Napalys Klicius
8fc81f4263
Merge branch 'main' into js/remote-property-injection-update
2025-09-03 14:02:19 +02:00
Asger F
0d0eaa21a1
Merge pull request #20302 from asgerf/js/simpler-locations
...
JS: Remove synthetic locations
2025-09-01 09:46:13 +02:00
Asger F
cc8fe10801
JS: Update locations in expected files
2025-08-29 12:03:11 +02:00
Napalys Klicius
bafe22c50c
Merge pull request #20048 from Napalys/js/xml_bomb_sinks
...
JS: Exclude patched libraries from `xml-bomb` sink
2025-08-29 08:10:55 +02:00
Napalys Klicius
32606584ea
JS: add enumeration taint flow to Remote Property Injection query
2025-08-27 10:23:03 +00:00
Napalys Klicius
c39c04cb86
JS: added new test case for remote prop injection via Object.keys
2025-08-27 10:20:57 +00:00
Napalys Klicius
10c10c7d30
JS: fixed typo in folder name
2025-08-27 10:17:39 +00:00
Napalys Klicius
b19d1e0f57
Merge pull request #20151 from Napalys/js/command-line-libs
...
JS: Enhance command injection detection for CLI argument parsing libraries
2025-08-18 09:32:29 +02:00
Napalys Klicius
ae4077db72
add taint flow for arg/command-line-args with custom argv option
2025-08-01 13:34:08 +02:00
Napalys Klicius
d6508f34b6
Add taint flow for Commander.js direct property access and action callbacks
2025-08-01 13:24:19 +02:00
Napalys Klicius
39170f327c
Added couple more test cases for commander js
2025-08-01 13:14:39 +02:00
Napalys Klicius
6b4e34dd39
Added a step from parse to opts for commander js
2025-08-01 13:12:43 +02:00
Napalys Klicius
e980798ede
Added step through yargs/yargs constructor and chained methods.
2025-08-01 12:01:30 +02:00
Napalys Klicius
e8eb9be3f6
Add command injection tests for CLI argument parsing libraries
2025-08-01 11:02:59 +02:00
Napalys Klicius
d28a6e6352
Added new test cases for regexp injection with enviromental variable threat model enabled
2025-07-31 13:20:37 +02:00
Napalys Klicius
8583257574
Created new folder for test with threat models disabled
2025-07-31 13:20:30 +02:00
Napalys Klicius
5f538209c9
Exlucde environmental variables from default detection in regexp injection
2025-07-31 12:09:30 +02:00
Napalys Klicius
1851deb929
Removed libxmljs from being marked as sink for xml-bomb.
2025-07-15 09:33:11 +02:00
Asger F
47a90c8b32
Merge branch 'main' into js/no-type-extraction
2025-07-02 13:18:05 +02:00
Napalys Klicius
3d9e2f5438
Merge pull request #19858 from Napalys/js/execa
...
JS: moved `execa` out of experimental
2025-06-25 10:34:52 +02:00
Asger F
d39b68cd41
Merge pull request #19849 from asgerf/js/remove-legacy-actions-queries
...
JS: Remove legacy actions queries
2025-06-25 09:18:33 +02:00
Asger F
853fc1a7cf
Merge pull request #19852 from asgerf/js/react-use-server
...
JS: Model React 'use' and 'use server'
2025-06-25 09:13:56 +02:00
Napalys Klicius
0902ca0605
JS: address copilot suggestions
2025-06-24 11:37:07 +02:00
Napalys Klicius
d05de1ba4e
JS: moved execa test cases outside experimental
2025-06-24 09:08:13 +02:00
Napalys Klicius
ef51ab172f
JS: exclude sinon module from regexp match calls
2025-06-23 20:25:17 +02:00
Napalys Klicius
584b4f51aa
JS: add false positive test cases for hostname regex detection
2025-06-23 20:25:10 +02:00
Asger F
61887beae0
JS: Add test case for false positive
2025-06-23 16:03:41 +02:00
Asger F
76b7228160
JS: Remove js/actions/command-injection
...
