Asger F
0496de6c8f
JS: Accept alerts in UselessCharacterEscape
2025-02-28 13:29:22 +01:00
Asger F
aade1e863d
JS: Add a related location in UnusedOrUndefinedStateProperty
2025-02-28 13:29:21 +01:00
Asger F
8ef51c495f
JS: Fix wrong expectation in UnusedOrUndefinedStateProperty
2025-02-28 13:29:19 +01:00
Asger F
87ed86e4fd
JS: Update UnusedOrUndefinedStateProperty
...
Using RelatedLocations to add clarity
2025-02-28 13:29:18 +01:00
Asger F
605999454a
JS: Accept more results in SpuriousArguments
2025-02-28 13:29:17 +01:00
Asger F
dc28bb527b
JS: Fix alert location and use RelatedLocation in InsecureUrlWhitelist
2025-02-28 13:29:16 +01:00
Asger F
a1c13f02be
JS: Remove alert marker that's reported on another line
...
We had two 'NOT OK' comments for the same alert. The alert appears on the 'pref' object above.
2025-02-28 13:29:14 +01:00
Asger F
2b33ed3671
JS: Remove incorrect alert marker
2025-02-28 13:29:13 +01:00
Asger F
6cf1334c6d
Fix comment style in UnboundEventHandlerReceiver
2025-02-28 13:29:12 +01:00
Asger F
7623ebb13b
JS: Accept changes in UseOfReturnlessFunction
2025-02-28 13:29:11 +01:00
Asger F
507a0918ad
JS: More alert updates in UselessConditional
2025-02-28 13:29:10 +01:00
Asger F
e634b31c27
JS: Accept some UselessConditional alerts
2025-02-28 13:29:08 +01:00
Asger F
4d7cbe6f60
JS: Accept to web socket-based SSRF alerts
2025-02-28 13:29:07 +01:00
Asger F
764eb98809
JS: Move two alerts and add query ID
2025-02-28 13:29:06 +01:00
Asger F
976096540f
JS: Accept an alert
2025-02-28 13:29:05 +01:00
Asger F
49274d5f73
JS: Accept an alert
2025-02-28 13:29:03 +01:00
Asger F
2d1aa3e00a
JS: Accept missing alert and clarify reason
2025-02-28 13:29:02 +01:00
Asger F
9f8744680d
JS: Remove a fixed spurious alert
2025-02-28 13:29:01 +01:00
Asger F
3a535dbf68
JS: Accept another alert
2025-02-28 13:29:00 +01:00
Asger F
db98dc6272
JS: Move some alerts and add query IDs
2025-02-28 13:28:59 +01:00
Asger F
c79d355d26
JS: Update alerts in example_bypass.js
...
We happen to flag the condition with different-kinds-comparison-bypass.
The ConditionalBypass query was originally intended to flag this I think, but doesn't anymore.
2025-02-28 13:28:57 +01:00
Asger F
7ed5398688
JS: Accept some different-kind comparison-bypass alerts
2025-02-28 13:28:55 +01:00
Asger F
a1796bda8a
JS: Accept some new alerts in HardcodedCredentials
...
I think these were just missing 'NOT OK' comments
2025-02-28 13:28:54 +01:00
Asger F
2bed3a40bf
JS: Mark some missing alerts in HardcodedCredentials
...
Not sure why
2025-02-28 13:28:52 +01:00
Asger F
9ef5a97b4e
JS: Accept alerts in HardcodedCredentials and add Sink tags
...
This query now uses the source as the primary alert location, and some old comments appeared at the sink.
To make the change easier to verify, this commit migrates the test to include Sink tags. (Source/Sink tags in general are added later)
2025-02-28 13:28:51 +01:00
Asger F
7fa63fa6ee
JS: Update alerts in HardcodedCredentials test
...
Note that file is inside a folder named __tests__. The same code is found in another file outside the test folder, where it is flagged.
