik Krogh Kristensen
|
3ef5d89e39
|
update expected output
|
2020-11-08 23:27:38 +01:00 |
|
Erik Krogh Kristensen
|
17a687b344
|
testing many possible intersections, instead of a single intersection
|
2020-11-08 23:24:36 +01:00 |
|
Erik Krogh Kristensen
|
34fd0d89f5
|
finding the minimum that is not an FP - instead of finding the minimum and then checking if it was an FP. And detecting more FPs by finding when a witness pass through the accept state
|
2020-11-08 23:24:27 +01:00 |
|
Erik Krogh Kristensen
|
ac514b1739
|
remove false positives where the analysis would wrongly conclude that the accept state could not be reached
|
2020-11-08 23:24:03 +01:00 |
|
Erik Krogh Kristensen
|
a5e75f53ff
|
add support for escape char classes inside char classes
|
2020-11-08 23:22:49 +01:00 |
|
Erik Krogh Kristensen
|
0063cb140c
|
add support for \W, \S, \D
|
2020-11-08 23:16:56 +01:00 |
|
Erik Krogh Kristensen
|
2dd8b6ffef
|
support \f and \v in the \s class
|
2020-11-08 23:16:56 +01:00 |
|
Erik Krogh Kristensen
|
68fe03060d
|
support \d \s and \w in ReDoS.ql
|
2020-11-08 23:16:56 +01:00 |
|
Erik Krogh Kristensen
|
fa54ad1a5e
|
refactor character class implementation in ReDoS.ql - preparing support for RegExpCharacterClassEscape
|
2020-11-08 23:16:55 +01:00 |
|
Erik Krogh Kristensen
|
a09ffd5cda
|
expand getAOverlapBetweenCharacterClasses to support overlap between more char classes
|
2020-11-08 23:16:37 +01:00 |
|
Erik Krogh Kristensen
|
82252c0f1c
|
detect redos between charclass and inverted charclass
|
2020-11-08 23:16:34 +01:00 |
|
Asger Feldthaus
|
acb30e73bc
|
JS: More precise handling of default import fallback
|
2020-11-06 12:04:41 +00:00 |
|
Erik Krogh Kristensen
|
16473fc2a4
|
matching a inverted char class with a char
|
2020-11-06 10:18:57 +01:00 |
|
Erik Krogh Kristensen
|
804aaf36f0
|
support inverted char class and dot
|
2020-11-06 10:18:57 +01:00 |
|
Erik Krogh Kristensen
|
64d680e2d3
|
support that an inverted char class can intersect with itself
|
2020-11-06 10:18:57 +01:00 |
|
Erik Krogh Kristensen
|
321cf09bd8
|
add redos support for the simplest possible inverted char class
|
2020-11-06 10:18:57 +01:00 |
|
Asger Feldthaus
|
24714c41be
|
JS: Update test output after rebase
|
2020-11-06 09:14:03 +00:00 |
|
Asger Feldthaus
|
7bf21d80b2
|
JS: Shift line numbers in test file
|
2020-11-06 09:13:52 +00:00 |
|
Asger Feldthaus
|
9418c6c8fe
|
JS: Add support for dateformat package
|
2020-11-06 09:13:52 +00:00 |
|
Asger Feldthaus
|
790526b529
|
JS: Some fixes and address review comments
|
2020-11-06 09:06:20 +00:00 |
|
Asger Feldthaus
|
8a3fba05e9
|
JS: Add steps through date-formatting functions
|
2020-11-06 09:06:18 +00:00 |
|
Asger Feldthaus
|
d07e69e529
|
JS: Improve handling of destructuring export declaration
|
2020-11-05 23:51:44 +00:00 |
|
CodeQL CI
|
a908e5938e
|
Merge pull request #4574 from erik-krogh/jsdom
Approved by asgerf
|
2020-11-05 22:13:39 +00:00 |
|
Erik Krogh Kristensen
|
e124ba66b4
|
moving jsdom sink to js/xss
|
2020-11-05 16:10:33 +01:00 |
|
CodeQL CI
|
89a808cafe
|
Merge pull request #4552 from erik-krogh/tsImport
Approved by asgerf
|
2020-11-05 09:23:58 +00:00 |
|
CodeQL CI
|
c85f817cee
|
Merge pull request #4579 from erik-krogh/redos
Approved by asgerf
|
2020-11-05 08:38:44 +00:00 |
|
Erik Krogh Kristensen
|
e16fa0668a
|
update expected output
|
2020-11-04 18:24:31 +01:00 |
|
Asger Feldthaus
|
5eb3067f58
|
JS: Add test case
|
2020-11-04 16:50:23 +00:00 |
|
Erik Krogh Kristensen
|
b02004430c
|
prune results that end with newline, where the input cannot contain newlines
|
2020-11-03 14:48:39 +01:00 |
|
Erik Krogh Kristensen
|
120faf9d1a
|
add a code injection sink for JSDOM when "runScripts" is set to "dangerously"
|
2020-11-03 14:29:00 +01:00 |
|
Erik Krogh Kristensen
|
e6e4a485c8
|
add JSDOM.fromUrl() as a request forgery sink
|
2020-11-02 17:05:56 +01:00 |
|
CodeQL CI
|
4a59e69722
|
Merge pull request #4564 from asgerf/js/react-hooks
Approved by esbena
|
2020-10-30 21:00:31 +00:00 |
|
Erik Krogh Kristensen
|
39028f62a3
|
add test for outDir
|
2020-10-30 10:37:10 +01:00 |
|
Erik Krogh Kristensen
|
ebc4856456
|
detect more expensive regexps in js/polynomial-redos
|
2020-10-30 09:52:13 +01:00 |
|
CodeQL CI
|
7856e784e1
|
Merge pull request #4566 from asgerf/js/classnames
Approved by erik-krogh
|
2020-10-29 11:00:06 +00:00 |
|
Asger Feldthaus
|
a4a6e3beb3
|
JS: Update dataflow tests
|
2020-10-29 10:38:09 +00:00 |
|
Asger Feldthaus
|
469767d279
|
JS: Fix test output
|
2020-10-28 17:00:05 +00:00 |
|
Asger Feldthaus
|
f99db23e7b
|
JS: Add test and fix for contextType
|
2020-10-28 16:23:36 +00:00 |
|
Asger Feldthaus
|
3d86e855f3
|
JS: Add model of classnames and clsx
|
2020-10-28 13:56:35 +00:00 |
|
Asger Feldthaus
|
d116b424f4
|
JS: Add model of react hooks and react-router
|
2020-10-28 11:57:11 +00:00 |
|
Erik Krogh Kristensen
|
bce06d3194
|
add test that promisify is not imprecise
|
2020-10-28 11:59:03 +01:00 |
|
Asger Feldthaus
|
9fc5c0bdb8
|
JS: Update ComposedFunctions
|
2020-10-28 10:09:40 +00:00 |
|
Erik Krogh Kristensen
|
2e514c4d7b
|
add model for Node Redis
|
2020-10-28 09:52:54 +01:00 |
|