semmle-qlci
|
999e0c8b95
|
Merge pull request #947 from asger-semmle/string-ops-concat
Approved by xiemaisi
|
2019-02-27 09:54:46 +00:00 |
|
Max Schaefer
|
cd9ccd4c8d
|
Merge pull request #983 from asger-semmle/closure-global-ref
JS: add closure library in globalObjectRef
|
2019-02-26 16:55:58 +00:00 |
|
Max Schaefer
|
db5fbe29a3
|
Merge pull request #941 from esben-semmle/js/vue-support-2
JS: Vue security improvements
|
2019-02-26 16:49:38 +00:00 |
|
Max Schaefer
|
739705865b
|
JavaScript: Add basic model of socket.io.
|
2019-02-26 15:53:29 +00:00 |
|
Asger F
|
29d2d620e4
|
JS: add taint step through object/array spread operators
|
2019-02-26 11:43:59 +00:00 |
|
semmle-qlci
|
681ff0f39c
|
Merge pull request #977 from asger-semmle/extend-test-version
Approved by xiemaisi
|
2019-02-26 09:55:41 +00:00 |
|
semmle-qlci
|
74a4103857
|
Merge pull request #976 from asger-semmle/closure-import-deep
Approved by esben-semmle
|
2019-02-26 09:34:04 +00:00 |
|
semmle-qlci
|
00d490e84d
|
Merge pull request #945 from asger-semmle/extensible-module-import
Approved by xiemaisi
|
2019-02-26 09:26:28 +00:00 |
|
Max Schaefer
|
c2a5350bf2
|
Merge pull request #982 from asger-semmle/closure-string-lib
JS: model string functions from closure library
|
2019-02-26 08:26:14 +00:00 |
|
Asger F
|
93440014a0
|
JS: only propagate through first argument of truncate()
|
2019-02-25 17:11:55 +00:00 |
|
Asger F
|
8354909d46
|
JS: add closure library in globalObjectRef
|
2019-02-25 16:45:47 +00:00 |
|
Asger F
|
fab0afd755
|
JS: model string functions from closure library
|
2019-02-25 16:08:47 +00:00 |
|
semmle-qlci
|
58cc8d0ecc
|
Merge pull request #936 from xiemaisi/js/revive-electron-support
Approved by esben-semmle
|
2019-02-25 15:23:20 +00:00 |
|
Esben Sparre Andreasen
|
4dc147d506
|
JS: rename CapturedSource -> LocalObject (files)
|
2019-02-25 16:09:07 +01:00 |
|
Asger F
|
050626aca0
|
JS: remove audit alerts from package.json
|
2019-02-25 15:04:47 +00:00 |
|
Esben Sparre Andreasen
|
66367987af
|
JS: rename CapturedSource -> LocalObject
|
2019-02-25 16:04:37 +01:00 |
|
Esben Sparre Andreasen
|
65fb1423b7
|
JS: format test case (update expected output)
|
2019-02-25 15:55:44 +01:00 |
|
Esben Sparre Andreasen
|
1150f4c02b
|
JS: add documentation to test case
|
2019-02-25 15:52:23 +01:00 |
|
Asger F
|
7d14429dce
|
JS: handle deeper access paths in Closure::moduleImport
|
2019-02-25 12:31:18 +00:00 |
|
Asger F
|
2f6496f6bd
|
JS: add test with undeclared nested access
|
2019-02-25 12:27:36 +00:00 |
|
Asger F
|
b31d7d1f5f
|
JS: add test case
|
2019-02-25 11:31:09 +00:00 |
|
Esben Sparre Andreasen
|
4ce7ec1661
|
JS: add XSS vector for Vue's v-html
|
2019-02-25 12:17:56 +01:00 |
|
Esben Sparre Andreasen
|
da1ffcfd1b
|
JS: introduce Vue Template Element
|
2019-02-25 12:17:33 +01:00 |
|
Esben Sparre Andreasen
|
9f4f945975
|
JS: introduce Vue::InstanceHeapStep
|
2019-02-25 12:17:33 +01:00 |
|
Asger F
|
614ba92fac
|
JS: add ClassContainsTwo.expected
|
2019-02-25 09:51:40 +00:00 |
|
semmle-qlci
|
014d4b9ed0
|
Merge pull request #934 from asger-semmle/module-import
Approved by xiemaisi
|
2019-02-25 09:46:52 +00:00 |
|
Max Schaefer
|
e7c95bae49
|
JavaScript: Add flow steps modelling Electron IPC.
