31 Commits

Author	SHA1	Message	Date
Rasmus Wriedt Larsen	7ae1047fda	JS: Tag queries with CWE-328 ... CWE-328: Use of Weak Hash, see https://cwe.mitre.org/data/definitions/328.html	2021-12-06 14:02:24 +01:00
Asger Feldthaus	f6da030572	JS: Migrate to *Query.qll convention	2021-08-12 09:30:18 +02:00
Calum Grant	771e686946	Update security-severity scores	2021-06-15 13:25:17 +01:00
Calum Grant	a594afb828	Add security-severity metadata	2021-06-10 20:11:08 +01:00
Asger Feldthaus	f8f3770a58	JS: BadRandomness can just use type-tracking now	2021-03-23 14:53:14 +00:00
Anders Schack-Mulligen	8f2094f0bf	Autoformat.	2020-11-30 14:42:38 +01:00
Erik Krogh Kristensen	3f8881a334	don't report insecure randomness when the insecure random is just a fallback	2020-06-23 15:53:19 +02:00
Erik Krogh Kristensen	d811518a2e	fixed from doc review, and add fixed example for js/biased-cryptographic-random using a secure library	2020-06-16 23:26:54 +02:00
Erik Krogh Kristensen	696879653a	add qhelp to js/biased-cryptographic-random	2020-06-16 11:10:09 +02:00
Erik Krogh Kristensen	3ef5dc74a1	add backtracking to find division that end up being rounded	2020-06-15 17:10:10 +02:00
Erik Krogh Kristensen	7c7af8d841	less heuristics when flagging division that is rounded	2020-06-11 12:55:13 +02:00
Erik Krogh Kristensen	f1b24ba901	use type inference to detect string concatenations	2020-06-11 12:34:58 +02:00
Erik Krogh Kristensen	f634c62af5	remove redundant check	2020-06-11 12:18:41 +02:00
Erik Krogh Kristensen	1124816f73	fixing FPs in js/biased-cryptographic-random	2020-06-11 11:06:02 +02:00
Erik Krogh Kristensen	5c31b94761	autoformat and update expected output	2020-06-10 18:00:56 +02:00
Erik Krogh Kristensen	c4f61134f1	include the source of cryptographically random number in alert message	2020-06-10 13:32:46 +02:00
Erik Krogh Kristensen	7e8fd80327	use steps from InsecureRandomness, and use small-steps	2020-06-10 12:27:50 +02:00
Erik Krogh Kristensen	9189f23403	add support for secure-random	2020-06-10 10:39:02 +02:00
Erik Krogh Kristensen	16ec405724	add explanations about modulo by power of 2	2020-06-10 10:38:47 +02:00
Erik Krogh Kristensen	111f6d406c	introduce query to detect biased random number generators	2020-06-10 10:00:10 +02:00
Esben Sparre Andreasen	1c5bffc095	JS: fix some FNs in the qhelp examples	2020-05-15 12:40:38 +02:00
Sauyon Lee	0040c9fb4c	Update links to OWASP cheat sheet	2019-11-06 20:21:47 -08:00
Max Schaefer	31bb39a810	JavaScript: Autoformat all QL files.	2019-01-07 10:15:45 +00:00
Max Schaefer	3fcd02ab0e	JavaScript: Rename hasPathFlow to hasFlowPath for consistency with other languages.	2018-11-14 11:23:17 +00:00
Max Schaefer	52ae757279	JavaScript: Select Nodes (instead of PathNodes) everywhere.	2018-11-14 09:16:40 +00:00
Max Schaefer	e365b722ee	JavaScript: Select source and sink in all path queries.	2018-11-14 09:16:40 +00:00
Max Schaefer	11d6259dbf	JavaScript: Move from Node to PathNode.	2018-11-14 09:16:40 +00:00
Max Schaefer	8d87f556e1	JavaScript: Add import DataFlow::PathGraph.	2018-11-14 09:16:40 +00:00
Max Schaefer	60a1357092	JavaScript: Make all taint-based security queries have @kind path-problem.	2018-11-14 09:16:40 +00:00
Max Schaefer	65bcf0f526	JavaScript: Refactor security queries for uniformity.	2018-11-14 09:16:40 +00:00
Pavel Avgustinov	b55526aa58	QL code and tests for C#/C++/JavaScript.	2018-08-02 17:53:23 +01:00