Esben Sparre Andreasen
|
d591c519a8
|
JS: reformulate js/server-crash as a path problem
|
2021-01-13 00:08:28 +01:00 |
|
CodeQL CI
|
1c8547c897
|
Merge pull request #4774 from erik-krogh/forms
Approved by asgerf
|
2021-01-12 02:01:38 -08:00 |
|
Esben Sparre Andreasen
|
847687974f
|
JS: only select non-nullable terms in the broken sanitizer
|
2021-01-12 08:50:19 +01:00 |
|
Esben Sparre Andreasen
|
40cfbab335
|
JS: address review feedback
|
2021-01-12 08:49:08 +01:00 |
|
Esben Sparre Andreasen
|
2dbd762bd9
|
JS: reintroduce reverted js/server-crash
This reverts commit 0a8d15ccc4.
|
2021-01-11 14:13:41 +01:00 |
|
Esben Sparre Andreasen
|
580a24e982
|
JS: rewrite js/incomplete-multi-character-sanitization
|
2021-01-11 11:26:45 +01:00 |
|
Erik Krogh Kristensen
|
2aa59a3f8b
|
support sanitizers that sanitize individual chars in js/shell-command-constructed-from-input
|
2021-01-07 13:58:25 +01:00 |
|
Erik Krogh Kristensen
|
bfd8d1b1e9
|
Merge branch 'main' into revertSum
|
2021-01-06 23:04:08 +01:00 |
|
Erik Krogh Kristensen
|
f1cee70e82
|
add class-field flowstep to js/shell-command-constructed-from-input
|
2021-01-06 14:37:00 +01:00 |
|
Erik Krogh Kristensen
|
530a4aea35
|
Merge branch 'main' into shellSanitizer
|
2020-12-22 13:57:15 +01:00 |
|
CodeQL CI
|
2bb96369f1
|
Merge pull request #4868 from erik-krogh/boundShell
Approved by esbena
|
2020-12-22 03:35:42 -08:00 |
|
CodeQL CI
|
7c6b4d7324
|
Merge pull request #4865 from esbena/js/fix-execa-model
Approved by erik-krogh
|
2020-12-22 03:32:26 -08:00 |
|
Erik Krogh Kristensen
|
da9a4e5267
|
add test
|
2020-12-22 11:22:25 +01:00 |
|
Esben Sparre Andreasen
|
34a09ff522
|
JS: add js/conditional-bypass example as a test case
|
2020-12-22 09:34:25 +01:00 |
|
Esben Sparre Andreasen
|
ab4f3ea259
|
JS: fixup for execa.shell and execa.shellSync models
|
2020-12-22 09:06:18 +01:00 |
|
Esben Sparre Andreasen
|
ba714a1214
|
JS: add execa.shell tests
|
2020-12-22 09:01:43 +01:00 |
|
Erik Krogh Kristensen
|
876ba7ef2d
|
add typeof sanitizer to js/shell-command-constructed-from-input
|
2020-12-21 14:16:55 +01:00 |
|
CodeQL CI
|
41ef7a3fce
|
Merge pull request #4733 from erik-krogh/args
Approved by esbena
|
2020-12-16 06:51:26 -08:00 |
|
CodeQL CI
|
287954e0d8
|
Merge pull request #4686 from erik-krogh/buildFp
Approved by esbena
|
2020-12-16 06:42:41 -08:00 |
|
CodeQL CI
|
9ff6d68a9b
|
Merge pull request #4778 from asgerf/js/more-prototype-pollution
Approved by erik-krogh, mchammer01
|
2020-12-11 13:58:09 -08:00 |
|
CodeQL CI
|
8129d0c0ac
|
Merge pull request #4762 from asgerf/js/template-sinks-in-code-injection
Approved by erik-krogh, mchammer01
|
2020-12-07 04:35:11 -08:00 |
|
Asger Feldthaus
|
254ac7f963
|
JS: Fix TypeofCheck
|
2020-12-07 10:46:00 +00:00 |
|
Asger Feldthaus
|
f132b4a279
|
JS: Add type confusion sink for prototype pollution checks
|
2020-12-07 10:16:38 +00:00 |
|
Asger Feldthaus
|
daab3c1437
|
JS: Add tests and fix some bugs
|
2020-12-07 10:16:38 +00:00 |
|
Asger Feldthaus
|
0a7513fdfb
|
JS: Move and rename test cases as well
|
2020-12-07 10:16:38 +00:00 |
|
Erik Krogh Kristensen
|
3bad75dae5
|
better support for forms in js/xss-through-dom
|
2020-12-03 16:57:41 +01:00 |
|
Asger Feldthaus
|
20d9848f07
|
JS: Add test case
|
2020-12-03 15:08:43 +00:00 |
|
Asger Feldthaus
|
68d2bc861d
|
JS: Update test expectations
|
2020-12-03 15:01:50 +00:00 |
|
CodeQL CI
|
edbbc846d0
|
Merge pull request #4753 from max-schaefer/js/more-nosql-query-args
Approved by asgerf, mchammer01
|
2020-12-03 08:46:47 +00:00 |
|
Asger Feldthaus
|
6211fe718b
|
JS: Add test
|
2020-12-01 17:05:48 +00:00 |
|
Erik Krogh Kristensen
|
9a31ed13ac
|
add test case
|
2020-12-01 09:18:40 +01:00 |
|
Max Schaefer
|
978d2db252
|
JavaScript: Add models for more Mongoose methods.
