Napalys
|
a0df33c3ac
|
JS: UnsafeShellCommand Using unknown flags in the RegExp object is no longer flagged as bad sanitization to reduce false positives.
|
2024-11-28 11:26:43 +01:00 |
|
Napalys
|
155f1fca85
|
JS: Added test cases for unsafe shell command sanitization with RegExpr Object, instead of literal
|
2024-11-28 11:26:42 +01:00 |
|
erik-krogh
|
943bdeca6d
|
make appliesTo recursive
|
2023-02-14 14:16:45 +01:00 |
|
erik-krogh
|
9549cac3e5
|
add an additional barrier guard that finds "=== true" versions of previous barrier guards
|
2023-02-14 14:15:23 +01:00 |
|
erik-krogh
|
68656274f4
|
dont recognize regexps that match dot as sanitizers
|
2023-02-13 17:36:51 +01:00 |
|
Erik Krogh Kristensen
|
fc66c905ff
|
Merge pull request #11859 from erik-krogh/moreShell
JS: slightly broaden the regular expression that recognizes bad string-concats used as shell commands
|
2023-01-23 22:26:17 +01:00 |
|
erik-krogh
|
23a847b1cf
|
track shell:true more in js/shell-command-constructed-from-input
|
2023-01-10 15:27:37 +01:00 |
|
erik-krogh
|
79e161e046
|
slightly broaden the regular expression that recognizes bad string-concats used as shell commands
|
2023-01-10 12:49:37 +01:00 |
|
Erik Krogh Kristensen
|
f67219965e
|
Merge pull request #11082 from erik-krogh/shellArr
JS: treat arrays that gets executed with shell:true as a sink for `js/shell-command-constructed-from-input`
|
2022-11-22 13:03:50 +01:00 |
|
erik-krogh
|
fc38bf0429
|
Merge branch 'main' into aliasFlow
|
2022-11-07 09:46:48 +01:00 |
|
erik-krogh
|
40032f295a
|
treat arrays that gets executed with shell:true as a sink for js/shell-command-constructed-from-input
|
2022-11-07 09:19:05 +01:00 |
|
erik-krogh
|
946720f414
|
reorder the CWE-078 tests into subdirectories
|
2022-10-28 10:16:21 +02:00 |
|