Asger F
c8af28c2ca
Merge pull request #13700 from asgerf/js/path-join-spread
...
JS: Recognize 'fs/promises' alias and handle spread arguments in path.join()
2023-07-11 15:31:13 +02:00
Asger F
8234b8f175
JS: Change note
2023-07-10 13:19:44 +02:00
github-actions[bot]
13cf054a9d
Post-release preparation for codeql-cli-2.14.0
2023-07-07 14:55:41 +00:00
github-actions[bot]
6484ee106e
Release preparation for version 2.14.0
2023-07-07 08:22:14 +00:00
Dave Bartolomeo
9631e9f2f1
Bump minor version numbers post-GHES
2023-07-06 10:10:01 -04:00
Dave Bartolomeo
2bb9adfbf1
Merge remote-tracking branch 'origin/main' into dbartol/mergeback-3.10
2023-07-06 10:00:46 -04:00
github-actions[bot]
668aaa2dc8
Post-release preparation for codeql-cli-2.13.5
2023-06-30 08:51:48 +00:00
github-actions[bot]
9d7987f822
Release preparation for version 2.13.5
2023-06-29 09:26:18 +00:00
Henry Mercer
5afdaf8fe1
Merge pull request #13525 from github/rc/3.10
...
Merge `rc/3.10` back to `main`
2023-06-21 17:13:36 +01:00
Adrien Pessu
e332a4348d
Update javascript/ql/src/Security/CWE-798/HardcodedCredentials.qhelp
...
Co-authored-by: Erik Krogh Kristensen <erik-krogh@github.com >
2023-06-21 12:55:33 +01:00
Adrien Pessu
4d1bbe36a9
Merge branch 'main' into main
2023-06-21 09:11:57 +01:00
Adrien Pessu
7dfb404fd7
clean examples
2023-06-21 08:11:39 +00:00
Adrien Pessu
e85987bfc5
remove useless phrase
2023-06-21 07:59:24 +00:00
Adrien Pessu
2a2f6de78c
fixed text not in a tag
2023-06-20 17:27:37 +00:00
Adrien Pessu
36cb60c746
Add fixed proposition for NodeJS
2023-06-20 17:22:56 +00:00
Tiago Pascoal
150854603b
Single quote was preventing the shell from expanding the BODY variable
...
While this prevents the attack highlighted in the query help it also prevents it from working.
Double quotes will allow the expansion of the variable while still preventing the attack
2023-06-20 11:38:27 +01:00
github-actions[bot]
18b678e69e
Post-release preparation for codeql-cli-2.13.4
2023-06-20 10:20:05 +00:00
Adrien Pessu
eb28266bcb
improv example the help file
2023-06-19 17:00:52 +00:00
Tony Torralba
8f6d2ed2f9
Adjust ZipSlip query description according to review suggestions.
2023-06-19 10:27:41 +02:00
Tony Torralba
3c4d938cf1
Apply code review suggestions.
...
Co-authored-by: Asger F <asgerf@github.com >
2023-06-19 10:20:19 +02:00
Tony Torralba
433fc680ec
Apply suggestions from code review
...
Co-authored-by: mc <42146119+mchammer01@users.noreply.github.com >
2023-06-19 10:17:40 +02:00
Tony Torralba
c97868f774
Add change notes
2023-06-16 09:01:02 +02:00
Tony Torralba
3e96fe60c5
Go/Java/JS/Python/Ruby: Update the description and qhelp of the ZipSlip query
...
All filesystem operations, not just writes, with paths built from untrusted archive entry names are dangerous
2023-06-16 08:52:44 +02:00
github-actions[bot]
e4be303a23
Release preparation for version 2.13.4
2023-06-08 19:57:37 +00:00
Asger F
76a8e9827e
Merge pull request #13283 from asgerf/js/restrict-regex-search-function
...
JS: Be more conservative about flagging "search" call arguments as regex
2023-06-08 10:50:51 +02:00
Erik Krogh Kristensen
6ba7f9a238
Merge pull request #13352 from erik-krogh/once-again-deps-not-py-cpp
...
delete old deprecations
2023-06-07 13:00:57 +02:00
Erik Krogh Kristensen
b78cd48954
Merge pull request #13329 from erik-krogh/sqlhelp
...
JS: improve the sql-injection help page
2023-06-06 08:44:44 +02:00
erik-krogh
3cb2ec4e87
fix nits from doc review
2023-06-05 19:06:07 +02:00
erik-krogh
f61b781386
JS: delete effectively empty file
2023-06-02 11:58:09 +02:00
erik-krogh
44b6366586
delete old deprecations
2023-06-02 11:58:08 +02:00
erik-krogh
9aeba4f31e
changes based on review
2023-06-01 17:24:44 +02:00
Erik Krogh Kristensen
96a720cfa0
Merge pull request #13285 from erik-krogh/redoshelp
...
ReDoS: fix whitespace in the samples in ReDoS.qhelp
2023-06-01 15:53:58 +02:00
Asger F
baef99995d
JS: Change note
2023-06-01 14:10:11 +02:00
erik-krogh
1e08105863
less duplicated headers in the sql-injection samples
2023-05-31 18:04:34 +02:00
erik-krogh
98820780af
show how to use mysql.escape in the sql-injection qhelp
2023-05-31 18:04:34 +02:00
erik-krogh
7d801e05ee
add an example of using dollar eq
2023-05-31 18:04:23 +02:00
erik-krogh
e24b45b423
elaborate on both SQL and NoSQL injection in the js/sql-injection qhelp
2023-05-31 09:57:38 +02:00
erik-krogh
b343dcaadd
put string/object in the alert-message for sql-injection
2023-05-31 08:06:04 +02:00
Arthur Baars
490d22d123
Merge remote-tracking branch 'upstream/main' into post-release-prep/codeql-cli-2.13.3
2023-05-30 21:31:28 +02:00
erik-krogh
9f5bf8fb22
also fix the first code-block
2023-05-25 13:56:29 +02:00
erik-krogh
765076bcba
fix whitespace in the samples in ReDoS.qhelp
2023-05-25 13:28:39 +02:00
github-actions[bot]
d2e192020b
Post-release preparation for codeql-cli-2.13.3
2023-05-24 11:26:12 +00:00
Erik Krogh Kristensen
50cb5ea184
Merge pull request #13164 from erik-krogh/polyQhelp
...
ReDoS: add another example to the qhelp in poly-redos, showing how to just limit the length of the input
2023-05-23 09:25:15 +02:00
github-actions[bot]
7aa23cf11d
Release preparation for version 2.13.3
2023-05-22 20:47:00 +00:00
erik-krogh
710b309142
apply suggestions from doc review
2023-05-21 22:18:48 +02:00
erik-krogh
10bf17c33e
Merge branch 'main' into polyQhelp
2023-05-21 22:17:06 +02:00
Erik Krogh Kristensen
239234c5d2
fix bad change-note
...
Co-authored-by: Asger F <asgerf@github.com >
2023-05-17 14:47:32 +02:00
erik-krogh
5a82454710
add change-note
2023-05-17 12:02:21 +02:00
erik-krogh
480e71fd69
avoid contractions
2023-05-17 08:42:45 +02:00
erik-krogh
2ebce99eae
add another example of how to fix the prototype pollution issue
2023-05-15 17:24:02 +02:00
