Erik Krogh Kristensen
0e33eae960
add dbscheme upgrade script
2020-08-12 11:50:32 +02:00
Erik Krogh Kristensen
26dcd2faae
add support for getting the name from named tuple elements
2020-08-12 10:33:49 +02:00
Erik Krogh Kristensen
b101305248
autoformat
2020-08-12 09:27:43 +02:00
Erik Krogh Kristensen
d2c87d0a2e
add support for the new assign expression in TypeScript 4
2020-08-11 13:57:11 +02:00
Erik Krogh Kristensen
2f34990ae6
add another test for spread elements in tuple types
2020-08-11 13:57:11 +02:00
Erik Krogh Kristensen
ea583fe862
add basic support for named tuple elements
2020-08-11 13:57:11 +02:00
Erik Krogh Kristensen
2612e0c5dd
add test for spread in tuple in non-last position
2020-08-11 13:57:11 +02:00
Erik Krogh Kristensen
b602a36a24
add test for generic spreads in a tuple
2020-08-11 13:57:11 +02:00
Erik Krogh Kristensen
08c017eb09
change where tuples elements are loaded from to match TS 4.0
2020-08-11 13:57:10 +02:00
Erik Krogh Kristensen
ba2d19c70f
upgrade ts version in package.json
2020-08-11 13:57:10 +02:00
CodeQL CI
7c4e10df17
Merge pull request #4014 from erik-krogh/stringify
...
Approved by esbena
2020-08-10 07:50:21 +01:00
Erik Krogh Kristensen
aab2e6f803
update name of test file
2020-08-07 18:20:22 +02:00
Erik Krogh Kristensen
cc5ef4d5e1
rename JsonSerializeCall to JsonStringifyCall
2020-08-05 13:22:41 +02:00
Erik Krogh Kristensen
f70cb2e7b3
add test for new JSON serializers
2020-08-05 12:14:56 +02:00
Erik Krogh Kristensen
5a3f67a682
introduce model for JSON.stringify and similar libraries
2020-08-05 12:14:51 +02:00
Erik Krogh Kristensen
67c4320287
make JumpStmt non abstract
2020-08-05 10:03:46 +02:00
Erik Krogh Kristensen
016bdc1614
make ControlStmt non abstract
2020-08-05 09:59:30 +02:00
Erik Krogh Kristensen
5727e6f9f8
make CompoundAssignExpr non-abstract
2020-08-04 16:17:08 +02:00
Erik Krogh Kristensen
cf3f275aa1
make DestructuringPattern non-abstract
2020-08-04 16:02:32 +02:00
CodeQL CI
8855ab8c8c
Merge pull request #3835 from Raz0r/js/xss-protocol-sinks
...
Approved by erik-krogh
2020-08-03 15:40:05 +01:00
CodeQL CI
a4f8b19ae4
Merge pull request #3876 from erik-krogh/CWE078-Correctness
...
Approved by esbena
2020-08-03 15:38:51 +01:00
CodeQL CI
c8e5db189a
Merge pull request #3913 from erik-krogh/topmost
...
Approved by asgerf
2020-08-03 13:18:22 +01:00
Erik Krogh Kristensen
f5cc14f980
fix typo
2020-08-03 13:49:21 +02:00
CodeQL CI
0bbdc70cdb
Merge pull request #3864 from erik-krogh/exprString
...
Approved by asgerf, esbena
2020-08-03 09:25:17 +01:00
Arthur Baars
7e72ef350e
Merge pull request #3975 from aibaars/lgtm-suites
...
CodeQL: complete LGTM suites
2020-07-30 18:39:01 +02:00
Arthur Baars
5bad003c0c
Add qlpack.yml files for example queries
2020-07-29 16:57:04 +02:00
Arthur Baars
c4041e55ba
CodeQL: complete LGTM suites
2020-07-28 20:40:44 +02:00
Max Schaefer
91762ec274
JavaScript: Add partial model for opener.
...
3.5M weekly downloads.
Note that we do not treat the first argument as a command-injection sink. While it is possible to inject commands that way, it is more likely to cause false positives where the user input is concatenated with some prefix that makes the opening heuristic decide to treat it as a URL.
2020-07-27 11:42:32 +01:00
Max Schaefer
9aa26fa4bc
JavaScript: Add model for foreground-child.
...
>1M weekly downloads, so seems worth doing.
2020-07-27 11:37:06 +01:00
Max Schaefer
2f842042ea
JavaScript: Model another execa function relevant for command injection.
2020-07-27 11:34:04 +01:00
semmle-qlci
e167b87150
Merge pull request #3932 from max-schaefer/portals-additions
...
Approved by esbena
2020-07-09 11:43:45 +01:00
Max Schaefer
7a1410e0d5
JavaScript: Update and expand tests.
2020-07-09 09:25:52 +01:00
Max Schaefer
1c47260bde
JavaScript: Add support for global variables to portals.
2020-07-09 09:12:56 +01:00
Max Schaefer
c40ef0556a
JavaScript: Broaden scope of imports considered relevant to portals.
...
Previously, we only considered an import relevant to portals if the path it imported was declared as a dependency. This falls down for deep imports where a specific module inside the package is imported rather than the default entry point, for imports of built-in modules like `fs`, and in cases where a developer simply forgets to declare a dependency.
So instead we now consider all imports relevant whose path does not start with a dot or a slash.
2020-07-09 09:09:44 +01:00
Max Schaefer
8b4b5781e6
JavaScript: Add utility predicate getBasePortal(i).
...
This iterates the existing `getBasePortal()` predicate `i` times.
2020-07-09 09:08:18 +01:00
Erik Krogh Kristensen
022cafebd3
make sure the consisntecy-checking library does not mix configurations
2020-07-08 10:28:41 +02:00
Erik Krogh Kristensen
ec38df69b3
update consistency comments for CWE-918
2020-07-08 10:24:55 +02:00
Erik Krogh Kristensen
c5285f7418
update inconsistency comment for CWE-843
2020-07-08 10:16:43 +02:00
Erik Krogh Kristensen
45b6906a0d
move comments to match alert location for CWE-834
2020-07-08 10:16:04 +02:00
Erik Krogh Kristensen
71a3d49d2b
update comments to match alert location for CWE-807
2020-07-08 10:15:26 +02:00
Erik Krogh Kristensen
d814e73023
update comment position to match alert location for CWE-798
2020-07-08 10:12:12 +02:00
Erik Krogh Kristensen
bcffc97de7
update comment position to match alert location for CWE-776
2020-07-08 10:10:31 +02:00
Erik Krogh Kristensen
2235634347
update consistency comments for CWE-754
2020-07-08 10:08:51 +02:00
Erik Krogh Kristensen
0d64a0f2c8
update consistency comment for CWE-730
2020-07-08 10:07:34 +02:00
Erik Krogh Kristensen
5a87628478
update consistency comments for CWE-611
2020-07-08 10:03:03 +02:00
Erik Krogh Kristensen
1f1c09af02
update consistency comments for CWE-601
2020-07-08 10:02:29 +02:00
Erik Krogh Kristensen
ce6a211340
update inconsistency comment for CWE-506
2020-07-08 10:01:40 +02:00
Erik Krogh Kristensen
bf36137834
update inconsistency comment for CWE-346
2020-07-08 10:01:04 +02:00
Erik Krogh Kristensen
16b0427dc4
update inconsistency comment for CWE-338
2020-07-08 10:00:19 +02:00
Erik Krogh Kristensen
9bcbedde46
update consistency comment in passwords.js
2020-07-08 09:55:00 +02:00
