Erik Krogh Kristensen
0720fa75df
Merge pull request #10286 from erik-krogh/js-followMsg
...
JS: change alert messages of path queries to use the same template
2022-09-20 16:12:45 +02:00
erik-krogh
fb5a04a71d
filter out "file read after existence check" from js/file-system-race
2022-09-19 13:26:10 +02:00
erik-krogh
87fb01d55b
apply another suggestion from doc review
2022-09-12 15:36:02 +02:00
erik-krogh
afcb767f8d
Merge branch 'main' into js-followMsg
2022-09-12 13:21:16 +02:00
erik-krogh
6ec03d4738
apply suggestions from doc review
2022-09-12 13:16:39 +02:00
erik-krogh
26d8553f6e
ensure consistent casing of names
2022-09-09 10:34:14 +02:00
Erik Krogh Kristensen
9893650f7c
Merge pull request #8604 from erik-krogh/httpNode
...
JS: refactor most library models away from AST nodes
2022-09-09 10:04:17 +02:00
erik-krogh
a35fe1ffab
Merge branch 'main' into js-followMsg
2022-09-08 13:09:15 +02:00
erik-krogh
24f2e3cc07
update alert-messages of the sensitive data queries to match #10314
2022-09-06 12:25:36 +02:00
erik-krogh
0776687991
fix leftover todo in js/insecure-temporary-file
2022-09-06 10:05:50 +02:00
Erik Krogh Kristensen
b4968eb645
refactor the SensitiveExpr to be a dataflow node
2022-09-05 16:11:54 +02:00
Erik Krogh Kristensen
9cb7522bc1
change RouteSetup to a DataFlow::Node
2022-09-05 15:45:31 +02:00
erik-krogh
aa56ca37ae
make the alert messages of taint-tracking queries more consistent
2022-09-05 14:04:52 +02:00
erik-krogh
cc7a9ef97a
rename more acronyms
2022-08-25 20:52:27 +02:00
Erik Krogh Kristensen
06afe9c0f4
Merge pull request #9816 from erik-krogh/msgConsis
...
Make alert messages consistent across languages
2022-08-25 15:20:01 +02:00
erik-krogh
f1799ae3d2
print the endpointExample in the alert-messsage, and only report one working example
2022-08-24 13:09:48 +02:00
erik-krogh
20625ae60d
update {js/go/py}/xpath-injection to match csharp/java
2022-08-22 21:41:46 +02:00
erik-krogh
b5458b2125
update js/insecure-randomness to match csharp
2022-08-22 21:41:46 +02:00
erik-krogh
9cdd8cc8f5
update js/tainted-format-string to match ruby/java
2022-08-22 21:41:46 +02:00
erik-krogh
9395f156de
update {js/py}/command-line-injection to match csharp/java
2022-08-22 21:41:46 +02:00
erik-krogh
3553f3d9b8
update {rb/py/js/go}/path-injection to match java/csharp
2022-08-22 21:41:45 +02:00
erik-krogh
594fbc678e
update js/zip-slip to match java/go/csharp
2022-08-22 21:41:45 +02:00
erik-krogh
0aebc90b61
don't lowercase the endpointExample, and correctly handle root states
2022-08-21 18:38:47 +02:00
erik-krogh
d052b1e3c9
also support regular expressions without repetitions
2022-08-19 19:21:44 +02:00
erik-krogh
26fcf6b25b
apply suggestions from review
2022-08-18 15:00:57 +02:00
erik-krogh
de3e1c39e4
use the shared regular expression libraries in js/case-sensitive-middleware-path
2022-08-18 10:07:55 +02:00
Harry Maclean
f1a546c4d6
Rename IncompleteMultiCharacterSanitization[Query]
2022-08-17 16:03:49 +12:00
Harry Maclean
e48158b9ad
JS: Share more code with Ruby
2022-08-17 16:03:49 +12:00
Harry Maclean
b7d9bf4066
Share IncompleteMultiCharacterSanitization JS/Ruby
...
Most of the classes and predicates in this query can be shared between
the two languages. There's just a few language-specific things that we
place in IncompleteMultiCharacterSanitizationSpecific.
2022-08-17 16:03:46 +12:00
Erik Krogh Kristensen
f106e064fa
Merge pull request #9422 from erik-krogh/refacReDoS
...
Refactorizations of the ReDoS libraries
2022-08-16 09:32:08 +02:00
Erik Krogh Kristensen
0adb588fe8
Merge pull request #9712 from erik-krogh/badRange
...
JS/RB/PY/Java: add suspicious range query
2022-08-15 13:55:44 +02:00
erik-krogh
b54f037424
Merge branch 'main' into refacReDoS
2022-08-12 20:28:30 +02:00
Esben Sparre Andreasen
0c6f28014c
Merge pull request #9821 from erik-krogh/jsQlFix
...
JS: fix some QL-for-QL warnings in JS
2022-08-09 22:06:29 +02:00
Erik Krogh Kristensen
49276b1f38
Merge branch 'main' into refacReDoS
2022-08-09 16:18:46 +02:00
Erik Krogh Kristensen
0abbd50ca1
apply changes based on docs review
2022-08-09 13:51:40 +02:00
Asger F
855d4c2ea1
Merge pull request #9718 from asgerf/js/case-sensitive-middleware
...
JS: Add 'case sensitive middleware' query
2022-07-14 10:47:58 +02:00
Erik Krogh Kristensen
43a82004b2
Merge pull request #9798 from erik-krogh/backtrackers
...
JS: use small steps in TypeBackTracker correctly
2022-07-14 10:28:07 +02:00
Erik Krogh Kristensen
ed80089d7c
fix some QL-for-QL warnings in JS
2022-07-14 09:45:44 +02:00
Asger F
18c5a8c8da
Merge branch 'main' into js/case-sensitive-middleware
2022-07-14 09:38:35 +02:00
Asger F
da8123072d
Apply suggestions from doc review
...
Co-authored-by: mc <42146119+mchammer01@users.noreply.github.com >
2022-07-14 09:38:10 +02:00
Erik Krogh Kristensen
a4262f8d91
add some more references to the overly-large-range qhelp
2022-07-13 11:20:24 +02:00
Erik Krogh Kristensen
fd10947ca0
use small steps in TypeBackTracker correctly
2022-07-13 10:29:57 +02:00
Erik Krogh Kristensen
a49d34cf0f
Merge branch 'main' into missDocParam
2022-07-13 09:58:04 +02:00
Erik Krogh Kristensen
220ff3cb2e
convert tabs to spaces in qhelp
2022-07-12 16:02:50 +02:00
Erik Krogh Kristensen
ff25451699
rename query to overly-large-range, and rewrite the @description
2022-07-12 16:02:46 +02:00
Asger F
c1a2e2abe0
JS: Rename to isLikelyCaseSensitiveRegExp
2022-06-28 10:21:33 +02:00
Asger F
fd28397056
JS: Fix typo
2022-06-28 10:10:23 +02:00
Asger F
9cf48fc804
JS: Clarify that strings are case insensitive by default
2022-06-28 10:09:56 +02:00
Asger F
b1251f0c63
JS: invertCase -> toOtherCase
2022-06-28 10:07:57 +02:00
Erik Krogh Kristensen
a343ceaf8b
add suspicious-regexp-range query
2022-06-28 09:49:27 +02:00
