Erik Krogh Kristensen
62746bbbac
skip analyzing regular expressions in minified files for ReDoS
2021-01-21 22:31:42 +01:00
CodeQL CI
d0b70d15f0
Merge pull request #4996 from esbena/js/nodejs-client-request-event-emitter
...
Approved by erik-krogh
2021-01-21 12:37:00 -08:00
Esben Sparre Andreasen
cb25f2ab20
JS: add docstring with source examples
2021-01-21 20:46:34 +01:00
CodeQL CI
b83c949109
Merge pull request #4986 from erik-krogh/logInf
...
Approved by esbena
2021-01-21 06:02:50 -08:00
Asger Feldthaus
c29014f122
JS: Autoformat
2021-01-21 13:55:21 +00:00
Esben Sparre Andreasen
1c100bbbc2
JS: recognize event emitters in nodejs client requests
2021-01-21 14:14:00 +01:00
Asger Feldthaus
2f58683f2d
JS: Remove PipeCallExpr
2021-01-21 12:12:17 +00:00
Asger Feldthaus
1d1149f4cd
JS: Test and QLDoc for RxJS model
2021-01-21 12:08:22 +00:00
Asger Feldthaus
144d04f3ce
JS: Add test exposing source location of attribute after line break
2021-01-21 11:25:39 +00:00
Asger Feldthaus
7c6704a63f
JS: Shift line numbers in test case
2021-01-21 11:09:36 +00:00
Asger F
34280f90b0
Update QLDoc for getATemplateArgument
...
Co-authored-by: Erik Krogh Kristensen <erik-krogh@github.com >
2021-01-21 10:51:46 +00:00
Erik Krogh Kristensen
a9a901d1e2
add change note
2021-01-21 11:08:39 +01:00
Erik Krogh Kristensen
dafec3ceaa
rename to AnalyzedCompoundNumericAssignExpr
2021-01-21 11:06:46 +01:00
CodeQL CI
30015ee995
Merge pull request #4942 from esbena/js/reintroduce-resource-exhaustion
...
Approved by erik-krogh
2021-01-21 01:21:33 -08:00
Esben Sparre Andreasen
b90dd89746
JS: move js/resource-exhaustion to experimental
2021-01-21 09:09:01 +01:00
Esben Sparre Andreasen
5a6e692807
add js/server-crash to the security suite
2021-01-21 08:43:13 +01:00
Esben Sparre Andreasen
9e3cc3b1b2
JS: add qhelp and changenotes for js/server-crash
2021-01-21 08:43:13 +01:00
Erik Krogh Kristensen
a44aefa6c9
add test for top-level closure modules - and simplify
2021-01-20 19:47:32 +01:00
Erik Krogh Kristensen
bf518f1c90
flag less overly general functions with js/unneeded-defensive-code
2021-01-20 15:48:12 +01:00
Erik Krogh Kristensen
2e024c3c61
fix that type inference assumed every compound-assignment have type number
2021-01-20 15:26:39 +01:00
Erik Krogh Kristensen
fbfbe70deb
add support for unnamed/default exports in PackageExports.qll
2021-01-19 22:40:45 +01:00
CodeQL CI
bdfb81064d
Merge pull request #4969 from asgerf/js/angular-dom-santizier-from-core
...
Approved by erik-krogh
2021-01-19 08:45:15 -08:00
Erik Krogh Kristensen
2a8a2832e2
Merge pull request #4946 from erik-krogh/libRedos
...
JS: Add library input as source for `js/polynomial-redos`
2021-01-19 17:30:20 +01:00
Esben Sparre Andreasen
3015dcd310
JS: reformulate js/server-crash. Support promises and shorter paths.
2021-01-19 09:08:52 +01:00
Erik Krogh Kristensen
01900d7ca2
remove false positive due to "\n" not being in the relevant relation
2021-01-18 14:47:29 +01:00
Asger Feldthaus
deca7f3cd6
JS: Add change note
2021-01-18 13:46:43 +00:00
CodeQL CI
fc2fe6cccb
Merge pull request #4928 from esbena/js/rewrite-multi-sanitization
...
Approved by asgerf
2021-01-18 05:11:42 -08:00
Asger Feldthaus
fbb5d14263
JS: Update angular test output
2021-01-18 12:19:09 +00:00
Asger Feldthaus
bb6bd9168e
JS: Update HTML TRAP tests output
2021-01-18 12:19:09 +00:00
Asger Feldthaus
2a7b4487f1
JS: More auto format
2021-01-18 12:19:09 +00:00
Asger Feldthaus
d8c9dba990
JS: Autoformat
2021-01-18 12:19:09 +00:00
Asger Feldthaus
5f4016be76
JS: Cache Import.getImportedModule
2021-01-18 12:19:09 +00:00
Asger Feldthaus
c5f2c04f16
JS: Add upgrade script
2021-01-18 12:19:09 +00:00
Asger Feldthaus
1b4a4ea2fa
JS: Bump extractor version string
2021-01-18 12:19:09 +00:00
Asger Feldthaus
44c5d36e83
JS: Simple RxJS model
2021-01-18 12:19:09 +00:00
Asger Feldthaus
00cd0644f0
JS: Implement getAResponseDataNode
2021-01-18 12:19:09 +00:00
Asger Feldthaus
2f3cef177b
JS: More steps in Angular2 model
2021-01-18 12:19:09 +00:00
Asger Feldthaus
c8901b62f5
JS: Add test for $any step
2021-01-18 12:19:08 +00:00
Asger Feldthaus
2ba98da107
JS: Only extract local vars in TemplateTopLevel
...
Angular template expressions cannot refer to global variables, any
unqualified identifier is a reference to a property provided by the
component.
We extract them as implicitly declared local variables which the
QL model can then connect with data flow steps.
2021-01-18 12:19:08 +00:00
Asger Feldthaus
faad466aa8
JS: Add ScopeKind enum
2021-01-18 12:19:08 +00:00
Asger Feldthaus
07cfceee19
JS: TRAP test for angular templates
2021-01-18 12:19:08 +00:00
Asger Feldthaus
3c0867125b
JS: Remove FP in TargetBlank
2021-01-18 12:19:08 +00:00
Asger Feldthaus
97f7cb4dc1
JS: Track location information using SourceMaps
2021-01-18 12:19:08 +00:00
Asger Feldthaus
898d22d2f4
JS: Simplify HTML element access
2021-01-18 12:19:08 +00:00
Asger Feldthaus
f24af58a60
JS: Extract mapping from HTML node to parent Expression
2021-01-18 12:19:08 +00:00
Asger Feldthaus
3b666a5646
JS: Extract mapping from TopLevel to parent HTML node
2021-01-18 12:19:08 +00:00
Asger Feldthaus
8848ee2d10
JS: Extract HTML from inline templates
2021-01-18 12:19:08 +00:00
Asger Feldthaus
6bf9345258
JS: Add test for class with locally-unused field
2021-01-18 12:19:08 +00:00
Asger Feldthaus
cc952bd2a4
JS: Reorganize test a bit
2021-01-18 12:19:08 +00:00
Asger Feldthaus
1ab36dc81f
JS: Flow through *ngFor loops
2021-01-18 12:19:08 +00:00