2025-02-28 13:28:50 +01:00
Asger F
69b2d197e6
JS: Move an alert and add RelatedLocations
2025-02-28 13:28:48 +01:00
Asger F
360c76514c
JS: Accept some suboptimal alert locations
...
Not perfect alert locations, but not important enough to fix right now
2025-02-28 13:28:47 +01:00
Asger F
dbc079c880
JS: Accept a spurious alert
...
Unlike the previous case 'isLocalUrl' actually resolves to a function in this case, but we don't recognise the sanitiser used in it. Fixing it is out of scope for this PR.
2025-02-28 13:28:46 +01:00
Asger F
29659647ea
JS: Fix barrier guards for ServerSideUrlRedirect
...
The barrier guards for ServerSideUrlRedirect were lost when it was ported to ConfigSig, and the aforementioned spurious alert was a result of that.
The query had two guards: a proper barrier guard and a heuristic one for functions named 'isLocalURL'. We should move away from the heuristic name-based sanitiser guards, so I'm only reinstating the proper barrier guard.
Therefore updating the test to test the real barrier guard.
2025-02-28 13:28:43 +01:00
Asger F
38be524b6a
JS: Temporarily accept a spurious alert
...
This was due to a bug that will be fixed in the following commit
2025-02-28 13:28:41 +01:00
Asger F
7c2394fab4
JS: Accept some alerts
2025-02-28 13:28:40 +01:00
Asger F
b734a3d804
JS: Fix a test case bug due to a typo
...
We got a missing result on that line
2025-02-28 13:28:39 +01:00
Asger F
1ee93cf51b
JS: Manually fix two comments in JSX
2025-02-28 13:28:37 +01:00
Asger F
0f23c33d3c
JS: Fix a comment
...
Apparently this comment used to say 'NOT OK' but clearly 'OK' was meant
2025-02-28 13:28:36 +01:00
Asger F
cd788bc509
JS: Mark what seems to be missing alerts for fflate
...
The query doesn't seem to model or even mention fflate. Not sure if the library is safe or just not modeled.
2025-02-28 13:28:35 +01:00
Asger F
3f7f74b925
JS: Accept alerts for DecompressionBomb
2025-02-28 13:28:33 +01:00
Asger F
48760d66b2
JS: Accept alerts for HardcodedDataInterpretedAsCode
2025-02-28 13:28:32 +01:00
Asger F
260c66b3cf
JS: Mark a spurious alert in missing-x-frame-options
2025-02-28 13:28:30 +01:00
Asger F
cea53371f2
JS: Accept alerts for missing-x-frame-options
2025-02-28 13:28:29 +01:00
Asger F
cded75766f
JS: Add a query ID
2025-02-28 13:28:28 +01:00
Asger F
a0f8e28790
JS: Accept a fixed FN
2025-02-28 13:28:27 +01:00
Asger F
1fcebcec87
JS: Move some ReDoS alerts
2025-02-28 13:28:25 +01:00
Asger F
266ac09637
JS: Add query iDs
2025-02-28 13:28:24 +01:00
Asger F
082e16b3d3
JS: More Alert comments in ReDoS/tst.js based on variable naming
...
Again just trying to translate the original intent behind the test, without taking actual query results into account
2025-02-28 13:28:23 +01:00
Asger F
607b184a7f
JS: Fix a bug in test case
2025-02-28 13:28:22 +01:00
Asger F
51fb3dad74
JS: Accept ReDoS alerts in regexplib
2025-02-28 13:28:21 +01:00
Asger F
d298d8740f
JS: Accept some exponenital redos alerts in the polynomial redos test suite
2025-02-28 13:28:19 +01:00
Asger F
283b14207d
JS: Accept some ReDoS alerts
2025-02-28 13:28:18 +01:00
Asger F
92c3939457
JS: Accept InsecureRandomness alerts
2025-02-28 13:28:17 +01:00
