17 Commits

Author	SHA1	Message	Date
Erik Krogh Kristensen	99f5f70345	Merge branch 'main' into protoLib	2021-11-04 12:53:53 +01:00
Asger Feldthaus	08bc80ffdb	JS: Block prototype pollution assignment flows through .replace()	2021-11-03 13:24:29 +01:00
Erik Krogh Kristensen	4f6e5c903b	filter out writes to number indexes	2021-10-28 14:27:07 +02:00
Erik Krogh Kristensen	96b6f670d9	filter away paths that start with libary inputs and end with a fixed-property write	2021-10-27 21:01:11 +02:00
Erik Krogh Kristensen	a9a9e34265	recognize delete expresssions as a sink for js/prototype-polluting-assignment	2021-10-27 20:37:42 +02:00
Erik Krogh Kristensen	2dedfb302a	remove paths without unmatched returns from js/prototype-polluting-assignment	2021-10-27 20:37:42 +02:00
Erik Krogh Kristensen	0c9c9bbde7	detect library input when the arguments object is converted to an array	2021-10-27 20:37:41 +02:00
Erik Krogh Kristensen	d1238dfd8b	update alert message to distinguish between library input and remote flow	2021-10-27 20:35:38 +02:00
Erik Krogh Kristensen	6e183af383	ignore test files for the `prototypeLessObject' predicate	2021-10-27 20:35:37 +02:00
Erik Krogh Kristensen	e94b0f5913	recognize inclusion based sanitizers for js/prototype-polluting-assignment	2021-10-27 20:35:37 +02:00
Erik Krogh Kristensen	2a808b2cd6	track taint through string coercions for js/prototype-polluting-assignment	2021-10-27 20:35:37 +02:00
Erik Krogh Kristensen	2d65aa17db	recognize exported functions that use the arguments object	2021-10-27 20:35:37 +02:00
Erik Krogh Kristensen	78774233c7	add library input as source to js/prototype-polluting-assignment	2021-10-27 20:35:36 +02:00
Asger Feldthaus	cb0075f15a	JS: Remove use of deprecated API	2021-08-12 09:30:43 +02:00
Asger Feldthaus	254ac7f963	JS: Fix TypeofCheck	2020-12-07 10:46:00 +00:00
Asger Feldthaus	daab3c1437	JS: Add tests and fix some bugs	2020-12-07 10:16:38 +00:00
Asger Feldthaus	0a7513fdfb	JS: Move and rename test cases as well	2020-12-07 10:16:38 +00:00