Kasper Svendsen
|
65deb9d90a
|
Merge pull request #13016 from kaspersv/kaspersv/js-explicit-this-receivers3
JS: Make implicit this receivers explicit
|
2023-05-04 09:15:01 +02:00 |
|
Kasper Svendsen
|
67950c8e6b
|
JS: Make implicit this receivers explicit
|
2023-05-03 15:31:00 +02:00 |
|
Kasper Svendsen
|
aca2ace843
|
JS, Python, Ruby: Make implicit this receivers explicit
|
2023-05-03 13:51:51 +02:00 |
|
Asger F
|
e9f1e99526
|
Merge pull request #12887 from asgerf/js/unsafe-yaml-deserialization
JS: Update model of js-yaml
|
2023-05-01 09:57:20 +02:00 |
|
Asger F
|
1d0a0dec6f
|
JS: Fix typo
|
2023-04-20 12:48:17 +02:00 |
|
Asger F
|
1acc0d2ddf
|
JS: Update model of js-yaml
|
2023-04-20 12:47:13 +02:00 |
|
Asger F
|
1c2fdc8df9
|
JS: Ignore more webpack modules
|
2023-04-19 10:29:14 +02:00 |
|
Asger F
|
13b1e97caa
|
JS: Fix the ExtendCall restriction
|
2023-04-17 12:30:08 +02:00 |
|
Asger F
|
2f4a181a7d
|
JS: revert path sanitizers in proto pollution query
|
2023-04-17 12:21:00 +02:00 |
|
Asger F
|
b728f71b4b
|
JS: Move 'this' sanitizer to customizations
|
2023-04-17 12:11:18 +02:00 |
|
Asger F
|
c250ba7f27
|
JS: Undo sanitization of path.normalize()
|
2023-04-17 08:23:04 +02:00 |
|
Asger F
|
0d598c437d
|
JS: Fix observed FPs in UnsafeJQueryPlugin
|
2023-04-17 08:20:18 +02:00 |
|
Asger F
|
b321151a28
|
JS: Restrict ExtendCall flow in proto pollution query
|
2023-04-17 08:20:18 +02:00 |
|
Asger F
|
efb582b661
|
JS: Drive-by fix to newly gained FPs
|
2023-04-17 08:20:18 +02:00 |
|
erik-krogh
|
b1957623c1
|
add browser history as XSS sink
|
2023-04-12 13:38:18 +02:00 |
|
tyage
|
7f9b8557ac
|
Add Next.js router push as XSS sink
|
2023-04-08 18:18:34 +09:00 |
|
Asger F
|
61a7ee9387
|
JS: Use getABoundFunctionValue instead of type-tracking
|
2023-03-28 12:56:03 +02:00 |
|
Asger F
|
92a681213d
|
JS: Step through jQuery callback return values
|
2023-03-27 11:17:27 +02:00 |
|
Asger F
|
86a06bde72
|
JS: Flag crypto operations with weak block mode
|
2023-03-16 14:52:52 +01:00 |
|
Erik Krogh Kristensen
|
060c37b6a2
|
Merge pull request #12345 from erik-krogh/delOldDeps
delete old deprecations
|
2023-03-13 12:48:24 +01:00 |
|
Asger F
|
5461f94c6c
|
Merge pull request #12424 from asgerf/js/html-sanitizer-for-sql
JS: Add html sanitizers as a taint step in a few queries
|
2023-03-13 11:36:19 +01:00 |
|
erik-krogh
|
6c1ebd999e
|
Merge branch 'main' into delOldDeps
|
2023-03-13 11:00:29 +01:00 |
|
Anders Schack-Mulligen
|
8d97fe9ed3
|
JavaScript: Autoformat
|
2023-03-10 09:41:20 +01:00 |
|
Asger F
|
4f0e17bf97
|
JS: Add step to a few other queries
|
2023-03-07 09:39:40 +01:00 |
|
Asger F
|
d4b4d22378
|
JS: Step through HTML sanitizers in SQL injection query
|
2023-03-06 15:10:26 +01:00 |
|
erik-krogh
|
f96d6accbb
|
delete old deprecations
|
2023-03-03 09:23:02 +01:00 |
|
Erik Krogh Kristensen
|
64dad3db8a
|
Merge pull request #12333 from kaspersv/kaspersv/fix-join-order
ReflectedXss: Prevent bad join order
|
2023-03-01 12:48:30 +01:00 |
|
Kasper Svendsen
|
86925646f3
|
ReflectedXss: Prevent bad join order
|
2023-02-28 12:06:27 +01:00 |
