Stephan Brandauer
|
3f13a5e082
|
fix a FN for prototype polluting function query
|
2022-04-28 22:00:09 +02:00 |
|
Stephan Brandauer
|
4964f2df9a
|
add flow step to rest parameters
|
2022-04-27 16:03:19 +02:00 |
|
Erik Krogh Kristensen
|
4fba5e4dfb
|
step through parentheses in barrier functions
|
2022-02-25 17:47:12 +01:00 |
|
Erik Krogh Kristensen
|
517e17d422
|
support more property writes in js/prototype-pollution-utility, and generalize ObjectDefinePropertyAsPropWrite
|
2022-02-22 13:23:34 +01:00 |
|
Erik Krogh Kristensen
|
99f5f70345
|
Merge branch 'main' into protoLib
|
2021-11-04 12:53:53 +01:00 |
|
Asger Feldthaus
|
08bc80ffdb
|
JS: Block prototype pollution assignment flows through .replace()
|
2021-11-03 13:24:29 +01:00 |
|
Erik Krogh Kristensen
|
4f6e5c903b
|
filter out writes to number indexes
|
2021-10-28 14:27:07 +02:00 |
|
Erik Krogh Kristensen
|
96b6f670d9
|
filter away paths that start with libary inputs and end with a fixed-property write
|
2021-10-27 21:01:11 +02:00 |
|
Erik Krogh Kristensen
|
a9a9e34265
|
recognize delete expresssions as a sink for js/prototype-polluting-assignment
|
2021-10-27 20:37:42 +02:00 |
|
Erik Krogh Kristensen
|
2dedfb302a
|
remove paths without unmatched returns from js/prototype-polluting-assignment
|
2021-10-27 20:37:42 +02:00 |
|
Erik Krogh Kristensen
|
0c9c9bbde7
|
detect library input when the arguments object is converted to an array
|
2021-10-27 20:37:41 +02:00 |
|
Erik Krogh Kristensen
|
d1238dfd8b
|
update alert message to distinguish between library input and remote flow
|
2021-10-27 20:35:38 +02:00 |
|
Erik Krogh Kristensen
|
6e183af383
|
ignore test files for the `prototypeLessObject' predicate
|
2021-10-27 20:35:37 +02:00 |
|
Erik Krogh Kristensen
|
e94b0f5913
|
recognize inclusion based sanitizers for js/prototype-polluting-assignment
|
2021-10-27 20:35:37 +02:00 |
|
Erik Krogh Kristensen
|
2a808b2cd6
|
track taint through string coercions for js/prototype-polluting-assignment
|
2021-10-27 20:35:37 +02:00 |
|
Erik Krogh Kristensen
|
2d65aa17db
|
recognize exported functions that use the arguments object
|
2021-10-27 20:35:37 +02:00 |
|
Erik Krogh Kristensen
|
78774233c7
|
add library input as source to js/prototype-polluting-assignment
|
2021-10-27 20:35:36 +02:00 |
|
Asger Feldthaus
|
cb0075f15a
|
JS: Remove use of deprecated API
|
2021-08-12 09:30:43 +02:00 |
|
Asger Feldthaus
|
254ac7f963
|
JS: Fix TypeofCheck
|
2020-12-07 10:46:00 +00:00 |
|
Asger Feldthaus
|
daab3c1437
|
JS: Add tests and fix some bugs
|
2020-12-07 10:16:38 +00:00 |
|
Asger Feldthaus
|
0a7513fdfb
|
JS: Move and rename test cases as well
|
2020-12-07 10:16:38 +00:00 |
|