4 Commits

Author	SHA1	Message	Date
Asger F	64d39da5f8	JS: Accept Sources/Sink tags	2025-02-28 13:29:30 +01:00
Asger F	9be041e27d	JS: Update OK-style comments to $-style	2025-02-28 13:27:28 +01:00
Asger F	4568967a76	JS: Do not use legacy taint steps in TaintedUrlSuffix ... Tainted URL suffix steps are added as configuration-specific additional steps, which means implicit reads may occur before any of these steps. These steps accidentally included the legacy taint steps which include a step from 'arguments' to all positional parameters. Combined with the implicit read, arguments could escape their array index and flow to any parameter while in the tainted-url flow state.	2024-08-29 13:48:30 +02:00
Asger F	65a36b0b3b	JS: Add regression test for argument position confusion	2024-08-29 13:42:28 +02:00