semmle-qlci
|
d0d3882121
|
Merge pull request #1919 from esben-semmle/js/fixup-1
Approved by asger-semmle, xiemaisi
|
2019-09-13 10:40:38 +01:00 |
|
semmle-qlci
|
1313821a25
|
Merge pull request #1904 from erik-semmle/passportModel
Approved by asger-semmle, esben-semmle
|
2019-09-13 10:38:14 +01:00 |
|
semmle-qlci
|
72db219c13
|
Merge pull request #1910 from xiemaisi/js/unused-index-variable
Approved by esben-semmle, shati-semmle
|
2019-09-11 14:33:32 +01:00 |
|
Max Schaefer
|
500cde68c3
|
JavaScript: Add new query UnusedIndexVariable.
|
2019-09-11 11:36:50 +01:00 |
|
Esben Sparre Andreasen
|
0e31cad027
|
JS: simplify this.getStringValue() to getStringValue()
|
2019-09-11 10:56:49 +02:00 |
|
Esben Sparre Andreasen
|
ee106ccff9
|
JS: simplify asExpr().getStringValue() calls
|
2019-09-11 10:56:57 +02:00 |
|
Esben Sparre Andreasen
|
aab17850d1
|
JS: eliminate redundant ConstantString casts
|
2019-09-11 10:56:49 +02:00 |
|
semmle-qlci
|
16c95d8c5e
|
Merge pull request #1876 from esben-semmle/js/more-delimiter-stripping-whitelisting
Approved by xiemaisi
|
2019-09-11 09:16:57 +01:00 |
|
semmle-qlci
|
df1bf4a95b
|
Merge pull request #1907 from asger-semmle/mongoose-types
Approved by xiemaisi
|
2019-09-10 12:05:57 +01:00 |
|
Max Schaefer
|
bdba647bf5
|
Merge pull request #1893 from erik-semmle/addXLinkHref
JS: add xlink:href as xss target when using setAttribute
|
2019-09-09 15:56:47 +01:00 |
|
Asger F
|
ea446f2aa1
|
JS: Use type info in mongodb/mongoose model
|
2019-09-09 15:35:26 +01:00 |
|
Asger F
|
8e397ad203
|
JS: Use type tracking in mongodb/mongoose model
|
2019-09-09 15:35:23 +01:00 |
|
semmle-qlci
|
e899250e87
|
Merge pull request #1894 from asger-semmle/fp-incorrect-suffix-check
Approved by xiemaisi
|
2019-09-09 15:33:47 +01:00 |
|
semmle-qlci
|
89cba089b4
|
Merge pull request #1892 from asger-semmle/event-handler-sink
Approved by esben-semmle
|
2019-09-09 15:33:21 +01:00 |
|
Erik Krogh Kristensen
|
03b210a8e1
|
made the two Passport classes in the Express model private
|
2019-09-09 13:04:47 +01:00 |
|
semmle-qlci
|
2283195ebd
|
Merge pull request #1871 from asger-semmle/type-tracking-through-imports
Approved by xiemaisi
|
2019-09-09 12:25:06 +01:00 |
|
Erik Krogh Kristensen
|
26f6b1d186
|
add model for passport.use in the Express model
|
2019-09-09 12:01:11 +01:00 |
|
Asger F
|
631ff27d31
|
JS: Use ValueNode for all ImportSpecifiers
|
2019-09-09 10:53:13 +01:00 |
|
Asger F
|
61e1d793df
|
JS: Fixes in DeadStoreOfLocal
|
2019-09-09 10:51:21 +01:00 |
|
Asger F
|
afcdc12e7b
|
JS: Use ValueNode, not SSA node, to model NamedImportSpecifier
|
2019-09-09 10:51:17 +01:00 |
|
Esben Sparre Andreasen
|
2a22471975
|
JS: address review comments
|
2019-09-09 10:31:40 +02:00 |
|
Esben Sparre Andreasen
|
5d6997c1c9
|
JS: additional extraction metrics cleanup
|
2019-09-09 09:05:12 +02:00 |
|
Esben Sparre Andreasen
|
03d38ca54b
|
JS: simplify cache interaction
|
2019-09-09 09:05:12 +02:00 |
|
Esben Sparre Andreasen
|
6dbe827dd3
|
JS: add QL classes for the extraction metrics
|
2019-09-09 09:05:12 +02:00 |
|
Esben Sparre Andreasen
|
7fcde4c130
|
JS: add extraction metrics to the dbscheme
|
2019-09-09 09:05:12 +02:00 |
|
Asger F
|
7007698de4
|
JS: Fix the FP
|
2019-09-06 15:39:40 +01:00 |
|
Erik Krogh Kristensen
|
ccdc821c5d
|
add xlink:href as xss target when using setAttribute
|
2019-09-06 14:43:47 +01:00 |
|
Asger F
|
fa95871f46
|
JS: Add event handler sink to code injection
|
2019-09-06 14:33:00 +01:00 |
|
Anders Schack-Mulligen
|
ca45fb5a60
|
JavaScript: Autoformat.
