Napalys
de5c7efd63
Added test case for unescape.
2025-03-13 13:47:42 +01:00
Asger F
dad4838d3b
Update javascript/ql/test/query-tests/Security/CWE-079/DomBasedXss/tst.js
...
Co-authored-by: Napalys Klicius <napalys@github.com >
2025-03-10 14:18:42 +01:00
Asger F
64d39da5f8
JS: Accept Sources/Sink tags
2025-02-28 13:29:30 +01:00
Asger F
10a7294327
JS: Accept trivial test changes
...
This adds Alert annotations for alerts that seem intentional by the test
but has not been annotated with 'NOT OK', or the comment was in the wrong
place.
In a few cases I included 'Source' expectations to make it easier to see
what happened. Other 'Source' expectations will be added in bulk a later
commit.
2025-02-28 13:27:43 +01:00
Asger F
9be041e27d
JS: Update OK-style comments to $-style
2025-02-28 13:27:28 +01:00
Asger F
3acd4814de
Merge branch 'main' into js/shared-dataflow-merge-main
2024-12-19 10:14:38 +01:00
Napalys
c71778f1aa
JS: xss does not flag anymore replace with RegExp unknown flags
2024-11-28 11:26:53 +01:00
Napalys
dbae553146
JS: add xss test cases with unknownflags for replace using RegExp
2024-11-28 11:26:52 +01:00
Asger F
1df69ec1d2
JS: Actually don't propagate into array element 0
...
Preserving tainted-url-suffix into array element 0 seemed like a good idea, but didn't work out so well.
2024-09-12 13:42:36 +02:00
Asger F
7790f68fe2
JS: Make the TaintedUrlSuffix library use optional steps/barriers
2024-09-12 13:35:36 +02:00
Asger F
0ddb1c87f5
JS: Test update indicating a problem with .split()
2024-09-10 13:14:37 +02:00
Asger F
b0d4b31103
JS: Trim whitespace in test
2023-04-17 08:23:04 +02:00
Asger F
c7f16cd224
JS: Add test
2023-04-17 08:23:03 +02:00
erik-krogh
b1957623c1
add browser history as XSS sink
2023-04-12 13:38:18 +02:00
Erik Krogh Kristensen
0e4954a68c
add navigation.navigate as an XSS / URL sink
2022-06-29 14:56:20 +02:00
Erik Krogh Kristensen
f083e87fa1
refactor the js/xss query to use three flowlabels and one configuration
2022-03-16 22:32:08 +01:00
Erik Krogh Kristensen
87842bb8b7
add client-side-url sinks that may execute JavaScript as XSS sinks
2022-03-16 22:32:08 +01:00
Erik Krogh Kristensen
fc79242674
add tests
2022-03-16 22:32:08 +01:00
Asger Feldthaus
00f4694616
JS: Recognize methods returning DOM objects
2021-08-04 16:25:56 +02:00
Erik Krogh Kristensen
ae2fc7171b
add a taint step through the ansi-to-html library
2021-07-15 14:04:16 +02:00
Esben Sparre Andreasen
85b9003af4
JS: add Mootools XSS sinks
2021-07-01 09:17:27 +02:00
Erik Krogh Kristensen
1dcfc3840d
add test
2021-03-12 16:25:33 +01:00
Asger Feldthaus
4137d3f971
JS: Split CWE-079 tests into their own folders
2020-10-16 17:32:36 +01:00
