hohn/codeql
1
0
Fork 0
mirror of https://github.com/github/codeql.git synced 2025-12-18 01:33:15 +01:00
Code Issues Packages Projects Releases Wiki Activity
79,003 Commits 1,671 Branches 157 Tags
ginsbach/NewOverlayLocalJavaRebase
Commit Graph

2117 Commits

Author SHA1 Message Date
Asger F
169ae19015 Merge pull request #19391 from asgerf/js/typescript-path-resolution 
JS: Overhaul import resolution
 2025-05-13 15:46:38 +02:00
Asger F
aea676df3c Merge pull request #19445 from asgerf/js/summaries-with-fallback 
JS: Generate flow summaries from summaryModels; only generate steps as a fallback
 2025-05-13 14:49:38 +02:00
Napalys Klicius
d1e769ba54 Merge pull request #19422 from Napalys/js/shelljs 
JS: Modeling of `ShellJS` functions
 2025-05-02 14:18:44 +02:00
Napalys Klicius
871e93d9fe Update javascript/ql/lib/semmle/javascript/frameworks/ShellJS.qll 
Co-authored-by: Asger F <asgerf@github.com>
 2025-05-02 13:39:46 +02:00
Asger F
1f308ee47a JS: Explain use of monotonicAggregates 2025-05-02 13:22:27 +02:00
Asger F
5c9218fe5a JS: Add comment about 'path' heuristic 2025-05-02 13:22:25 +02:00
Asger F
f3e0cfd947 Apply suggestions from code review 
Co-authored-by: Erik Krogh Kristensen <erik-krogh@github.com>
 2025-05-02 12:41:29 +02:00
Asger F
a44bdf3be2 JS: Generate summaries from summaryModel, and only generate steps as a fallback 2025-05-01 15:22:47 +02:00
Asger F
ca5f8b0c1d JS: Move some code into ModelsAsData.qll 2025-05-01 15:17:07 +02:00
Napalys Klicius
68a9dd9f9e Address comments 2025-05-01 11:19:41 +02:00
Napalys Klicius
d4b5ef6a66 Refactor process.env handling in CleartextLogging and IndirectCommandInjection modules to use ThreatModelSource 2025-05-01 11:14:15 +02:00
Napalys Klicius
71f1b82a56 Added support for fastify.all 2025-04-30 14:54:09 +02:00
Asger F
8ebbfb198e Merge pull request #19412 from asgerf/js/promise-all 
JS: Better type-tracking through Promise.all()
 2025-04-30 14:19:12 +02:00
Napalys Klicius
18cea2d6a5 Added support for shelljs.cmd and async-shelljs.asyncExec 2025-04-30 13:37:02 +02:00
Napalys Klicius
25d04f1cdd Added support for shelljs.which 2025-04-30 13:35:17 +02:00
Napalys Klicius
6de38b1827 Merge pull request #19300 from Napalys/js/fastify 
JS: Added support for `fastify.addHook`
 2025-04-29 18:32:25 +02:00
Asger F
5de2c938d8 JS: Rename getTargetFile to getImportedFile and remove its deprecated name clash 
'getTargetFile' was originally named to avoid the clash with 'getImportedFile' from a subclass. But we now just merge the two predicates.
 2025-04-29 16:06:36 +02:00
Asger F
eae1e1cb02 JS: Make API graphs rely on type-tracking steps in general 2025-04-29 15:08:19 +02:00
Asger F
e40b93b8a3 JS: Add type-tracking step through simple Promise.all() calls 2025-04-29 15:08:18 +02:00
Asger F
ed2a832a55 JS: Deprecate PathExpr and related classes 2025-04-29 13:23:47 +02:00
Asger F
fe055ad603 JS: Use PackageJsonEx instead of resolveMainModule 2025-04-29 13:23:45 +02:00
Asger F
c293f03b9e JS: Remove a dependency on getImportedPath() 
To avoid negative recursion in some upcoming changes, we want to make sure the modeling of createRequire does not depend on getImportedPath().