Superseded by actions/command-injection/{medium,critical}
2025-06-23 14:41:26 +02:00
Asger F
9dcb61e771
JS: Remove js/actions/actions-artifact-leak
...
Superseded by actions/secrets-in-artifacts
2025-06-23 14:39:28 +02:00
Asger F
fb92d9b034
JS: Update type usage in UnreachableMethodOverloads
...
This query depended on the cons-hashing performed by type extraction to determine if two types are the same.
This is not trivial to restore, but not important enough to reimplement right now, so for now just simplifying the query's ability to recognise that two types are the same.
2025-06-23 12:55:06 +02:00
Napalys Klicius
3fbe348f99
Merge pull request #19784 from Napalys/js/express_middleware
...
JS: Improve Express middleware taint tracking
2025-06-20 15:36:26 +02:00
Napalys Klicius
bca536c5b6
Merge remote-tracking branch 'origin/main' into js/quality/loop_shift
2025-06-20 11:30:20 +02:00
Napalys Klicius
f80651e78a
Merge pull request #19750 from Napalys/js/remove_encodeURI
...
JS: remove `encodeURI` from sanitizer list of request forgery
2025-06-19 14:12:52 +02:00
Napalys Klicius
53cae4fa97
Merge remote-tracking branch 'origin/main' into js/quality/loop_shift
2025-06-19 10:21:52 +02:00
Napalys Klicius
060b98d36c
JS: enchance middleware taint tracking via local source
2025-06-17 08:30:19 +02:00
Napalys Klicius
da21a064ac
JS: add _parsedUrl as remote input source
2025-06-16 16:28:30 +02:00
Napalys Klicius
67aac7abfa
JS: add test cases for middleware property assignment tracking
2025-06-16 16:26:08 +02:00
Napalys Klicius
bdbc49c63f
JS: Removed encodeURI from request forgery sanitizer list
2025-06-16 13:08:11 +02:00
Napalys Klicius
deb715a517
JS: Add test case with encodeURI for request forgery
2025-06-16 10:49:29 +02:00
Napalys Klicius
5a107ec33b
JS: track taint through serialize-javascript calls with object arguments
2025-06-16 10:38:20 +02:00
Napalys Klicius
a96ea182c7
JS: add test cases for serialize-javascript with tainted object properties
2025-06-16 09:30:52 +02:00
Napalys Klicius
0906d85b39
Merge pull request #19726 from Napalys/js/quality/string_interpolation
...
JS: Promote `js/template-syntax-in-string-literal` to the Code Quality suite.
2025-06-13 13:36:53 +02:00
Napalys Klicius
28ae39694f
Merge pull request #19741 from Napalys/js/quality/suspicious_method_names
...
JS: Promote `js/suspicious-method-name-declaration` to the Code Quality suite.
2025-06-12 15:30:13 +02:00
Napalys Klicius
66d66fe87d
JS: fix false positives for splice with conditional index decrement
2025-06-12 14:51:10 +02:00
Napalys Klicius
7292a76ee4
JS: add test cases for false positives in loop-iteration-skipped-due-to-shifting
2025-06-12 14:39:47 +02:00
Napalys Klicius
923aff2439
JS: Fixed false positive on manual string interpolation.
2025-06-12 11:35:33 +02:00
Napalys Klicius
bafe7e66ad
JS: Fix template literal detection in string concatination
2025-06-12 11:18:20 +02:00
Napalys Klicius
861e4ee11e
JS: Added test cases including manual interpolation and string concatination.
2025-06-12 11:15:36 +02:00
Napalys Klicius
41f4236b86
JS: expanded suspicious-method-name-declaration test suite
2025-06-12 09:29:30 +02:00
Asger F
423ffc78db
Merge pull request #19078 from asgerf/js/name-resolution
...
JS: QL-side type/name resolution for TypeScript and JSDoc
2025-06-11 14:17:11 +02:00
