Esben Sparre Andreasen
977b287129
JS: implement getADataNode for FetchUrlRequest
2018-10-16 08:51:30 +02:00
Esben Sparre Andreasen
c21a0472d4
JS: implement getADataNode for AxiosUrlRequest
2018-10-16 08:50:56 +02:00
Max Schaefer
080f974663
JavaScript: Refactor AnalyzedPropertyWrite::writes to enable correct modelling of variable exports.
2018-10-12 13:00:52 +01:00
Max Schaefer
cd284b2f97
JavaScript: Add support for Google Cloud Spanner.
2018-10-11 09:30:39 +01:00
Asger F
fd58039753
JS: update additional QL test output
2018-10-09 08:54:14 +01:00
Asger F
030bae9454
JS: Canonicalize ThisNode
2018-10-09 08:53:41 +01:00
Asger F
d2af4ab94a
Merge pull request #227 from xiemaisi/js/taint-kinds
...
JavaScript: Add support for state-based taint tracking.
2018-10-08 15:09:12 +01:00
Max Schaefer
5727b2a5f4
JavaScript: Properly handle value-preserving paths.
...
When constructing a path through a property write/read pair, we want to make sure that we only use value-preserving steps to track the base object. However, the value flowing in from the right-hand side of the assignment may have a different flow label (such as `taint()`), so we cannot use the normal `append` predicate to construct the composite path.
2018-10-03 15:49:02 +01:00
Max Schaefer
910d6de47d
JavaScript: Add new tests.
2018-10-03 15:49:02 +01:00
Max Schaefer
f4ea8bc82a
JavaScript: Introduce flow labels.
2018-10-03 15:49:02 +01:00
Max Schaefer
f3239cbec9
JavaScript: Respect barriers on return edges.
2018-10-03 15:49:01 +01:00
Max Schaefer
8b7bb8cecc
JavaScript: Add test case for type inference in the presence of non-toplevel imports.
2018-10-03 13:08:31 +01:00
semmle-qlci
b35f450b01
Merge pull request #162 from asger-semmle/partial-calls
...
Approved by esben-semmle, xiemaisi
2018-10-02 11:24:02 +01:00
Asger F
e4c8653549
JS: Factor RequestHeaderAccess into separate class
2018-09-27 16:28:58 +01:00
Asger F
1b4fc93e9d
JS: add HTTP::RequestInputAccess.getAHeaderName()
2018-09-27 10:20:35 +01:00
Asger F
f7775f36a8
JS: Add EmailClients lib
2018-09-27 10:20:35 +01:00
semmle-qlci
c36e7f07be
Merge pull request #231 from asger-semmle/express-headers
...
Approved by xiemaisi
2018-09-26 15:40:58 +01:00
semmle-qlci
a93939b827
Merge pull request #230 from esben-semmle/js/ad-hoc-whitelisting
...
Approved by xiemaisi
2018-09-26 14:14:25 +01:00
Asger F
057c3a92b4
JS: update other Express test outputs
2018-09-26 08:36:52 +01:00
Asger F
a47b1dc774
JS: recognize Express header access with dynamic name
2018-09-26 08:22:21 +01:00
Esben Sparre Andreasen
52061b35d8
JS: address review comments: improve regex, limit sanitizer usage
2018-09-26 09:20:07 +02:00
Asger F
e78a4e9f10
JS: update output from other Express tests
2018-09-26 07:58:44 +01:00
Asger F
ce11b5330d
JS: recognize Express headers as RequestInputAccess
2018-09-26 07:58:44 +01:00
Asger F
3ca7d6b4bf
JavaScript: address comments
2018-09-25 10:16:40 +01:00
Esben Sparre Andreasen
42fc28bc55
JS: add ad hoc whitelist checks as sanitizers
2018-09-24 11:17:35 +02:00
Dave Bartolomeo
1f36f5552f
Normalize all text files to LF
...
