hohn/codeql
1
0
Fork 0
mirror of https://github.com/github/codeql.git synced 2025-12-19 18:33:16 +01:00
Code Issues Packages Projects Releases Wiki Activity
35,614 Commits 1,671 Branches 157 Tags
c20ee76826e10318f8f39c6fae901b743c2e8254
Commit Graph

3250 Commits

Author SHA1 Message Date
Erik Krogh Kristensen
3d5c1560e4 basic support for .cjs files 2020-08-19 10:53:57 +02:00
Erik Krogh Kristensen
103f739d16 add test for types of modules 2020-08-19 10:52:38 +02:00
Erik Krogh Kristensen
1e65ed2228 support module.createRequire 2020-08-18 14:43:03 +02:00
Erik Krogh Kristensen
d1b3963e2d correctly treat ES2015 modules as being in strict-mode in the extractor 2020-08-18 10:13:20 +02:00
Erik Krogh Kristensen
eb5dfe8438 autoformat 2020-08-17 22:46:20 +02:00
Erik Krogh Kristensen
73d1fac88e support named tuples where not all tuple elements are named 2020-08-17 16:20:26 +02:00
Erik Krogh Kristensen
c28889225a skip binary files when extracting JavaScript 2020-08-17 15:21:15 +02:00
CodeQL CI
c917cd02bd Merge pull request #4054 from erik-krogh/urlIncludes 
Approved by esbena
 2020-08-17 13:54:25 +01:00
CodeQL CI
a19963e9b7 Merge pull request #3930 from erik-krogh/fastProp 
Approved by esbena
 2020-08-17 13:42:12 +01:00
Erik Krogh Kristensen
6f28ddf1f8 proper support for this inside a JSX-name 2020-08-17 14:23:42 +02:00
ubuntu
5d6e6be4e4 Add query-tests 2020-08-16 15:02:52 +02:00
Erik Krogh Kristensen
15a74493e0 more permissive path elements in js/incomplete-url-substring-sanitization 2020-08-13 11:46:13 +02:00
Erik Krogh Kristensen
3fb9c28806 adjust comment about slash position 2020-08-13 11:46:13 +02:00
Erik Krogh Kristensen
d35d3f4271 add test for catch with type unknown 2020-08-13 09:37:55 +02:00
Erik Krogh Kristensen
d95d427c5b better support for the &&=, ||=, and ??= operators 2020-08-13 09:22:32 +02:00
Erik Krogh Kristensen
fd9eb1d40b use Identifier instead of just a plain string when getting tuple-element-names 2020-08-12 16:55:55 +02:00
CodeQL CI
66541f260b Merge pull request #4012 from erik-krogh/getId 
Approved by asgerf, esbena
 2020-08-12 13:28:18 +01:00
Erik Krogh Kristensen
1d111c3e1f expand what urls are detected by js/incomplete-url-substring-sanitization 2020-08-12 14:25:35 +02:00
Erik Krogh Kristensen
a7a016c5df update expected output 2020-08-12 13:29:43 +02:00
Erik Krogh Kristensen
0e33eae960 add dbscheme upgrade script 2020-08-12 11:50:32 +02:00
Erik Krogh Kristensen
26dcd2faae add support for getting the name from named tuple elements 2020-08-12 10:33:49 +02:00
Erik Krogh Kristensen
d2c87d0a2e add support for the new assign expression in TypeScript 4 2020-08-11 13:57:11 +02:00
Erik Krogh Kristensen
2f34990ae6 add another test for spread elements in tuple types 2020-08-11 13:57:11 +02:00
Erik Krogh Kristensen
ea583fe862 add basic support for named tuple elements 2020-08-11 13:57:11 +02:00
Erik Krogh Kristensen
2612e0c5dd add test for spread in tuple in non-last position 2020-08-11 13:57:11 +02:00
Erik Krogh Kristensen
b602a36a24 add test for generic spreads in a tuple 2020-08-11 13:57:11 +02:00
Erik Krogh Kristensen
9bcac10d9e summarize exceptions thrown by immidiatly awaited function calls 2020-08-10 13:28:25 +02:00
Erik Krogh Kristensen
30dc77e538 update expected output 2020-08-08 21:26:45 +02:00
Erik Krogh Kristensen
aab2e6f803 update name of test file 2020-08-07 18:20:22 +02:00
Erik Krogh Kristensen
8f06e9651f update expected output 2020-08-07 17:40:58 +02:00
Erik Krogh Kristensen
b9a98f51ea update existing tests to work with FunctionReturnNode 2020-08-07 17:40:02 +02:00
Erik Krogh Kristensen
0edb46c20d improve precision for load/store steps with async functions 2020-08-07 17:39:59 +02:00
Erik Krogh Kristensen
26ef2f34da add precise return-flow for async functions 2020-08-07 17:33:26 +02:00
Erik Krogh Kristensen
cc94c5ec60 remove imprecise return-flow from async functions 2020-08-07 17:33:24 +02:00
Erik Krogh Kristensen
0004c28fe8 introduce and use FunctionReturnNode 2020-08-07 17:32:25 +02:00
Asger Feldthaus
64f58b74f6 JS: Fix extractor crash when some parameters have no type annotation 2020-08-07 11:56:54 +01:00
Erik Krogh Kristensen
f1dc36244c update tests and queries that used getId() 2020-08-05 14:32:09 +00:00
Erik Krogh Kristensen
f70cb2e7b3 add test for new JSON serializers 2020-08-05 12:14:56 +02:00
Erik Krogh Kristensen
e629e6bbb0 changes based on review 2020-08-04 10:25:05 +02:00
Erik Krogh Kristensen
97aa3cc8a3 rewrite DeadStoreOfProperty to improve worst-case complexity 2020-08-04 10:25:05 +02:00
Erik Krogh Kristensen
dbeef312ca add some TypeScript tests to DeadStoreOfProperty 2020-08-04 10:25:05 +02:00
CodeQL CI
8855ab8c8c Merge pull request #3835 from Raz0r/js/xss-protocol-sinks 
Approved by erik-krogh
 2020-08-03 15:40:05 +01:00
CodeQL CI
a4f8b19ae4 Merge pull request #3876 from erik-krogh/CWE078-Correctness 
Approved by esbena
 2020-08-03 15:38:51 +01:00
CodeQL CI
c8e5db189a Merge pull request #3913 from erik-krogh/topmost 
Approved by asgerf
 2020-08-03 13:18:22 +01:00
Erik Krogh Kristensen
f5cc14f980 fix typo 2020-08-03 13:49:21 +02:00
CodeQL CI
0bbdc70cdb Merge pull request #3864 from erik-krogh/exprString 
Approved by asgerf, esbena
 2020-08-03 09:25:17 +01:00
Max Schaefer
91762ec274 JavaScript: Add partial model for opener. 
3.5M weekly downloads.

Note that we do not treat the first argument as a command-injection sink. While it is possible to inject commands that way, it is more likely to cause false positives where the user input is concatenated with some prefix that makes the opening heuristic decide to treat it as a URL.
 2020-07-27 11:42:32 +01:00
Max Schaefer
9aa26fa4bc JavaScript: Add model for foreground-child. 
>1M weekly downloads, so seems worth doing.
 2020-07-27 11:37:06 +01:00
Max Schaefer
2f842042ea JavaScript: Model another execa function relevant for command injection. 2020-07-27 11:34:04 +01:00
semmle-qlci
e167b87150 Merge pull request #3932 from max-schaefer/portals-additions 
Approved by esbena
 2020-07-09 11:43:45 +01:00