|
2019-09-06 09:04:51 +02:00 |
|
semmle-qlci
|
33329f95c2
|
Merge pull request #1874 from asger-semmle/express-types
Approved by esben-semmle, xiemaisi
|
2019-09-05 16:42:28 +01:00 |
|
semmle-qlci
|
fd2e8486e4
|
Merge pull request #1862 from asger-semmle/prototype-pollution-angular-merge
Approved by esben-semmle
|
2019-09-05 12:50:58 +01:00 |
|
semmle-qlci
|
e6bfe2bd5d
|
Merge pull request #1873 from asger-semmle/type-inf-consistency
Approved by xiemaisi
|
2019-09-05 12:46:59 +01:00 |
|
Asger F
|
61c4d30dd6
|
JS: Use express module instead
|
2019-09-05 12:09:24 +01:00 |
|
Esben Sparre Andreasen
|
a9665f53b8
|
JS: whitelist quote stripping for js/incomplete-sanitization
|
2019-09-05 09:47:49 +01:00 |
|
Asger F
|
0e4c34bd81
|
JS: Add deprecated predicate alias
|
2019-09-04 16:14:51 +01:00 |
|
Asger F
|
27567e41c5
|
JS: Add angular.fromJson as JSON parser
|
2019-09-04 16:14:51 +01:00 |
|
Asger F
|
5aa948cd17
|
JS: Add angular.merge sink to prototype pollution query
|
2019-09-04 16:14:51 +01:00 |
|
Asger F
|
744f0b1aa3
|
JS: Use type info to recognize routers
|
2019-09-04 11:43:21 +01:00 |
|
Asger F
|
c06fd451d6
|
JS: Handle router chaining in type tracking predicate
|
2019-09-04 11:43:21 +01:00 |
|
Asger F
|
f3aea0706a
|
JS: Use type info in Express Request/Response
|
2019-09-04 11:43:21 +01:00 |
|
semmle-qlci
|
6778f28424
|
Merge pull request #1854 from asger-semmle/prototype-pollution-precision
Approved by esben-semmle, xiemaisi
|
2019-09-03 10:50:24 +01:00 |
|
Asger F
|
7790d4b667
|
JS: Make getALocalValue overriders include super
|
2019-09-02 16:45:06 +01:00 |
|
Asger F
|
2006826101
|
JS: Avoid breaking local object analysis
|
2019-09-02 16:45:06 +01:00 |
|
Asger F
|
9f2f10fa15
|
JS: Make type inference flow go through ssa definition node
|
2019-09-02 16:45:06 +01:00 |
|
Asger F
|
54d47f60da
|
JS: Include base types in TypeName
|
2019-09-02 14:18:48 +01:00 |
|
Asger F
|
a41a23fdba
|
JS: Raise precision of prototype-pollution query
|
2019-09-02 11:00:24 +01:00 |
|
semmle-qlci
|
6d55d1f7c0
|
Merge pull request #1707 from asger-semmle/canonical-name-call-graph
Approved by xiemaisi
|
2019-09-02 09:45:24 +01:00 |
|
Asger F
|
89b91af6db
|
JS: Make getDocumentation handle chain assignments
|
2019-08-30 18:20:54 +01:00 |
|
Asger F
|
3926436bd4
|
JS: Explain use of t.call()
|
2019-08-30 18:19:19 +01:00 |
|
Asger F
|
d6578e10c8
|
JS: Handle constructor calls to avoid regression
|
2019-08-30 18:19:19 +01:00 |
|