Asger F
d3e70c1e97
JS: Add in-barrier to XSS query
...
This is a bit of a bandaid to cover issues with the push() method on next/router being
treated as an array push, which causes it to flow into other taint sources.
2024-10-29 08:32:08 +01:00
Asger F
12e316b99d
JS: Update test output after merging in 'main'
...
- Paths are now relative to the test case, not the qlpack
- Paths going through an implicit reads have changed slightly
2024-10-08 10:11:15 +02:00
Asger F
e2e91ac7d9
Merge branch 'main' into js/shared-dataflow-merge-main
2024-10-08 09:28:26 +02:00
Asger F
6cbe04dcb7
JS: Consistently use the shared XSS barrier guards in the XSS queries
...
Previously only reflected XSS used shared barrier guards.
2024-10-02 14:44:17 +02:00
Sid Gawri
e8c68fff7f
resolve id conflict with dom based xss test ql
2024-09-25 10:01:59 -04:00
Asger F
1df69ec1d2
JS: Actually don't propagate into array element 0
...
Preserving tainted-url-suffix into array element 0 seemed like a good idea, but didn't work out so well.
2024-09-12 13:42:36 +02:00
Asger F
cf90c83604
JS: Accept changes to nodes/edges results
2024-09-12 13:42:19 +02:00
Asger F
7790f68fe2
JS: Make the TaintedUrlSuffix library use optional steps/barriers
2024-09-12 13:35:36 +02:00
Asger F
0ddb1c87f5
JS: Test update indicating a problem with .split()
2024-09-10 13:14:37 +02:00
Asger F
4568967a76
JS: Do not use legacy taint steps in TaintedUrlSuffix
...
Tainted URL suffix steps are added as configuration-specific additional
steps, which means implicit reads may occur before any of these steps.
These steps accidentally included the legacy taint steps which include
a step from 'arguments' to all positional parameters. Combined with the
implicit read, arguments could escape their array index and flow to
any parameter while in the tainted-url flow state.
2024-08-29 13:48:30 +02:00
Asger F
65a36b0b3b
JS: Add regression test for argument position confusion
2024-08-29 13:42:28 +02:00
Asger F
837a8be1b8
JS: Update test output and add related TODO in 'markdown-table' model
2024-08-27 11:35:34 +02:00
Asger F
2e2181be2c
JS: Update test output that only affects nodes/edges/subpaths
2024-08-27 11:35:33 +02:00
Asger F
a2dd47aeb2
JS: Update test output
...
These files conflicted and have been regenerated.
2024-08-22 14:27:15 +02:00
Asger F
c54f5858b1
Merge branch 'main' into js/shared-dataflow-merge-main
2024-08-22 13:22:05 +02:00
Asger F
9ee7599aeb
JS: Move AngularJSTemplateUrlSink to ClientSideUrlRedirection query
...
This is not perfect but at least we can be consistent about keeping URLs-that-lead-to-xss in the same query
2024-08-16 14:37:13 +02:00
Asger F
2d814428d6
JS: Update expected output with provenance
2024-08-06 12:45:08 +02:00
Asger F
c3806a2210
JS: Messy test output updates
...
These initially got messed up by a merge conflict where I couldn't rerun the tests due to breaking
changes in the data flow library. I wanted the breaking-change updates to live in their own commits,
not just eaten by a merge resolution commit, so the test output became broken for a while.
The '#select' result set is unchanged in all of these, so they should be safe to accept.
2024-06-27 11:59:56 +02:00
Asger F
53efb5837b
JS: Update some tests with provenance columns
...
Only includes the changes that purely contain the new provenance columns
2024-06-26 13:51:44 +02:00
Asger F
c408ab9e6a
Merge branch 'main' into js/shared-dataflow
2024-05-02 19:43:34 +02:00
Asger F
5e7d1d5c2c
Merge branch 'main' into js/shared-dataflow-merged
2024-03-13 14:27:16 +01:00
erik-krogh
129286aa1c
allow more flow through .filter()
2024-03-13 12:03:00 +01:00
erik-krogh
a9f2b3fad6
promote PropsTaintStep to a PreCallGraphStep
2024-01-04 10:45:22 +01:00
Asger F
bab639f23c
JS: Update ReflectedXssWithCustomSanitizer test
2023-10-13 13:15:08 +02:00
Asger F
d08e4504ff
JS: Port UnsafeJQueryPlugin
2023-10-13 13:15:06 +02:00
Asger F
6e3f4bd7d8
JS: Port UnsafeHtmlConstruction
2023-10-13 13:15:06 +02:00
Asger F
d7b4e0c206
JS: Port ExceptionXss
2023-10-13 13:15:03 +02:00
Asger F
cf5450dbd5
JS: Port XssThroughDom
2023-10-13 13:15:03 +02:00
Asger F
5f05232e02
JS: Port StoredXss
2023-10-13 13:15:03 +02:00
Asger F
46b90e51fc
JS: Port ReflectedXss
2023-10-13 13:15:03 +02:00
Asger F
e091fdefa4
JS: Port DomBasedXss
2023-10-13 13:15:03 +02:00
Kasper Svendsen
67950c8e6b
JS: Make implicit this receivers explicit
2023-05-03 15:31:00 +02:00
tyage
933b55d37d
Track interfile useRouter
2023-04-28 15:49:26 +09:00
Asger F
04079752f7
JS: update test output after adding 'this' sanitizer
2023-04-17 12:15:46 +02:00
Asger F
f87f6c8556
JS: Add test to unsafe jquery plugin
2023-04-17 12:15:05 +02:00
Asger F
b0d4b31103
JS: Trim whitespace in test
2023-04-17 08:23:04 +02:00
Asger F
c7f16cd224
JS: Add test
2023-04-17 08:23:03 +02:00
erik-krogh
b1957623c1
add browser history as XSS sink
2023-04-12 13:38:18 +02:00
tyage
320cb99dbf
Add replace method test
2023-04-08 18:31:48 +09:00
tyage
668e1accaa
Remove unnecessary whiteline
2023-04-08 18:24:31 +09:00
tyage
7f9b8557ac
Add Next.js router push as XSS sink
2023-04-08 18:18:34 +09:00
Asger F
43174cfe3a
Merge pull request #12668 from asgerf/js/jquery-callback-sinks
...
JS: fix handling of jQuery sinks involving callback
2023-03-30 12:42:53 +02:00
Asger F
92a681213d
JS: Step through jQuery callback return values
2023-03-27 11:17:27 +02:00
Asger F
bc2a772f3b
JS: Add test case showing false negative
2023-03-27 11:08:39 +02:00
erik-krogh
2bba9057a0
better callgraph support for global variables
2023-03-22 13:49:33 +01:00
Asger F
856b50735d
JS: Expand test case
2023-03-07 13:04:26 +01:00
erik-krogh
a6c9af4182
add the html argument to the jQuery functions as an XSS sink
2023-03-03 11:09:53 +01:00
erik-krogh
94870b838f
add failing test
2023-03-03 11:08:33 +01:00
erik-krogh
0e60fc5512
Merge branch 'main' into alias-html
2023-02-27 09:16:25 +01:00
erik-krogh
51ddb55d7b
use tainted-object to precisely model that plain object are fine, but their properties are not
2023-02-15 15:02:03 +01:00
