Erik Krogh Kristensen
5340530cb7
use the number guard in existing queries that contained typeof checks
2022-02-09 09:51:57 +01:00
Erik Krogh Kristensen
d6721ec574
implement a isNaN guard for unsafe-shell-command-construction
2022-02-09 09:51:57 +01:00
Tom Hvitved
9440a45015
Merge branch 'main' into post-release-prep/codeql-cli-2.8.0
2022-02-09 09:40:33 +01:00
Chuan-kai Lin
a7f1ee574c
Upgrade scripts testing: set initial dbschemes
...
This commit sets initial dbschemes for cpp, csharp, java, javascript, and
python so that automated testing for upgrade scripts would also cover legacy
upgrades.
2022-02-08 11:11:41 -08:00
Erik Krogh Kristensen
4bbb7ad320
Merge pull request #7876 from erik-krogh/zipRelative
...
JS: recognize more startswith sanitizers for path-injection queries
2022-02-08 15:22:39 +01:00
Erik Krogh Kristensen
28ba78cb76
add explicit this
2022-02-08 12:20:21 +01:00
Erik Krogh Kristensen
d73b2effa0
rename maybeGetJoinArg maybeGetPathSuffix
2022-02-08 10:42:06 +01:00
Erik Krogh Kristensen
cc3f9bf2a8
fix performance issue by inlining a simpler version of getASourceProp
2022-02-08 00:22:01 +01:00
Erik Krogh Kristensen
ca5f91e587
recognize more startswith sanitizers for path-injection queries
2022-02-07 14:19:13 +01:00
Erik Krogh Kristensen
d1d4ebb3b5
add values written to the global scope as exports
2022-02-07 13:34:18 +01:00
Erik Krogh Kristensen
91b03f56ad
move .qll files from src to lib
2022-02-07 13:34:18 +01:00
Erik Krogh Kristensen
955ad8c458
add JSON.stringify as a code-injection sanitizer
2022-02-07 13:34:18 +01:00
Erik Krogh Kristensen
68a5c1f5b5
add code-injection sink for calls to node
2022-02-07 13:34:18 +01:00
Erik Krogh Kristensen
0584a6acaf
recognize a nodejs re-exports in a loop
2022-02-07 10:12:38 +01:00
github-actions[bot]
b4ab86c020
Post-release preparation for codeql-cli-2.8.0
2022-02-06 23:34:07 +00:00
Erik Krogh Kristensen
ab2d3a7ca0
Merge pull request #7828 from Naman-ntc/main
...
JS: Adding model for `.get` function of `Map` in Unvalidated Dynamic Method Call
2022-02-04 20:19:02 +01:00
Erik Krogh Kristensen
edcb3ba902
add file sources from jszip to js/zip-slip
2022-02-04 14:39:49 +01:00
Naman Jain
aea7054938
modified query and added tests
2022-02-02 19:39:08 +05:30
Arthur Baars
33b97f3e0c
Update synchronized files
2022-02-02 13:30:45 +01:00
Erik Krogh Kristensen
7aa59ca233
Merge pull request #7633 from erik-krogh/CWE-300
...
JS: add js/http-dependency query
2022-01-28 12:10:14 +01:00
Erik Krogh Kristensen
b5198bdaca
apply suggestions from doc review
...
Co-authored-by: mc <42146119+mchammer01@users.noreply.github.com >
2022-01-28 10:46:27 +01:00
github-actions[bot]
634134f283
Release preparation for version 2.8.0
2022-01-27 10:40:20 +00:00
Stephan Brandauer
b7690e5e6b
Merge pull request #7734 from kaeluka/js-add-node-prefix-to-module-import
...
js: add support for the 'node:' prefix for importing internal modules
2022-01-26 10:15:08 +01:00
Edoardo Pirovano
662675ebf0
Merge pull request #7739 from github/edoardo/3.4-mergeback
...
