Napalys
|
9d4e737bc2
|
JS: follow proper code standards for get predicates
Co-authored-by: asgerf <asgerf@github.com>
|
2024-11-29 11:32:10 +01:00 |
|
Napalys
|
3171f38cdd
|
JS: fixed bad alert messages when it came to incomplete sanitization for new RegExp objects
|
2024-11-29 11:14:45 +01:00 |
|
Napalys Klicius
|
13afd6310b
|
Update javascript/ql/lib/change-notes/2024-11-28-regexp-unknown-flags.md
Co-authored-by: Erik Krogh Kristensen <erik-krogh@github.com>
|
2024-11-29 08:26:04 +01:00 |
|
Napalys
|
d2de9a2238
|
Fixed change notes
|
2024-11-28 14:24:27 +01:00 |
|
Napalys Klicius
|
9ca0fe4cbf
|
Update RegExp handling and add test case
Co-authored-by: erik-krogh <erik-krogh@github.com>
|
2024-11-28 14:13:40 +01:00 |
|
Napalys
|
fd773603e6
|
Added change notes
|
2024-11-28 12:04:09 +01:00 |
|
Napalys
|
9a1c1f4be3
|
JS: Added in RegExpCreationNode maybeGlobal predicate for more convenience.
|
2024-11-28 12:03:51 +01:00 |
|
Napalys
|
1d2e08a3b6
|
JS: now Reg Exp injection treats unknownFlags as sanitization, MetacharEscapeSanitizer
|
2024-11-28 11:26:58 +01:00 |
|
Napalys
|
62194f5337
|
JS: add test cases RegExp with unknown flags
|
2024-11-28 11:26:57 +01:00 |
|
Napalys
|
e673348ed3
|
JS: now RegExp with unknown flags is not flagged as an issue within password Clear text storage of sensitive information
|
2024-11-28 11:26:56 +01:00 |
|
Napalys
|
a2c46749c6
|
JS: fixed issue where MaskingReplacer would work only with regexp literals but not objects
|
2024-11-28 11:26:55 +01:00 |
|
Napalys
|
1ca57cfb9d
|
JS: add test cases with RegExp object for MaskingReplacer, currently gives wrong results
|
2024-11-28 11:26:54 +01:00 |
|
Napalys
|
c71778f1aa
|
JS: xss does not flag anymore replace with RegExp unknown flags
|
2024-11-28 11:26:53 +01:00 |
|
Napalys
|
dbae553146
|
JS: add xss test cases with unknownflags for replace using RegExp
|
2024-11-28 11:26:52 +01:00 |
|
Napalys
|
fe28657c7d
|
JS: add test cases with unknown flags for double escaping, works as expected.
|
2024-11-28 11:26:51 +01:00 |
|
Napalys
|
98fd97799c
|
JS: imcomplete sanization now handles properly maybe global
|
2024-11-28 11:26:50 +01:00 |
|
Napalys
|
1ae174849f
|
JS: incomplete sanitization now also works with RegExp objects
|
2024-11-28 11:26:48 +01:00 |
|
Napalys
|
76318035ff
|
JS: Add test cases for RegExp object usage in replace within incomplete sanitization
|
2024-11-28 11:26:47 +01:00 |
|
Napalys
|
9c2366a660
|
JS: Added tests for ReDos with unknownFlags, everything seems to be good
|
2024-11-28 11:26:46 +01:00 |
|
Napalys
|
875478c1c6
|
JS: Fixed path query not flagging new RegExp with DotRemovingReplaceCall
|
2024-11-28 11:26:45 +01:00 |
|
Napalys
|
aa557cf950
|
JS: Added tests for DotRemovingReplaceCall with RegExp Object.
|
2024-11-28 11:26:44 +01:00 |
|
Napalys
|
a0df33c3ac
|
JS: UnsafeShellCommand Using unknown flags in the RegExp object is no longer flagged as bad sanitization to reduce false positives.
|
2024-11-28 11:26:43 +01:00 |
|
Napalys
|
155f1fca85
|
JS: Added test cases for unsafe shell command sanitization with RegExpr Object, instead of literal
|
2024-11-28 11:26:42 +01:00 |
|
Napalys
|
23b18aeca9
|
JS: Now unknown flags are not flagged in taint paths
|
2024-11-28 11:26:41 +01:00 |
|
Napalys
|
eca7a88615
|
JS: Fixed docs description
|
2024-11-28 11:26:40 +01:00 |
|
Napalys
|
7db6f7c721
|
JS: Added test cases with new RegExp for Tainted paths, currently works only with literals
|
2024-11-28 11:26:39 +01:00 |
|
Napalys
|
faef9dd877
|
JS: protyte poluting now treats unknownFlags as potentially good sanitization.
