1112 Commits

Author	SHA1	Message	Date
semmle-qlci	163285bee7	Merge pull request #2735 from asger-semmle/prototype-pollution-manual-dataflow ... Approved by esbena	2020-02-05 12:52:59 +00:00
semmle-qlci	53763c789f	Merge pull request #2741 from esbena/js/split-and-slice-for-tainted-path ... Approved by erik-krogh	2020-02-05 10:53:39 +00:00
Erik Krogh Kristensen	ffc6fddddd	update expected test output	2020-02-05 10:52:40 +01:00
Erik Krogh Kristensen	76aca02752	change the pseudo-property on URL to a two-stage process	2020-02-05 10:27:03 +01:00
Erik Krogh Kristensen	8d37c03209	using pseudo-properties to model URL parsing	2020-02-04 16:30:07 +01:00
Asger Feldthaus	c185cededf	JS: More pruning and more data flow	2020-02-04 15:06:42 +00:00
semmle-qlci	bd51ef35b7	Merge pull request #2731 from erik-krogh/CVE527 ... Approved by esbena	2020-02-04 08:38:26 +00:00
Esben Sparre Andreasen	bbd60f52ba	JS: add additional flow steps to js/path-injection	2020-02-03 16:36:25 +01:00
Esben Sparre Andreasen	c70997febf	JS: address review comments for js/unsafe-jquery-plugin	2020-01-31 19:33:04 +01:00
Esben Sparre Andreasen	2ad9b843ae	JS: fix FP for js/unsafe-jquery-plugin	2020-01-31 19:33:04 +01:00
Esben Sparre Andreasen	cfd567f01d	JS: fix FP for js/unsafe-jquery-plugin	2020-01-31 19:33:04 +01:00
Esben Sparre Andreasen	9e247921fc	JS: add FP tests for js/unsafe-jquery-plugin	2020-01-31 19:33:04 +01:00
Esben Sparre Andreasen	fef918ac13	JS: add query "Unsafe jQuery plugin"	2020-01-31 19:33:04 +01:00
Erik Krogh Kristensen	e6d46b9279	add test for new prefix check on TaintedPath	2020-01-31 12:35:03 +01:00
Erik Krogh Kristensen	162c19c348	changes based on review	2020-01-30 14:04:04 +01:00
Erik Krogh Kristensen	7637ebcc03	Merge remote-tracking branch 'upstream/master' into exceptionFPs	2020-01-30 10:56:41 +01:00
Asger Feldthaus	b98db62e82	JS: Recognize req.user a cookie access	2020-01-24 09:44:20 +00:00
Asger Feldthaus	a68bb9ffd1	JS: Ignore calls and csrf/captcha access	2020-01-23 15:32:05 +00:00
Asger Feldthaus	b1ec3e1bf2	JS: Add test and dont check predecessors	2020-01-23 14:59:03 +00:00
Erik Krogh Kristensen	6494649125	fix a number of FPs in js/exception-xss	2020-01-20 15:11:57 +01:00
Asger F	2c05ee8ab8	JS: Add regression test	2020-01-14 10:53:00 +00:00
Asger F	9bd3c4a11c	JS: Add sanitizer for "in" exprs	2020-01-14 10:53:00 +00:00
Asger Feldthaus	7ac30e2289	JS: Add test for rephinement nodes	2020-01-14 10:53:00 +00:00
Asger F	a447645c10	JS: Add test with typeof on value	2020-01-14 10:52:59 +00:00
Asger F	bd9405ab84	JS: Guard against more FPs	2020-01-14 10:52:59 +00:00
Asger F	f7543aec95	JS: Support Reflect.ownKeys	2020-01-14 10:52:59 +00:00
Asger F	8af233307a	JS: Support enumeration through Object.entries	2020-01-14 10:52:59 +00:00
Asger F	96bf9db200	JS: Add another test and more barriers	2020-01-14 10:52:59 +00:00
Asger F	bc7871078a	JS: Fix FPs from Object.create(null)	2020-01-14 10:52:59 +00:00
Asger F	c889420dd3	JS: Add qhelp samples to test suite	2020-01-14 10:52:59 +00:00
Asger F	654f145772	JS: Add PrototypePollutionUtility query	2020-01-14 10:52:59 +00:00
semmle-qlci	06d812a6ff	Merge pull request #2556 from erik-krogh/RegexpVoidCxt ... Approved by max-schaefer	2020-01-03 08:38:56 +00:00
Erik Krogh Kristensen	15d74b7d03	remove FP from js/regexpinjection where no regexp was constructed	2019-12-19 10:47:03 +01:00
Erik Krogh Kristensen	bf56797ad7	update expected output of tests	2019-12-17 16:27:55 +01:00
Erik Krogh Kristensen	7c931452d9	autoformat	2019-12-16 13:45:42 +01:00
Erik Krogh Kristensen	904976c7ac	update tests after removing control-flow checks from error-callbacks	2019-12-16 08:30:21 +01:00
Erik Krogh Kristensen	e164f46330	changes based on review feedback	2019-12-13 11:44:31 +01:00
Erik Krogh Kristensen	f35dc5d274	Merge remote-tracking branch 'upstream/master' into moarExceptions	2019-12-12 16:13:52 +01:00
Erik Krogh Kristensen	08d0cb795b	revert the introduction of getEnclosingCall	2019-12-12 15:14:02 +01:00
Erik Krogh Kristensen	62512dd3e9	expand the js/exception-xss to handle more types of exceptional flow	2019-12-11 10:43:50 +01:00
Asger F	2acd616e6f	JS: Review comments	2019-12-06 11:53:06 +00:00
Asger F	bbb6dad726	JS: Update koa testcase	2019-12-06 11:49:59 +00:00
Asger F	a6e75259d6	JS: More fine-grained regexp-based sanitizer guards	2019-12-06 11:49:59 +00:00
Erik Krogh Kristensen	ea9d6189de	update expected test outpu	2019-12-02 12:52:39 +01:00
Erik Krogh Kristensen	c6c1ebe81a	Merge remote-tracking branch 'upstream/master' into typeAheadSink	2019-12-02 08:41:49 +01:00
Erik Krogh Kristensen	d212394058	update expected output	2019-11-27 15:21:47 +01:00
Erik Krogh Kristensen	34e44e89fd	Merge remote-tracking branch 'upstream/master' into typeAheadSink	2019-11-27 15:19:06 +01:00
Erik Krogh Kristensen	9351cd44e4	Merge remote-tracking branch 'githubsemmle/master' into HEAD	2019-11-27 13:45:59 +01:00
Erik Krogh Kristensen	42fbcbf007	update expected test output	2019-11-27 11:14:04 +01:00
Asger F	605c8834c6	JS: Avoid redundant window.name sources	2019-11-27 06:15:12 +00:00