7317 Commits

Author	SHA1	Message	Date
Henry Mercer	07abf7314c	Remove NoSQL sinks since September 2018	2022-04-01 15:20:24 +01:00
Esben Sparre Andreasen	8a43368e62	Remove additional Xss sinks	2022-04-01 15:20:24 +01:00
Esben Sparre Andreasen	6024740b97	Remove additional SQL sinks	2022-04-01 15:20:24 +01:00
Esben Sparre Andreasen	449ad7a3c9	Remove additional path-injection sinks	2022-04-01 15:20:24 +01:00
Esben Sparre Andreasen	15f554ed2a	Remove pseudo-properties	2022-04-01 15:20:24 +01:00
Esben Sparre Andreasen	f3621cd472	Remove 2020 sinks from SqlInjection.ql	2022-04-01 15:20:24 +01:00
Esben Sparre Andreasen	f2b85e2b88	Remove 2020 sinks from Xss.ql	2022-04-01 15:20:24 +01:00
Esben Sparre Andreasen	7b1ecc19a3	Remove 2020 sinks from TaintedPath.ql	2022-04-01 15:17:45 +01:00
Erik Krogh Kristensen	67e1ffdd3e	fix isKnownStepSrc such that it actually includes taint/dataflow-steps	2022-03-31 09:46:01 +02:00
Erik Krogh Kristensen	e038baed36	add .gitignore ignoring test dbs	2022-03-31 09:45:28 +02:00
Chuan-kai Lin	48015e5a2e	Merge pull request #8597 from cklin/run-js-ml-tests ... JS: Fix expected test output for ATM queries	2022-03-30 13:10:02 -07:00
Chuan-kai Lin	a8dabb238d	JS: Fix expected test output for ATM queries	2022-03-30 11:35:17 -07:00
Arthur Baars	031d183bdf	Merge pull request #8532 from aibaars/regex-refactor-2 ... JS/Ruby/Python: rename RegExpTreeView.qll to ReDoSUtilSpecific.qll	2022-03-30 16:38:47 +02:00
Asger Feldthaus	e152416317	JS: write all CSV rows as literals	2022-03-28 15:30:18 +02:00
Asger F	e5f2b830f3	Merge pull request #8577 from asgerf/fix-mad-warning ... JS/Ruby: Fix regexp in MaD checking	2022-03-28 15:29:16 +02:00
Asger F	f22df765ed	Merge pull request #8533 from asgerf/mad-receiver-token ... JS/Ruby: Represent non-positional arguments with Argument/Parameter tokens	2022-03-28 15:28:52 +02:00
Asger Feldthaus	7e6206ed36	JS: Fix the regexp for valid MaD token arguments	2022-03-28 12:43:43 +02:00
Arthur Baars	b103679d8a	JS/Ruby/Python: rename RegExpTreeView.qll to ReDoSUtilSpecific.qll	2022-03-28 12:17:26 +02:00
Erik Krogh Kristensen	cf94c93b1a	Merge pull request #8481 from erik-krogh/schemeChain ... JS: recognize string replacement chains as scheme checks in js/incomplete-url-scheme-check	2022-03-25 11:13:10 +01:00
Asger Feldthaus	b0b795dbbb	JS: Autoformat	2022-03-23 19:15:01 +01:00
Asger Feldthaus	95122b2b6c	JS: Support Argument[this] token	2022-03-23 18:06:12 +01:00
Asger Feldthaus	d476f976fe	JS: Support Parameter[this] token	2022-03-23 18:06:12 +01:00
CodeQL CI	ac29d5f51b	Merge pull request #8523 from asgerf/js/api-graph-receiver-label ... Approved by erik-krogh	2022-03-23 15:31:12 +00:00
github-actions[bot]	1e620c99c6	JS: Bump patch version of ML-powered library and query packs post-release	2022-03-23 11:53:34 +00:00
github-actions[bot]	dc0c8374d2	JS: Bump minor version of ML-powered library and query packs	2022-03-23 11:47:53 +00:00
github-actions[bot]	2b42d84ccd	JS: Bump patch version of ML-powered model pack post-release	2022-03-23 11:47:53 +00:00
