Napalys
678eccb417
Added searchParams.get as potential source for SSRF
2025-04-11 09:42:07 +02:00
Napalys
8674b61e5a
Added SSRF test case with searchParams for NextRequest
2025-04-11 09:26:16 +02:00
Napalys
6e09a65da0
Added support for NextRequest middleware SSRF.
2025-04-11 08:43:36 +02:00
Napalys
734ad2d767
Removed legacy Consistency check as it is redundant now with inline test expectations.
2025-04-11 08:43:08 +02:00
Napalys
208487f236
Added middleware test
2025-04-11 08:39:47 +02:00
Napalys
86b64afa13
Added NextResponse to the ResponseCall class it models similar near idential behaviour.
2025-04-10 15:06:44 +02:00
Napalys
8acb0243ad
Added test cases for NextResponse and Response
2025-04-10 14:57:40 +02:00
Napalys
63a3953b0c
Enhance Next.js API endpoint handling for compatibility with both Pages and App Router structures.
2025-04-10 14:48:17 +02:00
Napalys
81cba7fa2f
Added test cases with missing alerts for Request and NextRequest.
2025-04-10 14:43:48 +02:00
Asger F
eac14b9837
Merge pull request #19200 from asgerf/js/web-response
...
JS: Add sinks for calls to 'new Response()'
2025-04-10 14:41:32 +02:00
Asger F
3da1f261f7
JS: Change note
2025-04-10 07:21:48 +02:00
Asger F
cfa1a9b603
JS: Update extractor version string
2025-04-10 07:20:53 +02:00
Asger F
1434f7acd2
JS: Tolerate trailing comma in JSON array
...
Previously we'd fail to extract some tsconfig.json files because of this.
2025-04-10 07:20:51 +02:00
Asger F
800dd168c2
JS: Add failing TRAP test for trailing comma
2025-04-10 07:20:49 +02:00
Napalys Klicius
f02783a9c6
Merge pull request #19210 from Napalys/js/mkdirp
...
JS: Modeling of `mkdirp` functions
2025-04-09 13:43:37 +02:00
Asger F
da7d6d3346
JS: Change note
2025-04-09 11:28:21 +02:00
Napalys
4a4d78bbde
Added change note
2025-04-08 08:12:42 +02:00
Napalys
b8802a29f4
Added open package model as data.
2025-04-08 08:12:30 +02:00
Napalys
df89739085
Added test cases for open package.
2025-04-08 08:10:10 +02:00
Asger F
14c5495b4c
JS: Use in SensitiveActions test as an example
2025-04-03 13:24:18 +02:00
Asger F
6c33013788
JS: Enable association with headers without needing a route handler
...
Previously it was not possible to associate a ResponseSendArgument with its header definitions if they did not have the same route handler.
But for calls like `new Response(body, { headers })` the headers are fairly obvious whereas the route handler is unnecessarily hard to find. So we use the direct and obvious association between 'body' and 'headers' in the call.
2025-04-03 11:08:10 +02:00
Asger F
db2720ea5b
JS: Initial model of Response
2025-04-03 11:08:05 +02:00
Napalys
0e7bff0f81
Added change note.
2025-04-03 10:45:17 +02:00
Napalys
04a39eb735
Removed old mkdirp modeling and replaced it with MaD.
2025-04-03 10:45:16 +02:00
Napalys
3fa24d6026
Add sink model for mkdirp and update tests for path injection alerts.
2025-04-03 10:45:14 +02:00
Napalys
533f1a93e2
JS: Added test cases for mkdirp.
2025-04-03 10:45:12 +02:00
Napalys Klicius
5c42c0ba4c
Merge pull request #19196 from Napalys/js/rimraf
...
JS: Modeling of `rimraf` functions
2025-04-03 09:51:52 +02:00
Asger F
bb15f30ef6
Merge pull request #19192 from asgerf/js/name-resolution-independent-fixes
...
JS: Some preliminary fixes from name resolution branch
2025-04-03 09:36:02 +02:00
Jon Janego
d8ef4fc25d
Update javascript/ql/src/Expressions/ExprHasNoEffect.ql
...
Co-authored-by: Napalys Klicius <napalys@github.com >
2025-04-02 10:22:27 -05:00
Asger F
6c3bc941c5
Merge branch 'main' into js/name-resolution-independent-fixes
2025-04-02 14:15:44 +02:00
Asger F
2c40359143
JS: Change note
2025-04-02 14:12:07 +02:00
Asger F
30a9cd7c8a
JS: Include document as a DOM value
2025-04-02 14:09:52 +02:00
Asger F
9ebaac82cf
JS: Add tests for Response object sink
2025-04-02 13:47:18 +02:00
Napalys
390d9ffe66
Added change note
2025-04-02 12:50:53 +02:00
Napalys
b16b407f89
Add rimraf model and update tests for path injection vulnerabilities
2025-04-02 12:49:48 +02:00
Napalys
14999c19da
Added test cases for rimraf library.
2025-04-02 12:46:48 +02:00
Asger F
78b25388ca
JS: Protect against bad join in BadRandomness
...
This code resulted in bad join orders in response to certain library
changes. The actual library changes have to be split into smaller pieces
but I'd like to ensure I don't run into the bad join again.
2025-04-02 10:14:07 +02:00
Asger F
46f88e7ce7
JS: Updates to DOM model
2025-04-02 10:14:03 +02:00
Asger F
48db2b9315
JS: Add test
2025-04-02 10:12:36 +02:00
Jon Janego
74587f0d64
Update ExprHasNoEffect.ql
...
adding quality tags per metadata styleguide
2025-04-01 18:47:52 -05:00
Asger F
887942e3e9
Merge pull request #19108 from asgerf/js/api-graph-spread-rest
...
JS: Handle spread/rest in API graphs
2025-04-01 17:48:36 +02:00
Asger F
4746cfddf2
JS: Add clarifying comment
2025-04-01 16:26:07 +02:00
Asger F
e1784bb10c
JS: Fix handling of spread args on a bound function
2025-04-01 16:20:57 +02:00
github-actions[bot]
10205cb990
Post-release preparation for codeql-cli-2.21.0
2025-04-01 11:30:43 +00:00
github-actions[bot]
84f6564cc0
Release preparation for version 2.21.0
2025-03-31 17:35:15 +00:00
Arthur Baars
cd9ccef8b2
Javascript, add missing * to changenote
2025-03-31 18:45:01 +02:00
Asger F
149ec20758
JS: Add comment about internal edge
2025-03-31 15:39:09 +02:00
Asger F
f64bdccd6d
Update javascript/ql/lib/semmle/javascript/ApiGraphs.qll
...
Co-authored-by: Erik Krogh Kristensen <erik-krogh@github.com >
2025-03-31 15:30:59 +02:00
Napalys Klicius
4572376e9a
Merge pull request #19143 from Napalys/js/fs-extra-missing
...
JS: Modeling of `fs-extra` functions
2025-03-31 10:35:45 +02:00
Napalys Klicius
de8a3289e2
Merge pull request #19118 from Napalys/js/hana_db_client
...
JS: support `hana` db client
2025-03-31 10:35:11 +02:00
