semmle-qlci
|
0230b79efc
|
Merge pull request #3391 from erik-krogh/SplitFPs
Approved by esbena
|
2020-05-18 08:46:26 +01:00 |
|
Esben Sparre Andreasen
|
9552352d6a
|
JS: address qhelp feedback
|
2020-05-13 12:53:59 +02:00 |
|
Esben Sparre Andreasen
|
7cc3a5a242
|
JS: qhelp fixups
|
2020-05-06 14:46:34 +02:00 |
|
Esben Sparre Andreasen
|
69191577d6
|
JS: qhelp for js/unsafe-html-expansion
|
2020-05-06 14:03:27 +02:00 |
|
Esben Sparre Andreasen
|
99e5db407f
|
JS: address review comments
|
2020-05-05 14:04:05 +02:00 |
|
Erik Krogh Kristensen
|
bffb12725b
|
add test and change-note to prototype-polution
|
2020-05-05 13:49:11 +02:00 |
|
Erik Krogh Kristensen
|
3568439769
|
change getAnElementRead to getASubstringRead
|
2020-05-05 13:33:21 +02:00 |
|
Erik Krogh Kristensen
|
fe02137d0b
|
change naming of StringSplitCall methods
|
2020-05-05 13:27:14 +02:00 |
|
Esben Sparre Andreasen
|
304b013f88
|
JS: query and tests for unsafe HTML expansion
|
2020-05-05 10:32:16 +02:00 |
|
Erik Krogh Kristensen
|
89f45372d1
|
introduce StringSplitCall and use it
|
2020-05-05 09:13:15 +02:00 |
|
Esben Sparre Andreasen
|
04b5a794f1
|
Merge pull request #3313 from esbena/js/typical-bad-sanitizer
New query: Incomplete HTML attribute sanitization
|
2020-04-27 14:31:13 +02:00 |
|
Esben Sparre Andreasen
|
c0250894de
|
Apply suggestions from code review
Co-Authored-By: mc <42146119+mchammer01@users.noreply.github.com>
|
2020-04-27 12:37:39 +02:00 |
|
Esben Sparre Andreasen
|
0a8e371b0e
|
Update javascript/ql/src/Security/CWE-116/IncompleteHtmlAttributeSanitization.qhelp
Co-Authored-By: Asger F <asgerf@github.com>
|
2020-04-27 09:09:26 +02:00 |
|
Esben Sparre Andreasen
|
58b5bd5cfd
|
JS: fixup documentation
|
2020-04-24 10:56:53 +02:00 |
|
Esben Sparre Andreasen
|
6d6ec89ba8
|
JS: add qhelp
|
2020-04-24 09:18:09 +02:00 |
|
Esben Sparre Andreasen
|
89613dbd23
|
JS: add query for incomplete HTML attribute sanitization
|
2020-04-24 09:17:46 +02:00 |
|
Erik Krogh Kristensen
|
a71567da54
|
autoformat
|
2020-04-23 18:58:33 +02:00 |
|
Erik Krogh Kristensen
|
96896fd7f5
|
second round of UnsafeJQueryPlugin reuse
|
2020-04-23 15:12:32 +02:00 |
|
Erik Krogh Kristensen
|
7bfea946fd
|
update links in xss-through-dom qhelp
|
2020-04-22 10:23:03 +02:00 |
|
Erik Krogh Kristensen
|
76503d3536
|
user controlled -> user-controlled
|
2020-04-22 10:08:01 +02:00 |
|
Erik Krogh Kristensen
|
947e9828da
|
Update javascript/ql/src/Security/CWE-079/XssThroughDom.qhelp
Co-Authored-By: mc <42146119+mchammer01@users.noreply.github.com>
|
2020-04-22 10:07:50 +02:00 |
|
Erik Krogh Kristensen
|
9fc29ee0f8
|
update qhelp
|
2020-04-20 13:29:00 +02:00 |
|
Erik Krogh Kristensen
|
2d3e42e6d6
|
update qhelp for xss-through-dom
Co-Authored-By: Asger F <asgerf@github.com>
|
2020-04-20 11:50:46 +02:00 |
|
Erik Krogh Kristensen
|
1b80f46f30
|
add QHelp for js/xss-through-dom query
|
2020-04-17 10:54:21 +02:00 |
|
Erik Krogh Kristensen
|
14b551f887
|
Xss through DOM
|
2020-04-17 10:54:14 +02:00 |
|
Asger Feldthaus
|
7da0345c6a
|
JS: Autoformat
|
2020-04-06 12:30:04 +01:00 |
|
Asger Feldthaus
|
2c6beadf68
|
JS: Recognize more forms of scheme checks
|
2020-04-06 12:30:03 +01:00 |
|
Max Schaefer
|
3c785ecaa7
|
JavaScript: Move flow summaries to experimental.
