64 Commits

Author	SHA1	Message	Date
Napalys	c71778f1aa	JS: xss does not flag anymore replace with RegExp unknown flags	2024-11-28 11:26:53 +01:00
Napalys	dbae553146	JS: add xss test cases with unknownflags for replace using RegExp	2024-11-28 11:26:52 +01:00
Asger F	9ee7599aeb	JS: Move AngularJSTemplateUrlSink to ClientSideUrlRedirection query ... This is not perfect but at least we can be consistent about keeping URLs-that-lead-to-xss in the same query	2024-08-16 14:37:13 +02:00
erik-krogh	a9f2b3fad6	promote PropsTaintStep to a PreCallGraphStep	2024-01-04 10:45:22 +01:00
tyage	933b55d37d	Track interfile useRouter	2023-04-28 15:49:26 +09:00
Asger F	c7f16cd224	JS: Add test	2023-04-17 08:23:03 +02:00
erik-krogh	b1957623c1	add browser history as XSS sink	2023-04-12 13:38:18 +02:00
tyage	320cb99dbf	Add replace method test	2023-04-08 18:31:48 +09:00
tyage	668e1accaa	Remove unnecessary whiteline	2023-04-08 18:24:31 +09:00
tyage	7f9b8557ac	Add Next.js router push as XSS sink	2023-04-08 18:18:34 +09:00
Asger F	92a681213d	JS: Step through jQuery callback return values	2023-03-27 11:17:27 +02:00
Asger F	bc2a772f3b	JS: Add test case showing false negative	2023-03-27 11:08:39 +02:00
Asger F	856b50735d	JS: Expand test case	2023-03-07 13:04:26 +01:00
tyage	232893aafa	make query parameters in ServerSideProps and next/router ... as a RemoteFlowSource	2022-10-26 14:41:07 +09:00
Asger F	67cef92f94	JS: Rewrite to use DataFlow::Node API and restrict context	2022-10-10 16:08:21 +02:00
tyage	ddc8f72ef7	accept test result Xss.qlref	2022-10-06 18:23:10 +09:00
Erik Krogh Kristensen	e387ebaedd	add domNode.innerHTML += sink as a DOM sink	2022-09-05 16:11:55 +02:00
Erik Krogh Kristensen	0e4954a68c	add navigation.navigate as an XSS / URL sink	2022-06-29 14:56:20 +02:00
Erik Krogh Kristensen	7f592a6c64	merge Clipboard.qll and DragAndDrop.qll, and support InputEvent	2022-04-18 22:17:31 +02:00
Erik Krogh Kristensen	34abef8a6c	Merge branch 'main' into dragAndDrop	2022-04-11 23:59:46 +02:00
bananabr	57fac949fd	included ClipboardEvent and DragEvent as XSS sources	2022-04-11 16:37:00 -05:00
Erik Krogh Kristensen	aafa8ddc9f	add support for domNode.onpaste for copy-paste events	2022-04-11 20:10:56 +02:00
Erik Krogh Kristensen	6713b2c671	add support for domNode.ondrop for drag-and-drop events	2022-04-11 20:06:12 +02:00
bananabr	0f1582f3f6	included JavaScript drag and drop API Xss sources	2022-04-09 22:33:30 -05:00
Asger Feldthaus	4eda6f643f	JS: Recognize subclasses of HTMLElement in domValueRef	2022-04-07 09:57:31 +02:00
Erik Krogh Kristensen	6cdc38748c	update expected output	2022-03-16 22:32:09 +01:00
Erik Krogh Kristensen	d8a5947a08	simplify TaintedUrlSuffix::source() to only consider window.location based sources	2022-03-16 22:32:09 +01:00
Erik Krogh Kristensen	f083e87fa1	refactor the js/xss query to use three flowlabels and one configuration	2022-03-16 22:32:08 +01:00
Erik Krogh Kristensen	87842bb8b7	add client-side-url sinks that may execute JavaScript as XSS sinks	2022-03-16 22:32:08 +01:00
Erik Krogh Kristensen	b471fec149	split interpretsArgumentsAsURL out of interpretsArgumentsAsHTML, and use it to generalize AttributeUrlSink	2022-03-16 22:32:08 +01:00
Asger Feldthaus	7e947b2a65	JS: Use return value of trusted type policy callback as a sink	2021-12-14 13:28:46 +01:00
Erik Krogh Kristensen	8569d261f7	add test	2021-09-13 20:43:31 +02:00
Asger Feldthaus	f1bcfa287b	JS: Add more tests	2021-08-10 08:55:03 +02:00
Asger Feldthaus	00f4694616	JS: Recognize methods returning DOM objects	2021-08-04 16:25:56 +02:00
CodeQL CI	6c2c51a767	Merge pull request #6287 from erik-krogh/react-tooltip ... Approved by asgerf	2021-07-16 02:10:36 -07:00
Erik Krogh Kristensen	ae2fc7171b	add a taint step through the ansi-to-html library	2021-07-15 14:04:16 +02:00
Erik Krogh Kristensen	22dfe84ee8	add xss sink for react-tooltip	2021-07-14 20:03:50 +02:00
Esben Sparre Andreasen	85b9003af4	JS: add Mootools XSS sinks	2021-07-01 09:17:27 +02:00
Erik Krogh Kristensen	c736606695	add support for moment/dayjs/luxon instances returned by @date-io adapters	2021-06-22 10:42:24 +02:00
Erik Krogh Kristensen	227f61b954	add model for the luxon library	2021-06-21 23:29:12 +02:00
Erik Krogh Kristensen	cdf3cdcf71	add model for the formatByString and formatByNumber functions in @date-io	2021-06-21 23:29:01 +02:00
Erik Krogh Kristensen	2a4570eaaa	add model for the dayjs library	2021-06-21 23:28:45 +02:00
Asger Feldthaus	9cfbb90591	JS: Add test case for insufficient replace-sanitizer	2021-03-17 15:20:40 +00:00
Asger Feldthaus	2e57a7d3e9	JS: Add ClientSideRemoteFlowSource	2021-03-16 13:28:09 +00:00
Erik Krogh Kristensen	1dcfc3840d	add test	2021-03-12 16:25:33 +01:00
Asger Feldthaus	18cfe72e99	JS: Add model of d3	2021-03-11 10:05:05 +00:00
CodeQL CI	d7b9251b0d	Merge pull request #5262 from max-schaefer/event-handler-receiver-is-dom-element ... Approved by asgerf	2021-03-05 02:04:59 -08:00
Max Schaefer	2e252ba3e4	JavaScript: Learn that receivers of DOM event handlers are themselves DOM nodes.	2021-02-25 09:06:58 +00:00
Esben Sparre Andreasen	9678534f25	JS: add tests for some syntactic XSS vector obfuscations	2021-02-01 10:20:23 +01:00
Asger Feldthaus	3db6069372	JS: Add test for new sink	2021-01-18 10:55:34 +00:00