Erik Krogh Kristensen
|
e164f46330
|
changes based on review feedback
|
2019-12-13 11:44:31 +01:00 |
|
Erik Krogh Kristensen
|
f35dc5d274
|
Merge remote-tracking branch 'upstream/master' into moarExceptions
|
2019-12-12 16:13:52 +01:00 |
|
Erik Krogh Kristensen
|
08d0cb795b
|
revert the introduction of getEnclosingCall
|
2019-12-12 15:14:02 +01:00 |
|
Erik Krogh Kristensen
|
62512dd3e9
|
expand the js/exception-xss to handle more types of exceptional flow
|
2019-12-11 10:43:50 +01:00 |
|
Asger F
|
2acd616e6f
|
JS: Review comments
|
2019-12-06 11:53:06 +00:00 |
|
Asger F
|
bbb6dad726
|
JS: Update koa testcase
|
2019-12-06 11:49:59 +00:00 |
|
Asger F
|
a6e75259d6
|
JS: More fine-grained regexp-based sanitizer guards
|
2019-12-06 11:49:59 +00:00 |
|
Erik Krogh Kristensen
|
ea9d6189de
|
update expected test outpu
|
2019-12-02 12:52:39 +01:00 |
|
Erik Krogh Kristensen
|
c6c1ebe81a
|
Merge remote-tracking branch 'upstream/master' into typeAheadSink
|
2019-12-02 08:41:49 +01:00 |
|
Erik Krogh Kristensen
|
d212394058
|
update expected output
|
2019-11-27 15:21:47 +01:00 |
|
Erik Krogh Kristensen
|
34e44e89fd
|
Merge remote-tracking branch 'upstream/master' into typeAheadSink
|
2019-11-27 15:19:06 +01:00 |
|
Erik Krogh Kristensen
|
9351cd44e4
|
Merge remote-tracking branch 'githubsemmle/master' into HEAD
|
2019-11-27 13:45:59 +01:00 |
|
Erik Krogh Kristensen
|
42fbcbf007
|
update expected test output
|
2019-11-27 11:14:04 +01:00 |
|
Asger F
|
605c8834c6
|
JS: Avoid redundant window.name sources
|
2019-11-27 06:15:12 +00:00 |
|
Erik Krogh Kristensen
|
7b262fa9cf
|
update expected output
|
2019-11-26 14:39:09 +01:00 |
|
Erik Krogh Kristensen
|
5a0cabb039
|
Merge remote-tracking branch 'upstream/master' into typeAheadSink
|
2019-11-26 14:37:40 +01:00 |
|
Erik Krogh Kristensen
|
4a94c49d37
|
changes based on review feedback
|
2019-11-26 13:40:48 +01:00 |
|
Erik Krogh Kristensen
|
f284b3a2bb
|
Merge remote-tracking branch 'upstream/master' into exceptionXss
|
2019-11-26 10:54:04 +01:00 |
|
Erik Krogh Kristensen
|
c7235bb372
|
add sources and sinks for typeahead.js
|
2019-11-25 10:46:54 +01:00 |
|
Erik Krogh Kristensen
|
7d825af9a3
|
Added an XSS sink for Handlebars.SafeString
|
2019-11-22 15:56:21 +01:00 |
|
Erik Krogh Kristensen
|
f40d79271d
|
cleanup module imports and update expected outputs
|
2019-11-22 13:55:47 +01:00 |
|
Max Schaefer
|
0edb70f373
|
JavaScript: Deal with escape-unescape-escape (and similar) chains.
|
2019-11-22 09:24:34 +00:00 |
|
Max Schaefer
|
cb54618a5d
|
JavaScript: Deal with (un-)escaping on captured variables.
|
2019-11-22 09:24:34 +00:00 |
|
Max Schaefer
|
61aa075e8d
|
JavaScript: Fix regexes for escaping schemes.
|
2019-11-22 09:24:34 +00:00 |
|
Max Schaefer
|
4f899a9b0d
|
JavaScript: Recognize string escaping using .replace with a callback.