|
2024-11-28 11:26:38 +01:00 |
|
Napalys
|
41fef0f2b3
|
JS: Added test cases which cover new RegExp creation with replace on protytpe pulluting
|
2024-11-28 11:26:37 +01:00 |
|
Napalys
|
18c7b18f82
|
JS: Now BadHtmlSanitizers new RegExp with unknown flags is also flagged.
|
2024-11-28 11:26:36 +01:00 |
|
Napalys
|
89f3b6f8d3
|
JS: Added test case for bad sanitizer with unknown flags, currently not flagged.
|
2024-11-28 11:26:35 +01:00 |
|
Napalys
|
38be0e4c0a
|
JS: Now BadHtmlSanitizers also flags new RegExp as potential issue
|
2024-11-28 11:26:34 +01:00 |
|
Napalys
|
41f21d429b
|
JS: Added test case which is not flagged but should be abusing new RegExp with global flag
|
2024-11-28 11:26:33 +01:00 |
|
Napalys Klicius
|
d6372aebc7
|
Update javascript/ql/src/Security/CWE-178/CaseSensitiveMiddlewarePath.ql
Co-authored-by: Erik Krogh Kristensen <erik-krogh@github.com>
|
2024-11-25 12:12:12 +01:00 |
|
Napalys
|
e38b63ebcd
|
JS: previously js/case-sensitive-middleware-path was not taking into consideration unknown flags
|
2024-11-25 11:56:06 +01:00 |
|
Napalys
|
178da21fb8
|
JS: Added test case for CWE-178 RegExp with unknown flags
|
2024-11-25 11:53:00 +01:00 |
|
Jami
|
f0045692a7
|
Merge pull request #17869 from jcogs33/jcogs33/improve-weak-crypto
Java: Improve weak crypto query
|
2024-11-24 12:04:00 -05:00 |
|
Calum Grant
|
7baaa2373f
|
Merge pull request #18080 from github/revert-18072-revert-18009-calumgrant/bmn/record-build-mode
C++: Implement compilation_build_mode
|
2024-11-22 17:15:26 +00:00 |
|
Calum Grant
|
b1b62f2362
|
Merge pull request #17919 from github/calumgrant/bmn/too-few-arguments
C++: Remove FPs from cpp/too-few-arguments
|
2024-11-22 16:40:07 +00:00 |
|
Calum Grant
|
4dab0390c9
|
C++: Update expected output
|
2024-11-22 16:10:23 +00:00 |
|
Calum Grant
|
fcf16848d2
|
Revert "Revert "C++: Implement compilation_build_mode""
|
2024-11-22 15:48:50 +00:00 |
|
Calum Grant
|
3b4fdb3fc2
|
Update cpp/ql/test/query-tests/Likely Bugs/Underspecified Functions/test.c
Co-authored-by: Jeroen Ketema <93738568+jketema@users.noreply.github.com>
|
2024-11-22 15:39:28 +00:00 |
|
Calum Grant
|
60155ce205
|
C++: Address review comments
|
2024-11-22 15:30:24 +00:00 |
|
Calum Grant
|
4fa8c6ae65
|
C++: Add change note
|
2024-11-22 15:12:09 +00:00 |
|
Calum Grant
|
227f9c7c1b
|
C++: Update the test.c comments
|
2024-11-22 15:12:07 +00:00 |
|
Calum Grant
|
4d851440b6
|
C++: Remove FPs from cpp/too-few-arguments
|
2024-11-22 15:12:05 +00:00 |
|
Paolo Tranquilli
|
86c25d0396
|
Merge pull request #18074 from github/redsun82/rust-format-parent-child
Rust: fix regression in `getFormat` indexing
|
2024-11-22 14:37:50 +01:00 |
|
Paolo Tranquilli
|
28d517da59
|
Rust: fix regression in getFormat indexing
|
2024-11-22 14:13:15 +01:00 |
|
Paolo Tranquilli
|
626b1cef17
|
Merge pull request #18071 from github/redsun82/rust-format-parent-child
Rust: fix parent/child relationship for format entities
|
2024-11-22 14:03:53 +01:00 |
|
Paolo Tranquilli
|
2e90c80a6f
|
Rust: accept test changes
|
2024-11-22 13:45:00 +01:00 |
|
Tom Hvitved
|
faabc9982e
|
Merge pull request #18056 from paldepind/rust-df-global
Rust: Extend data flow library instantiation for global data flow
|
2024-11-22 13:23:02 +01:00 |
|