github-actions[bot]	6fbc0e6e32	JS: Bump ML model pack dependency of ML-powered model building and query packs	2022-03-23 11:47:53 +00:00
github-actions[bot]	8d13662315	JS: Bump minor version of ML-powered model pack	2022-03-23 11:47:08 +00:00
Asger Feldthaus	f2285709bd	JS: Change note	2022-03-23 10:42:51 +01:00
Asger Feldthaus	59d5c54432	JS: Update test output from knex	2022-03-23 10:42:51 +01:00
Asger Feldthaus	73071bdc08	JS: Change getAParameter to not return the receiver	2022-03-23 10:42:51 +01:00
Asger Feldthaus	6bef5a70b3	JS: Add dedicated API graph label for receiver, instead of parameter -1	2022-03-23 10:42:51 +01:00
Rasmus Wriedt Larsen	bbf60b875e	Merge pull request #8476 from RasmusWL/shared-concepts-scaffolding ... Python/JS/Ruby: Shared concepts scaffolding	2022-03-23 10:22:42 +01:00
Erik Krogh Kristensen	8ae04e04d4	Merge pull request #8509 from erik-krogh/fpXss ... JS: filter away reads of .src that end in a URL sink for js/xss-through-dom	2022-03-22 14:51:17 +01:00
Rasmus Wriedt Larsen	311cbb4e13	Merge branch 'main' into shared-concepts-scaffolding	2022-03-22 10:36:33 +01:00
Rasmus Wriedt Larsen	414764ccee	Concepts: Minor rewrite in qldoc ... As suggested by @hmac	2022-03-22 10:33:58 +01:00
Rasmus Wriedt Larsen	e50a9421a6	JS: Update dataflow import in ConceptsImports.qll ... Co-authored-by: Erik Krogh Kristensen <erik-krogh@github.com>	2022-03-22 10:32:20 +01:00
Erik Krogh Kristensen	099d91ba6f	update qldoc	2022-03-22 10:27:21 +01:00
Harry Maclean	c2d4bc50c9	Add missing file doc comment	2022-03-22 11:10:09 +13:00
Harry Maclean	91a7e9405c	Share HttpToFileAccessQuery between JS and Ruby ... There's so little in this query that it may not be worth sharing, but it's an interesting exercise in figuring out how we do it nicely.	2022-03-22 11:10:08 +13:00
Harry Maclean	6c18e1d7ac	Merge pull request #8272 from hmac/hmac/tainted-format-string	2022-03-22 08:37:47 +13:00
Erik Krogh Kristensen	c8385a1e80	js/xss-through-dom: filter away reads of .src that end in a URL sink	2022-03-21 16:48:59 +01:00
Alex Ford	c891c53835	Merge pull request #8395 from alexrford/ruby/clear-text-storage ... Ruby: add `rb/clear-text-storage-sensitive-data` query	2022-03-21 10:05:39 +00:00
CodeQL CI	b04c46f96d	Merge pull request #8478 from asgerf/js/store-load-flow-context-sensitivity-bug ... Approved by erik-krogh	2022-03-21 08:54:51 +00:00
Harry Maclean	0cfe37dff4	Share TaintedFormatString between Ruby and JS	2022-03-21 12:51:46 +13:00
Arthur Baars	4a27928728	Ruby/JS add missing ^ in qhelp	2022-03-18 14:00:10 +01:00
Arthur Baars	431b60506e	Merge remote-tracking branch 'upstream/main' into incomplete-hostname	2022-03-18 13:05:34 +01:00
Asger Feldthaus	26b7edccd4	JS: Change note	2022-03-18 11:59:36 +01:00
Erik Krogh Kristensen	693c77f3df	add test for string replacement chains of URL schemes	2022-03-18 11:05:59 +01:00
Asger F	929419abba	Merge pull request #8254 from asgerf/ruby/mad-prototype ... Ruby: initial prototype of models-as-data	2022-03-18 10:48:33 +01:00