|
2020-11-30 16:32:13 +00:00 |
|
Erik Krogh Kristensen
|
fd0d5c9e46
|
add command parsing model for "commander"
|
2020-11-27 09:58:00 +00:00 |
|
Erik Krogh Kristensen
|
653ebf7668
|
add command parsing model for "dashdash"
|
2020-11-27 09:57:05 +00:00 |
|
Erik Krogh Kristensen
|
269de49196
|
add model for "meow"
|
2020-11-27 09:57:05 +00:00 |
|
Erik Krogh Kristensen
|
c5ac98d2e8
|
add command parsing model for command-line-args
|
2020-11-27 09:57:05 +00:00 |
|
Erik Krogh Kristensen
|
f33cd8bc8e
|
add command parsing model for argparse
|
2020-11-27 09:57:05 +00:00 |
|
Erik Krogh Kristensen
|
45067ee651
|
add command parsing model for "arg"
|
2020-11-27 09:57:05 +00:00 |
|
Erik Krogh Kristensen
|
821b4be522
|
more accurately model command parsers that take process.argv as an argument
|
2020-11-27 09:56:50 +00:00 |
|
CodeQL CI
|
4be158b362
|
Merge pull request #4708 from erik-krogh/emptyName
Approved by asgerf
|
2020-11-24 17:34:55 +00:00 |
|
Erik Krogh Kristensen
|
33dab1717e
|
treat nodes with type "Location" as a location source - but not if we can track it from an original node with type "Location"
|
2020-11-23 17:03:50 +01:00 |
|
Erik Krogh Kristensen
|
f7f9beeefd
|
avoid reporting empty names in js/exposure-of-private-files
|
2020-11-23 14:24:42 +01:00 |
|
Erik Krogh Kristensen
|
02d5fbf46b
|
remove superfluous space
|
2020-11-23 14:22:16 +01:00 |
|
Asger Feldthaus
|
f737f34dcd
|
JS: Add UntrustedDataToExternalApi query
|
2020-11-19 13:42:25 +00:00 |
|
Erik Krogh Kristensen
|
64828713d6
|
remove FPs in js/build-artifact-leak where the "leaked" properties are constrained to a safe subset
|
2020-11-18 10:35:02 +01:00 |
|
Erik Krogh Kristensen
|
49be7e959f
|
Merge branch 'main' into jwt
|
2020-11-12 21:36:09 +01:00 |
|
Erik Krogh Kristensen
|
99d03bab24
|
only flag the secret key in JWT
|
2020-11-12 21:36:05 +01:00 |
|
Erik Krogh Kristensen
|
5ecae55e77
|
add keys used by jsonwebtoken as CredentialsExpr
|
2020-11-10 10:41:39 +01:00 |
|
Erik Krogh Kristensen
|
e75259d3a6
|
model the verify function in jsonwebtoken
|
2020-11-10 10:41:39 +01:00 |
|
Erik Krogh Kristensen
|
6732493377
|
add model for jwt-decode
|
2020-11-10 10:41:36 +01:00 |
|