Erik Krogh Kristensen
|
3157cd724d
|
add noSQL tests for type-tracking req.query
|
2020-07-01 11:45:09 +02:00 |
|
Erik Krogh Kristensen
|
bace2994c3
|
add test for type-tracking req.params
|
2020-07-01 11:38:54 +02:00 |
|
semmle-qlci
|
224289c55f
|
Merge pull request #3845 from max-schaefer/js/walk-sync
Approved by asgerf
|
2020-06-30 14:45:41 +01:00 |
|
semmle-qlci
|
42bca1a3fa
|
Merge pull request #3824 from asger-semmle/js/static-regexp-capture-group-step
Approved by erik-krogh, esbena
|
2020-06-30 13:20:14 +01:00 |
|
semmle-qlci
|
c850938af0
|
Merge pull request #3833 from asger-semmle/js/vue-class-component
Approved by erik-krogh
|
2020-06-30 13:16:42 +01:00 |
|
semmle-qlci
|
15a0297ca2
|
Merge pull request #3834 from asger-semmle/js/vue-classification
Approved by erik-krogh
|
2020-06-30 13:14:25 +01:00 |
|
Max Schaefer
|
62d56a3d7c
|
JavaScript: Fix module name for walk-sync package.
|
2020-06-30 11:57:16 +01:00 |
|
Esben Sparre Andreasen
|
c7f67fafd9
|
JS: support additional promisification of the fs-module members
|
2020-06-30 09:10:30 +02:00 |
|
Asger Feldthaus
|
182e4ce727
|
JS: Autoformat
|
2020-06-29 19:10:28 +01:00 |
|
Asger Feldthaus
|
cb12d894a6
|
JS: Add test
|
2020-06-29 15:54:06 +01:00 |
|
semmle-qlci
|
da8725aa5c
|
Merge pull request #3823 from dellalibera/js/fancy-log
Approved by erik-krogh
|
2020-06-29 14:46:51 +01:00 |
|
semmle-qlci
|
b3e68ef81c
|
Merge pull request #3806 from erik-krogh/moreDownloads
Approved by asgerf
|
2020-06-29 13:53:10 +01:00 |
|
Asger Feldthaus
|
b05942b599
|
JS: Add HTML file example
|
2020-06-29 13:45:01 +01:00 |
|
Asger Feldthaus
|
3938856e61
|
JS: Make this work in qltest
|
2020-06-29 13:42:55 +01:00 |
|
Asger Feldthaus
|
da3d1a3b5f
|
JS: Recognize 'lang' attribute of script tags
|
2020-06-29 08:15:52 +01:00 |
|
Asger Feldthaus
|
03c91a66c5
|
JS: Update expected output
|
2020-06-29 07:52:25 +01:00 |
|
Asger Feldthaus
|
9ca25d5bef
|
JS: Support .hash extraction via a few more methods
|
2020-06-28 01:38:59 +01:00 |
|
Asger Feldthaus
|
19db418395
|
JS: Add missing store step in Xss query
|
2020-06-28 01:26:11 +01:00 |
|
Asger Feldthaus
|
3e616e998e
|
JS: Add test
|
2020-06-27 21:31:40 +01:00 |
|
ubuntu
|
9135bbd5c8
|
JS: model fancy-log (and recognize the 'dir' log level)
|
2020-06-26 21:33:52 +02:00 |
|
Asger Feldthaus
|
06dd3ab2ca
|
JS: Propagate into RegExp.$x
|
2020-06-26 18:58:43 +01:00 |
|
Asger Feldthaus
|
17af8f7650
|
JS: Add test for taint propagating into RegExp.$1
|
2020-06-26 18:58:43 +01:00 |
|
semmle-qlci
|
3aefb7fad9
|
Merge pull request #3613 from erik-krogh/Reassigned
Approved by asgerf
|
2020-06-26 17:05:45 +01:00 |
|
semmle-qlci
|
b015c735d0
|
Merge pull request #3809 from max-schaefer/util-deprecate
Approved by asgerf
|
2020-06-26 14:20:14 +01:00 |
|
Max Schaefer
|
640c194c92
|
JavaScript: Model util.deprecate as a pre call-graph step.
|
2020-06-26 11:47:19 +01:00 |
|
Max Schaefer
|
712a216461
|
Add self-verifying type-tracking tests.