Merge `rc/3.4` into `main`
2022-01-25 17:44:13 +00:00
Edoardo Pirovano
1b539eb4dc
Merge branch rc/3.4 into main
2022-01-25 16:22:01 +00:00
Erik Krogh Kristensen
cc527bdecd
Merge pull request #7721 from erik-krogh/CWE-1275
...
JS: add a js/samesite-none-cookie cookie
2022-01-25 13:28:08 +01:00
Erik Krogh Kristensen
caaee5e4e5
make a utility predicate for extracting sameSite values
2022-01-25 12:32:04 +01:00
Stephan Brandauer
9825136e58
add support for the 'node:' prefix for importing internal modules
2022-01-25 10:55:34 +01:00
Stephan Brandauer
35cc5ff0e2
Merge pull request #7715 from kaeluka/recognize-fs-extra-path-args
...
JS: add a predicate to recognize path arguments in calls to the fs-extra lib
2022-01-25 09:36:59 +01:00
CodeQL CI
8d1e22bc38
Merge pull request #7632 from erik-krogh/CWE-862
...
Approved by esbena, felicitymay
2022-01-24 12:47:16 -08:00
Erik Krogh Kristensen
d4bac887cf
add a js/samesite-none-cookie cookie
2022-01-24 21:39:41 +01:00
Stephan Brandauer
02db472209
consistent notation
2022-01-24 10:58:06 +01:00
Stephan Brandauer
8be58fe01e
Fix comment to avoid summarizing implementation
...
Co-authored-by: Esben Sparre Andreasen <esbena@github.com >
2022-01-24 10:47:28 +01:00
Stephan Brandauer
b277731312
add a predicate to recognize path arguments in calls to the fs-extra lib
2022-01-24 09:40:22 +01:00
Erik Krogh Kristensen
a235f8f023
remove redundant inline type casts
2022-01-21 11:46:33 +01:00
Erik Krogh Kristensen
f500bccbe4
add explicit this to member call
2022-01-21 11:46:33 +01:00
CodeQL CI
b02f1c87a1
Merge pull request #7679 from erik-krogh/ql-doc-style
...
Approved by esbena
2022-01-20 23:43:44 -08:00
CodeQL CI
2287b6e549
Merge pull request #7675 from erik-krogh/move-url-sink-to-customizations
...
Approved by esbena
2022-01-20 23:43:15 -08:00
Erik Krogh Kristensen
15c1ce722a
Merge pull request #7678 from erik-krogh/use-set
...
JS: use more set literals
2022-01-20 21:03:48 +01:00
Erik Krogh Kristensen
3155114e36
use more set literals
2022-01-20 16:06:34 +01:00
Erik Krogh Kristensen
5780161b2c
fix most issues found by ql/class-doc-style in JS
2022-01-20 15:10:16 +01:00
Erik Krogh Kristensen
7167e856fe
move electron sink to the customizations file
2022-01-20 14:07:23 +01:00
Erik Krogh Kristensen
548fb47603
JS: move ExternalArtifact.qll into lib/ folder to fix ql/db-type-outside-core
2022-01-20 14:00:57 +01:00
github-actions[bot]
ab218421da
Post-release preparation for codeql-cli-2.7.6
2022-01-20 12:59:20 +00:00
Erik Krogh Kristensen
4e8e3a7420
simplify expressions that could be type-casts
2022-01-20 10:41:35 +01:00
Erik Krogh Kristensen
b8f1fb3954
JS: fix ql/field-only-used-in-charpred within JavaScript
2022-01-20 09:41:13 +01:00
github-actions[bot]
4ce8ccc52b
Release preparation for version 2.7.6
2022-01-20 08:21:18 +00:00
Erik Krogh Kristensen
ef2eacebce
add a js/empty-password-in-configuration-file query
2022-01-19 10:48:45 +01:00
Erik Krogh Kristensen
b7a0b8765e
add js/http-dependency query
2022-01-19 10:05:39 +01:00
Andrew Eisenberg
fbb5d7196f
Merge branch 'main' into post-release-prep/codeql-cli-2.7.5
2022-01-14 08:23:43 -08:00
