hohn/codeql
1
0
Fork 0
mirror of https://github.com/github/codeql.git synced 2025-12-17 09:13:20 +01:00
Code Issues Packages Projects Releases Wiki Activity
18,252 Commits 1,671 Branches 157 Tags
revert-4653-feature/csharp9-relational-pattern
Commit Graph

1210 Commits

Author SHA1 Message Date
CodeQL CI
395403789e Merge pull request #4585 from erik-krogh/moreReDoS 
Approved by asgerf
 2020-11-24 18:52:36 +00:00
CodeQL CI
4be158b362 Merge pull request #4708 from erik-krogh/emptyName 
Approved by asgerf
 2020-11-24 17:34:55 +00:00
Erik Krogh Kristensen
33dab1717e treat nodes with type "Location" as a location source - but not if we can track it from an original node with type "Location" 2020-11-23 17:03:50 +01:00
Erik Krogh Kristensen
f7f9beeefd avoid reporting empty names in js/exposure-of-private-files 2020-11-23 14:24:42 +01:00
Erik Krogh Kristensen
02d5fbf46b remove superfluous space 2020-11-23 14:22:16 +01:00
Asger Feldthaus
f737f34dcd JS: Add UntrustedDataToExternalApi query 2020-11-19 13:42:25 +00:00
Erik Krogh Kristensen
c4153a617e remove duplicated test cases from ReDoS, and adjust variables names to match test output 2020-11-18 14:49:09 +01:00
Erik Krogh Kristensen
8270bf5bb9 make the character search skip unencodable characters 2020-11-18 11:55:49 +01:00
Erik Krogh Kristensen
55f2f86a26 limit the search of state-pairs to the ones that are reachable within the given length 2020-11-18 09:23:35 +01:00
Erik Krogh Kristensen
c4d7533701 Merge branch 'main' into moreReDoS 2020-11-17 17:34:49 +01:00
Erik Krogh Kristensen
97acf1fd87 fix FP related to inverted character classes choosing a char that was not matched by the char class 2020-11-17 17:34:43 +01:00
CodeQL CI
09cfb24afa Merge pull request #4648 from erik-krogh/regexpParse 
Approved by asgerf
 2020-11-16 08:20:40 +00:00
Erik Krogh Kristensen
7f68b07665 Merge branch 'main' into regexpParse 2020-11-13 09:33:16 +01:00
Erik Krogh Kristensen
49be7e959f Merge branch 'main' into jwt 2020-11-12 21:36:09 +01:00
Erik Krogh Kristensen
99d03bab24 only flag the secret key in JWT 2020-11-12 21:36:05 +01:00
Erik Krogh Kristensen
e01d4b104e update expected output 2020-11-10 23:42:38 +01:00
Erik Krogh Kristensen
5ecae55e77 add keys used by jsonwebtoken as CredentialsExpr 2020-11-10 10:41:39 +01:00
Erik Krogh Kristensen
e75259d3a6 model the verify function in jsonwebtoken 2020-11-10 10:41:39 +01:00
Erik Krogh Kristensen
6732493377 add model for jwt-decode 2020-11-10 10:41:36 +01:00
Erik Krogh Kristensen
3ef5d89e39 update expected output 2020-11-08 23:27:38 +01:00
Erik Krogh Kristensen
17a687b344 testing many possible intersections, instead of a single intersection 2020-11-08 23:24:36 +01:00
Erik Krogh Kristensen
34fd0d89f5 finding the minimum that is not an FP - instead of finding the minimum and then checking if it was an FP. And detecting more FPs by finding when a witness pass through the accept state 2020-11-08 23:24:27 +01:00
Erik Krogh Kristensen
ac514b1739 remove false positives where the analysis would wrongly conclude that the accept state could not be reached 2020-11-08 23:24:03 +01:00
Erik Krogh Kristensen
a5e75f53ff add support for escape char classes inside char classes 2020-11-08 23:22:49 +01:00
Erik Krogh Kristensen
0063cb140c add support for \W, \S, \D 2020-11-08 23:16:56 +01:00
Erik Krogh Kristensen
2dd8b6ffef support \f and \v in the \s class 2020-11-08 23:16:56 +01:00
Erik Krogh Kristensen
68fe03060d support \d \s and \w in ReDoS.ql 2020-11-08 23:16:56 +01:00
Erik Krogh Kristensen
fa54ad1a5e refactor character class implementation in ReDoS.ql - preparing support for RegExpCharacterClassEscape 2020-11-08 23:16:55 +01:00
Erik Krogh Kristensen
a09ffd5cda expand getAOverlapBetweenCharacterClasses to support overlap between more char classes 2020-11-08 23:16:37 +01:00
Erik Krogh Kristensen
82252c0f1c detect redos between charclass and inverted charclass 2020-11-08 23:16:34 +01:00
Erik Krogh Kristensen
16473fc2a4 matching a inverted char class with a char 2020-11-06 10:18:57 +01:00
Erik Krogh Kristensen
804aaf36f0 support inverted char class and dot 2020-11-06 10:18:57 +01:00
Erik Krogh Kristensen
64d680e2d3 support that an inverted char class can intersect with itself 2020-11-06 10:18:57 +01:00
Erik Krogh Kristensen
321cf09bd8 add redos support for the simplest possible inverted char class 2020-11-06 10:18:57 +01:00
Asger Feldthaus
24714c41be JS: Update test output after rebase 2020-11-06 09:14:03 +00:00
Asger Feldthaus
7bf21d80b2 JS: Shift line numbers in test file 2020-11-06 09:13:52 +00:00
Asger Feldthaus
9418c6c8fe JS: Add support for dateformat package 2020-11-06 09:13:52 +00:00
Asger Feldthaus
790526b529 JS: Some fixes and address review comments 2020-11-06 09:06:20 +00:00
Asger Feldthaus
8a3fba05e9 JS: Add steps through date-formatting functions 2020-11-06 09:06:18 +00:00
CodeQL CI
a908e5938e Merge pull request #4574 from erik-krogh/jsdom 
Approved by asgerf
 2020-11-05 22:13:39 +00:00
Erik Krogh Kristensen
e124ba66b4 moving jsdom sink to js/xss 2020-11-05 16:10:33 +01:00
CodeQL CI
c85f817cee Merge pull request #4579 from erik-krogh/redos 
Approved by asgerf
 2020-11-05 08:38:44 +00:00
Erik Krogh Kristensen
e16fa0668a update expected output 2020-11-04 18:24:31 +01:00
Erik Krogh Kristensen
b02004430c prune results that end with newline, where the input cannot contain newlines 2020-11-03 14:48:39 +01:00
Erik Krogh Kristensen
120faf9d1a add a code injection sink for JSDOM when "runScripts" is set to "dangerously" 2020-11-03 14:29:00 +01:00
Erik Krogh Kristensen
e6e4a485c8 add JSDOM.fromUrl() as a request forgery sink 2020-11-02 17:05:56 +01:00
CodeQL CI
4a59e69722 Merge pull request #4564 from asgerf/js/react-hooks 
Approved by esbena
 2020-10-30 21:00:31 +00:00
Erik Krogh Kristensen
ebc4856456 detect more expensive regexps in js/polynomial-redos 2020-10-30 09:52:13 +01:00
CodeQL CI
7856e784e1 Merge pull request #4566 from asgerf/js/classnames 
Approved by erik-krogh
 2020-10-29 11:00:06 +00:00
Asger Feldthaus
469767d279 JS: Fix test output 2020-10-28 17:00:05 +00:00