181 Commits

Author	SHA1	Message	Date
Max Schaefer	3c00d4be6d	Merge pull request #607 from esben-semmle/js/more-react-methods ... JS: model additional React component methods	2018-12-05 08:00:16 +00:00
Esben Sparre Andreasen	d63d838534	JS: add regression test for ODASA-7506	2018-12-04 22:22:46 +01:00
Esben Sparre Andreasen	417dac7ad6	JS: support React getDerivedStateFromProps	2018-12-04 10:48:35 +01:00
Esben Sparre Andreasen	0d62191d84	JS: add more React tests	2018-12-04 10:48:35 +01:00
Asger F	374f7ab65d	JS: address comments	2018-12-03 11:23:02 +00:00
Asger F	0462eb4b50	JS: add IncorrectSuffixCheck query	2018-12-03 11:23:02 +00:00
Max Schaefer	52b8a6bb56	Merge branch 'master' into js/invalid-entity-transcoding	2018-11-30 16:49:20 +00:00
Max Schaefer	10166be535	JavaScript: Add new query DoubleEscaping.	2018-11-30 09:39:00 +00:00
Max Schaefer	3ed40d5da1	Merge branch 'master' into range-analysis	2018-11-30 09:36:40 +00:00
Asger F	d69e584cc2	JS: fix bug in foldedComparisonEdge	2018-11-29 11:22:15 +00:00
Asger F	477be260f3	JS: rename UselessRangeCheck -> UselessComparisonTest	2018-11-29 11:22:14 +00:00
Asger F	344bec3865	JS: Add UselessRangeCheck.ql	2018-11-29 11:22:14 +00:00
Esben Sparre Andreasen	f3889e715e	JS: simplify isReactImportForJSX to isReactForJSX	2018-11-28 15:06:53 +01:00
Esben Sparre Andreasen	54e2215db4	JS: support require in isReactImportForJSX	2018-11-28 13:16:55 +01:00
semmle-qlci	04c2b23abd	Merge pull request #520 from esben-semmle/js/clear-text-logging-taint-kinds ... Approved by asger-semmle	2018-11-23 12:40:40 +00:00
Esben Sparre Andreasen	b780f82869	JS: sharpen js/clear-text-logging (ODASA-7485)	2018-11-22 13:38:43 +01:00
semmle-qlci	4e72a08b8d	Merge pull request #507 from esben-semmle/js/mixed-static-intance-this-access-inheritance ... Approved by xiemaisi	2018-11-21 16:07:25 +00:00
semmle-qlci	f5d3274655	Merge pull request #508 from esben-semmle/js/indirect-global-call-with-default-arguments ... Approved by xiemaisi	2018-11-21 16:06:46 +00:00
Esben Sparre Andreasen	caea6212ed	JS: use inheritance in js/mixed-static-instance-this-access	2018-11-21 09:48:37 +01:00
Esben Sparre Andreasen	01ad9ed8bc	JS: address review comments	2018-11-21 09:19:20 +01:00
semmle-qlci	b21b066255	Merge pull request #499 from xiemaisi/js/target-blank-location ... Approved by esben-semmle	2018-11-20 17:16:05 +00:00
Max Schaefer	c1690a69e5	JavaScript: Make TargetBlank only highlight the first line of the link. ... Otherwise alerts for multi-line `<a>` elements end up looking very red. I also took the opportunity to improve the tests slightly.	2018-11-20 12:53:27 +00:00
Esben Sparre Andreasen	82fc8ae32a	JS: support indirection with extra args in js/missing-this-qualifier	2018-11-20 11:29:03 +01:00
Esben Sparre Andreasen	54fea1a4cb	JS: support "xyz:nomunge" YUI compressor directives	2018-11-20 09:00:33 +01:00
Asger F	6ec13feab4	JS: recognize sanitizing slashes in URL redirection queries	2018-11-16 10:43:25 +00:00
