Erik Krogh Kristensen
|
46751e515c
|
Merge pull request #10388 from erik-krogh/exportNew
JS: recognize returning an instance of a class as exporting that class
|
2022-09-13 13:45:16 +02:00 |
|
erik-krogh
|
ceda5f69fc
|
recognize returning an instanceof of a class as exporting that class
|
2022-09-12 17:31:51 +02:00 |
|
erik-krogh
|
98243118b2
|
recognize a list of bad strings as a sanitizer for js/prototype-polluting-assignment
|
2022-09-12 13:41:07 +02:00 |
|
erik-krogh
|
2f11f3760e
|
simplify getALibraryInputParameter by adding more general dataflow for the arguments object
|
2022-08-22 08:32:43 +02:00 |
|
Erik Krogh Kristensen
|
d86b7f6c54
|
recognize an access to the arguments object as library-input
|
2022-08-22 08:29:24 +02:00 |
|
erik-krogh
|
3355a7a046
|
generalize BarrierGuardFunctionto work on function that have multiple parameters
|
2022-08-16 09:13:15 +02:00 |
|
Erik Krogh Kristensen
|
82c6c22d50
|
make a model for hasOwnProperty calls and similar
|
2022-05-24 14:13:53 +02:00 |
|
Erik Krogh Kristensen
|
2a97dd9f6f
|
add support for Object.hasOwn(obj, key)
|
2022-05-24 13:59:25 +02:00 |
|
Erik Krogh Kristensen
|
ba844aa0ab
|
Merge branch 'main' into exportObj
|
2022-05-23 14:18:31 +02:00 |
|
Erik Krogh Kristensen
|
9050f9999c
|
recognize functions that return object of methods as library input
|
2022-05-12 09:56:19 +02:00 |
|
Erik Krogh Kristensen
|
b1e8b3332c
|
resolve main module when there is a folder with the same name as the main file
|
2022-05-12 08:20:30 +02:00 |
|
Stephan Brandauer
|
3f13a5e082
|
fix a FN for prototype polluting function query
|
2022-04-28 22:00:09 +02:00 |
|
Stephan Brandauer
|
4964f2df9a
|
add flow step to rest parameters
|
2022-04-27 16:03:19 +02:00 |
|
Erik Krogh Kristensen
|
4fba5e4dfb
|
step through parentheses in barrier functions
|
2022-02-25 17:47:12 +01:00 |
|
Erik Krogh Kristensen
|
517e17d422
|
support more property writes in js/prototype-pollution-utility, and generalize ObjectDefinePropertyAsPropWrite
|
2022-02-22 13:23:34 +01:00 |
|
Erik Krogh Kristensen
|
99f5f70345
|
Merge branch 'main' into protoLib
|
2021-11-04 12:53:53 +01:00 |
|
Asger Feldthaus
|
08bc80ffdb
|
JS: Block prototype pollution assignment flows through .replace()
|
2021-11-03 13:24:29 +01:00 |
|
Erik Krogh Kristensen
|
4f6e5c903b
|
filter out writes to number indexes
|
2021-10-28 14:27:07 +02:00 |
|
Erik Krogh Kristensen
|
96b6f670d9
|
filter away paths that start with libary inputs and end with a fixed-property write
|
2021-10-27 21:01:11 +02:00 |
|
Erik Krogh Kristensen
|
a9a9e34265
|
recognize delete expresssions as a sink for js/prototype-polluting-assignment
|
2021-10-27 20:37:42 +02:00 |
|
Erik Krogh Kristensen
|
2dedfb302a
|
remove paths without unmatched returns from js/prototype-polluting-assignment
|
2021-10-27 20:37:42 +02:00 |
|
Erik Krogh Kristensen
|
0c9c9bbde7
|
detect library input when the arguments object is converted to an array
|
2021-10-27 20:37:41 +02:00 |
|
Erik Krogh Kristensen
|
d1238dfd8b
|
update alert message to distinguish between library input and remote flow
|
2021-10-27 20:35:38 +02:00 |
|
Erik Krogh Kristensen
|
6e183af383
|
ignore test files for the `prototypeLessObject' predicate
|
2021-10-27 20:35:37 +02:00 |
|
Erik Krogh Kristensen
|
e94b0f5913
|
recognize inclusion based sanitizers for js/prototype-polluting-assignment
|
2021-10-27 20:35:37 +02:00 |
|
Erik Krogh Kristensen
|
2a808b2cd6
|
track taint through string coercions for js/prototype-polluting-assignment
|
2021-10-27 20:35:37 +02:00 |
|
Erik Krogh Kristensen
|
2d65aa17db
|
recognize exported functions that use the arguments object
|
2021-10-27 20:35:37 +02:00 |
|
Erik Krogh Kristensen
|
78774233c7
|
add library input as source to js/prototype-polluting-assignment
|
2021-10-27 20:35:36 +02:00 |
|
Asger Feldthaus
|
cb0075f15a
|
JS: Remove use of deprecated API
|
2021-08-12 09:30:43 +02:00 |
|
Asger Feldthaus
|
254ac7f963
|
JS: Fix TypeofCheck
|
2020-12-07 10:46:00 +00:00 |
|
Asger Feldthaus
|
daab3c1437
|
JS: Add tests and fix some bugs
|
2020-12-07 10:16:38 +00:00 |
|
Asger Feldthaus
|
0a7513fdfb
|
JS: Move and rename test cases as well
|
2020-12-07 10:16:38 +00:00 |
|