Asger F
b54ff3b5b3
JS: Accept an alert
2025-02-28 13:28:10 +01:00
Asger F
576dbcb020
JS: Stop overriding entire module.exports object in test
...
Doing `module.exports = blah` prevents other exports from being seen as library inputs.
2025-02-28 13:28:09 +01:00
Asger F
f72cd21a55
JS: Some more test changes in SpuriousArguments
2025-02-28 13:28:08 +01:00
Asger F
d3de6d18a4
JS: Accept other changes to UnusedVariable
2025-02-28 13:28:07 +01:00
Asger F
e745f42291
JS: Remove alert expectation from step
...
This is just a step on the path, not a sink
2025-02-28 13:28:06 +01:00
Asger F
319ee2ccd5
JS: Track deep flow through qs.stringify
2025-02-28 13:28:04 +01:00
Asger F
c593853710
JS: Record some missing alerts in FileAccessToHttp
2025-02-28 13:28:03 +01:00
Asger F
cf33db78cc
JS: Fix the spurious flow
2025-02-28 13:28:02 +01:00
Asger F
c051b4c98d
JS: Add spurious alert marker
2025-02-28 13:28:00 +01:00
Asger F
b095fe2a19
JS: Fix some bugs in a test case
...
'args' was a redeclared block-level variable, and 'myArgs' was not used when clearly intended to be used
2025-02-28 13:27:59 +01:00
Asger F
22c218d665
JS: Mark a 'good' test as 'bad' and add Alert marker
...
The lack of whitespace around '&&' is problematic
2025-02-28 13:27:58 +01:00
Asger F
a9b263f465
JS: Remove incorrect alert expectation
...
This is not flagged and AFAICT it shouldn't be
2025-02-28 13:27:57 +01:00
Asger F
287753187e
JS: Remove invalid syntax from test
...
TS decorators may not appear on functions and enums
2025-02-28 13:27:56 +01:00
Asger F
426a871405
JS: Remove incorrect Alert marker
...
This is expected, based on a comment earlier in the file about the 'y' variable
2025-02-28 13:27:54 +01:00
Asger F
2c46e10678
JS: Mark an alert as missing
2025-02-28 13:27:53 +01:00
Asger F
e026b9e048
JS: Mark regressions due to lack of local field steps
2025-02-28 13:27:52 +01:00
Asger F
e5bee19b19
JS: Accept a double-flagged line
...
This is flagged by two queries but for two separate issues. Seems valid to flag it twice.
2025-02-28 13:27:51 +01:00
Asger F
68fae9ded8
JS: Accept alerts about newline replacement
2025-02-28 13:27:49 +01:00
Asger F
1f3c49638b
JS: Accept some less obvious alerts
...
These are listed in a function called 'good' but it's difficult to say in isolation whether they should be flagged or not. Accepting the changes as they seem reasonable.
2025-02-28 13:27:48 +01:00
Asger F
f395651807
JS: Mark alert as MISSING
...
See https://github.com/github/codeql-javascript-team/issues/447
2025-02-28 13:27:47 +01:00
Asger F
07a876b4e9
JS: Accept some alerts at the SystemCommandExecution location
2025-02-28 13:27:46 +01:00
Asger F
10a7294327
JS: Accept trivial test changes
...
This adds Alert annotations for alerts that seem intentional by the test
but has not been annotated with 'NOT OK', or the comment was in the wrong
place.
In a few cases I included 'Source' expectations to make it easier to see
what happened. Other 'Source' expectations will be added in bulk a later
commit.
2025-02-28 13:27:43 +01:00
Asger F
0453ded338
JS: Add query ID to some alerts
2025-02-28 13:27:41 +01:00
Asger F
86932c51bc
JS: Move some alerts to their correct location
...
One of the diffs look confusing but:
Previously parameter {2,3} where flagged, now parameter {1,2} are flagged.
Note that for command injection, the SystemCommandExecution is flagged
despite the test file claiming otherwise.
2025-02-28 13:27:40 +01:00
Asger F
f5911c9e5a
JS: Accept raw test output
2025-02-28 13:27:38 +01:00
Asger F
795c1100fc
JS: Disable for SyntaxError
...
