Asger F
42f762a140
JS: Update test output now that 'satisfies' is a SourceNode
2025-06-09 16:22:30 +02:00
Chuan-kai Lin
631502e129
Merge branch 'main' into cklin/rc-3.18-mergeback
2025-06-09 07:19:40 -07:00
Mathew Payne
9d23677024
Merge branch 'main' into js-clientrests-axios
2025-06-09 14:18:54 +01:00
Taus
b8772bc736
JavaScript: Add change note
2025-06-05 15:06:40 +00:00
Taus
281ccf7c11
JavaScript: Extract tsconfig.json also in basic mode
...
This is needed for the logic that skips files inside the directory
specified in the `tsconfig.json` `outDir` compiler option.
2025-06-05 15:01:05 +00:00
Taus
619256e037
JavaScript: Fix existing tests and test runner
...
Fixes two things:
- The basic test should no longer extract `tst.js` (as `tst.ts` is
present)
- The `AutoBuild` mock did not populate `extractedFiles` correctly,
which broke the logic that looks for TypeScript files with the same
basename.
2025-06-05 14:59:40 +00:00
Taus
8829f7820a
JavaScript: Don't extract files with TypeScript progenitors
2025-06-05 14:57:00 +00:00
Taus
14f50880e9
JavaScript: Don't extract files in tsconfig.json outDir
2025-06-05 14:56:59 +00:00
GeekMasher
302097ec85
docs(js): Add AxiosInstanceRequest docs
2025-06-05 09:52:25 +01:00
Asger F
691fdb106e
JS: Nicer jump-to-def for function declarations
2025-06-04 22:17:42 +02:00
Asger F
57fad7e6c9
JS: Add SatisfiesExpr
2025-06-04 22:17:40 +02:00
Asger F
79101fd121
JS: Add test with type casts
2025-06-04 22:17:39 +02:00
Asger F
853ba49212
Update javascript/ql/lib/semmle/javascript/internal/TypeResolution.qll
...
Co-authored-by: Napalys Klicius <napalys@github.com >
2025-06-04 10:17:25 +02:00
GeekMasher
79a72fc15b
fix(js): Update tests
2025-06-03 16:37:36 +01:00
GeekMasher
3b64bd48ab
style(js): Update Formatting
2025-06-03 15:59:32 +01:00
GeekMasher
2eb5f10850
feat(js): Add Axios instance support change notes
2025-06-03 15:58:49 +01:00
GeekMasher
6a1cfb6aef
feat(js): Add Axios Instance support and add tests
2025-06-03 15:55:23 +01:00
Napalys Klicius
aac56e089a
JavaScript: Fix false positive on Flow type annotations in ExprHasNoEffect
2025-06-03 15:26:22 +02:00
Napalys Klicius
46b5ded862
JS: Enhance void context propagation
2025-06-03 15:20:55 +02:00
Napalys Klicius
bf48b59874
JS: Removed exclusion of FunctionExpr from compound statements.
2025-06-03 15:12:26 +02:00
Napalys Klicius
8521c53a40
Renamed test directory to match the query name
...
Co-Authored-By: Asger F <316427+asgerf@users.noreply.github.com >
2025-06-03 14:12:12 +02:00
Napalys Klicius
d1869941c2
Renamed UnhandledStreamPipe.ql to a better fitting name and ID
...
As a side effect of merge `security-and-quality` does not contain anymore related new query.
Co-Authored-By: Asger F <316427+asgerf@users.noreply.github.com >
2025-06-03 13:57:10 +02:00
Napalys Klicius
f6e7059589
Merge branch 'main' into js/quality/stream_pipe
2025-06-03 13:48:41 +02:00
Napalys Klicius
8ba1f3f265
Update javascript/ql/src/Quality/UnhandledStreamPipe.qhelp
...
Co-authored-by: Asger F <asgerf@github.com >
2025-06-03 13:43:45 +02:00
Asger F
9ea4410592
Merge pull request #19587 from asgerf/js/angular2-client-side
...
JS: Mark AngularJS $location as client-side remote flow source
2025-06-03 13:40:01 +02:00
Napalys Klicius
7993f7d8c8
Update qhelp example to more accurately demonstrate flagged cases
2025-06-02 19:08:33 +02:00
Napalys Klicius
bf2f19da56
Update UnhandledStreamPipe.ql
...
