Anders Schack-Mulligen
78e1879c9e
Use more flowTo.
2025-12-03 14:12:08 +01:00
Nora Dimitrijević
a0975e7e19
Constrain location overrides to actual sources/sinks
2025-10-28 09:42:20 +01:00
Nora Dimitrijević
bcdbe0b50a
JS/PolynomialReDoSQuery
...
javascript/ql/src/Performance/PolynomialReDoS.ql
2025-10-28 09:40:16 +01:00
Nora Dimitrijević
94343254e3
JS/ShellCommandInjectionFromEnvironmentQuery
...
javascript/ql/src/Security/CWE-078/ShellCommandInjectionFromEnvironment.ql
2025-10-28 09:40:14 +01:00
Nora Dimitrijević
71cf042607
JS/IndirectCommandInjectionQuery
...
javascript/ql/src/Security/CWE-078/IndirectCommandInjection.ql
2025-10-28 09:40:11 +01:00
Nora Dimitrijević
2a30ea923a
JS/CommandInjectionQuery
...
javascript/ql/src/experimental/heuristics/ql/src/Security/CWE-078/CommandInjection.ql
javascript/ql/src/Security/CWE-078/CommandInjection.ql
2025-10-28 09:40:09 +01:00
Asger F
8d49f26f3d
Merge pull request #20397 from asgerf/js/build-artifact-leak-fp
...
JS: Fix FP in js/build-artifact-leak when keys come from an array of constants
2025-10-28 06:40:13 +01:00
Asger F
2a4d6830ec
JS: An array of constants should be considered "filtered"
2025-09-10 11:07:32 +02:00
Napalys Klicius
b2feaaceea
Merge branch 'main' into js/move-cors-query-from-experimental
2025-09-05 12:11:09 +02:00
Napalys Klicius
d8c4d6deb4
Rename cors-misconfiguration to cors-origin.
2025-09-05 11:30:07 +02:00
Napalys Klicius
c4c8dbcf7d
Merge remote-tracking branch 'origin/main' into js/move-cors-query-from-experimental
2025-09-04 15:24:44 +02:00
Napalys Klicius
d3d608fa33
Updated query description and added a sanitizer
2025-09-04 13:16:37 +00:00
Napalys Klicius
6c751ce934
Merged config classes
2025-09-04 12:31:24 +00:00
Napalys Klicius
4dac80a998
Replace complex wrapper classes with MaD
2025-09-04 12:19:22 +00:00
Michael Nebel
8009ddebce
Merge pull request #20329 from michaelnebel/javascript/ql4ql
...
JS: Fix some Ql4Ql violations.
2025-09-04 13:01:37 +02:00
Michael Nebel
8b10ad49d7
JS: Fix some Ql4Ql violations.
2025-09-01 15:17:53 +02:00
Napalys Klicius
32606584ea
JS: add enumeration taint flow to Remote Property Injection query
2025-08-27 10:23:03 +00:00
Napalys Klicius
b2346183d6
Merge pull request #20148 from Napalys/js/reg-exp-env-variable-threat-model
...
JS: Exclude environment variables from `js/regex-injection` query by default
2025-08-18 09:32:15 +02:00
Napalys Klicius
5f538209c9
Exlucde environmental variables from default detection in regexp injection
2025-07-31 12:09:30 +02:00
Napalys Klicius
2baca58b27
Removed deprecations from cors as it was moved out experimental
2025-07-31 11:08:22 +02:00
Napalys Klicius
fd4233e30e
Moved apollo modeling to MaD
2025-07-31 10:58:38 +02:00
Napalys Klicius
84ffbbec33
Added missing doc strings
2025-07-30 10:51:38 +00:00
Napalys Klicius
358617f533
Move CORS misconfiguration query from experimental to Security
2025-07-30 10:22:59 +00:00
Jeroen Ketema
1990438376
JS: Fix import
...
The import should not have been private, because we want users to still be
able to import this file and have access to the crypto algorithms.
