Asger F
|
9497199cbd
|
JS: add localFieldStep
|
2019-02-27 14:20:47 +00:00 |
|
Asger F
|
b6648def19
|
JS: Add ClassNode.getAReceiverNode
|
2019-02-27 14:20:47 +00:00 |
|
Asger F
|
3d400cc57f
|
JS: basic model of closure Promises
|
2019-02-27 11:58:51 +00:00 |
|
semmle-qlci
|
999e0c8b95
|
Merge pull request #947 from asger-semmle/string-ops-concat
Approved by xiemaisi
|
2019-02-27 09:54:46 +00:00 |
|
Max Schaefer
|
37a3085466
|
Merge pull request #993 from asger-semmle/getacallee
JS: document new behavior of overriding InvokeNode.getACallee()
|
2019-02-27 09:00:59 +00:00 |
|
Max Schaefer
|
0648d7aa09
|
JavaScript: Sharpen result type of getAReceivedItem.
|
2019-02-27 08:51:43 +00:00 |
|
Max Schaefer
|
cd9ccd4c8d
|
Merge pull request #983 from asger-semmle/closure-global-ref
JS: add closure library in globalObjectRef
|
2019-02-26 16:55:58 +00:00 |
|
Max Schaefer
|
db5fbe29a3
|
Merge pull request #941 from esben-semmle/js/vue-support-2
JS: Vue security improvements
|
2019-02-26 16:49:38 +00:00 |
|
Asger F
|
eaf3f52372
|
JS: document new behavior of overriding InvokeNode.getACallee()
|
2019-02-26 16:09:19 +00:00 |
|
Max Schaefer
|
739705865b
|
JavaScript: Add basic model of socket.io.
|
2019-02-26 15:53:29 +00:00 |
|
semmle-qlci
|
86e646beb4
|
Merge pull request #975 from asger-semmle/global-closure-dataflow
Approved by esben-semmle
|
2019-02-26 13:57:39 +00:00 |
|
Asger F
|
29d2d620e4
|
JS: add taint step through object/array spread operators
|
2019-02-26 11:43:59 +00:00 |
|
Esben Sparre Andreasen
|
f9111f68e9
|
Update javascript/ql/src/semmle/javascript/dataflow/TypeInference.qll
Co-Authored-By: asger-semmle <42069257+asger-semmle@users.noreply.github.com>
|
2019-02-26 11:11:44 +01:00 |
|
Asger F
|
6b9157540b
|
JS: mark globalFlowPred as internal
|
2019-02-26 09:56:22 +00:00 |
|
semmle-qlci
|
74a4103857
|
Merge pull request #976 from asger-semmle/closure-import-deep
Approved by esben-semmle
|
2019-02-26 09:34:04 +00:00 |
|
semmle-qlci
|
00d490e84d
|
Merge pull request #945 from asger-semmle/extensible-module-import
Approved by xiemaisi
|
2019-02-26 09:26:28 +00:00 |
|
Esben Sparre Andreasen
|
9511bdf6ae
|
JS: address review comment
|
2019-02-26 10:07:00 +01:00 |
|
Max Schaefer
|
c2a5350bf2
|
Merge pull request #982 from asger-semmle/closure-string-lib
JS: model string functions from closure library
|
2019-02-26 08:26:14 +00:00 |
|
Asger F
|
93440014a0
|
JS: only propagate through first argument of truncate()
|
2019-02-25 17:11:55 +00:00 |
|
Asger F
|
d45f670646
|
JS: remove duplicate modelling of urlDecode/urlEncode
|
2019-02-25 17:04:56 +00:00 |
|
Asger F
|
29de1411b7
|
JS: remove restriction on truncate calls
|
2019-02-25 17:00:47 +00:00 |
|
Asger F
|
50e8f83ad5
|
JS: use globalVarRef/SourceNode instead
|
2019-02-25 16:54:45 +00:00 |
|
Asger F
|
8354909d46
|
JS: add closure library in globalObjectRef
|
2019-02-25 16:45:47 +00:00 |
|
Asger F
|
d70d0e21cc
|