Address comments
Co-Authored-By: Asger F <316427+asgerf@users.noreply.github.com >
2025-06-02 19:02:48 +02:00
Napalys Klicius
ae74edb033
Update javascript/ql/src/Quality/UnhandledStreamPipe.ql
...
Co-authored-by: Asger F <asgerf@github.com >
2025-06-02 17:53:54 +02:00
Napalys Klicius
d43695c929
Update javascript/ql/src/Quality/UnhandledStreamPipe.qhelp
...
Co-authored-by: Asger F <asgerf@github.com >
2025-06-02 17:52:42 +02:00
Napalys Klicius
7198372ae5
Update javascript/ql/src/Quality/UnhandledStreamPipe.qhelp
...
Co-authored-by: Asger F <asgerf@github.com >
2025-06-02 17:52:41 +02:00
Napalys Klicius
abd446ae77
Update javascript/ql/src/Quality/UnhandledStreamPipe.ql
...
Co-authored-by: Asger F <asgerf@github.com >
2025-06-02 17:52:40 +02:00
Napalys Klicius
64f00fd0f2
Update javascript/ql/src/Quality/UnhandledStreamPipe.ql
...
Co-authored-by: Asger F <asgerf@github.com >
2025-06-02 17:52:34 +02:00
Napalys Klicius
3cbc4142f0
Update javascript/ql/src/Quality/UnhandledStreamPipe.ql
...
Co-authored-by: Asger F <asgerf@github.com >
2025-06-02 17:40:06 +02:00
Napalys Klicius
aed9e9c883
Merge pull request #19634 from Napalys/js/url_obj_propagation
...
JS: Add URL constructor taint tracking for request forgery
2025-06-02 17:32:44 +02:00
Napalys Klicius
1f256ab71e
Added change note
2025-06-02 14:59:43 +02:00
Napalys Klicius
bca1bc7153
JS: Enhance isDomProperty to check for getAPropertyRead on DOM nodes
2025-06-02 14:56:45 +02:00
Napalys Klicius
9b2ef8be10
JS: add test for DOM access where expression appears to have no side effects
2025-06-02 14:54:46 +02:00
Napalys Klicius
c981c4fe30
Update javascript/ql/lib/change-notes/2025-05-30-url-package-taint-step.md
...
Co-authored-by: Asger F <asgerf@github.com >
2025-06-02 13:34:47 +02:00
Napalys Klicius
298ef9ab12
Now able to track error handler registration via instance properties
2025-06-02 11:01:41 +02:00
Napalys Klicius
0b6a747737
Added change note
2025-05-30 18:33:59 +02:00
Napalys Klicius
b9b62fa1c1
JS: Add URL from url package constructor taint step for request forgery detection
2025-05-30 18:32:02 +02:00
Napalys Klicius
19cc3e335f
JS: Add test case for RequestForgery with url wrapped via package URL
2025-05-30 18:26:47 +02:00
Napalys Klicius
f843cc02f6
Fix false positives in stream pipe analysis by improving error handler tracking via property access.
2025-05-30 18:08:04 +02:00
Napalys Klicius
d3b2a57fbf
Fixed ql warning Expression can be replaced with a cast
2025-05-28 17:34:16 +02:00
Napalys Klicius
2e2b9a9d63
Make predicates private and clarify stream reference naming.
2025-05-28 17:23:55 +02:00
Napalys Klicius
f8f5d8f561
Exclude .pipe detection which are in a test file.
2025-05-28 17:18:39 +02:00
Napalys Klicius
5bb29b6e33
Now flags only .pipe calls which have an error somewhere down the stream, but not on the source stream.
2025-05-28 17:17:43 +02:00
github-actions[bot]
d2c6875eac
Post-release preparation for codeql-cli-2.21.4
2025-05-27 18:16:21 +00:00
github-actions[bot]
bfb91e95e3
Release preparation for version 2.21.4
2025-05-27 17:22:05 +00:00
Asger F
076e4a49d5
JS: Mark AngularJS $location as client-side remote flow source
2025-05-27 09:47:43 +02:00
