Adrien Pessu
e332a4348d
Update javascript/ql/src/Security/CWE-798/HardcodedCredentials.qhelp
...
Co-authored-by: Erik Krogh Kristensen <erik-krogh@github.com >
2023-06-21 12:55:33 +01:00
Adrien Pessu
4d1bbe36a9
Merge branch 'main' into main
2023-06-21 09:11:57 +01:00
Adrien Pessu
7dfb404fd7
clean examples
2023-06-21 08:11:39 +00:00
Adrien Pessu
e85987bfc5
remove useless phrase
2023-06-21 07:59:24 +00:00
Adrien Pessu
2a2f6de78c
fixed text not in a tag
2023-06-20 17:27:37 +00:00
Adrien Pessu
36cb60c746
Add fixed proposition for NodeJS
2023-06-20 17:22:56 +00:00
Tiago Pascoal
150854603b
Single quote was preventing the shell from expanding the BODY variable
...
While this prevents the attack highlighted in the query help it also prevents it from working.
Double quotes will allow the expansion of the variable while still preventing the attack
2023-06-20 11:38:27 +01:00
Adrien Pessu
eb28266bcb
improv example the help file
2023-06-19 17:00:52 +00:00
Tony Torralba
8f6d2ed2f9
Adjust ZipSlip query description according to review suggestions.
2023-06-19 10:27:41 +02:00
Tony Torralba
3c4d938cf1
Apply code review suggestions.
...
Co-authored-by: Asger F <asgerf@github.com >
2023-06-19 10:20:19 +02:00
Tony Torralba
3e96fe60c5
Go/Java/JS/Python/Ruby: Update the description and qhelp of the ZipSlip query
...
All filesystem operations, not just writes, with paths built from untrusted archive entry names are dangerous
2023-06-16 08:52:44 +02:00
erik-krogh
3cb2ec4e87
fix nits from doc review
2023-06-05 19:06:07 +02:00
erik-krogh
9aeba4f31e
changes based on review
2023-06-01 17:24:44 +02:00
erik-krogh
1e08105863
less duplicated headers in the sql-injection samples
2023-05-31 18:04:34 +02:00
erik-krogh
98820780af
show how to use mysql.escape in the sql-injection qhelp
2023-05-31 18:04:34 +02:00
erik-krogh
7d801e05ee
add an example of using dollar eq
2023-05-31 18:04:23 +02:00
erik-krogh
e24b45b423
elaborate on both SQL and NoSQL injection in the js/sql-injection qhelp
2023-05-31 09:57:38 +02:00
erik-krogh
b343dcaadd
put string/object in the alert-message for sql-injection
2023-05-31 08:06:04 +02:00
erik-krogh
2ebce99eae
add another example of how to fix the prototype pollution issue
2023-05-15 17:24:02 +02:00
erik-krogh
7a338c408e
fix typo, the variable in the example is called items
2023-05-15 17:23:40 +02:00
Asger F
20e8ee8423
Merge pull request #12748 from JarLob/yi
...
JS: Add more sources, more unit tests, fixes to the GitHub Actions injection query
2023-05-15 11:03:00 +02:00
Max Schaefer
5dfe52afd0
Merge pull request #13152 from github/max-schaefer/unsafe-shell-command-construction-examples-sync
...
JavaScript: Use synchronous APIs in examples for js/shell-command-constructed-from-input.
2023-05-12 16:50:25 +01:00
Max Schaefer
2e7eb50319
JavaScript: Use synchronous APIs in examples for js/shell-command-constructed-from-input.
2023-05-12 14:42:11 +01:00
Max Schaefer
a4f6ccf2fc
JavaScript: Use gender-neutral language in qhelp for js/user-controlled-bypass
2023-05-12 14:21:40 +01:00
Jaroslav Lobačevski
5aa71352dc
Update javascript/ql/src/Security/CWE-094/ExpressionInjection.qhelp
...
Co-authored-by: Asger F <asgerf@github.com >
2023-05-09 12:23:52 +02:00
Kasper Svendsen
67950c8e6b
JS: Make implicit this receivers explicit
2023-05-03 15:31:00 +02:00
jarlob
6e9f54ef55
Use double curly braces
2023-04-21 19:03:38 +02:00
smiddy007
e4ec1ae261
Update InsufficientPasswordHash.qhelp
...
change file name to original
2023-04-17 13:18:47 -04:00
smiddy007
88d2f65c5f
Rename InsufficientPasswordHash_NodeJS_fixed.js to InsufficientPasswordHash_fixed.js
2023-04-17 13:17:13 -04:00
smiddy007
cbe45f7e55
Rename InsufficientPasswordHash_NodeJS.js to InsufficientPasswordHash.js
2023-04-17 13:16:57 -04:00
smiddy007
36d7370998
Delete InsufficientPasswordHash_CryptoJS_fixed
...
file not used in qhelp
2023-04-17 13:16:25 -04:00
smiddy007
e65daaae49
Delete InsufficientPasswordHash_CryptoJS.js
...
not used in qhelp file
2023-04-17 13:15:10 -04:00
jarlob
e9dee3a185
Move actions/github-script out of Actions.qll
2023-04-14 14:26:23 +02:00
jarlob
3724ea1a7b
Extract where parts into predicates
2023-04-14 10:49:56 +02:00
jarlob
ac1c20673d
Encapsulate github-script
2023-04-14 10:23:49 +02:00
jarlob
d80c541da6
Encapsulate composite actions
2023-04-14 10:06:35 +02:00
jarlob
94065764d5
Make predicate name clearer
2023-04-14 01:05:21 +02:00
jarlob
79218a3946
Use YamlMapping for modeling Env
2023-04-14 00:56:51 +02:00
jarlob
dd52ef85cd
Rename Env
2023-04-13 23:41:31 +02:00
jarlob
7573c615f6
Fix warnings
2023-04-06 23:07:22 +02:00
jarlob
9c7eecf547
Add support for composite actions
2023-04-06 22:53:59 +02:00
jarlob
40635e60d1
Improve documentation
2023-04-05 10:26:02 +02:00
jarlob
9fba7d31f1
Improve documentation
2023-04-05 10:24:07 +02:00
jarlob
eef1973b93
Change UI message
2023-04-05 10:05:24 +02:00
jarlob
5c5b9f99a8
Add simple taint tracking for env variables
2023-04-05 10:03:46 +02:00
jarlob
8ea418216c
Look for script injections in actions/github-script
2023-04-03 23:13:28 +02:00
jarlob
ba5747dff3
fix formatting
2023-04-03 15:10:27 +02:00
jarlob
99d634c8a4
Add more sources, more unit tests, fixes to the GitHub Actions injection query
2023-04-03 15:02:02 +02:00
Jeroen Ketema
17bd9c12d7
JS: Fix qhelp after file rename
2023-04-03 09:25:19 +02:00
Asger F
dec1e4dfd6
Merge pull request #12666 from smiddy007/improve-insufficient-pw-hash-query
...
JS: Improve insufficient pw hash query
2023-03-31 11:58:41 +02:00
