Asger F
c3ad805fe8
JS: Sharpen up EnumerationRegExp
2025-02-28 13:58:11 +01:00
Asger F
cd6ebb103e
JS: Make test not assume implicit through for maps
2024-12-19 15:25:45 +01:00
Asger F
dc2f39c399
JS: Add model of Map#groupBy
2024-12-19 15:25:43 +01:00
Asger F
de5e6ddeed
JS: Update with changes in TaintTracking test
2024-12-19 15:25:42 +01:00
Asger F
8818fcc207
JS: Benign test output changes
2024-11-26 15:47:13 +01:00
Asger F
1ac7591faf
JS: Update missed flow in capture-flow.js
...
We previously caught this flow because of a heuristic in capture flow. We'll have to fix it properly later.
2024-11-21 12:57:34 +01:00
Asger F
1b85feb1fa
JS: Add imprecise post-update steps for when a captured var/this is not tracked precisely
...
With the capture library we sometimes bails out of handling certain functions for scalability reasons.
This means we have a notion of "captured but imprecisely-tracked" variables and 'this'. In these cases we go back to propagating flow from a post-update node to the local source.
2024-10-29 08:32:07 +01:00
Asger F
d557c7689c
JS: Update a test that now has more precise output
2024-10-29 08:32:06 +01:00
Asger F
12e316b99d
JS: Update test output after merging in 'main'
...
- Paths are now relative to the test case, not the qlpack
- Paths going through an implicit reads have changed slightly
2024-10-08 10:11:15 +02:00
Asger F
094112c905
Merge pull request #17213 from asgerf/jss/spread-argument
...
JS: Improve handling of spread arguments and rest parameters [shared data flow branch]
2024-09-09 13:15:22 +02:00
Asger F
cb5dbb919d
JS: Update test to reflect implicit read flow has been fixed
...
Shows the effect of https://github.com/github/codeql/pull/17262
2024-08-27 11:35:36 +02:00
Asger F
aa8bd332bf
JS: Add a few more tests
2024-08-27 11:35:31 +02:00
Asger F
371f7ef551
JS: Add implicit taint read of array elements
2024-08-27 11:35:31 +02:00
Asger F
df42e7c527
JS: Add test showing lack of implicit reads for ArrayElement
2024-08-27 11:35:30 +02:00
Asger F
4389b5c999
JS: Fix issue for .apply() calls
2024-08-27 11:35:28 +02:00
Asger F
ac1dd1850e
JS: Remove taint step from array element to whole array
2024-08-27 11:35:26 +02:00
Asger F
47c519fc0a
JS: Add test for flow through dynamic imports
2024-08-26 15:15:49 +02:00
Asger F
5e7d1d5c2c
Merge branch 'main' into js/shared-dataflow-merged
2024-03-13 14:27:16 +01:00
Asger F
858c79e395
JS: Add plain taint step through Promise.all()
2024-03-13 08:57:42 +01:00
Asger F
13a8e0fbf0
JS: Add failing test for Promise.all()
2024-03-13 08:54:06 +01:00
Asger F
18db769d6d
JS: Update expected output
2024-02-14 10:45:51 +01:00
Asger F
bafe5e3d8e
JS: Add test case (with old expected data)
2024-02-14 10:45:51 +01:00
Asger F
9faf300dd0
JS: Use type-pruning to restrict callback flow
2023-10-13 13:15:08 +02:00
Asger F
e738b5d125
JS: Expand callback test case
...
Type-based pruning is confused by the different tests being interleaved, so we additionally want to have a test that is independent from the other parts of this test.
2023-10-13 13:15:08 +02:00
Asger F
51dec79401
JS: Lower access path limit to 2
2023-10-13 13:15:08 +02:00
Asger F
7c5eb89491
JS: Add tests for captured 'this' (genuine FN)
2023-10-13 13:15:08 +02:00
Asger F
2eff07f476
JS: Update TaintTracking test
2023-10-13 13:15:08 +02:00
erik-krogh
7ca0996912
add a taint-tracking tests for calls to tagged template strings
2023-10-06 21:39:42 +02:00
erik-krogh
a57981ea69
apply suggestions from review
2022-08-23 10:18:14 +02:00
erik-krogh
45e78a355f
ensure call-apply.js is seen as a module
2022-08-23 10:11:46 +02:00
erik-krogh
2f11f3760e
simplify getALibraryInputParameter by adding more general dataflow for the arguments object
2022-08-22 08:32:43 +02:00
Erik Krogh Kristensen
11b039c1f1
add tests
2022-08-22 08:29:28 +02:00
Erik Krogh Kristensen
1717d17fb3
add flow step for Array.prototype.at
2022-05-24 12:41:27 +02:00
Asger Feldthaus
cff8dc0537
JS: Improve flow through Array.prototype.reduce
2022-04-07 09:57:31 +02:00
Asger Feldthaus
8753632193
JS: Fix bug in reachableFromStoreBase
2022-03-17 17:30:46 +01:00
Asger Feldthaus
b336c29283
JS: Track functions with methods
2021-12-10 09:38:29 +01:00
Asger Feldthaus
4ef2a5f4f1
JS: Add test
2021-12-10 09:38:29 +01:00
Erik Krogh Kristensen
d2c74480b9
add taint step through flatten libraries
2021-07-15 12:36:07 +02:00
Erik Krogh Kristensen
77f4d56cd9
add taint step through array-union, array-uniq, and uniq
2021-07-15 12:32:29 +02:00
Erik Krogh Kristensen
5ff7d208b7
add taint step through arrify
2021-07-15 11:24:50 +02:00
CodeQL CI
f9b539e5b9
Merge pull request #6253 from asgerf/js/more-precise-capture-steps
...
Approved by erik-krogh
2021-07-13 07:42:07 -07:00
CodeQL CI
c87fe95d52
Merge pull request #6258 from erik-krogh/case
...
Approved by asgerf
2021-07-13 05:44:49 -07:00
Erik Krogh Kristensen
d22ebadcf2
add support for many more case changing libraries
2021-07-12 14:09:34 +02:00
Erik Krogh Kristensen
a5d1325d3f
add support for the change-case library
2021-07-12 13:37:06 +02:00
Erik Krogh Kristensen
bef7e61e76
add support for the fast-json-stringify library
2021-07-12 11:13:01 +02:00
Erik Krogh Kristensen
40aa970db3
add support for the strip-json-comments library
2021-07-12 11:08:50 +02:00
Erik Krogh Kristensen
23c3be6860
add support for the json-cycle library
2021-07-12 11:03:39 +02:00
Erik Krogh Kristensen
f99a33598f
add support for the safe-stable-stringify library
2021-07-12 10:51:43 +02:00
Erik Krogh Kristensen
d6300bced3
add support for the replicator library
2021-07-12 10:51:43 +02:00
Erik Krogh Kristensen
babf657d9d
add support for the teleport-javascript library
2021-07-12 10:51:43 +02:00