Max Schaefer	9221b62ded	JavaScript: Update expectd test output for security path queries to include nodes and edges query predicates.	2018-11-14 09:32:31 +00:00
Max Schaefer	d57b5d9628	JavaScript: Remove ReflectdXssPath.ql, which is now spurious.	2018-11-14 09:16:40 +00:00
Max Schaefer	a499009f59	Merge pull request #395 from esben-semmle/js/useless-defensive-code ... JS: add query: js/useless-defensive-code	2018-11-13 16:55:59 +00:00
semmle-qlci	86e31a584e	Merge pull request #447 from esben-semmle/js/indirect-sanitization ... Approved by asger-semmle	2018-11-13 09:14:28 +00:00
Esben Sparre Andreasen	5666deac14	JS: rename js/useless-defensive-code to js/unneeded-defensive-code	2018-11-13 08:19:38 +01:00
Esben Sparre Andreasen	8b71b25a2a	JS: annotate test file with expected results	2018-11-13 08:19:38 +01:00
Esben Sparre Andreasen	358e6188d9	JS: downgrade other alerts to js/useless-defensive-code	2018-11-13 08:19:38 +01:00
Esben Sparre Andreasen	e29c57a58e	JS: add whitelist to js/useless-defensive-code	2018-11-13 08:19:38 +01:00
Esben Sparre Andreasen	b073fcfca2	JS: add query: js/useless-defensive-code	2018-11-13 08:19:38 +01:00
Max Schaefer	663bdd60a0	Merge pull request #396 from esben-semmle/js/unconditional-property-override ... JS: add query: js/unconditional-property-override	2018-11-12 17:10:32 +00:00
Esben Sparre Andreasen	ffc3d6ba49	JS: simplify test (move alerts four lines up)	2018-11-12 10:21:41 +01:00
Max Schaefer	bdfe938d02	JavaScript: Improve StackTraceExposure query. ... It now also flags exposure of the entire exception object (not just the `stack` property).	2018-11-09 09:42:09 +00:00
Esben Sparre Andreasen	bd2fc33621	JS: annotate tests with expectations	2018-11-08 13:23:19 +01:00
Esben Sparre Andreasen	33a297c829	JS: add query: js/useless-assignment-to-property	2018-11-08 13:23:19 +01:00
Asger F	e0d5557ef4	JS: add email HTML body as XSS sink	2018-11-07 11:31:40 +00:00
semmle-qlci	2457eb98df	Merge pull request #166 from asger-semmle/documentable-self-assign ... Approved by esben-semmle, xiemaisi	2018-11-07 08:30:17 +00:00
semmle-qlci	282d1e2096	Merge pull request #404 from asger-semmle/useless-conditional2 ... Approved by xiemaisi	2018-11-07 08:28:01 +00:00
Max Schaefer	212a78b5fc	Merge pull request #323 from esben-semmle/js/always-return-type-inference ... JS: additional return type inference	2018-11-07 08:25:28 +00:00
Esben Sparre Andreasen	a07c094437	JS: introduce TypeInferredCalleeWithAnalyzedReturnFlow	2018-11-06 16:04:46 +01:00
Asger F	87e0027974	JS: address comments	2018-11-06 10:29:04 +00:00
Asger F	56707fc79a	JS: recognize more conditionals in useless-conditional	2018-11-06 10:28:05 +00:00
Esben Sparre Andreasen	651f32514b	JS: use 'Util::describeExpression' in js/trivial-conditional	2018-11-05 13:00:07 +01:00
Esben Sparre Andreasen	4e54af3b41	JS: introduce 'Util::describeExpression'	2018-11-05 12:58:12 +01:00
Asger F	4f4ad2b942	JavaScript: ignore self-assignments with a JSDoc comment	2018-11-05 11:31:02 +00:00
Esben Sparre Andreasen	8f3497a7bf	JS: improve tests for interprocedural type inference	2018-11-01 13:51:38 +01:00