18 Commits

Author	SHA1	Message	Date
Erik Krogh Kristensen	fd0d5c9e46	add command parsing model for "commander"	2020-11-27 09:58:00 +00:00
Erik Krogh Kristensen	653ebf7668	add command parsing model for "dashdash"	2020-11-27 09:57:05 +00:00
Erik Krogh Kristensen	269de49196	add model for "meow"	2020-11-27 09:57:05 +00:00
Erik Krogh Kristensen	c5ac98d2e8	add command parsing model for command-line-args	2020-11-27 09:57:05 +00:00
Erik Krogh Kristensen	f33cd8bc8e	add command parsing model for argparse	2020-11-27 09:57:05 +00:00
Erik Krogh Kristensen	45067ee651	add command parsing model for "arg"	2020-11-27 09:57:05 +00:00
Erik Krogh Kristensen	821b4be522	more accurately model command parsers that take process.argv as an argument	2020-11-27 09:56:50 +00:00
Erik Krogh Kristensen	ef72c03ca9	use simpler taint-step for DestructingPattern	2020-06-11 23:16:46 +02:00
Erik Krogh Kristensen	b8a9ac39f4	add lValueFlowStep for rest-pattern nested inside a property-pattern (and removed old incorrect approach)	2020-06-09 18:16:00 +02:00
Erik Krogh Kristensen	b510e470b1	support rest-patterns inside property patterns	2020-06-09 13:28:56 +02:00
Erik Krogh Kristensen	0f06f04e32	extend support for yargs for js/indirect-command-line-injection	2020-06-08 16:45:09 +02:00
Esben Sparre Andreasen	8e6a19b3d3	JS: add DefaultParsedCommandLineArgumentsAsSource	2019-11-15 08:42:02 +01:00
Max Schaefer	8aae1f443f	JavaScript: Use type tracking instead of auxiliary data-flow configuration to track indirect command arguments.	2019-10-31 12:13:55 +00:00
Max Schaefer	b42026a90a	JavaScript: Update expected output.	2019-10-29 15:36:24 +00:00
Max Schaefer	dc1d1c2f22	JavaScript: Update expected output.	2019-10-29 15:30:06 +00:00
Max Schaefer	6964945c74	JavaScript: Restrict edges to only contain nodes.	2019-10-29 15:03:52 +00:00
Esben Sparre Andreasen	5a983cb535	JS: add query js/shell-command-injection-from-environment	2019-10-21 23:31:55 +02:00
Esben Sparre Andreasen	bf4a324a86	JS: add query js/indirect-command-line-injection	2019-07-31 09:24:25 +02:00