Erik Krogh Kristensen
|
f083e87fa1
|
refactor the js/xss query to use three flowlabels and one configuration
|
2022-03-16 22:32:08 +01:00 |
|
Asger Feldthaus
|
f6da030572
|
JS: Migrate to *Query.qll convention
|
2021-08-12 09:30:18 +02:00 |
|
Calum Grant
|
771e686946
|
Update security-severity scores
|
2021-06-15 13:25:17 +01:00 |
|
Calum Grant
|
a594afb828
|
Add security-severity metadata
|
2021-06-10 20:11:08 +01:00 |
|
Erik Krogh Kristensen
|
646bf99489
|
rewrite the qhelp to focus more on documenting unsafe functions
|
2021-05-10 10:48:40 +02:00 |
|
Erik Krogh Kristensen
|
b53759c5a0
|
corrections after code review
|
2021-05-06 22:49:25 +02:00 |
|
Erik Krogh Kristensen
|
2d1ba59e6d
|
Apply suggestions from code review
Co-authored-by: Esben Sparre Andreasen <esbena@github.com>
|
2021-05-06 21:55:30 +02:00 |
|
Erik Krogh Kristensen
|
7ef641e7b2
|
add qhelp
|
2021-05-06 11:05:02 +02:00 |
|
Erik Krogh Kristensen
|
e86a3b5e57
|
add js/html-constructed-from-input query
|
2021-05-06 11:04:49 +02:00 |
|
Chris Smowton
|
455b840712
|
Fix all dead qhelp links
For those documents with no obvious new home I've pointed the links to the Internet Archive.
|
2021-04-23 15:20:21 +01:00 |
|
Asger Feldthaus
|
d916118ea4
|
JS: Move ExceptionXss source into Xss.qll
|
2021-03-02 13:16:10 +00:00 |
|
Asger Feldthaus
|
7afa755597
|
JS: Add ajv error as source of ExceptionXss
|
2021-03-02 12:39:04 +00:00 |
|
Asger Feldthaus
|
c91cdb5194
|
JS: Address review comments
|
2020-10-20 12:00:02 +01:00 |
|
Asger Feldthaus
|
50a015c73e
|
JS: Move $() sink into separate dataflow config
|
2020-10-20 10:52:33 +01:00 |
|
Erik Krogh Kristensen
|
6fccf5aa70
|
use isLikelyIntentionalHtmlSink in the sink instead of in the where clause
|
2020-09-04 09:26:03 +02:00 |
|
Asger F
|
56124b68a3
|
Update javascript/ql/src/Security/CWE-079/ExceptionXss.ql
Co-authored-by: Erik Krogh Kristensen <erik-krogh@github.com>
|
2020-06-22 12:54:19 +01:00 |
|
Asger Feldthaus
|
1edb2a1892
|
JS: Rephrase XSS queries that use exception/dom text as source
|
2020-06-22 10:44:46 +01:00 |
|
Esben Sparre Andreasen
|
1c5bffc095
|
JS: fix some FNs in the qhelp examples
|
2020-05-15 12:40:38 +02:00 |
|
Erik Krogh Kristensen
|
a71567da54
|
autoformat
|
2020-04-23 18:58:33 +02:00 |
|
Erik Krogh Kristensen
|
96896fd7f5
|
second round of UnsafeJQueryPlugin reuse
|
2020-04-23 15:12:32 +02:00 |
|
Erik Krogh Kristensen
|
7bfea946fd
|
update links in xss-through-dom qhelp
|
2020-04-22 10:23:03 +02:00 |
|
Erik Krogh Kristensen
|
76503d3536
|
user controlled -> user-controlled
|
2020-04-22 10:08:01 +02:00 |
|
Erik Krogh Kristensen
|
947e9828da
|
Update javascript/ql/src/Security/CWE-079/XssThroughDom.qhelp
Co-Authored-By: mc <42146119+mchammer01@users.noreply.github.com>
|
2020-04-22 10:07:50 +02:00 |
|
Erik Krogh Kristensen
|
9fc29ee0f8
|
update qhelp
|
2020-04-20 13:29:00 +02:00 |
|
Erik Krogh Kristensen
|
2d3e42e6d6
|
update qhelp for xss-through-dom
