4806 Commits

Author	SHA1	Message	Date
semmle-qlci	92a6e7e04c	Merge pull request #932 from asger-semmle/cookbook-prepare ... Approved by xiemaisi	2019-02-13 18:20:09 +00:00
Asger F	dfe3f254de	JS: generalize to include default imports	2019-02-13 18:03:57 +00:00
Max Schaefer	5b2df068d3	Merge pull request #921 from asger-semmle/class-node-absval ... JS: use type inference to back up function-style classes	2019-02-13 10:12:20 +00:00
semmle-qlci	c422ade739	Merge pull request #927 from xiemaisi/js/ambiguous-id-attr-templates ... Approved by esben-semmle	2019-02-13 08:35:41 +00:00
Asger F	be10f24de7	JS: make moduleImport() work for named imports	2019-02-12 17:22:06 +00:00
Max Schaefer	2fce626c3a	JavaScript: Add Range.prototype.createContextualFragment as an XSS sink.	2019-02-12 16:32:30 +00:00
Max Schaefer	25f95d9fb1	JavaScript: Be more conservative about templates in AmbiguousIdAttribute. ... Previously, we only excluded attributes where the value of the attribute itself suggests templating happening. Now we exclude all attributes in documents where _any_ attribute value suggests templating.	2019-02-12 16:31:01 +00:00
Anders Schack-Mulligen	15a6044445	Javascript: Autoformat qlls	2019-02-12 14:41:31 +01:00
Asger F	3290c174c3	JS: Add DataFlow::Node.getAFunctionValue	2019-02-12 13:38:46 +00:00
Asger F	2fd1ee60a2	JS: add DataFlow::Node.getIntValue()	2019-02-12 13:38:46 +00:00
Anders Schack-Mulligen	1182fca665	Javascript: Autoformat qls	2019-02-12 14:38:42 +01:00
semmle-qlci	c133362660	Merge pull request #910 from xiemaisi/js/regexp-taint ... Approved by esben-semmle	2019-02-12 13:15:16 +00:00
Asger F	0444fa307d	TS: update test expectations	2019-02-12 12:33:09 +00:00
semmle-qlci	ac3f413b87	Merge pull request #920 from xiemaisi/js/field-as-prop-write ... Approved by asger-semmle	2019-02-12 10:48:13 +00:00
semmle-qlci	10b00254ec	Merge pull request #915 from asger-semmle/closure-uri-methods ... Approved by xiemaisi	2019-02-11 10:51:07 +00:00
Max Schaefer	10ef945b51	JavaScript: Restrict InstanceFieldAsPropWrite to fields with initializers.	2019-02-11 08:17:53 +00:00
semmle-qlci	986afa1b1b	Merge pull request #909 from xiemaisi/js/improve-incomplete-sanitization-alerts ... Approved by esben-semmle	2019-02-08 17:39:36 +00:00
Asger F	74a9c4b500	JS: use type inference to back up function-style classes	2019-02-08 16:42:24 +00:00
Asger F	f6e0ccfcf0	JS: model URI and XHR methods from closure library	2019-02-08 15:18:27 +00:00
Asger F	fd2e9f1fcb	JS: shift line numbers in RequestForgery test	2019-02-08 15:13:33 +00:00
semmle-qlci	937049e060	Merge pull request #891 from xiemaisi/js/simplify-sensitive-actions ... Approved by esben-semmle	2019-02-08 14:12:47 +00:00
semmle-qlci	7e298cfbbe	Merge pull request #900 from esben-semmle/js/defuse-default ... Approved by xiemaisi	2019-02-08 11:28:32 +00:00
semmle-qlci	a48594ad8e	Merge pull request #906 from asger-semmle/q-library ... Approved by xiemaisi	2019-02-08 11:12:50 +00:00
Asger F	bfe88e9784	JS: make Closure::moduleImport handle member access.	2019-02-08 10:51:07 +00:00
Max Schaefer	b314c546e1	JavaScript: Track taint through RegExp.prototype.replace.	2019-02-08 09:57:07 +00:00
Max Schaefer	25d06ad0cf	JavaScript: Treat regexp replacements of HTML metacharacters as sanitizers for XSS queries.	2019-02-08 09:57:06 +00:00