|
2020-06-26 11:47:19 +01:00 |
|
semmle-qlci
|
f81fc77e9e
|
Merge pull request #3782 from erik-krogh/promiseSteps
Approved by asgerf
|
2020-06-26 10:11:10 +01:00 |
|
semmle-qlci
|
92cc59b47b
|
Merge pull request #3800 from esbena/js/npmlog
Approved by erik-krogh
|
2020-06-26 07:54:08 +01:00 |
|
Erik Krogh Kristensen
|
1ec2c549d2
|
autoformat
|
2020-06-25 23:00:52 +02:00 |
|
Erik Krogh Kristensen
|
081b03c8f4
|
add tests that access-path domination can happen within a statement
|
2020-06-25 23:00:52 +02:00 |
|
Erik Krogh Kristensen
|
926f2c139f
|
require that a write must dominate the enclosing stmt of a read
|
2020-06-25 23:00:52 +02:00 |
|
Erik Krogh Kristensen
|
cc2e61531e
|
update expected output
|
2020-06-25 23:00:52 +02:00 |
|
Erik Krogh Kristensen
|
21e5a522b0
|
give the same rank to all expressions inside a single stmt
|
2020-06-25 23:00:52 +02:00 |
|
Erik Krogh Kristensen
|
e467d3ccbf
|
use dominating write check in js/path-injection
|
2020-06-25 23:00:52 +02:00 |
|
Erik Krogh Kristensen
|
6bc821b1ab
|
add tests for dominating writes
|
2020-06-25 23:00:52 +02:00 |
|
Erik Krogh Kristensen
|
2b2d691e45
|
don't treated a property from a tainted object as tainted when there exists a dominating write
|
2020-06-25 23:00:52 +02:00 |
|
semmle-qlci
|
056e1a8c4b
|
Merge pull request #3599 from asger-semmle/js/nameditem
Approved by esbena
|
2020-06-25 17:34:14 +01:00 |
|
Erik Krogh Kristensen
|
690bde47aa
|
remove a .getALocalSource() that isn't needed
|
2020-06-25 16:51:10 +02:00 |
|
semmle-qlci
|
cf0cd00458
|
Merge pull request #3627 from asger-semmle/js/unneeded-defensive-return
Approved by erik-krogh
|
2020-06-25 15:28:57 +01:00 |
|
semmle-qlci
|
c39dce4d66
|
Merge pull request #3781 from asger-semmle/js/deprecate-type-member-lookup
Approved by erik-krogh
|
2020-06-25 14:56:17 +01:00 |
|
Erik Krogh Kristensen
|
09d969a8ad
|
recognize sensitive files by file-system writes
|
2020-06-25 15:19:42 +02:00 |
|
Erik Krogh Kristensen
|
8f5a3e9f4f
|
add support for getASavePath() to js/insecure-download
|
2020-06-25 15:18:31 +02:00 |
|
Erik Krogh Kristensen
|
dafca8fd81
|
introduce flow-labels to js/insecure-download
|
2020-06-25 15:17:57 +02:00 |
|
Asger Feldthaus
|
f9b796231b
|
JS: Add regression tests
|
2020-06-25 11:10:27 +01:00 |
|
Esben Sparre Andreasen
|
4bfce4b8a3
|
JS: model npmlog (and recognize the "verbose" log level)
|
2020-06-25 12:06:51 +02:00 |
|
Asger Feldthaus
|
ea3560fe07
|
JS: Ignore document.all checks explicitly
|
2020-06-25 11:03:06 +01:00 |
|
Asger Feldthaus
|
b867512db4
|
JS: Update test
|
2020-06-25 11:01:10 +01:00 |
|
Asger Feldthaus
|
42f32bf76c
|
JS: Recognize calls to .item and .namedItem
|
2020-06-24 15:11:18 +01:00 |
|
semmle-qlci
|
696d19cb14
|
Merge pull request #3773 from erik-krogh/guardedCrypto
Approved by asgerf
|
2020-06-24 13:04:04 +01:00 |
|
semmle-qlci
|
a723ac0d8e
|
Merge pull request #3767 from esbena/js/console-member-calls
Approved by erik-krogh
|
2020-06-24 08:03:49 +01:00 |
|