Felicity Chapman
236e1f7955
Update change notes for name change
2019-11-01 12:27:43 +00:00
Max Schaefer
311cbd824c
JavaScript: Recognize ":" pseudo-directive.
2019-10-31 11:39:09 +00:00
semmle-qlci
33374ee089
Merge pull request #2202 from asger-semmle/express-sendfile
...
Approved by esbena
2019-10-28 09:24:34 +00:00
semmle-qlci
d2f3574427
Merge pull request #2165 from erik-krogh/dosHigh
...
Approved by asger-semmle
2019-10-25 16:28:07 +01:00
Asger F
4e3f6c5107
JS: Add change note
2019-10-25 13:09:39 +01:00
Erik Krogh Kristensen
834b572f45
add initial support for expressions in TypeScript
2019-10-24 10:17:00 +02:00
semmle-qlci
1c79ec550e
Merge pull request #2092 from esben-semmle/js/brittle-system-reflection-command
...
Approved by mchammer01, xiemaisi
2019-10-22 08:36:44 +01:00
Erik Krogh Kristensen
1ae8e25603
change precision of js/loop-bound-injection and fix a false positive
2019-10-22 09:21:19 +02:00
semmle-qlci
0dcb189e67
Merge pull request #2162 from xiemaisi/js/remove-deprecated-queries
...
Approved by esben-semmle
2019-10-22 07:15:58 +01:00
Esben Sparre Andreasen
5a983cb535
JS: add query js/shell-command-injection-from-environment
2019-10-21 23:31:55 +02:00
Max Schaefer
55fb86d618
JavaScript: Remove deprecated queries.
...
These queries have all been deprecated since 1.17 (released in July 2018). I think it's time to say goodbye.
2019-10-21 14:42:02 +01:00
Erik Krogh Kristensen
9eda120de4
implement a new query to detect unreachable overloaded methods in TypeScript
2019-10-21 13:34:42 +02:00
Max Schaefer
a4bffe35fd
JavaScript: Add support for globalThis.
2019-10-17 12:04:01 +01:00
Esben Sparre Andreasen
e1d7434be4
JS: add query js/useless-regexp-character-escape
2019-10-16 00:15:54 +02:00
Erik Krogh Kristensen
be18adca3c
update description in change-notes
2019-10-08 11:54:56 +02:00
Erik Krogh Kristensen
9788b16dee
add change note for js/use-of-returnless-function
2019-10-08 11:54:08 +02:00
Erik Krogh Kristensen
aa1368741b
rename suspicious-method-name to suspicious-method-name-declaration
2019-10-01 14:37:07 +02:00
Erik Krogh Kristensen
0320f0f26b
add query for detecting suspisous method names in TypeScript
2019-09-30 13:05:50 +02:00
Max Schaefer
d4fca84898
JavaScript: Improve XSS sanitizer detection.
...
We now use local data flow to detect more regexp-based sanitizers.
2019-09-23 17:07:06 +01:00
semmle-qlci
e2c941c577
Merge pull request #1916 from erik-krogh/taintedLength
...
Approved by asger-semmle, xiemaisi
2019-09-23 11:47:48 +01:00
Max Schaefer
149ae5d7ab
JavaScript: Fix IllegalInvocation.
...
This fixes false positives that arise when a call such as `f.apply` can either be interpreted as a reflective invocation of `f`, or a normal call to method `apply` of `f`.
2019-09-23 07:44:14 +01:00
Erik Krogh Kristensen
814c5537be
update name of loop bound injection in change-notes
2019-09-20 22:56:08 +02:00
semmle-qlci
6f2e485ace
Merge pull request #1950 from xiemaisi/js/rate-limiter-flexible
...
Approved by esben-semmle
2019-09-19 12:45:45 +01:00
Erik Krogh Kristensen
3ef187f7f2
Add external/cwe/cwe-834 tag in change notes for js/loop-bound-injectoin
...
Co-Authored-By: Max Schaefer <max@semmle.com >
2019-09-19 11:30:15 +02:00
Max Schaefer
3970ead7ab
JavaScript: Add support for rate-limiter-flexible package.
2019-09-18 12:25:33 +01:00
Esben Sparre Andreasen
ac6554b7da
Merge branch 'master' into js/improve-getAResponseDataNode
2019-09-17 13:18:41 +02:00
Esben Sparre Andreasen
c9d31e90fe
JS: add change notes
2019-09-16 10:11:43 +02:00
Erik Krogh Kristensen
3fb64abb09
fix consistency and spelling in the documentation
...
suggestions from the documentation team
Co-Authored-By: shati-patel <42641846+shati-patel@users.noreply.github.com >
2019-09-13 14:52:11 +01:00
Erik Krogh Kristensen
5b2b60f132
change DOS to DoS, and other small documentation fixes
...
Co-Authored-By: Max Schaefer <max@semmle.com >
2019-09-13 10:26:01 +01:00
Erik Krogh Kristensen
17a71a97c5
add loop-bound-injection to change-notes
2019-09-12 15:28:14 +01:00
semmle-qlci
72db219c13
Merge pull request #1910 from xiemaisi/js/unused-index-variable
...
Approved by esben-semmle, shati-semmle
2019-09-11 14:33:32 +01:00
Max Schaefer
500cde68c3
JavaScript: Add new query UnusedIndexVariable.
2019-09-11 11:36:50 +01:00
Esben Sparre Andreasen
086c473c18
JS: sharpen js/http-to-file-access
2019-09-11 12:05:33 +02:00
semmle-qlci
16c95d8c5e
Merge pull request #1876 from esben-semmle/js/more-delimiter-stripping-whitelisting
...
Approved by xiemaisi
2019-09-11 09:16:57 +01:00
Esben Sparre Andreasen
f7bfc472c1
JS: treat server responses as untrusted for command injections
2019-09-11 09:38:18 +02:00
Asger F
194a1c3530
JS: Change note
2019-09-09 15:42:43 +01:00
semmle-qlci
e899250e87
Merge pull request #1894 from asger-semmle/fp-incorrect-suffix-check
...
Approved by xiemaisi
2019-09-09 15:33:47 +01:00
Asger F
b6690bb644
JS: Add change note
2019-09-09 12:45:03 +01:00
Asger F
dfd18a51ee
JS: Change note
2019-09-06 16:03:16 +01:00
Esben Sparre Andreasen
a9665f53b8
JS: whitelist quote stripping for js/incomplete-sanitization
2019-09-05 09:47:49 +01:00
Asger F
93a3f571ec
JS: Add change note
2019-09-04 16:14:51 +01:00
Asger F
c71a66a045
JS: Add change note
2019-09-02 11:05:07 +01:00
semmle-qlci
6d55d1f7c0
Merge pull request #1707 from asger-semmle/canonical-name-call-graph
...
Approved by xiemaisi
2019-09-02 09:45:24 +01:00
Asger F
45941869ad
JS: Change note
2019-08-30 18:25:39 +01:00
Asger F
9533ca0926
JS: Change note
2019-08-30 18:19:49 +01:00
Asger F
3186942906
JS: Add change note
2019-08-30 16:05:13 +01:00
Max Schaefer
78ce290de3
JavaScript: Fix DomMethodCallExpr.interpretsArgumentsAsHTML.
2019-08-28 11:22:03 +01:00
