Erik Krogh Kristensen
|
bace2994c3
|
add test for type-tracking req.params
|
2020-07-01 11:38:54 +02:00 |
|
semmle-qlci
|
15a0297ca2
|
Merge pull request #3834 from asger-semmle/js/vue-classification
Approved by erik-krogh
|
2020-06-30 13:14:25 +01:00 |
|
Esben Sparre Andreasen
|
c7f67fafd9
|
JS: support additional promisification of the fs-module members
|
2020-06-30 09:10:30 +02:00 |
|
Asger Feldthaus
|
cb12d894a6
|
JS: Add test
|
2020-06-29 15:54:06 +01:00 |
|
semmle-qlci
|
b3e68ef81c
|
Merge pull request #3806 from erik-krogh/moreDownloads
Approved by asgerf
|
2020-06-29 13:53:10 +01:00 |
|
Asger Feldthaus
|
03c91a66c5
|
JS: Update expected output
|
2020-06-29 07:52:25 +01:00 |
|
Asger Feldthaus
|
9ca25d5bef
|
JS: Support .hash extraction via a few more methods
|
2020-06-28 01:38:59 +01:00 |
|
Asger Feldthaus
|
19db418395
|
JS: Add missing store step in Xss query
|
2020-06-28 01:26:11 +01:00 |
|
Erik Krogh Kristensen
|
926f2c139f
|
require that a write must dominate the enclosing stmt of a read
|
2020-06-25 23:00:52 +02:00 |
|
Erik Krogh Kristensen
|
cc2e61531e
|
update expected output
|
2020-06-25 23:00:52 +02:00 |
|
Erik Krogh Kristensen
|
e467d3ccbf
|
use dominating write check in js/path-injection
|
2020-06-25 23:00:52 +02:00 |
|
Erik Krogh Kristensen
|
6bc821b1ab
|
add tests for dominating writes
|
2020-06-25 23:00:52 +02:00 |
|
Erik Krogh Kristensen
|
2b2d691e45
|
don't treated a property from a tainted object as tainted when there exists a dominating write
|
2020-06-25 23:00:52 +02:00 |
|
semmle-qlci
|
056e1a8c4b
|
Merge pull request #3599 from asger-semmle/js/nameditem
Approved by esbena
|
2020-06-25 17:34:14 +01:00 |
|
Erik Krogh Kristensen
|
09d969a8ad
|
recognize sensitive files by file-system writes
|
2020-06-25 15:19:42 +02:00 |
|
Erik Krogh Kristensen
|
8f5a3e9f4f
|
add support for getASavePath() to js/insecure-download
|
2020-06-25 15:18:31 +02:00 |
|
Erik Krogh Kristensen
|
dafca8fd81
|
introduce flow-labels to js/insecure-download
|
2020-06-25 15:17:57 +02:00 |
|
Asger Feldthaus
|
f9b796231b
|
JS: Add regression tests
|
2020-06-25 11:10:27 +01:00 |
|
Asger Feldthaus
|
ea3560fe07
|
JS: Ignore document.all checks explicitly
|
2020-06-25 11:03:06 +01:00 |
|
Asger Feldthaus
|
b867512db4
|
JS: Update test
|
2020-06-25 11:01:10 +01:00 |
|
Erik Krogh Kristensen
|
3f8881a334
|
don't report insecure randomness when the insecure random is just a fallback
|
2020-06-23 15:53:19 +02:00 |
|
semmle-qlci
|
0d61443915
|
Merge pull request #3753 from asger-semmle/js/xss-dom-exception-rephrasing
Approved by erik-krogh
|
2020-06-23 13:01:41 +01:00 |
|
Asger Feldthaus
|
b4f75ef414
|
Merge branch 'master' into js-team-sprint-merge2
|
2020-06-23 00:18:09 +01:00 |
|
Esben Sparre Andreasen
|
9a0bbb31f4
|
Revert "Merge pull request #3702 from esbena/js/memory-exhaustion"
This reverts commit eca5e2df8a, reversing
changes made to 1548eca994.
|
2020-06-22 14:46:51 +02:00 |
|
Esben Sparre Andreasen
|
0a8d15ccc4
|
Revert "Merge pull request #3672 from esbena/js/server-crashing-route-handler"
This reverts commit 243e3ad9e3, reversing
changes made to df79f2adc5.
