1251 Commits

Author	SHA1	Message	Date
Jami	5259a6ecfc	Merge pull request #13324 from jcogs33/jcogs33/shared-sink-kind-validation ... Shared: share MaD kind validation across languages	2023-06-20 11:56:12 -04:00
Asger F	318a60b208	Merge pull request #13456 from asgerf/js/vuex-perf ... JS: Restrict length of state path in vuex model	2023-06-14 19:50:06 +02:00
Asger F	22b98c8959	JS: Restrict length of state path in vuex model	2023-06-14 15:48:58 +02:00
Jami	35591113c2	Merge branch 'main' into jcogs33/shared-sink-kind-validation	2023-06-14 08:06:34 -04:00
erik-krogh	cd6f738f72	add mongoose.Types.ObjectId.isValid as a sanitizer-guard for NoSQL injection	2023-06-12 16:38:11 +02:00
Jami Cogswell	9abe3e3da4	Shared: use a module as input to 'KindValidation'	2023-06-09 14:35:37 -04:00
Jami Cogswell	da58b2afc8	Shared: move shared file to 'shared' folder and add parameterized module for 'getInvalidModelKind'	2023-06-08 20:05:27 -04:00
Asger F	76a8e9827e	Merge pull request #13283 from asgerf/js/restrict-regex-search-function ... JS: Be more conservative about flagging "search" call arguments as regex	2023-06-08 10:50:51 +02:00
Jami Cogswell	5a23421d9a	Shared: minor updates to comments	2023-06-05 13:46:56 -04:00
Jami Cogswell	9d5972acc2	Shared: update qldocs	2023-06-05 12:18:34 -04:00
Jami Cogswell	3f1dc8e5c7	Shared: add outdated Swift sink kinds	2023-06-05 12:18:34 -04:00
Jami Cogswell	62ac0dc471	Shared: add outdated sink kind msg to 'getInvalidModelKind' for all languages	2023-06-05 12:18:33 -04:00
Jami Cogswell	76f5dca861	Shared: move 'OutdatedSinkKind' to shared file and add outdated JS and C# sink kinds	2023-06-05 12:18:33 -04:00
Jami Cogswell	7b629f5d63	Shared: include 'qltest%' and 'test-%'	2023-06-05 12:18:33 -04:00
Jami Cogswell	254e447923	JS/Python/Ruby: update getInvalidModelKind	2023-06-05 12:18:33 -04:00
Jami Cogswell	7317c29eea	Shared: update kind information	2023-06-05 12:18:33 -04:00
Jami Cogswell	0ab1848b70	JS/Python/Ruby: use 'SharedModelValidation' file	2023-06-05 12:18:33 -04:00
Jami Cogswell	ddb5d92ef8	Shared: add source, summary, and neutral shared valid kinds	2023-06-05 12:18:33 -04:00
Jami Cogswell	869f820fcf	Shared: add 'SharedModelValidation' file as experiment	2023-06-05 12:18:33 -04:00
Jami Cogswell	e24e3a6115	JS/Python/Ruby: add getInvalidModelKind as experiment	2023-06-05 12:18:33 -04:00
erik-krogh	9000243828	JS: fix compilation	2023-06-02 11:58:08 +02:00
erik-krogh	44b6366586	delete old deprecations	2023-06-02 11:58:08 +02:00
Asger F	77d2799278	Update javascript/ql/lib/semmle/javascript/Regexp.qll ... Co-authored-by: Erik Krogh Kristensen <erik-krogh@github.com>	2023-06-02 10:33:44 +02:00
erik-krogh	8eed1a95f6	stop recursive fromRhs related to getLaterBaseAccess	2023-06-01 23:16:52 +02:00
Jami	3886ebffa9	Merge branch 'main' into jcogs33/update-javascript-sink-kinds	2023-06-01 14:09:10 -04:00
Asger F	2629ec1b1d	JS: Be more conservative about flagging "search" call arguments as regex	2023-05-26 11:55:53 +02:00