Use `* text=auto eol=lf`
2018-09-23 16:24:31 -07:00
semmle-qlci
f146e34e26
Merge pull request #207 from dave-bartolomeo/dave/JSNewlines
...
Approved by esben-semmle
2018-09-20 14:49:54 +01:00
Dave Bartolomeo
b12c739915
JavaScript: Normalize line endings of .js and .html files
...
Added .gitattributes files for the two directories where we intentionally have line endings other than LF
2018-09-19 21:33:27 -07:00
semmle-qlci
4aca8f4fd3
Merge pull request #201 from asger-semmle/string-concatenation-squashed
...
Approved by esben-semmle
2018-09-19 21:59:17 +01:00
Asger F
9384b85bcc
JavaScript: ensure prefix sanitizers work for array.join()
2018-09-17 14:31:26 +01:00
Asger F
e2cdf5d7ed
JavaScript: add string concatenation library
2018-09-17 12:47:37 +01:00
Esben Sparre Andreasen
444a09a17c
JS: add models of five file system libraries
2018-09-14 15:30:44 +02:00
semmle-qlci
abbadf24f0
Merge pull request #192 from esben-semmle/js/additional-array-taint-steps
...
Approved by asger-semmle
2018-09-14 10:02:36 +01:00
Esben Sparre Andreasen
4c13e6b46b
JS: add additional array-specific taint steps
2018-09-13 21:36:53 +02:00
semmle-qlci
b17aeb689c
Merge pull request #118 from esben-semmle/js/request-forgery
...
Approved by asger-semmle
2018-09-11 16:28:59 +01:00
Asger F
0a4a5da1f0
JavaScript: update output of CFG test
2018-09-11 12:15:01 +01:00
Esben Sparre Andreasen
f63a3b3f39
JS: add missing abstract modifier
2018-09-05 09:20:45 +02:00
Esben Sparre Andreasen
2306afdebf
JS: use extensible architecture for Electron- and NodeClientRequest
2018-09-05 09:20:45 +02:00
Esben Sparre Andreasen
0da14fccbd
JS: renaming UrlRequests.qll -> ClientRequests.qll
2018-09-05 09:20:45 +02:00
Esben Sparre Andreasen
6d78350fee
JS: s/URLRequest/ClientRequest, merge with NodeJSLib::ClientRequest
2018-09-05 09:20:45 +02:00
Esben Sparre Andreasen
2104cf55e3
JS: add models of URL requests
2018-09-04 09:25:42 +02:00
Max Schaefer
759d98661c
Merge pull request #117 from esben-semmle/js/push-sort-taint-steps
...
JS: support `push` and `sort` taint steps for arrays
2018-09-03 09:20:35 +01:00
Max Schaefer
20bff709b1
Merge pull request #136 from esben-semmle/js/composed-function-taint
...
JS: model composed functions (RC)
2018-09-03 08:18:20 +01:00
Max Schaefer
7e3adec789
Merge pull request #135 from esben-semmle/js/pick-get-taint-steps
...
JS: model property projection calls (RC)
2018-09-03 08:17:42 +01:00
Esben Sparre Andreasen
90b3902244
JS: add a taint step for property projection
2018-08-30 09:39:02 +02:00
Esben Sparre Andreasen
df97132519
JS: add model for property projection
2018-08-30 09:39:02 +02:00
Esben Sparre Andreasen
86ab9adb06
JS: support push and sort taint steps for arrays
2018-08-30 09:14:06 +02:00
Esben Sparre Andreasen
dc72788746
JS: add a model of some function composition libraries
2018-08-30 08:17:01 +02:00
Dave Bartolomeo
d920fc7d94
Force LF line endings for .ql, .qll, and .qlref files
2018-08-24 11:58:58 -07:00
semmle-qlci
55ceb9be8b
Merge pull request #91 from esben-semmle/js/additional-indexof-sanitizers
...
Approved by xiemaisi
2018-08-24 08:37:41 +01:00