|
2019-02-23 21:43:13 +00:00 |
|
Max Schaefer
|
a4e4957f31
|
JavaScript: Model webContents property.
|
2019-02-23 21:43:13 +00:00 |
|
Max Schaefer
|
ff83e600dc
|
JavaScript: Track Electron browser objects inter-procedurally.
|
2019-02-23 21:43:13 +00:00 |
|
Max Schaefer
|
d59c12e6eb
|
JavaScript: Recognise Electron browser objects based on TypeScript types when available.
|
2019-02-23 21:43:13 +00:00 |
|
Esben Sparre Andreasen
|
6c1b29e4b6
|
JS: add missing flowstep for unused parameter field initializers
|
2019-02-21 21:44:28 +01:00 |
|
Esben Sparre Andreasen
|
6766716867
|
JS: add PropWrite tests for parameter field initializers
|
2019-02-21 21:44:28 +01:00 |
|
Esben Sparre Andreasen
|
bdd8691e65
|
JS: add type inference for the return value of captured method calls
|
2019-02-21 21:44:28 +01:00 |
|
Esben Sparre Andreasen
|
0cf2eaec5e
|
JS: introduce CapturedSource
|
2019-02-21 21:44:28 +01:00 |
|
Asger F
|
e7e29101e4
|
JS: add StringOps::Concatenation
|
2019-02-15 16:57:26 +00:00 |
|
Asger F
|
c115451b9d
|
JS: Fix copy-pasta bug
|
2019-02-15 16:48:42 +00:00 |
|
semmle-qlci
|
26525fc1b5
|
Merge pull request #929 from asger-semmle/typescript-no-expansion
Approved by xiemaisi
|
2019-02-13 18:20:41 +00:00 |
|
semmle-qlci
|
92a6e7e04c
|
Merge pull request #932 from asger-semmle/cookbook-prepare
Approved by xiemaisi
|
2019-02-13 18:20:09 +00:00 |
|
Asger F
|
dfe3f254de
|
JS: generalize to include default imports
|
2019-02-13 18:03:57 +00:00 |
|
Max Schaefer
|
5b2df068d3
|
Merge pull request #921 from asger-semmle/class-node-absval
JS: use type inference to back up function-style classes
|
2019-02-13 10:12:20 +00:00 |
|
Asger F
|
be10f24de7
|
JS: make moduleImport() work for named imports
|
2019-02-12 17:22:06 +00:00 |
|
Anders Schack-Mulligen
|
15a6044445
|
Javascript: Autoformat qlls
|
2019-02-12 14:41:31 +01:00 |
|
Asger F
|
3290c174c3
|
JS: Add DataFlow::Node.getAFunctionValue
|
2019-02-12 13:38:46 +00:00 |
|
Asger F
|
2fd1ee60a2
|
JS: add DataFlow::Node.getIntValue()
|
2019-02-12 13:38:46 +00:00 |
|
Anders Schack-Mulligen
|
1182fca665
|
Javascript: Autoformat qls
|
2019-02-12 14:38:42 +01:00 |
|
semmle-qlci
|
c133362660
|
Merge pull request #910 from xiemaisi/js/regexp-taint
Approved by esben-semmle
|
2019-02-12 13:15:16 +00:00 |
|
Asger F
|
0444fa307d
|
TS: update test expectations
|
2019-02-12 12:33:09 +00:00 |
|
semmle-qlci
|
10b00254ec
|
Merge pull request #915 from asger-semmle/closure-uri-methods
Approved by xiemaisi
|
2019-02-11 10:51:07 +00:00 |
|
Asger F
|
74a9c4b500
|
JS: use type inference to back up function-style classes
|
2019-02-08 16:42:24 +00:00 |
|
Asger F
|
f6e0ccfcf0
|
JS: model URI and XHR methods from closure library
|
2019-02-08 15:18:27 +00:00 |
|