|
2020-06-22 14:45:35 +02:00 |
|
Asger Feldthaus
|
1edb2a1892
|
JS: Rephrase XSS queries that use exception/dom text as source
|
2020-06-22 10:44:46 +01:00 |
|
Asger F
|
eca5e2df8a
|
Merge pull request #3702 from esbena/js/memory-exhaustion
JS: add query js/memory-exhaustion
|
2020-06-19 20:35:57 +01:00 |
|
Erik Krogh Kristensen
|
0f5ef2c02a
|
Merge branch 'js-team-sprint' into https-fix
|
2020-06-19 14:57:44 +02:00 |
|
Erik Krogh Kristensen
|
0ee3f4977c
|
add test of webpack-dev-server and monorepo import
|
2020-06-19 14:15:46 +02:00 |
|
Erik Krogh Kristensen
|
a17d152ca4
|
Merge branch 'js-team-sprint' into priv-file-polish
|
2020-06-19 13:19:10 +02:00 |
|
Erik Krogh Kristensen
|
7d6dac479c
|
Merge branch 'js-team-sprint' into https-fix
|
2020-06-18 16:53:01 +02:00 |
|
Erik Krogh Kristensen
|
dcf617b235
|
Merge branch 'js-team-sprint' into bad-random-polish
|
2020-06-18 16:52:32 +02:00 |
|
Erik Krogh Kristensen
|
1556b62007
|
Merge branch 'js-team-sprint' into priv-file-polish
|
2020-06-18 16:40:53 +02:00 |
|
Esben Sparre Andreasen
|
3f67e90374
|
JS: rename query, support timeouts, add documentation, add to suite
|
2020-06-18 13:01:02 +02:00 |
|
Esben Sparre Andreasen
|
d9d8eb4805
|
JS: avoid type inference in the taint steps (just a nice to have)
|
2020-06-18 13:00:45 +02:00 |
|
Esben Sparre Andreasen
|
7b97fd07a8
|
JS: add query js/memory-exhaustion
|
2020-06-18 13:00:45 +02:00 |
|
Erik Krogh Kristensen
|
7a1c161e9e
|
Merge branch 'js-team-sprint' into https-fix
|
2020-06-17 21:04:44 +02:00 |
|
Erik Krogh Kristensen
|
218338b4f1
|
Merge branch 'js-team-sprint' into bad-random-polish
|
2020-06-17 21:04:00 +02:00 |
|
Erik Krogh Kristensen
|
73f26956a6
|
Merge branch 'js-team-sprint' into priv-file-polish
|
2020-06-17 21:03:09 +02:00 |
|
Erik Krogh Kristensen
|
bdda587247
|
Merge branch 'js-team-sprint' into build-leaks
|
2020-06-17 19:51:30 +02:00 |
|
Erik Krogh Kristensen
|
fa0a8c3423
|
add documentation examples as tests
|
2020-06-17 11:37:32 +02:00 |
|
Erik Krogh Kristensen
|
639907967f
|
add home/rootdir as leaking folders
|
2020-06-17 10:46:42 +02:00 |
|
Erik Krogh Kristensen
|
6675ddae12
|
add more libraries that serve static files to js/exposure-of-private-files
|
2020-06-17 10:00:59 +02:00 |
|
Erik Krogh Kristensen
|
210e71cd93
|
update expected output
|
2020-06-16 21:52:59 +02:00 |
|
Erik Krogh Kristensen
|
5ce17bea60
|
add qhelp for js/bad-code-sanitization
|
2020-06-16 16:23:41 +02:00 |
|
Erik Krogh Kristensen
|
a0951f76b6
|
add additional taint steps when type-tracking RemoteFlowSource
|
2020-06-16 14:55:07 +02:00 |
|
Erik Krogh Kristensen
|
696879653a
|
add qhelp to js/biased-cryptographic-random
|
2020-06-16 11:10:09 +02:00 |
|
Asger Feldthaus
|
3242f5ed94
|
JS: Include qhelp example in test suite
|
2020-06-15 17:37:26 +01:00 |
|
Asger Feldthaus
|
7091a9f704
|
JS: Special-case alert message for type annotations
|
2020-06-15 17:17:47 +01:00 |
|
Asger Feldthaus
|
c8ab69af11
|
JS: Avoid duplicate alerts
|
2020-06-15 16:57:54 +01:00 |
|