Erik Krogh Kristensen
3640bbd466
add test for IncompleteHtmlAttributeSanitization
2021-03-16 13:25:27 +01:00
Erik Krogh Kristensen
ca435763b0
separate message for double and single quotes
2021-02-01 23:54:12 +01:00
Erik Krogh Kristensen
3f1e81533c
support html attribute concatenations with single quotes
2021-01-29 10:37:37 +01:00
Esben Sparre Andreasen
847687974f
JS: only select non-nullable terms in the broken sanitizer
2021-01-12 08:50:19 +01:00
Esben Sparre Andreasen
40cfbab335
JS: address review feedback
2021-01-12 08:49:08 +01:00
Esben Sparre Andreasen
580a24e982
JS: rewrite js/incomplete-multi-character-sanitization
2021-01-11 11:26:45 +01:00
Esben Sparre Andreasen
2d2468463b
JS: initial version of IncompleteMultiCharacterSanitization.ql
2020-06-09 08:59:59 +02:00
Esben Sparre Andreasen
344f0c36b0
JS: update expected output
2020-05-06 11:18:14 +02:00
Esben Sparre Andreasen
304b013f88
JS: query and tests for unsafe HTML expansion
2020-05-05 10:32:16 +02:00
Esben Sparre Andreasen
89613dbd23
JS: add query for incomplete HTML attribute sanitization
2020-04-24 09:17:46 +02:00
Max Schaefer
0edb70f373
JavaScript: Deal with escape-unescape-escape (and similar) chains.
2019-11-22 09:24:34 +00:00
Max Schaefer
cb54618a5d
JavaScript: Deal with (un-)escaping on captured variables.
2019-11-22 09:24:34 +00:00
Max Schaefer
61aa075e8d
JavaScript: Fix regexes for escaping schemes.
2019-11-22 09:24:34 +00:00
Max Schaefer
4f899a9b0d
JavaScript: Recognize string escaping using .replace with a callback.
2019-11-22 09:24:34 +00:00
Max Schaefer
5565be14fc
JavaScript: Teach IncompleteSanitization to flag incomplete path sanitizers.
2019-11-19 15:06:16 +00:00
Max Schaefer
155cea7b5b
Revert "JavaScript: Improve double-escaping query"
2019-11-12 22:54:12 +00:00
Max Schaefer
bb0771b36c
JavaScript: Deal with escape-unescape-escape (and similar) chains.
2019-10-30 14:49:01 +00:00
Max Schaefer
8c133ff61d
JavaScript: Deal with (un-)escaping on captured variables.
2019-10-30 14:46:50 +00:00
Max Schaefer
a8214ce7ee
JavaScript: Fix regexes for escaping schemes.
2019-10-30 14:15:59 +00:00
Max Schaefer
5349e0f881
JavaScript: Recognise wrapped chains of replacements.
2019-10-30 13:14:38 +00:00
Max Schaefer
02d16b1dc9
JavaScript: Recognise wrapped string replacement functions.
2019-10-30 13:01:17 +00:00
Max Schaefer
aaeca32519
JavaScript: Recognize string escaping using .replace with a callback.
2019-10-30 12:45:32 +00:00
Max Schaefer
bd1c99d8a4
JavaScript: Recognise JSON.stringify and JSON.parse as escaper/unescaper.
2019-10-30 12:38:05 +00:00
Esben Sparre Andreasen
a9665f53b8
JS: whitelist quote stripping for js/incomplete-sanitization
2019-09-05 09:47:49 +01:00
Esben Sparre Andreasen
ac0913c878
JS: add newline removal whitelist for js/incomplete-sanitization
2019-04-23 08:38:23 +02:00
Esben Sparre Andreasen
bdbd00e046
JS: add newline removal tests for js/incomplete-sanitization
2019-04-23 08:37:39 +02:00
Esben Sparre Andreasen
c80ee3df01
Mergeback: rc/1.20 into Semmle/master
2019-04-16 08:46:15 +02:00
Esben Sparre Andreasen
fd429ce639
JS: whitelist delimiter unwrapping for js/incomplete-sanitization
2019-04-12 08:38:44 +02:00
Esben Sparre Andreasen
a0ed362310
JS: add test case for js/incomplete-sanitization
2019-04-12 08:37:47 +02:00
Esben Sparre Andreasen
364ba1b4ac
JS: use RegExpLiteral as a SourceNode
2019-04-01 09:19:25 +02:00
Esben Sparre Andreasen
7923c9d77c
JS: add tests for missing flow of regular expressions
2019-04-01 09:19:25 +02:00
Max Schaefer
3e26bc6446
JavaScript: Improve alert location and message for IncompleteSanitization.
...
We now highlight the `replace` call (instead of the regular expression), and the alert message for the case of missing backslash escapes clarifies that it is talking about failure to escape backslashes in the input, not in the replacement text.
2019-02-08 09:13:40 +00:00
Esben Sparre Andreasen
a1d92bfa50
JS: generalize js/incomplete-sanitization to handle ConstantString
2018-12-11 13:39:15 +01:00
Max Schaefer
10166be535
JavaScript: Add new query DoubleEscaping.
2018-11-30 09:39:00 +00:00
Max Schaefer
41da997651
JavaScript: Teach IncompleteSanitization to recognize incomplete URL {en,de}coding.
2018-08-09 12:44:16 +01:00
Pavel Avgustinov
b55526aa58
QL code and tests for C#/C++/JavaScript.
2018-08-02 17:53:23 +01:00