Co-Authored-By: Asger F <asgerf@github.com>
|
2020-04-20 11:50:46 +02:00 |
|
Erik Krogh Kristensen
|
1b80f46f30
|
add QHelp for js/xss-through-dom query
|
2020-04-17 10:54:21 +02:00 |
|
Erik Krogh Kristensen
|
14b551f887
|
Xss through DOM
|
2020-04-17 10:54:14 +02:00 |
|
Asger Feldthaus
|
fefcf1a7a6
|
JS: Autoformat everything
|
2020-02-27 09:41:01 +00:00 |
|
Esben Sparre Andreasen
|
7f25c1bf47
|
JS: address doc-review comments
|
2020-01-31 19:33:04 +01:00 |
|
Esben Sparre Andreasen
|
c70997febf
|
JS: address review comments for js/unsafe-jquery-plugin
|
2020-01-31 19:33:04 +01:00 |
|
Esben Sparre Andreasen
|
eaff78b37e
|
JS: change severity to warning
|
2020-01-31 19:33:04 +01:00 |
|
Esben Sparre Andreasen
|
fef918ac13
|
JS: add query "Unsafe jQuery plugin"
|
2020-01-31 19:33:04 +01:00 |
|
Erik Krogh Kristensen
|
e27a69960d
|
update description
|
2019-11-27 11:17:19 +01:00 |
|
Erik Krogh Kristensen
|
b5a57986c6
|
small changes based on review feedback
|
2019-11-26 15:57:31 +01:00 |
|
Erik Krogh Kristensen
|
7ee12a3420
|
change doc based on review feedback
|
2019-11-26 10:48:24 +01:00 |
|
Erik Krogh Kristensen
|
f40d79271d
|
cleanup module imports and update expected outputs
|
2019-11-22 13:55:47 +01:00 |
|
Erik Krogh Kristensen
|
3b9847e075
|
apply suggestions from max
Co-Authored-By: Max Schaefer <54907921+max-schaefer@users.noreply.github.com>
|
2019-11-17 09:01:48 +01:00 |
|
Erik Krogh Kristensen
|
e95cceef1d
|
import all the shared XSS sources and sinks
|
2019-11-15 15:41:53 +01:00 |
|
Erik Krogh Kristensen
|
65a018ceed
|
use flow labels to avoid dual configurations
|
2019-11-15 14:37:46 +01:00 |
|
Erik Krogh Kristensen
|
e49b5e4afc
|
up precision from low to medium, and fix tab/spaces
|
2019-11-14 17:42:16 +01:00 |
|
Erik Krogh Kristensen
|
7137a64b7d
|
Added query for detecting XSS that happens through an exception
|
2019-11-14 17:04:00 +01:00 |
|
Sauyon Lee
|
0040c9fb4c
|
Update links to OWASP cheat sheet
|
2019-11-06 20:21:47 -08:00 |
|
Chris Gavin
|
bce153648e
|
JavaScript: Update link to the OWASP XSS prevetion cheat sheet.
|
2019-06-24 23:21:14 +01:00 |
|
Max Schaefer
|
31bb39a810
|
JavaScript: Autoformat all QL files.
|
2019-01-07 10:15:45 +00:00 |
|
Max Schaefer
|
ef347b3870
|
JavaScript: Teach Xss query about WinJS HTML injection functions.
|
2018-12-06 09:13:21 +00:00 |
|
Max Schaefer
|
3fcd02ab0e
|
JavaScript: Rename hasPathFlow to hasFlowPath for consistency with other languages.
|
2018-11-14 11:23:17 +00:00 |
|
Max Schaefer
|
52ae757279
|
JavaScript: Select Nodes (instead of PathNodes) everywhere.
|
2018-11-14 09:16:40 +00:00 |
|
Max Schaefer
|
e365b722ee
|
JavaScript: Select source and sink in all path queries.
|
2018-11-14 09:16:40 +00:00 |
|
Max Schaefer
|
11d6259dbf
|
JavaScript: Move from Node to PathNode.
|
2018-11-14 09:16:40 +00:00 |
|
Max Schaefer
|
8d87f556e1
|
JavaScript: Add import DataFlow::PathGraph.
|
2018-11-14 09:16:40 +00:00 |
|