CodeQL CI
cd26d97dd7
Merge pull request #6549 from erik-krogh/moreDom
...
Approved by asgerf
2021-09-08 05:10:47 -07:00
Asger Feldthaus
db1de18cc2
JS: Support transitive callback-passing
2021-09-08 13:08:16 +02:00
Asger Feldthaus
7c94dd94e9
JS: Add type-tracking steps through callback args
2021-09-08 13:08:05 +02:00
Asger Feldthaus
1f6df4e70d
JS: Add callback type tracking test
2021-09-08 13:08:04 +02:00
CodeQL CI
5b229e9392
Merge pull request #6574 from asgerf/js/vue-api-graphs
...
Approved by erik-krogh
2021-09-07 05:53:30 -07:00
Andrew Eisenberg
6a47fcaf1f
Packaging: Normalize all qlpack.yml files for all languages
...
This commit ensures consistency among all of our qlpacks. Here are the
changes:
1. Ensure only modern references are used (codeql-{lang} is converted to
codeql/{lang}-all or codeql/{lang}-queries where appropriate).
2. Use consistent version numbers. All languages are at 0.0.2 except
javascript, which is 0.0.3.
3. Convert all `libraryPathDependencies` to `dependencies` with version
constraints
4. Dependencies from query packs to other packs are always `"*"` since
these dependencies are always from source and we should get the
latest.
5. Dependencies from codeql/{lang}-lib to codeql/{lang}-upgrades must
be strict since there is a tight connection between the libary
and its relevant upgrades.
2021-09-03 11:53:28 -07:00
Nati Pesaresi
629efb85fb
ternary operator
2021-09-02 17:55:09 -03:00
CodeQL CI
b4963c7538
Merge pull request #6558 from erik-krogh/redosCasing
...
Approved by esbena, yoff
2021-09-02 12:20:08 +01:00
Erik Krogh Kristensen
cecb6c7bdd
add model for live-server
2021-08-31 14:23:23 +02:00
Erik Krogh Kristensen
b509627113
add tests for connect
2021-08-31 14:23:23 +02:00
Erik Krogh Kristensen
3d6ab81ab8
refactor the tests for connect
2021-08-31 14:23:23 +02:00
Erik Krogh Kristensen
c6399dbdf4
simplify the connect model by reusing NodeJSLib::RouteHandler
2021-08-31 14:23:23 +02:00
Asger Feldthaus
7dd65d8ac6
JS: Clean up taint step definitions
...
These are Unit types and so should be kept private as you can't
use them for anything other than getting all taint steps of a certain
type.
Also factors out accesses to 'this'.
2021-08-31 11:19:06 +02:00
Asger Feldthaus
e4901eda91
JS: Handle .extend called on any component
2021-08-31 11:19:01 +02:00
Asger Feldthaus
2a79817c3b
JS: Add test for "extends"
2021-08-31 11:19:01 +02:00
Asger Feldthaus
4d4443c3cf
JS: Use API graphs in getOption(s)
2021-08-31 11:19:00 +02:00
Erik Krogh Kristensen
486b283c20
support the "module" field in package.json files
2021-08-30 11:05:32 +02:00
Erik Krogh Kristensen
f5a1a12435
support case insensitive regexps in the ReDoS queries
2021-08-30 09:59:33 +02:00
Erik Krogh Kristensen
81742528a2
add test
2021-08-27 10:04:39 +02:00
Andrew Eisenberg
45d1fa7f01
Packaging: Rafactor Javascript core libraries
...
Extract the external facing `qll` files into the codeql/javascript-all
query pack.
2021-08-25 12:15:56 -07:00
CodeQL CI
1daeea5696
Merge pull request #6472 from erik-krogh/apiPromise
...
Approved by asgerf
2021-08-25 14:45:03 +01:00
CodeQL CI
170a069657
Merge pull request #6403 from asgerf/js/handlebars-extraction
...