|
2019-11-22 09:24:34 +00:00 |
|
Erik Krogh Kristensen
|
94e9c0203d
|
add test for exceptional taint-flow
|
2019-11-21 17:16:13 +01:00 |
|
semmle-qlci
|
77c869f528
|
Merge pull request #2220 from erik-krogh/processEnvTaint
Approved by esbena, max-schaefer
|
2019-11-20 13:16:43 +00:00 |
|
Max Schaefer
|
5565be14fc
|
JavaScript: Teach IncompleteSanitization to flag incomplete path sanitizers.
|
2019-11-19 15:06:16 +00:00 |
|
Erik Krogh Kristensen
|
1ba777a45d
|
remove deep taint of objects
|
2019-11-19 15:50:50 +01:00 |
|
Erik Krogh Kristensen
|
9fa7393d56
|
add support for try-statements with no catch block
|
2019-11-19 13:37:35 +01:00 |
|
Erik Krogh Kristensen
|
91674f681b
|
refactoring to remove duplicated code and simplify the ExceptionXss query
|
2019-11-19 08:54:51 +01:00 |
|
Erik Krogh Kristensen
|
1b81526691
|
Merge remote-tracking branch 'upstream/master' into exceptionXss
|
2019-11-17 09:29:54 +01:00 |
|
Erik Krogh Kristensen
|
a59a414e0b
|
update expected output
|
2019-11-16 15:20:42 +01:00 |
|
Erik Krogh Kristensen
|
8ff515a58d
|
address review feedback on MaskingReplacer
|
2019-11-16 15:20:42 +01:00 |
|
Erik Krogh Kristensen
|
4ec2070e48
|
remove property reads on process.env as a taint step, and add a barrier for masking replace calls
|
2019-11-16 15:20:42 +01:00 |
|
Erik Krogh Kristensen
|
92dc759cf9
|
remove type cast, and fix expected test results
|
2019-11-16 15:20:42 +01:00 |
|
Erik Krogh Kristensen
|
850278c62f
|
some changes based on review. And change to only flag unknown reads of process.env
|
2019-11-16 15:20:42 +01:00 |
|
Erik Krogh Kristensen
|
68c30aaef3
|
add flowlabels to js/clear-text-logging
|
2019-11-16 15:20:42 +01:00 |
|
Erik Krogh Kristensen
|
14e4decffa
|
changes based on review feedback. No flow-labels yet
|
2019-11-16 15:20:42 +01:00 |
|
Erik Krogh Kristensen
|
297c71a64b
|
add process.env as source for js/clear-text-logging
|
2019-11-16 15:20:41 +01:00 |
|
Erik Krogh Kristensen
|
4073dfaf24
|
remove redundant code
|
2019-11-15 16:17:18 +01:00 |
|
Erik Krogh Kristensen
|
d36312cf9f
|
update expected output
|
2019-11-15 16:08:13 +01:00 |
|
Erik Krogh Kristensen
|
3edd65f9ab
|
changed the exceptional taint-steps to step through each call-site
|
2019-11-15 16:05:15 +01:00 |
|
Erik Krogh Kristensen
|
e95cceef1d
|
import all the shared XSS sources and sinks
|
2019-11-15 15:41:53 +01:00 |
|
Erik Krogh Kristensen
|
65a018ceed
|
use flow labels to avoid dual configurations
|
2019-11-15 14:37:46 +01:00 |
|
Erik Krogh Kristensen
|
8d2ae136b0
|
move String.prototype.match taint step to a general AdditionalTaintStep
|
2019-11-15 12:52:54 +01:00 |
|
semmle-qlci
|
2f63b89941
|
Merge pull request #2338 from esbena/js/model-get-them-args
Approved by max-schaefer
|
2019-11-15 11:50:45 +00:00 |
|
Asger F
|
e01a9846d8
|
JS: Update test annotations
|
2019-11-15 09:27:20 +00:00 |
|
Asger F
|
153d34638b
|
JS: Fix a FP
|
2019-11-15 09:27:20 +00:00 |
|
Asger F
|
8c5b9b9195
|
JS: Add missing post-anchor case to MissingRegExpAnchor
|
2019-11-15 09:27:20 +00:00 |
|