Erik Krogh Kristensen
14cc352bd9
small documentation change based on review
2019-10-04 15:26:32 +02:00
Erik Krogh Kristensen
144e831515
mention that "function" should not be used when declaring a call signature in an interface
2019-10-04 15:05:11 +02:00
Erik Krogh Kristensen
bf1fd83851
fix typo in predicate name
2019-10-04 15:04:39 +02:00
Erik Krogh Kristensen
b741a65e9b
documentation changes based on review
...
Co-Authored-By: shati-patel <42641846+shati-patel@users.noreply.github.com >
2019-10-04 14:42:16 +02:00
Erik Krogh Kristensen
c8d60c9e2a
update @description of js/suspicious-method-name-declaration
2019-10-04 11:40:33 +02:00
Erik Krogh Kristensen
712a337bdd
qhelp adjustments based on code-review
2019-10-04 11:06:11 +02:00
Erik Krogh Kristensen
ced5e3ea29
qhelp adjustment from code-review
...
Co-Authored-By: Esben Sparre Andreasen <42067045+esben-semmle@users.noreply.github.com >
2019-10-04 11:02:15 +02:00
Erik Krogh Kristensen
2b5e3aebb7
change tabs to spaces
2019-10-02 15:03:38 +02:00
Erik Krogh Kristensen
0c46e5c1a8
update description of js/suspicious-method-name-declaration
2019-10-02 15:01:25 +02:00
Erik Krogh Kristensen
c0b7538cf0
made the blacklist for methods named "function" work again
2019-10-02 14:56:41 +02:00
Erik Krogh Kristensen
e5290f3bb0
remove some parentheses
2019-10-02 14:51:47 +02:00
Erik Krogh Kristensen
22aac8e723
ensure that the existence of non-synthetic constructor is checked correctly
2019-10-02 14:49:33 +02:00
Erik Krogh Kristensen
a66e33ea5e
add references to TypeScript spec for "new" and "constructor" keywords
2019-10-01 15:56:45 +02:00
Erik Krogh Kristensen
2ad85d16bd
refactor a list of negated conjunctions to a disjunction
2019-10-01 15:53:22 +02:00
Erik Krogh Kristensen
6c176fc967
introduce name as a variable, and adjust alert messages
2019-10-01 15:28:57 +02:00
Erik Krogh Kristensen
26a0bfac39
refactor js/suspicious-method-name-declaration to use isSynthetic predicate
2019-10-01 15:06:45 +02:00
Erik Krogh Kristensen
aa1368741b
rename suspicious-method-name to suspicious-method-name-declaration
2019-10-01 14:37:07 +02:00
Erik Krogh Kristensen
0320f0f26b
add query for detecting suspisous method names in TypeScript
2019-09-30 13:05:50 +02:00
Erik Krogh Kristensen
7fb8f8453d
fix for when the concatenation root is in parentheses
2019-09-26 16:35:38 +02:00
Erik Krogh Kristensen
69365ccd03
remove false positive in missingSpaceInAppend by requring the presence of a word-like fragment
2019-09-26 12:59:05 +02:00
Asger F
cafa9edf69
JS: upgrade script, stats, version string
2019-09-26 10:17:58 +01:00
Asger F
b4f67f20af
JS: Extract types and signatures for functions
2019-09-26 10:17:58 +01:00
Asger F
97494290de
JS: Add getOverloadIndex()
2019-09-26 10:17:58 +01:00
Max Schaefer
d4fca84898
JavaScript: Improve XSS sanitizer detection.
...
We now use local data flow to detect more regexp-based sanitizers.
2019-09-23 17:07:06 +01:00
semmle-qlci
825a3d2917
Merge pull request #1954 from asger-semmle/type-tracking-through-captured-vars
...
Approved by xiemaisi
2019-09-23 12:10:30 +01:00
semmle-qlci
e2c941c577
Merge pull request #1916 from erik-krogh/taintedLength
...