Erik Krogh Kristensen	e658177c31	Merge pull request #12975 from tyage/support-sub-modules ... JS: Support sub modules	2023-05-23 09:24:43 +02:00
Erik Krogh Kristensen	653cd86c13	update qldoc	2023-05-22 20:48:21 +02:00
erik-krogh	cbd7601a41	implement isShellInterpreted on ExecActionsCall	2023-05-17 11:07:48 +02:00
erik-krogh	3293a55e8f	require arguments to be shell interpreted to be flagged by indirect-command-injection	2023-05-17 11:07:45 +02:00
Jami Cogswell	359f6ffd1e	JS: update 'credentials[%]' sink kind to 'credentials-%'	2023-05-16 15:45:55 -04:00
Jami Cogswell	7880e9e92c	JS: update 'command-line-injection' sink kind to 'command-injection'	2023-05-16 15:45:55 -04:00
Asger F	20e8ee8423	Merge pull request #12748 from JarLob/yi ... JS: Add more sources, more unit tests, fixes to the GitHub Actions injection query	2023-05-15 11:03:00 +02:00
tyage	93af0d0c2f	formatting	2023-05-13 17:37:31 +00:00
tyage	6f66c047d0	JS: ignoresub pkgs in node_modules directory	2023-05-13 09:12:28 +00:00
Kasper Svendsen	189f8515c0	JS: Make implicit this receivers explicit	2023-05-12 09:49:14 +02:00
Kasper Svendsen	489a73c2c3	JS: Make implicit this receivers explicit	2023-05-11 11:50:56 +02:00
tyage	f6a8cd27ca	Update javascript/ql/lib/semmle/javascript/NPM.qll ... Co-authored-by: Erik Krogh Kristensen <erik-krogh@github.com>	2023-05-10 19:36:49 +09:00
Asger F	f4b5f39c57	Merge pull request #13044 from cklin/javascript-locatable-tostring-join-ordering ... JS: Add pragma[only_bind_out] to Locatable::toString() calls	2023-05-10 10:08:48 +02:00
Asger F	c376eeb133	Merge pull request #12978 from asgerf/js/github-actions-sources ... JS: Add sources and sinks related to GitHub Actions	2023-05-10 09:55:24 +02:00
Asger F	b28254327a	Update javascript/ql/lib/semmle/javascript/security/dataflow/IndirectCommandInjectionCustomizations.qll ... Co-authored-by: Erik Krogh Kristensen <erik-krogh@github.com>	2023-05-10 08:16:31 +02:00
Kasper Svendsen	c7d72e0d34	JS: Prevent join order regression	2023-05-09 17:01:41 +02:00
Jaroslav Lobačevski	891a94c166	Apply suggestions from code review ... Co-authored-by: Asger F <asgerf@github.com>	2023-05-09 16:27:32 +02:00
Jaroslav Lobačevski	1ad23c5366	Apply suggestions from code review ... Co-authored-by: Asger F <asgerf@github.com>	2023-05-09 12:23:06 +02:00
Chuan-kai Lin	0984fc7cce	JS: Add pragma[only_bind_out] to Locatable::toString() calls	2023-05-04 13:20:56 -07:00
Kasper Svendsen	65deb9d90a	Merge pull request #13016 from kaspersv/kaspersv/js-explicit-this-receivers3 ... JS: Make implicit this receivers explicit	2023-05-04 09:15:01 +02:00
Asger F	1a9956354e	JS: Restrict getInput to indirect command injection query	2023-05-03 16:10:03 +02:00
Kasper Svendsen	67950c8e6b	JS: Make implicit this receivers explicit	2023-05-03 15:31:00 +02:00
Kasper Svendsen	aca2ace843	JS, Python, Ruby: Make implicit this receivers explicit	2023-05-03 13:51:51 +02:00
Kasper Svendsen	efdaffedee	JS: Make implicit this receivers explicit	2023-05-03 10:49:46 +02:00