Approved by erik-krogh
2021-08-25 13:54:52 +01:00
Erik Krogh Kristensen
c664d7cfb3
add a getMaybePromisifiedCall method in API graphs, and use it to model child_process
2021-08-25 10:27:09 +02:00
CodeQL CI
c66a34be9c
Merge pull request #6533 from erik-krogh/cwdPath
...
Approved by asgerf
2021-08-24 13:10:38 +01:00
CodeQL CI
c0e8680c81
Merge pull request #6534 from erik-krogh/fallbackEntry
...
Approved by asgerf
2021-08-24 11:38:25 +01:00
Erik Krogh Kristensen
38477d7d2e
Merge pull request #6462 from erik-krogh/repeat
...
JS: support more regular expressions in js/incomplete-multi-character-sanitization
2021-08-23 15:39:31 +02:00
Erik Krogh Kristensen
5d232bbfce
recognize more src folders when "main" in package.json points to a compiled output
2021-08-23 08:09:01 +02:00
Erik Krogh Kristensen
32ac8778bd
add the cwd option to shell executions as a sink to js/path-injection
2021-08-23 07:32:05 +02:00
Asger Feldthaus
bac212c610
JS: Fix typo: instantiaton -> instantiation
2021-08-19 14:41:18 +02:00
Asger Feldthaus
7b6485c32a
JS: Rename some test predicates to match class name
2021-08-18 15:36:41 +02:00
Asger Feldthaus
b21071923e
JS: Rename variables to match new class name
2021-08-18 15:36:41 +02:00
Asger Feldthaus
0a98679f74
JS: Rename Vue::Instance to Vue::Component
2021-08-18 15:36:41 +02:00
Erik Krogh Kristensen
4cc2ac9d35
exclude char classes that match everything
2021-08-18 08:59:17 +00:00
Erik Krogh Kristensen
9c2d83e82b
add tests
2021-08-17 15:10:30 +02:00
Erik Krogh Kristensen
6d06550f7d
update expected output
2021-08-17 15:10:30 +02:00
CodeQL CI
92804a3cc3
Merge pull request #6487 from erik-krogh/moreJquerySinks
...
Approved by asgerf
2021-08-17 11:46:24 +01:00
CodeQL CI
e3cdc4522e
Merge pull request #6450 from asgerf/js/query-suffix-convention2
...
Approved by erik-krogh
2021-08-17 11:31:21 +01:00
Erik Krogh Kristensen
cc2a267b07
recognize array elements from JQuery objects as DOM values
2021-08-16 22:35:57 +02:00
Erik Krogh Kristensen
46959234b7
Merge pull request #6288 from erik-krogh/emptyRedos
...
JS/Python: Fix FP in redos related to empty lookaheads
2021-08-16 13:48:22 +02:00
Asger Feldthaus
cb0075f15a
JS: Remove use of deprecated API
2021-08-12 09:30:43 +02:00
CodeQL CI
8fe2a43fd9
Merge pull request #6433 from asgerf/js/tainted-url-suffix
...
Approved by erik-krogh
2021-08-12 00:28:46 -07:00
Asger Feldthaus
b9b10af9b5
JS: Tolerate parse errors in test due to speculative parsing
2021-08-11 12:54:22 +02:00
Asger Feldthaus
65b44248f8
JS: Autoformat
2021-08-11 12:50:54 +02:00
Asger Feldthaus
4f4f524937
JS: Add test for upward traversal
2021-08-11 12:50:54 +02:00
Asger Feldthaus
b7339348ef
JS: Add tests for EJS includes
2021-08-11 12:50:54 +02:00
Asger Feldthaus
b1cadc8ae7
JS: Add test for AngularJS sinks
2021-08-11 12:50:54 +02:00
Asger Feldthaus
e61d534c59
JS: Add ambiguity test for template file resolution
2021-08-11 12:50:54 +02:00
Asger Feldthaus
e8d10b983e
JS: Tests for template file resolution
2021-08-11 12:50:54 +02:00
Asger Feldthaus
28fe8da37c
JS: Add similar test for .njk file
2021-08-11 12:50:54 +02:00
Asger Feldthaus
1444ec5255
JS: Add similar test for hbs
2021-08-11 12:50:54 +02:00