The presence of a syntax error sometimes prevents us from parsing the inline comment correctly.
2025-02-28 13:27:37 +01:00
Asger F
789a7bdb48
JS: Disable for test with alerts in a JSON file
...
JSON does not support comments so we can't use inline expectations
2025-02-28 13:27:36 +01:00
Asger F
ac6547fd01
JS: Disable for comment-related alerts
2025-02-28 13:27:35 +01:00
Asger F
d0ce53ed82
JS: Enable post-processing for all .qlref files
2025-02-28 13:27:33 +01:00
Asger F
426edd55f2
JS: Update output after line number change
...
Some OK-style comments had to be moved to the following line, shifting line numbers.
In selected range also included the comments themselves.
Lastly, the result sets were reordered by the CLI in some cases.
2025-02-28 13:27:31 +01:00
Asger F
9be041e27d
JS: Update OK-style comments to $-style
2025-02-28 13:27:28 +01:00
Asger F
7e5c24a8ec
JS: Remove uses of old inline expectation test library
2025-02-28 13:27:26 +01:00
Asger F
79e2a758d7
JS: Allow more kinds of expectation comments
2025-02-28 13:27:25 +01:00
Asger F
ff36d1916f
Merge pull request #18810 from asgerf/js/test-related-locations
...
Test: Add support for RelatedLocation tag and use in a JS query
2025-02-25 16:40:41 +01:00
Asger F
baa7e35589
Merge pull request #18834 from Napalys/js/tanstack
...
JS: Support 'response' threat model and @tanstack/react-query
2025-02-25 16:16:06 +01:00
Napalys
3360829a58
Updated change note with response threat model info.
...
Co-authored-by: Asgerf <asgerf@github.com >
2025-02-25 15:22:14 +01:00
Napalys
bf77ffef37
Applied comment
...
Co-authored-by: Asgerf <asgerf@github.com >
2025-02-25 13:57:39 +01:00
Napalys
e2927b2fad
Updated tanstack to use API graph.
2025-02-25 11:48:44 +01:00
Anders Schack-Mulligen
b2a595596b
JS: Remove irrelevant comment.
2025-02-25 11:33:16 +01:00
Anders Schack-Mulligen
449150e6b5
JS: Accept fixed FP flow.
2025-02-25 10:42:21 +01:00
Anders Schack-Mulligen
57c4fd6f25
JS: Combine phi reads and ssa input nodes into SynthReadNode class.
2025-02-25 09:23:53 +01:00
Anders Schack-Mulligen
1af753cd0c
JS: Use shared barrier guard for falsy check.
2025-02-24 13:00:06 +01:00
Anders Schack-Mulligen
09b2aeb53a
SSA: Replace use-use step implementation in data-flow integration.
2025-02-24 10:58:14 +01:00
Anders Schack-Mulligen
4e515bc2f5
JS: Remove reference to isInputInto
2025-02-21 14:48:24 +01:00
Asger F
cd2c4d5e3a
JS: Use post-processed inline test in MissingCsrfMiddleware
...
This query flags the cookie-parsing middleware in order to consolidate huge numbers of alerts into a single alert, which is more manageable. But simply annotating the cookie-parsing middleware with 'Alert' isn't a very useful, we want to annotate which middlewares are vulnerable.
2025-02-21 14:44:46 +01:00
Napalys
3587ba593a
Add change note and added tanstack to supported framework list
2025-02-21 13:47:48 +01:00
Napalys
ab0241c1de
Added missing doc strings for Tanstack queries
2025-02-21 13:32:49 +01:00
Napalys
1227a7eedc
Add Tanstack framework support and enhance data flow tracking for fetch responses
2025-02-21 13:24:00 +01:00
Napalys
05690c21ed
Added a test for tanstack/react-query useQuery
2025-02-21 13:24:00 +01:00
Asger F
a1b7096125
Merge pull request #18783 from asgerf/js/downward-calls
...
JS: Resolve calls downward in class hierarchy
2025-02-20 09:01:58 +01:00