2025-07-16 14:41:50 +02:00
Jeroen Ketema
f07d8ee493
Remove duplicate copies of CryptoAlgorithms and CryptoAlgorithmNames
2025-07-14 11:39:06 +02:00
Jeroen Ketema
f4ba2e1fd0
Properly share CryptoAlgorithms and CryptoAlgorithmNames
2025-07-14 11:39:00 +02:00
Jeroen Ketema
c582a9ccd6
Remove duplicate copies of SensitiveDataHeuristics
2025-07-14 11:38:52 +02:00
Jeroen Ketema
8b828cecf1
Use shared SensitiveDataHeuristics
2025-07-14 11:38:47 +02:00
Napalys Klicius
0d5f5104d1
Updated UriEncodingSanitizer comment
2025-06-16 13:08:16 +02:00
Napalys Klicius
bdbc49c63f
JS: Removed encodeURI from request forgery sanitizer list
2025-06-16 13:08:11 +02:00
Napalys Klicius
b9b62fa1c1
JS: Add URL from url package constructor taint step for request forgery detection
2025-05-30 18:32:02 +02:00
Asger F
169ae19015
Merge pull request #19391 from asgerf/js/typescript-path-resolution
...
JS: Overhaul import resolution
2025-05-13 15:46:38 +02:00
Napalys Klicius
d4b5ef6a66
Refactor process.env handling in CleartextLogging and IndirectCommandInjection modules to use ThreatModelSource
2025-05-01 11:14:15 +02:00
Asger F
ed2a832a55
JS: Deprecate PathExpr and related classes
2025-04-29 13:23:47 +02:00
Asger F
6c33013788
JS: Enable association with headers without needing a route handler
...
Previously it was not possible to associate a ResponseSendArgument with its header definitions if they did not have the same route handler.
But for calls like `new Response(body, { headers })` the headers are fairly obvious whereas the route handler is unnecessarily hard to find. So we use the direct and obvious association between 'body' and 'headers' in the call.
2025-04-03 11:08:10 +02:00
Asger F
1324c11044
Merge pull request #19012 from asgerf/js/api-graph-array-element
...
JS: Make API graphs use steps from summaries
2025-03-18 18:03:43 +01:00
Napalys Klicius
478e32cbe5
Update javascript/ql/lib/semmle/javascript/security/dataflow/TaintedPathCustomizations.qll
...
Co-authored-by: Asger F <asgerf@github.com >
2025-03-17 10:17:39 +01:00
Asger F
ab74898bbb
JS: Deprecate getUnknownMember() and replace its uses with getArrayElement()
...
Although they mean slightly different things, every single call site
of getUnknownMember() just used it as a way to get array elements.
Since there is no known use-case for the original meaning of
getUnknownMember() I am deprecating it for now.
2025-03-14 23:08:19 +01:00
Napalys
4a691b778b
Added escape as UriEncodingSanitizer
2025-03-14 14:53:21 +01:00
Napalys
dc262236f4
Enhance taint tracking by including escape and unescape in TaintedPath customizations.
2025-03-14 11:43:22 +01:00
Asger F
29659647ea
JS: Fix barrier guards for ServerSideUrlRedirect
...
The barrier guards for ServerSideUrlRedirect were lost when it was ported to ConfigSig, and the aforementioned spurious alert was a result of that.
The query had two guards: a proper barrier guard and a heuristic one for functions named 'isLocalURL'. We should move away from the heuristic name-based sanitiser guards, so I'm only reinstating the proper barrier guard.
Therefore updating the test to test the real barrier guard.
2025-02-28 13:28:43 +01:00
Asger F
0ca9b2285b
Merge pull request #18740 from asgerf/js/more-precise-diff-informed
...
JS: Provide more precise related locations
2025-02-17 10:27:15 +01:00
Asger F
7e3f89842d
JS: Provide more precise related locations
2025-02-11 14:12:03 +01:00
Asger F
45242977a4
JS: Model query-string parsers that strip off ? or #
2025-02-11 10:41:23 +01:00
Paul Hodgkinson
f033f179f7
Merge branch 'main' into angular-sources-sinks
2025-01-24 15:46:48 +00:00
Asger F
1b7977bf90
Merge pull request #18466 from asgerf/js/view-component-inputs
...
JS: Add view-component-input threat model
2025-01-24 10:59:25 +01:00
aegilops
522f3d1337
Merge
2025-01-23 17:00:56 +00:00
Asger F
6423033db6
JS: Resolve inserted TODOs
2025-01-23 13:02:52 +01:00
Asger F
dba76a0e4d
JS: Rerun patch query after bugfix
2025-01-23 10:31:32 +01:00
Asger F
d647c7b14d
JS: Replace 'instanceof ClientSideRemoteFlowSource'
2025-01-22 10:45:49 +01:00