Also update description and change note to call out their experimental character more clearly.
|
2020-03-09 12:57:20 +00:00 |
|
semmle-qlci
|
7f3f629d39
|
Merge pull request #2913 from asger-semmle/js/prototype-pollution-path
Approved by erik-krogh
|
2020-03-03 10:29:47 +00:00 |
|
Erik Krogh Kristensen
|
019266e537
|
change name of Useless cat
|
2020-03-02 13:06:08 +01:00 |
|
Erik Krogh Kristensen
|
391b6a833c
|
add link to The Useless Use of Cat Award
|
2020-03-02 12:28:51 +01:00 |
|
Erik Krogh Kristensen
|
5e0ae7b4d0
|
add end </p> tag
|
2020-02-28 10:23:03 +01:00 |
|
Erik Krogh Kristensen
|
ce9cd53bf1
|
Merge remote-tracking branch 'upstream/master' into UselessCat
|
2020-02-28 09:56:23 +01:00 |
|
Erik Krogh Kristensen
|
922779e049
|
remove double a/an and adjust line lenghts
|
2020-02-28 09:48:07 +01:00 |
|
Erik Krogh Kristensen
|
17f1974e05
|
Apply suggestions from code review
Co-Authored-By: mc <42146119+mchammer01@users.noreply.github.com>
|
2020-02-28 09:43:32 +01:00 |
|
Asger Feldthaus
|
52ebe49a0b
|
JS: Flag deep assignments in prototype pollution query
|
2020-02-27 12:17:55 +00:00 |
|
Asger Feldthaus
|
fefcf1a7a6
|
JS: Autoformat everything
|
2020-02-27 09:41:01 +00:00 |
|
Erik Krogh Kristensen
|
b20e8520f6
|
add default message if not pretty printed call can be created
|
2020-02-24 14:52:08 +01:00 |
|
Erik Krogh Kristensen
|
a779ae58a8
|
add qhelp
|
2020-02-24 14:03:41 +01:00 |
|
Asger Feldthaus
|
d1df251b92
|
JS: Proto pollution: Add is-plain-object sanitizer
|
2020-02-21 14:38:33 +00:00 |
|
Erik Krogh Kristensen
|
75410e5760
|
big refactor of UselessUseOfCal
|
2020-02-21 14:26:42 +01:00 |
|
Erik Krogh Kristensen
|
6ea14532ab
|
small changes based on review
|
2020-02-21 10:27:57 +01:00 |
|
Erik Krogh Kristensen
|
924272a7a5
|
insert placeholder qhelp
|
2020-02-20 14:35:26 +01:00 |
|
semmle-qlci
|
f6af5da7f7
|
Merge pull request #2778 from erik-krogh/FalsySanitizer
Approved by asgerf
|
2020-02-20 11:17:03 +00:00 |
|
Erik Krogh Kristensen
|
a5fdcb67f9
|
restricts alerts to the first line
|
2020-02-20 10:43:41 +01:00 |
|
Erik Krogh Kristensen
|
bdab9ee12b
|
change useless cat query to only flag instances that can be re-written to
|
2020-02-19 16:59:28 +01:00 |
|
Erik Krogh Kristensen
|
73a7d406a5
|
add query for useless use of cat
|
2020-02-18 19:18:45 +01:00 |
|
Erik Krogh Kristensen
|
e359e1a373
|
use a barrier directly instead of a barrier guard
|
2020-02-18 10:57:28 +01:00 |
|
Esben Sparre Andreasen
|
abe7aeef7c
|
Merge pull request #2643 from esbena/js/unsafe-jquery
JS: add query js/unsafe-jquery-plugin
|
2020-02-18 09:26:14 +01:00 |
|
Erik Krogh Kristensen
|
0f511c92b4
|
Merge remote-tracking branch 'upstream/master' into FalsySanitizer
|
2020-02-10 09:54:58 +01:00 |
|