Max Schaefer	18c23ecfd4	JavaScript: Introduce shared library for modelling XSS-relevant concepts. ... As its first application, this library makes it possible for `StoredXss` to reuse the `Source` classes of `DomBasedXss` and `ReflectedXss` without having to pull in their libraries (which contain their `Configuration` classes, causing `StoredXss` to recompute all flow information for the other two queries).	2019-02-08 09:53:51 +00:00
Max Schaefer	3e26bc6446	JavaScript: Improve alert location and message for IncompleteSanitization. ... We now highlight the `replace` call (instead of the regular expression), and the alert message for the case of missing backslash escapes clarifies that it is talking about failure to escape backslashes in the input, not in the replacement text.	2019-02-08 09:13:40 +00:00
Max Schaefer	aebc5bc6c3	JavaScript: Update qhelp example for CleartextStorage.	2019-02-08 08:43:22 +00:00
Max Schaefer	6389f32847	JavaScript: Update expected output for ExtractSinkSummaries query.	2019-02-08 08:43:22 +00:00
Asger F	c2321045f2	TS: fix import of q.d.ts in test case	2019-02-07 12:37:54 +00:00
Asger F	e4b230ba60	Revert "Merge pull request #897 from Semmle/revert-817-closure-modules" ... This reverts commit 95185345fd, reversing changes made to b8be66ec48.	2019-02-07 11:58:38 +00:00
Esben Sparre Andreasen	5ad83360be	JS: move default parameter values to the DefUse graph	2019-02-07 11:41:36 +01:00
Esben Sparre Andreasen	65530c5edf	JS: add test for js/useless-comparison-test	2019-02-07 11:41:36 +01:00
Esben Sparre Andreasen	55fd948c24	JS: add test for js/trivial-conditional	2019-02-07 11:41:36 +01:00
Esben Sparre Andreasen	f956e570cb	JS: support default destructuring values in the dataflow graph	2019-02-07 11:41:36 +01:00
Esben Sparre Andreasen	687b7f0a7f	JS: exclude direct flow from the RHS in a destructuring assignment	2019-02-07 11:41:36 +01:00
Esben Sparre Andreasen	f333419bb4	JS: add defuse+dataflow tests for destructuring and default values	2019-02-07 11:24:46 +01:00
semmle-qlci	b4b37b3a7b	Merge pull request #880 from esben-semmle/js/better-alert-message-1 ... Approved by xiemaisi	2019-02-07 08:01:21 +00:00
Max Schaefer	812cba0fe3	Merge pull request #828 from esben-semmle/js/vue-support-1 ... JS: basic Vue support	2019-02-07 08:00:17 +00:00
Asger F	e46e2b2515	Revert "JS: Add support for Closure modules"	2019-02-06 17:30:45 +00:00
semmle-qlci	b8be66ec48	Merge pull request #887 from asger-semmle/jsdoc-accessors ... Approved by xiemaisi	2019-02-06 16:30:48 +00:00
semmle-qlci	b13c11017c	Merge pull request #885 from asger-semmle/async-waterfall ... Approved by xiemaisi	2019-02-06 16:30:17 +00:00
Esben Sparre Andreasen	235625d03a	Merge branch 'master' into js/vue-support-1	2019-02-06 16:57:16 +01:00
semmle-qlci	09825f28ed	Merge pull request #817 from asger-semmle/closure-modules ... Approved by esben-semmle, xiemaisi	2019-02-06 15:51:53 +00:00
semmle-qlci	a2691b32b5	Merge pull request #851 from xiemaisi/js/post-message-star ... Approved by esben-semmle	2019-02-06 09:57:04 +00:00
Asger F	abb7e63697	JS: update GlobalVariableRef.expected	2019-02-06 09:16:30 +00:00
Esben Sparre Andreasen	5e2b1c026a	JS: introduce HTML::ScriptElement::getScript()	2019-02-06 09:38:00 +01:00
Esben Sparre Andreasen	a78dd422b6	JS: add query js/vue/arrow-method-on-vue-instance	2019-02-06 09:38:00 +01:00
Esben Sparre Andreasen	ea175b2a9f	JS: introduce Vue XSS sinks	2019-02-06 09:38:00 +01:00