JS: add format function
|
2019-02-25 16:30:44 +00:00 |
|
Asger F
|
fab0afd755
|
JS: model string functions from closure library
|
2019-02-25 16:08:47 +00:00 |
|
Esben Sparre Andreasen
|
8e01ccd892
|
JS: fix docstring: s/node1/pred + s/node2/succ
|
2019-02-25 16:51:30 +01:00 |
|
semmle-qlci
|
58cc8d0ecc
|
Merge pull request #936 from xiemaisi/js/revive-electron-support
Approved by esben-semmle
|
2019-02-25 15:23:20 +00:00 |
|
Esben Sparre Andreasen
|
ab1b1c1431
|
JS: update docstring
|
2019-02-25 16:11:35 +01:00 |
|
Esben Sparre Andreasen
|
4dc147d506
|
JS: rename CapturedSource -> LocalObject (files)
|
2019-02-25 16:09:07 +01:00 |
|
Esben Sparre Andreasen
|
66367987af
|
JS: rename CapturedSource -> LocalObject
|
2019-02-25 16:04:37 +01:00 |
|
Esben Sparre Andreasen
|
0d94fe3f54
|
JS: analyze assignments in with correctly
|
2019-02-25 15:32:17 +01:00 |
|
Esben Sparre Andreasen
|
047b69a4c2
|
JS: address review comments
|
2019-02-25 15:19:00 +01:00 |
|
Asger F
|
7d14429dce
|
JS: handle deeper access paths in Closure::moduleImport
|
2019-02-25 12:31:18 +00:00 |
|
semmle-qlci
|
c31ccbc114
|
Merge pull request #925 from asger-semmle/closure-reorg
Approved by xiemaisi
|
2019-02-25 12:02:00 +00:00 |
|
Esben Sparre Andreasen
|
b0358d7d11
|
JS: autoformat
|
2019-02-25 12:44:55 +01:00 |
|
Asger F
|
707886f259
|
JS: minor qldoc fixes
|
2019-02-25 11:31:09 +00:00 |
|
Asger F
|
eab034ccfd
|
JS: add ModuleImportNode::Range
|
2019-02-25 11:31:08 +00:00 |
|
Asger F
|
e9bc728919
|
JS: fixes in qldoc
|
2019-02-25 11:26:12 +00:00 |
|
Esben Sparre Andreasen
|
97edfc5524
|
JS: address review comments
|
2019-02-25 12:17:56 +01:00 |
|
Esben Sparre Andreasen
|
80a716f3b3
|
JS: fixup visibility of DataFlow::HtmlAttributeNode
|
2019-02-25 12:17:56 +01:00 |
|
Esben Sparre Andreasen
|
4ce7ec1661
|
JS: add XSS vector for Vue's v-html
|
2019-02-25 12:17:56 +01:00 |
|
Esben Sparre Andreasen
|
4c5e48fbbc
|
JS: introduce DataFlow::HtmlAttributeNode
|
2019-02-25 12:17:56 +01:00 |
|
Esben Sparre Andreasen
|
da1ffcfd1b
|
JS: introduce Vue Template Element
|
2019-02-25 12:17:33 +01:00 |
|
Esben Sparre Andreasen
|
9f4f945975
|
JS: introduce Vue::InstanceHeapStep
|
2019-02-25 12:17:33 +01:00 |
|
Asger F
|
86153be64b
|
JS: fix qldoc
|
2019-02-25 09:51:31 +00:00 |
|
semmle-qlci
|
014d4b9ed0
|
Merge pull request #934 from asger-semmle/module-import
Approved by xiemaisi
|
2019-02-25 09:46:52 +00:00 |
|
Max Schaefer
|
d4dbe3bfb6
|
JavaScript: Back out parsing of qualified XML identifiers.
Their syntax conflicts with the proposed function-bind operator, which is more important to support.
|
2019-02-24 21:30:59 +00:00 |
|
Max Schaefer
|
be67d5129a
|
JavaScript: Add QL library support for E4X.
|
2019-02-24 20:45:41 +00:00 |
|
Max Schaefer
|
f3ea810c21
|
JavaScript: Add parser support for E4X.
|
2019-02-24 20:45:41 +00:00 |
|
Max Schaefer
|
c6fc4e4764
|
JavaScript: Address review comments.
|
2019-02-23 21:43:13 +00:00 |
|