|
Erik Krogh Kristensen
|
50aa5e072a
|
Merge pull request #12177 from erik-krogh/alias-html
JS: More precise type-test sanitizer guards in unsafe-html-construction
|
2023-02-27 18:16:11 +01:00 |
|
Alex Ford
|
7c85448cba
|
Merge pull request #12080 from alexrford/js-use-shared-cryptography
JS: Use shared `CryptographicOperation` concept
|
2023-02-27 12:26:38 +00:00 |
|
erik-krogh
|
0e60fc5512
|
Merge branch 'main' into alias-html
|
2023-02-27 09:16:25 +01:00 |
|
Erik Krogh Kristensen
|
f8f926ad50
|
Merge pull request #12175 from erik-krogh/reg-input
JS: add process.env and process.argv etc. as source for `js/regex-injection`
|
2023-02-27 09:12:02 +01:00 |
|
Alex Ford
|
1556b1a728
|
Merge branch 'main' into js-use-shared-cryptography
|
2023-02-15 17:13:53 +00:00 |
|
erik-krogh
|
51ddb55d7b
|
use tainted-object to precisely model that plain object are fine, but their properties are not
|
2023-02-15 15:02:03 +01:00 |
|
erik-krogh
|
09794fa836
|
delete PrefixStringSanitizer
|
2023-02-15 14:55:02 +01:00 |
|
Rasmus Wriedt Larsen
|
c72dbc49fc
|
Merge pull request #12165 from RasmusWL/crypto-updates
Python/Ruby/JS Crypto: Add a few algorithms + block modes
|
2023-02-15 14:35:40 +01:00 |
|
erik-krogh
|
393649b7ce
|
don't call environment variables for command-line arguments
|
2023-02-14 14:27:41 +01:00 |
|
erik-krogh
|
36478124ae
|
add process.env and process.argv etc. as source for js/regex-injection
|
2023-02-14 14:21:53 +01:00 |
|
Erik Krogh Kristensen
|
e3e2df3247
|
Merge pull request #12166 from erik-krogh/more-html-san
JS: add `HtmlSanitizer` as a sanitizer DOMBasedXss
|
2023-02-14 14:09:56 +01:00 |
|
Erik Krogh Kristensen
|
028fcc7edf
|
Merge pull request #11959 from erik-krogh/ssrfSan
JS: add encodeURIComponent as a sanitizer for request-forgery
|
2023-02-14 13:39:53 +01:00 |
|
erik-krogh
|
b85bfc8ba6
|
add HtmlSanitizer as a sanitizer for DOMBasedXss
|
2023-02-13 11:57:29 +01:00 |
|
Rasmus Wriedt Larsen
|
5235964b07
|
sync files
|
2023-02-13 10:44:12 +01:00 |
|
Alex Ford
|
7768026e70
|
Merge branch 'main' into js-use-shared-cryptography
|
2023-02-03 15:18:30 +00:00 |
|
Alex Ford
|
b968b59afc
|
CryptoAlgorithms: make CryptographicAlgorithm#matchesName hold only if that algorithm is the most specific match
|
2023-02-03 14:15:32 +00:00 |
|
Alex Ford
|
1435ef1862
|
CryptoAlgorithms: make CryptographicAlgorithm#matchesName split on underscores
|
2023-02-02 20:30:30 +00:00 |
|
Alex Ford
|
983055b8f9
|
JS: Use shared CryptographicOperation concept and implement BlockMode getBlockMode()
|
2023-02-02 20:30:30 +00:00 |
|
erik-krogh
|
e5e8496084
|
fix QL-for-QL warnings
|
2023-01-31 10:55:27 +01:00 |
|
erik-krogh
|
02da718786
|
add code-injection sink for node-pty
|
2023-01-30 15:14:25 +01:00 |
|
Erik Krogh Kristensen
|
fc66c905ff
|
Merge pull request #11859 from erik-krogh/moreShell
JS: slightly broaden the regular expression that recognizes bad string-concats used as shell commands
|
2023-01-23 22:26:17 +01:00 |
|
erik-krogh
|
11894144aa
|
remove regular expression that did nothing
|
2023-01-23 16:38:09 +01:00 |
|