hohn/codeql
1
0
Fork 0
mirror of https://github.com/github/codeql.git synced 2025-12-19 18:33:16 +01:00
Code Issues Packages Projects Releases Wiki Activity
35,614 Commits 1,671 Branches 157 Tags
c20ee76826e10318f8f39c6fae901b743c2e8254
Commit Graph

3250 Commits

Author SHA1 Message Date
Asger Feldthaus
3938856e61 JS: Make this work in qltest 2020-06-29 13:42:55 +01:00
Asger Feldthaus
da3d1a3b5f JS: Recognize 'lang' attribute of script tags 2020-06-29 08:15:52 +01:00
Asger Feldthaus
03c91a66c5 JS: Update expected output 2020-06-29 07:52:25 +01:00
Asger Feldthaus
9ca25d5bef JS: Support .hash extraction via a few more methods 2020-06-28 01:38:59 +01:00
Asger Feldthaus
19db418395 JS: Add missing store step in Xss query 2020-06-28 01:26:11 +01:00
Asger Feldthaus
3e616e998e JS: Add test 2020-06-27 21:31:40 +01:00
ubuntu
9135bbd5c8 JS: model fancy-log (and recognize the 'dir' log level) 2020-06-26 21:33:52 +02:00
Asger Feldthaus
06dd3ab2ca JS: Propagate into RegExp.$x 2020-06-26 18:58:43 +01:00
Asger Feldthaus
17af8f7650 JS: Add test for taint propagating into RegExp.$1 2020-06-26 18:58:43 +01:00
semmle-qlci
3aefb7fad9 Merge pull request #3613 from erik-krogh/Reassigned 
Approved by asgerf
 2020-06-26 17:05:45 +01:00
semmle-qlci
b015c735d0 Merge pull request #3809 from max-schaefer/util-deprecate 
Approved by asgerf
 2020-06-26 14:20:14 +01:00
Max Schaefer
640c194c92 JavaScript: Model util.deprecate as a pre call-graph step. 2020-06-26 11:47:19 +01:00
Max Schaefer
712a216461 Add self-verifying type-tracking tests. 2020-06-26 11:47:19 +01:00
semmle-qlci
f81fc77e9e Merge pull request #3782 from erik-krogh/promiseSteps 
Approved by asgerf
 2020-06-26 10:11:10 +01:00
semmle-qlci
92cc59b47b Merge pull request #3800 from esbena/js/npmlog 
Approved by erik-krogh
 2020-06-26 07:54:08 +01:00
Erik Krogh Kristensen
1ec2c549d2 autoformat 2020-06-25 23:00:52 +02:00
Erik Krogh Kristensen
081b03c8f4 add tests that access-path domination can happen within a statement 2020-06-25 23:00:52 +02:00
Erik Krogh Kristensen
926f2c139f require that a write must dominate the enclosing stmt of a read 2020-06-25 23:00:52 +02:00
Erik Krogh Kristensen
cc2e61531e update expected output 2020-06-25 23:00:52 +02:00
Erik Krogh Kristensen
21e5a522b0 give the same rank to all expressions inside a single stmt 2020-06-25 23:00:52 +02:00
Erik Krogh Kristensen
e467d3ccbf use dominating write check in js/path-injection 2020-06-25 23:00:52 +02:00
Erik Krogh Kristensen
6bc821b1ab add tests for dominating writes 2020-06-25 23:00:52 +02:00
Erik Krogh Kristensen
2b2d691e45 don't treated a property from a tainted object as tainted when there exists a dominating write 2020-06-25 23:00:52 +02:00
semmle-qlci
056e1a8c4b Merge pull request #3599 from asger-semmle/js/nameditem 
Approved by esbena
 2020-06-25 17:34:14 +01:00
Erik Krogh Kristensen
690bde47aa remove a .getALocalSource() that isn't needed 2020-06-25 16:51:10 +02:00
semmle-qlci
