Asger F
2a194a53af
raw test output
2025-02-28 13:29:39 +01:00
Asger F
64d39da5f8
JS: Accept Sources/Sink tags
2025-02-28 13:29:30 +01:00
Asger F
e026b9e048
JS: Mark regressions due to lack of local field steps
2025-02-28 13:27:52 +01:00
Asger F
10a7294327
JS: Accept trivial test changes
...
This adds Alert annotations for alerts that seem intentional by the test
but has not been annotated with 'NOT OK', or the comment was in the wrong
place.
In a few cases I included 'Source' expectations to make it easier to see
what happened. Other 'Source' expectations will be added in bulk a later
commit.
2025-02-28 13:27:43 +01:00
Asger F
0453ded338
JS: Add query ID to some alerts
2025-02-28 13:27:41 +01:00
Asger F
f5911c9e5a
JS: Accept raw test output
2025-02-28 13:27:38 +01:00
Asger F
d0ce53ed82
JS: Enable post-processing for all .qlref files
2025-02-28 13:27:33 +01:00
Asger F
426edd55f2
JS: Update output after line number change
...
Some OK-style comments had to be moved to the following line, shifting line numbers.
In selected range also included the comments themselves.
Lastly, the result sets were reordered by the CLI in some cases.
2025-02-28 13:27:31 +01:00
Asger F
9be041e27d
JS: Update OK-style comments to $-style
2025-02-28 13:27:28 +01:00
Asger F
d79f429978
JS: Update changes to nodes/edges/subpaths
...
No changes in actual alerts
2025-02-17 10:36:05 +01:00
Asger F
52ba91a7f8
JS: Updates to nodes/edges in tests
...
Only changes to nodes/edges for various reasons, no actual result changes
2024-10-29 08:32:13 +01:00
Asger F
2e2181be2c
JS: Update test output that only affects nodes/edges/subpaths
2024-08-27 11:35:33 +02:00
Asger F
2473274681
JS: Benign test output changes
2024-06-27 09:06:45 +02:00
Asger F
53efb5837b
JS: Update some tests with provenance columns
...
Only includes the changes that purely contain the new provenance columns
2024-06-26 13:51:44 +02:00
Asger F
9b46c4596c
JS: Update HeuristicSoruceCodeInjection test
2023-10-13 13:15:08 +02:00
Asger F
32022ccbda
JS: Port UnsafeCodeConstruction
2023-10-13 13:15:05 +02:00
Asger F
9128722627
JS: Port ImproperCodeSanitization
2023-10-13 13:15:05 +02:00
Asger F
fcfab5238e
JS: Port CodeInjection
2023-10-13 13:15:03 +02:00
jorgectf
2ac334bf15
Adapt Webix modeling to support HTML use-cases
2023-06-28 15:26:30 +02:00
jorgectf
1e663b8889
Update HeuristicSourceCodeInjection.expected
2023-06-26 13:32:20 +02:00
Jorge
08b9a5e2b2
Add missing ;
2023-06-23 23:10:06 +02:00
jorgectf
6947e99c15
Add models for webix
...
Co-authored-by: Kevin Stubbings <Kwstubbs@users.noreply.github.com >
2023-06-22 01:07:33 +02:00
Asger F
1a9956354e
JS: Restrict getInput to indirect command injection query
2023-05-03 16:10:03 +02:00
Asger F
08785a4063
JS: Add sources from actions/core
2023-05-01 11:42:17 +02:00
Asger F
cb95dbfa14
JS: Add tests
2023-05-01 11:42:17 +02:00
erik-krogh
34fe1a8f5e
use SSA in the GetLaterAccess module
2023-03-21 15:19:15 +01:00
erik-krogh
6192544fb4
add test for express-ws as a source
2023-02-13 15:26:50 +01:00
erik-krogh
02da718786
add code-injection sink for node-pty
2023-01-30 15:14:25 +01:00
erik-krogh
fc38bf0429
Merge branch 'main' into aliasFlow
2022-11-07 09:46:48 +01:00
erik-krogh
368f84785b
fix some more style-guide violations in the alert-messages
2022-10-07 11:22:22 +02:00
erik-krogh
dcdff7a995
Merge branch 'main' into aliasFlow
2022-09-22 16:01:31 +02:00
erik-krogh
843fce4bcd
expand localFieldStep to use access-paths, and build access-paths in more cases
2022-09-13 21:43:06 +02:00
erik-krogh
a35fe1ffab
Merge branch 'main' into js-followMsg
2022-09-08 13:09:15 +02:00
erik-krogh
6447234428
recognize calls to Function where spread arguments are used
2022-09-07 22:55:51 +02:00
erik-krogh
e829387cdb
add failing test for call the Function with a spread argument
2022-09-07 22:54:21 +02:00
erik-krogh
aa56ca37ae
make the alert messages of taint-tracking queries more consistent
2022-09-05 14:04:52 +02:00
Erik Krogh Kristensen
f71a64b99d
recognize when the js engine in gray-matter is set to something safe
2022-06-30 09:00:10 +02:00
Erik Krogh Kristensen
22d285f777
add model for the gray-matter libary to js/code-injection
2022-06-30 09:00:10 +02:00
Erik Krogh Kristensen
d1d4ebb3b5
add values written to the global scope as exports
2022-02-07 13:34:18 +01:00
Erik Krogh Kristensen
d790f3ccbb
add test for unsafe-code-construction query
2022-02-07 13:34:18 +01:00
Erik Krogh Kristensen
955ad8c458
add JSON.stringify as a code-injection sanitizer
2022-02-07 13:34:18 +01:00
Erik Krogh Kristensen
68a5c1f5b5
add code-injection sink for calls to node
2022-02-07 13:34:18 +01:00
Asger Feldthaus
cb0075f15a
JS: Remove use of deprecated API
2021-08-12 09:30:43 +02:00
Max Schaefer
ce24215dd5
JavaScript: Improve modelling of Module.prototype._compile sink.
2021-07-12 15:32:21 +01:00
Erik Krogh Kristensen
2ba2642c7a
add more template sinks for the js/code-injection query
2021-06-22 20:24:42 +02:00
Asger Feldthaus
710cca5395
JS: Update expectations with new sources
2021-03-16 13:28:12 +00:00
Erik Krogh Kristensen
aae69c6537
update expected output
2021-02-01 09:33:52 +01:00
Erik Krogh Kristensen
39591687ba
add js/code-injection sink for script tags in React
2021-01-29 12:50:17 +01:00
Asger Feldthaus
68d2bc861d
JS: Update test expectations
2020-12-03 15:01:50 +00:00
Asger Feldthaus
6211fe718b
JS: Add test
2020-12-01 17:05:48 +00:00