 2025-04-29 13:23:43 +02:00
Asger F
a195d074c9 JS: Resolve Angular2 templateUrl with ResolveExpr instead of PathExpr 2025-04-29 13:23:42 +02:00
Asger F
d724874969 JS: Implement babel-plugin-root-import as a PathMapping 2025-04-29 13:23:40 +02:00
Asger F
6725cb5b8c JS: Implement import resolution 2025-04-29 13:23:37 +02:00
Asger F
ed4864edf7 JS: Add two more helpers to FilePath class 2025-04-29 13:07:21 +02:00
Asger F
f542956f66 JS: Add internal extension of PackageJson class 2025-04-29 13:07:19 +02:00
Asger F
bb91df8145 JS: Add helper for doing path resolution with JS rules 2025-04-29 13:07:18 +02:00
Asger F
59e1cbcc7b JS: Add tsconfig class 2025-04-29 13:07:16 +02:00
Asger F
ef32a036b1 JS: Extract from methods from PathString into a non-abstract base class 
The new class 'FilePath' has bindingset[this] so one just has to cast a string to that type and you can use its methods.
 2025-04-29 13:07:15 +02:00
Asger F
17aa5220a6 JS: Add some helpers 2025-04-29 13:07:14 +02:00
Asger F
ec9d15bb79 JS: Make shared Folder module visible 2025-04-29 09:42:25 +02:00
Napalys Klicius
8b53f8f2a6 Fix, prevent addHook return values from being treated as XSS sinks 2025-04-28 14:22:51 +02:00
Napalys
fdfdcc0d93 Undo unnecessary name tracking for request, response objects 2025-04-22 14:16:45 +02:00
Asger F
00661b62dc JS: Add isMiddlewareSetup() hook to Routing model 2025-04-22 12:00:02 +02:00
Asger F
c2cab184ac Merge pull request #19283 from asgerf/js/rest-pattern-fix 
JS: Fix missing flow into rest pattern lvalue
 2025-04-22 10:37:36 +02:00
Napalys
5c3556da66 Add user-controlled property tracking and update code injection alerts in Fastify hooks 2025-04-15 09:41:52 +02:00
Napalys
9b194ea613 Added addHook to RouteSetup thus now it is recognized now as rouute handler 2025-04-15 09:37:13 +02:00
Napalys Klicius
86313715a4 Merge pull request #19184 from Napalys/js/request_handlers 
JS: Support for `Request` and `NextRequest`
 2025-04-14 08:07:24 +02:00
Napalys Klicius
3d7c0201d9 Merge pull request #19231 from Napalys/js/typed_array 
JS: Taint propagation from low-level `ArrayBuffer` to `Strings`
 2025-04-11 11:29:01 +02:00
Napalys
11abbf8c4a Now nextUrl is of type parameter and loosen the restriction for NextAppRouteHandler 2025-04-11 11:19:12 +02:00
Napalys Klicius
92e4f112c0 Update javascript/ql/lib/semmle/javascript/frameworks/Next.qll 
Co-authored-by: Asger F <asgerf@github.com>
 2025-04-11 11:08:40 +02:00
Napalys Klicius
d0dcf897cb Update javascript/ql/lib/semmle/javascript/internal/flow_summaries/Strings.qll 
Co-authored-by: Asger F <asgerf@github.com>
 2025-04-11 11:04:08 +02:00
Napalys Klicius
d17d29a387 Merge pull request #19218 from Napalys/js/upgrade_websocket 
JS: Refactor `WebSocket` to use `API` graphs
 2025-04-11 10:05:54 +02:00
Napalys
e3f1720f9c RenamedDecodeLike to Decode and updated propagatesFlow 2025-04-11 10:04:09 +02:00
Napalys
678eccb417 Added searchParams.get as potential source for SSRF 2025-04-11 09:42:07 +02:00
Napalys
6e09a65da0 Added support for NextRequest middleware SSRF. 2025-04-11 08:43:36 +02:00
Asger F
719456e27d JS: Fix missing flow into rest pattern lvalue 2025-04-11 08:37:09 +02:00
Napalys
86b64afa13 Added NextResponse to the ResponseCall class it models similar near idential behaviour. 2025-04-10 15:06:44 +02:00
Napalys
63a3953b0c Enhance Next.js API endpoint handling for compatibility with both Pages and App Router structures. 2025-04-10 14:48:17 +02:00