cf0cd00458 Merge pull request #3627 from asger-semmle/js/unneeded-defensive-return 
Approved by erik-krogh
 2020-06-25 15:28:57 +01:00
semmle-qlci
c39dce4d66 Merge pull request #3781 from asger-semmle/js/deprecate-type-member-lookup 
Approved by erik-krogh
 2020-06-25 14:56:17 +01:00
Erik Krogh Kristensen
09d969a8ad recognize sensitive files by file-system writes 2020-06-25 15:19:42 +02:00
Erik Krogh Kristensen
8f5a3e9f4f add support for getASavePath() to js/insecure-download 2020-06-25 15:18:31 +02:00
Erik Krogh Kristensen
dafca8fd81 introduce flow-labels to js/insecure-download 2020-06-25 15:17:57 +02:00
Asger Feldthaus
f9b796231b JS: Add regression tests 2020-06-25 11:10:27 +01:00
Esben Sparre Andreasen
4bfce4b8a3 JS: model npmlog (and recognize the "verbose" log level) 2020-06-25 12:06:51 +02:00
Asger Feldthaus
ea3560fe07 JS: Ignore document.all checks explicitly 2020-06-25 11:03:06 +01:00
Asger Feldthaus
b867512db4 JS: Update test 2020-06-25 11:01:10 +01:00
Asger Feldthaus
42f32bf76c JS: Recognize calls to .item and .namedItem 2020-06-24 15:11:18 +01:00
semmle-qlci
696d19cb14 Merge pull request #3773 from erik-krogh/guardedCrypto 
Approved by asgerf
 2020-06-24 13:04:04 +01:00
semmle-qlci
a723ac0d8e Merge pull request #3767 from esbena/js/console-member-calls 
Approved by erik-krogh
 2020-06-24 08:03:49 +01:00
Erik Krogh Kristensen
3f8881a334 don't report insecure randomness when the insecure random is just a fallback 2020-06-23 15:53:19 +02:00
semmle-qlci
0d61443915 Merge pull request #3753 from asger-semmle/js/xss-dom-exception-rephrasing 
Approved by erik-krogh
 2020-06-23 13:01:41 +01:00
Asger Feldthaus
4f67cc269b JS: Reduce ExpansiveTypes test 2020-06-23 11:44:07 +01:00
Asger Feldthaus
234f968294 JS: Deprecate property lookup on types 2020-06-23 11:42:28 +01:00
Esben Sparre Andreasen
2d32ee7448 JS: support member calls of console 2020-06-23 10:46:01 +02:00
Asger Feldthaus
b4f75ef414 Merge branch 'master' into js-team-sprint-merge2 2020-06-23 00:18:09 +01:00
Esben Sparre Andreasen
9a0bbb31f4 Revert "Merge pull request #3702 from esbena/js/memory-exhaustion" 
This reverts commit eca5e2df8a, reversing
changes made to 1548eca994.
 2020-06-22 14:46:51 +02:00
Esben Sparre Andreasen
0a8d15ccc4 Revert "Merge pull request #3672 from esbena/js/server-crashing-route-handler" 
This reverts commit 243e3ad9e3, reversing
changes made to df79f2adc5.
 2020-06-22 14:45:35 +02:00
Asger Feldthaus
1edb2a1892 JS: Rephrase XSS queries that use exception/dom text as source 2020-06-22 10:44:46 +01:00
Asger F
eca5e2df8a Merge pull request #3702 from esbena/js/memory-exhaustion 
JS: add query js/memory-exhaustion
 2020-06-19 20:35:57 +01:00
Erik Krogh Kristensen
0f5ef2c02a Merge branch 'js-team-sprint' into https-fix 2020-06-19 14:57:44 +02:00
Erik Krogh Kristensen
0ee3f4977c add test of webpack-dev-server and monorepo import 2020-06-19 14:15:46 +02:00
Erik Krogh Kristensen
11cc97d286 add basic support for importing from neighbouring packages 2020-06-19 14:15:10 +02:00