4809 Commits

Author	SHA1	Message	Date
Napalys Klicius	000e69fd48	Replaced fuzzy NonNodeStream MaD to a ql predicate to deal easier with submodules	2025-05-23 13:55:40 +02:00
Napalys Klicius	c6db32ed73	Add exceptions for arktype, execa, and highland to prevent them from being flagged by unhandled pipe error query	2025-05-23 12:34:11 +02:00
Napalys Klicius	15ff7cb41a	Added more test cases which common js libraries uses .pipe()	2025-05-23 12:30:49 +02:00
Napalys Klicius	b10a9481f3	Fixed false positives from strapi and rxjs/testing as well as when one passes function as second arg to pipe	2025-05-22 18:50:02 +02:00
Napalys Klicius	e6ae8bbde4	Added test cases where second parameter passed to pipe is a function and some popular library ones	2025-05-22 18:50:01 +02:00
Napalys Klicius	ac24fdd348	Add predicate to detect non-stream-like usage in sources of pipe calls	2025-05-22 18:49:59 +02:00
Napalys Klicius	5b1af0c0bd	Added detection of custom gulp-plumber sanitizer, thus one would not flag such instances.	2025-05-22 18:49:53 +02:00
Napalys Klicius	09220fce84	Fixed issue where pipe calls from rxjs package would been identified as pipe calls on streams	2025-05-22 12:33:36 +02:00
Napalys Klicius	d7f86db76c	Enhance PipeCall to exclude non-function and non-object arguments in pipe method detection	2025-05-22 12:31:27 +02:00
Napalys Klicius	4332de464a	Eliminate false positives by detecting non-stream objects returned from pipe() calls based on accessed properties	2025-05-22 12:31:26 +02:00
Napalys Klicius	5710f0cf51	Add test cases for non-stream field accesses and methods before and after pipe operations	2025-05-22 12:31:19 +02:00
Napalys Klicius	03d1f9a7d3	Restrict pipe detection to calls with 1-2 arguments	2025-05-21 11:41:22 +02:00
Napalys Klicius	30f2815503	Fixed issue where a custom pipe method which returns non stream would be flagged by the query	2025-05-21 11:41:19 +02:00
Napalys Klicius	ef1bde554a	Fixed issue where streams would not be tracked via chainable methods	2025-05-21 11:40:35 +02:00
Napalys Klicius	f39bf62fc6	test: Add edge cases for stream pipe error handling ... Add tests for chained stream methods and non-stream pipe objects	2025-05-21 11:39:03 +02:00
Napalys Klicius	c27157f021	Add UnhandledStreamPipee Quality query and tests to detect missing error handlers in Node.js streams	2025-05-21 11:38:57 +02:00
Napalys Klicius	d1e769ba54	Merge pull request #19422 from Napalys/js/shelljs ... JS: Modeling of `ShellJS` functions	2025-05-02 14:18:44 +02:00
Napalys Klicius	d4b5ef6a66	Refactor process.env handling in CleartextLogging and IndirectCommandInjection modules to use ThreatModelSource	2025-05-01 11:14:15 +02:00
Napalys Klicius	33d8ffa83e	Added test cases for shelljs.env	2025-05-01 11:11:29 +02:00
Napalys Klicius	71f1b82a56	Added support for fastify.all	2025-04-30 14:54:09 +02:00
Napalys Klicius	6d61766366	Added test case for fastify.all	2025-04-30 14:50:35 +02:00
Napalys Klicius	18cea2d6a5	Added support for shelljs.cmd and async-shelljs.asyncExec	2025-04-30 13:37:02 +02:00
Napalys Klicius	25d04f1cdd	Added support for shelljs.which	2025-04-30 13:35:17 +02:00
Napalys Klicius	f6fae7ad60	Added test cases for cmd, which and asyncExec	2025-04-30 13:33:31 +02:00
Napalys Klicius	6de38b1827	Merge pull request #19300 from Napalys/js/fastify ... JS: Added support for `fastify.addHook`	2025-04-29 18:32:25 +02:00
Napalys Klicius	73309fb9dd	Updated modeling of aws-sdk with MaD	2025-04-28 14:00:12 +02:00
Napalys Klicius	42d5b80e81	Added support for AWS.Credentials hardcoded credentials	2025-04-28 14:00:12 +02:00
Napalys Klicius	f69037c176	Added ability to detect direct write to global AWS.config	2025-04-28 14:00:12 +02:00
Napalys Klicius	05e4677fd1	Added ability to detect new AWS.ServiceName cases with hardcoded credentials	2025-04-28 14:00:12 +02:00
Napalys Klicius	e6450a17ec	Added test cases for individual AWS services, direct modification of global credentials and AWS.Credentials	2025-04-28 14:00:12 +02:00
Michael Nebel	2e0ce44fde	Javascript: Update test files.	2025-04-23 15:41:41 +02:00
Napalys	fdfdcc0d93	Undo unnecessary name tracking for request, response objects	2025-04-22 14:16:45 +02:00
Asger F	00661b62dc	JS: Add isMiddlewareSetup() hook to Routing model	2025-04-22 12:00:02 +02:00
Asger F	c2cab184ac	Merge pull request #19283 from asgerf/js/rest-pattern-fix ... JS: Fix missing flow into rest pattern lvalue	2025-04-22 10:37:36 +02:00
Napalys	5c3556da66	Add user-controlled property tracking and update code injection alerts in Fastify hooks	2025-04-15 09:41:52 +02:00
Napalys	9b194ea613	Added addHook to RouteSetup thus now it is recognized now as rouute handler	2025-04-15 09:37:13 +02:00
Napalys	c175081698	Added test cases for fastify.addHook	2025-04-15 09:33:41 +02:00
Napalys Klicius	86313715a4	Merge pull request #19184 from Napalys/js/request_handlers ... JS: Support for `Request` and `NextRequest`	2025-04-14 08:07:24 +02:00
Asger F	6c01709048	JS: Update more test output	2025-04-11 15:15:22 +02:00
Napalys Klicius	3d7c0201d9	Merge pull request #19231 from Napalys/js/typed_array ... JS: Taint propagation from low-level `ArrayBuffer` to `Strings`	2025-04-11 11:29:01 +02:00
Napalys Klicius	d17d29a387	Merge pull request #19218 from Napalys/js/upgrade_websocket ... JS: Refactor `WebSocket` to use `API` graphs	2025-04-11 10:05:54 +02:00
Napalys	678eccb417	Added searchParams.get as potential source for SSRF	2025-04-11 09:42:07 +02:00
Napalys	8674b61e5a	Added SSRF test case with searchParams for NextRequest	2025-04-11 09:26:16 +02:00
Napalys	6e09a65da0	Added support for NextRequest middleware SSRF.	2025-04-11 08:43:36 +02:00
Napalys	734ad2d767	Removed legacy Consistency check as it is redundant now with inline test expectations.	2025-04-11 08:43:08 +02:00
Napalys	208487f236	Added middleware test	2025-04-11 08:39:47 +02:00
Asger F	719456e27d	JS: Fix missing flow into rest pattern lvalue	2025-04-11 08:37:09 +02:00
Asger F	7703b1fab5	JS: Add test for missing getALocalSource flow for rest pattern	2025-04-11 08:37:07 +02:00
Napalys Klicius	43bf0beae9	Merge pull request #19263 from Napalys/js/make-dir-lib ... JS: Add support for `make-dir` package	2025-04-10 15:09:43 +02:00
Napalys	86b64afa13	Added NextResponse to the ResponseCall class it models similar near idential behaviour.	2025-04-10 15:06:44 +02:00