Erik Krogh Kristensen
d1b3963e2d
correctly treat ES2015 modules as being in strict-mode in the extractor
2020-08-18 10:13:20 +02:00
Erik Krogh Kristensen
eb5dfe8438
autoformat
2020-08-17 22:46:20 +02:00
Erik Krogh Kristensen
73d1fac88e
support named tuples where not all tuple elements are named
2020-08-17 16:20:26 +02:00
Erik Krogh Kristensen
c28889225a
skip binary files when extracting JavaScript
2020-08-17 15:21:15 +02:00
CodeQL CI
c917cd02bd
Merge pull request #4054 from erik-krogh/urlIncludes
...
Approved by esbena
2020-08-17 13:54:25 +01:00
CodeQL CI
a19963e9b7
Merge pull request #3930 from erik-krogh/fastProp
...
Approved by esbena
2020-08-17 13:42:12 +01:00
Erik Krogh Kristensen
6f28ddf1f8
proper support for this inside a JSX-name
2020-08-17 14:23:42 +02:00
ubuntu
5d6e6be4e4
Add query-tests
2020-08-16 15:02:52 +02:00
Erik Krogh Kristensen
15a74493e0
more permissive path elements in js/incomplete-url-substring-sanitization
2020-08-13 11:46:13 +02:00
Erik Krogh Kristensen
3fb9c28806
adjust comment about slash position
2020-08-13 11:46:13 +02:00
Erik Krogh Kristensen
d35d3f4271
add test for catch with type unknown
2020-08-13 09:37:55 +02:00
Erik Krogh Kristensen
d95d427c5b
better support for the &&=, ||=, and ??= operators
2020-08-13 09:22:32 +02:00
Erik Krogh Kristensen
fd9eb1d40b
use Identifier instead of just a plain string when getting tuple-element-names
2020-08-12 16:55:55 +02:00
CodeQL CI
66541f260b
Merge pull request #4012 from erik-krogh/getId
...
Approved by asgerf, esbena
2020-08-12 13:28:18 +01:00
Erik Krogh Kristensen
1d111c3e1f
expand what urls are detected by js/incomplete-url-substring-sanitization
2020-08-12 14:25:35 +02:00
Erik Krogh Kristensen
a7a016c5df
update expected output
2020-08-12 13:29:43 +02:00
Erik Krogh Kristensen
0e33eae960
add dbscheme upgrade script
2020-08-12 11:50:32 +02:00
Erik Krogh Kristensen
26dcd2faae
add support for getting the name from named tuple elements
2020-08-12 10:33:49 +02:00
Erik Krogh Kristensen
d2c87d0a2e
add support for the new assign expression in TypeScript 4
2020-08-11 13:57:11 +02:00
Erik Krogh Kristensen
2f34990ae6
add another test for spread elements in tuple types
2020-08-11 13:57:11 +02:00
Erik Krogh Kristensen
ea583fe862
add basic support for named tuple elements
2020-08-11 13:57:11 +02:00
Erik Krogh Kristensen
2612e0c5dd
add test for spread in tuple in non-last position
2020-08-11 13:57:11 +02:00
Erik Krogh Kristensen
b602a36a24
add test for generic spreads in a tuple
2020-08-11 13:57:11 +02:00
Erik Krogh Kristensen
9bcac10d9e
summarize exceptions thrown by immidiatly awaited function calls
2020-08-10 13:28:25 +02:00
Erik Krogh Kristensen
30dc77e538
update expected output
2020-08-08 21:26:45 +02:00
Erik Krogh Kristensen
aab2e6f803
update name of test file
2020-08-07 18:20:22 +02:00
Erik Krogh Kristensen
8f06e9651f
update expected output
2020-08-07 17:40:58 +02:00
Erik Krogh Kristensen
b9a98f51ea
update existing tests to work with FunctionReturnNode
2020-08-07 17:40:02 +02:00
Erik Krogh Kristensen
0edb46c20d
improve precision for load/store steps with async functions
2020-08-07 17:39:59 +02:00
Erik Krogh Kristensen
26ef2f34da
add precise return-flow for async functions
2020-08-07 17:33:26 +02:00
Erik Krogh Kristensen
cc94c5ec60
remove imprecise return-flow from async functions
2020-08-07 17:33:24 +02:00
Erik Krogh Kristensen
0004c28fe8
introduce and use FunctionReturnNode
2020-08-07 17:32:25 +02:00
Asger Feldthaus
64f58b74f6
JS: Fix extractor crash when some parameters have no type annotation
2020-08-07 11:56:54 +01:00
Erik Krogh Kristensen
f1dc36244c
update tests and queries that used getId()
2020-08-05 14:32:09 +00:00
Erik Krogh Kristensen
f70cb2e7b3
add test for new JSON serializers
2020-08-05 12:14:56 +02:00
Erik Krogh Kristensen
e629e6bbb0
changes based on review
2020-08-04 10:25:05 +02:00
Erik Krogh Kristensen
97aa3cc8a3
rewrite DeadStoreOfProperty to improve worst-case complexity
2020-08-04 10:25:05 +02:00
Erik Krogh Kristensen
dbeef312ca
add some TypeScript tests to DeadStoreOfProperty
2020-08-04 10:25:05 +02:00
CodeQL CI
8855ab8c8c
Merge pull request #3835 from Raz0r/js/xss-protocol-sinks
...
Approved by erik-krogh
2020-08-03 15:40:05 +01:00
CodeQL CI
a4f8b19ae4
Merge pull request #3876 from erik-krogh/CWE078-Correctness
...
Approved by esbena
2020-08-03 15:38:51 +01:00
CodeQL CI
c8e5db189a
Merge pull request #3913 from erik-krogh/topmost
...
Approved by asgerf
2020-08-03 13:18:22 +01:00
Erik Krogh Kristensen
f5cc14f980
fix typo
2020-08-03 13:49:21 +02:00
CodeQL CI
0bbdc70cdb
Merge pull request #3864 from erik-krogh/exprString
...
Approved by asgerf, esbena
2020-08-03 09:25:17 +01:00
Max Schaefer
91762ec274
JavaScript: Add partial model for opener.
...
3.5M weekly downloads.
Note that we do not treat the first argument as a command-injection sink. While it is possible to inject commands that way, it is more likely to cause false positives where the user input is concatenated with some prefix that makes the opening heuristic decide to treat it as a URL.
2020-07-27 11:42:32 +01:00
Max Schaefer
9aa26fa4bc
JavaScript: Add model for foreground-child.
...
>1M weekly downloads, so seems worth doing.
2020-07-27 11:37:06 +01:00
Max Schaefer
2f842042ea
JavaScript: Model another execa function relevant for command injection.
2020-07-27 11:34:04 +01:00
semmle-qlci
e167b87150
Merge pull request #3932 from max-schaefer/portals-additions
...
Approved by esbena
2020-07-09 11:43:45 +01:00
Max Schaefer
7a1410e0d5
JavaScript: Update and expand tests.
2020-07-09 09:25:52 +01:00
Erik Krogh Kristensen
022cafebd3
make sure the consisntecy-checking library does not mix configurations
2020-07-08 10:28:41 +02:00
Erik Krogh Kristensen
ec38df69b3
update consistency comments for CWE-918
2020-07-08 10:24:55 +02:00
