hohn/codeql
1
0
Fork 0
mirror of https://github.com/github/codeql.git synced 2025-12-17 09:13:20 +01:00
Code Issues Packages Projects Releases Wiki Activity
82,275 Commits 1,671 Branches 157 Tags
tausbn/python-refine-location-of-flask-request-sources
Commit Graph

11732 Commits

Author SHA1 Message Date
Napalys
c175081698 Added test cases for fastify.addHook 2025-04-15 09:33:41 +02:00
Napalys
f1a3293f4c Added change note 2025-04-15 09:27:51 +02:00
github-actions[bot]
b961c5961d Release preparation for version 2.21.1 2025-04-14 09:53:06 +00:00
Napalys Klicius
86313715a4 Merge pull request #19184 from Napalys/js/request_handlers 
JS: Support for `Request` and `NextRequest`
 2025-04-14 08:07:24 +02:00
Asger F
6c01709048 JS: Update more test output 2025-04-11 15:15:22 +02:00
Napalys Klicius
3d7c0201d9 Merge pull request #19231 from Napalys/js/typed_array 
JS: Taint propagation from low-level `ArrayBuffer` to `Strings`
 2025-04-11 11:29:01 +02:00
Napalys
11abbf8c4a Now nextUrl is of type parameter and loosen the restriction for NextAppRouteHandler 2025-04-11 11:19:12 +02:00
Napalys Klicius
92e4f112c0 Update javascript/ql/lib/semmle/javascript/frameworks/Next.qll 
Co-authored-by: Asger F <asgerf@github.com>
 2025-04-11 11:08:40 +02:00
Napalys Klicius
d0dcf897cb Update javascript/ql/lib/semmle/javascript/internal/flow_summaries/Strings.qll 
Co-authored-by: Asger F <asgerf@github.com>
 2025-04-11 11:04:08 +02:00
Napalys Klicius
d17d29a387 Merge pull request #19218 from Napalys/js/upgrade_websocket 
JS: Refactor `WebSocket` to use `API` graphs
 2025-04-11 10:05:54 +02:00
Napalys
e3f1720f9c RenamedDecodeLike to Decode and updated propagatesFlow 2025-04-11 10:04:09 +02:00
Napalys
2c4b3527b4 Added change note 2025-04-11 09:42:12 +02:00
Napalys
678eccb417 Added searchParams.get as potential source for SSRF 2025-04-11 09:42:07 +02:00
Napalys
8674b61e5a Added SSRF test case with searchParams for NextRequest 2025-04-11 09:26:16 +02:00
Napalys
6e09a65da0 Added support for NextRequest middleware SSRF. 2025-04-11 08:43:36 +02:00
Napalys
734ad2d767 Removed legacy Consistency check as it is redundant now with inline test expectations. 2025-04-11 08:43:08 +02:00
Napalys
208487f236 Added middleware test 2025-04-11 08:39:47 +02:00
Asger F
719456e27d JS: Fix missing flow into rest pattern lvalue 2025-04-11 08:37:09 +02:00
Asger F
7703b1fab5 JS: Add test for missing getALocalSource flow for rest pattern 2025-04-11 08:37:07 +02:00
Napalys Klicius
43bf0beae9 Merge pull request #19263 from Napalys/js/make-dir-lib 
JS: Add support for `make-dir` package
 2025-04-10 15:09:43 +02:00
Napalys
86b64afa13 Added NextResponse to the ResponseCall class it models similar near idential behaviour. 2025-04-10 15:06:44 +02:00
Napalys
8acb0243ad Added test cases for NextResponse and Response 2025-04-10 14:57:40 +02:00
Napalys
63a3953b0c Enhance Next.js API endpoint handling for compatibility with both Pages and App Router structures. 2025-04-10 14:48:17 +02:00
Napalys
81cba7fa2f Added test cases with missing alerts for Request and NextRequest. 2025-04-10 14:43:48 +02:00
Asger F
eac14b9837 Merge pull request #19200 from asgerf/js/web-response 
JS: Add sinks for calls to 'new Response()'
 2025-04-10 14:41:32 +02:00
Napalys
171a84609e Applied copilot suggestion. 2025-04-10 14:13:48 +02:00
Asger F
3da1f261f7 JS: Change note 2025-04-10 07:21:48 +02:00
Asger F
cfa1a9b603 JS: Update extractor version string 2025-04-10 07:20:53 +02:00
Asger F
1434f7acd2 JS: Tolerate trailing comma in JSON array 
Previously we'd fail to extract some tsconfig.json files because of this.
 2025-04-10 07:20:51 +02:00
Asger F
800dd168c2 JS: Add failing TRAP test for trailing comma 2025-04-10 07:20:49 +02:00
Napalys
5243f90c90 Brought back old methods and marked them as deprecated 2025-04-09 14:56:24 +02:00
Napalys
5ec71ab9af Added change note 2025-04-09 14:42:34 +02:00
Napalys
ce2fc25cdb Added make-dir model as data 2025-04-09 14:42:29 +02:00
Napalys
674f40b35f Added test cases for make-dir package. 2025-04-09 14:41:12 +02:00
Napalys Klicius
2dca95af92 Update javascript/ql/lib/change-notes/2025-04-07-websocket.md 
Co-authored-by: Asger F <asgerf@github.com>
 2025-04-09 14:26:00 +02:00
Napalys
0c52b5ad95 Added summary flow for StringFromCharCode 2025-04-09 14:24:43 +02:00
Napalys Klicius
f02783a9c6 Merge pull request #19210 from Napalys/js/mkdirp 
JS: Modeling of `mkdirp` functions
 2025-04-09 13:43:37 +02:00
Napalys
a3e4e62eac Removed taint from ArrayBuffer constructor as it accepts length 2025-04-09 13:27:13 +02:00
Napalys
4bc3e9e736 Addressed comments 
Co-authored-by: Asgerf <asgerf@github.com>
 2025-04-09 12:31:45 +02:00
Asger F
da7d6d3346 JS: Change note 2025-04-09 11:28:21 +02:00
Napalys
4a4d78bbde Added change note 2025-04-08 08:12:42 +02:00
Napalys
b8802a29f4 Added open package model as data. 2025-04-08 08:12:30 +02:00
Napalys
df89739085 Added test cases for open package. 2025-04-08 08:10:10 +02:00
Napalys
873db7c121 Added change note 2025-04-07 18:15:24 +02:00
Napalys
b97c61864e Add flow summaries and entry points for TextDecoder 2025-04-07 18:15:19 +02:00
Napalys
f28478e876 Add test cases from TypedArrays to strings. 2025-04-07 18:13:52 +02:00
Napalys
f4277204b7 Add flow summaries and entry points for ArrayBuffer and SharedArrayBuffer 2025-04-07 18:12:35 +02:00
Napalys
0e099474c5 Added test cases for ArrayBuffer and SharedArrayBuffer 2025-04-07 18:07:54 +02:00
Napalys
ff07ec8d8c Add flow summaries for TypedArray methods set and subarray 2025-04-07 18:06:40 +02:00
Napalys
d689a55229 Added test cases for TypedArray methods 2025-04-07 15:15:29 +02:00