52 Commits

Author	SHA1	Message	Date
Asger Feldthaus	945db4d86c	JS: Fix test output	2020-06-02 16:38:21 +01:00
Asger Feldthaus	707b0f33a0	JS: Use in ContainsHTMLGuard	2020-06-01 12:06:40 +01:00
Erik Krogh Kristensen	33da82d884	Merge branch 'master' of https://github.com/github/codeql into pr/erik-krogh/3566	2020-05-27 12:21:14 +00:00
Erik Krogh Kristensen	319363f56c	update expected output	2020-05-26 18:47:37 +02:00
Erik Krogh Kristensen	ad40c4b0f2	add a sanitizer guard for safe attribute string concatenations	2020-05-26 12:36:47 +02:00
Erik Krogh Kristensen	9254df1f78	sanitize optionally sanitized values	2020-05-26 00:09:11 +02:00
Erik Krogh Kristensen	7af19559d4	add test case for location.split("?")[0] for DomBasedXss	2020-05-05 09:13:21 +02:00
Erik Krogh Kristensen	ee43db1b58	slightly expand the $().each model	2020-04-23 16:49:47 +02:00
Erik Krogh Kristensen	ce106981b3	add tests	2020-04-23 14:24:33 +02:00
Erik Krogh Kristensen	e1423b0fa5	add test for jGrowl	2020-04-23 11:58:06 +02:00
Erik Krogh Kristensen	4864e77430	Merge branch 'master' of git.semmle.com:Semmle/ql into UrlSearch	2020-03-27 15:59:29 +01:00
Erik Krogh Kristensen	58af63d8cc	add test case for XSS on url suffix	2020-03-27 10:02:24 +01:00
Erik Krogh Kristensen	68ffd52d4c	update expected output	2020-03-09 16:45:10 +01:00
Erik Krogh Kristensen	8d37c03209	using pseudo-properties to model URL parsing	2020-02-04 16:30:07 +01:00
Erik Krogh Kristensen	bf56797ad7	update expected output of tests	2019-12-17 16:27:55 +01:00
Asger F	2acd616e6f	JS: Review comments	2019-12-06 11:53:06 +00:00
Erik Krogh Kristensen	c6c1ebe81a	Merge remote-tracking branch 'upstream/master' into typeAheadSink	2019-12-02 08:41:49 +01:00
Erik Krogh Kristensen	34e44e89fd	Merge remote-tracking branch 'upstream/master' into typeAheadSink	2019-11-27 15:19:06 +01:00
Erik Krogh Kristensen	9351cd44e4	Merge remote-tracking branch 'githubsemmle/master' into HEAD	2019-11-27 13:45:59 +01:00
Asger F	605c8834c6	JS: Avoid redundant window.name sources	2019-11-27 06:15:12 +00:00
Erik Krogh Kristensen	7b262fa9cf	update expected output	2019-11-26 14:39:09 +01:00
Erik Krogh Kristensen	5a0cabb039	Merge remote-tracking branch 'upstream/master' into typeAheadSink	2019-11-26 14:37:40 +01:00
Erik Krogh Kristensen	f284b3a2bb	Merge remote-tracking branch 'upstream/master' into exceptionXss	2019-11-26 10:54:04 +01:00
Erik Krogh Kristensen	c7235bb372	add sources and sinks for typeahead.js	2019-11-25 10:46:54 +01:00
Erik Krogh Kristensen	7d825af9a3	Added an XSS sink for Handlebars.SafeString	2019-11-22 15:56:21 +01:00
Erik Krogh Kristensen	94e9c0203d	add test for exceptional taint-flow	2019-11-21 17:16:13 +01:00
Erik Krogh Kristensen	d36312cf9f	update expected output	2019-11-15 16:08:13 +01:00
Max Schaefer	b42026a90a	JavaScript: Update expected output.	2019-10-29 15:36:24 +00:00
Max Schaefer	dc1d1c2f22	JavaScript: Update expected output.	2019-10-29 15:30:06 +00:00
Max Schaefer	6964945c74	JavaScript: Restrict edges to only contain nodes.	2019-10-29 15:03:52 +00:00
Asger F	8aa34e6a54	JS: Add XSS test case for new PostMessageEventHandler cases	2019-10-21 11:32:22 +01:00
Erik Krogh Kristensen	2729566bbf	add setAttributeNS('xlink', 'href',..) example in XSS test	2019-09-09 09:41:08 +01:00
Erik Krogh Kristensen	c780956f0d	add setAttributeNS method in the XSS test	2019-09-06 21:56:29 +01:00
Erik Krogh Kristensen	ccdc821c5d	add xlink:href as xss target when using setAttribute	2019-09-06 14:43:47 +01:00
Max Schaefer	b6220998d1	JavaScript: Restrict setAttribute sink to potentially dangerous attribute names.	2019-08-30 11:57:29 +01:00
Max Schaefer	78ce290de3	JavaScript: Fix DomMethodCallExpr.interpretsArgumentsAsHTML.	2019-08-28 11:22:03 +01:00
Asger F	9046fd15f7	JS: Update expected output of XSS query (benign)	2019-05-23 08:56:01 +01:00
Asger F	50a77ea843	JS: update test expectations	2019-03-06 08:41:03 +00:00
Esben Sparre Andreasen	4ce7ec1661	JS: add XSS vector for Vue's v-html	2019-02-25 12:17:56 +01:00
Max Schaefer	2fce626c3a	JavaScript: Add Range.prototype.createContextualFragment as an XSS sink.	2019-02-12 16:32:30 +00:00
Asger F	7f538e82c0	JS: add test case for non-whitelisted use of location	2018-12-18 13:55:05 +00:00
Asger F	02978c97f1	JS: whitelist $(location) in simple cases	2018-12-18 13:11:42 +00:00
Asger F	c17eca90a1	JS: add test case for $(location)	2018-12-18 13:06:12 +00:00
Max Schaefer	e194021c3b	Merge pull request #629 from esben-semmle/js/persistent-read-taint ... JS: add persistent storage taint steps	2018-12-13 08:24:42 +00:00
Asger F	a96c53f9b8	JS: restrict when a variable reference is considered a source	2018-12-12 12:28:26 +00:00
Esben Sparre Andreasen	28b4a78430	JS: introduce DOM::PersistentWebStorage	2018-12-06 14:53:22 +01:00
Max Schaefer	ef347b3870	JavaScript: Teach Xss query about WinJS HTML injection functions.	2018-12-06 09:13:21 +00:00
Max Schaefer	9221b62ded	JavaScript: Update expectd test output for security path queries to include nodes and edges query predicates.	2018-11-14 09:32:31 +00:00
Asger F	e0d5557ef4	JS: add email HTML body as XSS sink	2018-11-07 11:31:40 +00:00
Asger F	030bae9454	JS: Canonicalize ThisNode	2018-10-09 08:53:41 +01:00