8 Commits

Author	SHA1	Message	Date
Asger F	4a6030c592	JS: Update expected with some absent result sets	2024-12-19 15:25:46 +01:00
Asger F	33e8bd5032	JS: Update testUtilities import	2024-12-19 15:25:39 +01:00
Asger F	14ca1c134b	JS: Update TaintedUrlSuffix test	2024-12-13 10:08:07 +01:00
Asger F	1df69ec1d2	JS: Actually don't propagate into array element 0 ... Preserving tainted-url-suffix into array element 0 seemed like a good idea, but didn't work out so well.	2024-09-12 13:42:36 +02:00
Asger F	0e4e0f4fdd	JS: Preverse tainted-url-suffix when stepping into prefix ... A URL of form https://example.com?evil#bar will contain '?evil' after splitting out the '#' suffix, and vice versa.	2024-09-12 13:42:28 +02:00
Asger F	74ab346348	JS: Do not include taint steps in TaintedUrlSuffix::step ... TaintedUrlSuffix is currently only used in TaintTracking configs meaning it is already propagated by taint steps. The inclusion of these taint steps here however meant that implicit reads could appear prior to any of these steps. This was is problematic for PropRead steps as an expression like x[0] could spuriously read from array element 1 via the path: x [element 1] x [empty access path] (after implicit read) x[0] (taint step through PropRead)	2024-09-12 13:42:25 +02:00
Asger F	2712bf821a	JS: Fix a bug in isSafeClientSideUrlProperty	2024-09-12 13:42:23 +02:00
Asger F	e1bed42481	JS: Add inline expectation test specifically for TaintedUrlSuffix	2024-09-12 13:42:20 +02:00