Approved by asger-semmle, xiemaisi
2019-09-23 11:47:48 +01:00
Max Schaefer
149ae5d7ab
JavaScript: Fix IllegalInvocation.
...
This fixes false positives that arise when a call such as `f.apply` can either be interpreted as a reflective invocation of `f`, or a normal call to method `apply` of `f`.
2019-09-23 07:44:14 +01:00
Asger F
69a88c4fcd
JS: Fix typo and add metadata to DomValueRefs
2019-09-20 15:43:08 +01:00
semmle-qlci
6d9d859119
Merge pull request #1934 from asger-semmle/node-js-classification
...
Approved by esben-semmle
2019-09-20 09:50:34 +01:00
semmle-qlci
6f2e485ace
Merge pull request #1950 from xiemaisi/js/rate-limiter-flexible
...
Approved by esben-semmle
2019-09-19 12:45:45 +01:00
Erik Krogh Kristensen
7671b6759b
import DataFlow::PathGraph from the ql file instead of the qll file
2019-09-19 11:59:45 +02:00
Erik Krogh Kristensen
bbf7e56e47
remove unused import in query
2019-09-19 11:49:20 +02:00
Max Schaefer
4e1e7bc127
JavaScript: Apply review suggestion.
...
Co-Authored-By: Esben Sparre Andreasen <42067045+esben-semmle@users.noreply.github.com >
2019-09-19 09:40:28 +01:00
Esben Sparre Andreasen
b631bfc8eb
Merge branch 'master' into node-js-classification
2019-09-19 09:42:26 +02:00
Asger F
71763af2d5
JS: Further restrict receiver type inference
2019-09-18 16:18:10 +01:00
Asger F
e724f92ee8
JS: Also summarize loads
2019-09-18 16:18:10 +01:00
Asger F
ffc69cb61e
JS: Summarize functions in type tracking
2019-09-18 16:17:59 +01:00
Asger F
76438f98ad
JS: Add DomValuesRefs metric
2019-09-18 16:17:21 +01:00
Asger F
0924de4c56
JS: Simplify call graph metric
2019-09-18 16:17:21 +01:00
semmle-qlci
57a6c0c20d
Merge pull request #1918 from esben-semmle/js/improve-getAResponseDataNode
...
Approved by asger-semmle
2019-09-18 14:03:45 +01:00
semmle-qlci
b4b7314757
Merge pull request #1941 from xiemaisi/js/fix-incorrect-suffix-check-performance
...
Approved by asger-semmle
2019-09-18 12:31:46 +01:00
Max Schaefer
3970ead7ab
JavaScript: Add support for rate-limiter-flexible package.
2019-09-18 12:25:33 +01:00
Esben Sparre Andreasen
ac6554b7da
Merge branch 'master' into js/improve-getAResponseDataNode
2019-09-17 13:18:41 +02:00
Max Schaefer
df739e0fca
JavaScript: Fix performance regression in IncorrectSuffixCheck.
2019-09-16 15:25:17 +01:00
Esben Sparre Andreasen
a5645e168a
JS: exclude keys from whitelist
2019-09-16 10:13:18 +02:00
Esben Sparre Andreasen
0e2d2f8662
JS: whitelist some hardcoded dummy-passwords in two queries
2019-09-16 10:11:43 +02:00
Asger F
3b7ecd5ccf
JS: Add NumModules metric
2019-09-13 15:48:31 +01:00
Erik Krogh Kristensen
3fb64abb09
fix consistency and spelling in the documentation
...
suggestions from the documentation team
Co-Authored-By: shati-patel <42641846+shati-patel@users.noreply.github.com >
2019-09-13 14:52:11 +01:00
Erik Krogh Kristensen
c4f27ed4cc
rename TaintedLength to LoopBoundInjection
2019-09-13 11:12:01 +01:00
Erik Krogh Kristensen
673e883c21
use superscript to denote the size of the tainted object
2019-09-13 11:00:11 +01:00
