1353 Commits

Author	SHA1	Message	Date
Asger F	13b1e97caa	JS: Fix the ExtendCall restriction	2023-04-17 12:30:08 +02:00
Asger F	2f4a181a7d	JS: revert path sanitizers in proto pollution query	2023-04-17 12:21:00 +02:00
Asger F	b728f71b4b	JS: Move 'this' sanitizer to customizations	2023-04-17 12:11:18 +02:00
Asger F	c250ba7f27	JS: Undo sanitization of path.normalize()	2023-04-17 08:23:04 +02:00
Asger F	0d598c437d	JS: Fix observed FPs in UnsafeJQueryPlugin	2023-04-17 08:20:18 +02:00
Asger F	b321151a28	JS: Restrict ExtendCall flow in proto pollution query	2023-04-17 08:20:18 +02:00
Asger F	efb582b661	JS: Drive-by fix to newly gained FPs	2023-04-17 08:20:18 +02:00
Asger F	869c6d27fe	JS: Add implied receiver steps	2023-04-17 08:20:18 +02:00
Asger F	74dbc71535	JS: Change Extend steps to PreCallGraphStep	2023-04-17 08:20:18 +02:00
Erik Krogh Kristensen	cece307c60	Merge pull request #12802 from erik-krogh/history-xss ... JS: add browser history as XSS sink	2023-04-14 13:35:19 +02:00
Alex Eyers-Taylor	c6a482819a	Bump all qlpacks major versions	2023-04-13 19:15:27 +01:00
Alex Ford	8c46bfd051	Merge pull request #12816 from github/rc/3.9 ... Merge `rc/3.9` into `main`	2023-04-13 12:35:41 +01:00
Asger F	b819f55203	Merge pull request #12792 from asgerf/js/redux-model-perf ... JS: add getForwardingFunction and use to sharpen useSelector model	2023-04-12 14:09:59 +02:00
erik-krogh	b1957623c1	add browser history as XSS sink	2023-04-12 13:38:18 +02:00
Asger F	aef0fa3c8a	JS: Expand QLDoc	2023-04-11 14:16:36 +02:00
Asger F	2c65a49d7c	JS: Add getForwardingFunction() to API graphs	2023-04-11 14:00:30 +02:00
Asger F	4ce03d4dc4	JS: Restrict useSelector steps to local callbacks	2023-04-11 13:33:46 +02:00
Asger F	3cc931306f	JS: Add test for selector nodes with multiple access paths	2023-04-11 13:33:27 +02:00
tyage	40d475863d	Add change note	2023-04-08 18:36:50 +09:00
tyage	7f9b8557ac	Add Next.js router push as XSS sink	2023-04-08 18:18:34 +09:00
github-actions[bot]	ac426b1302	Post-release preparation for codeql-cli-2.12.6	2023-04-04 16:49:26 +00:00
Asger F	64cf27ab87	JS: Modernize crypto libraries	2023-03-31 14:49:23 +02:00
Asger F	40530ae14d	JS: Simplfy with set literal	2023-03-31 12:04:56 +02:00
Asger F	4a06b81429	JS: Use API graphs in CryptoJS	2023-03-31 12:03:14 +02:00
Asger F	dec1e4dfd6	Merge pull request #12666 from smiddy007/improve-insufficient-pw-hash-query ... JS: Improve insufficient pw hash query	2023-03-31 11:58:41 +02:00
github-actions[bot]	0a3218676c	Release preparation for version 2.12.6	2023-03-30 19:25:06 +00:00
github-actions[bot]	e87ce62f95	Post-release preparation for codeql-cli-2.12.5	2023-03-30 13:48:58 +00:00
Asger F	43174cfe3a	Merge pull request #12668 from asgerf/js/jquery-callback-sinks ... JS: fix handling of jQuery sinks involving callback	2023-03-30 12:42:53 +02:00
Jeroen Ketema	0acca2ba76	Merge pull request #12687 from jketema/unit-2 ... Make imports of `codeql.util.Unit` private	2023-03-29 13:07:12 +02:00
smiddy007	0eb61d39d3	formatting	2023-03-28 11:28:32 -04:00
smiddy007	fe3b0a56ca	Removed unnecessary field	2023-03-28 11:27:23 -04:00
smiddy007	8e9f2185c8	Merge branch 'main' into improve-insufficient-pw-hash-query	2023-03-28 11:15:10 -04:00
smiddy007	123eb1e57b	Update javascript/ql/lib/semmle/javascript/frameworks/CryptoLibraries.qll ... Co-authored-by: Asger F <asgerf@github.com>	2023-03-28 11:14:28 -04:00
Erik Krogh Kristensen	451f6f01bb	Merge pull request #12633 from erik-krogh/more-global-flow ... JS: better callgraph support for global variables	2023-03-28 15:19:50 +02:00
Jeroen Ketema	3b8ad087eb	Make imports of codeql.util.Unit private	2023-03-28 14:14:13 +02:00
Asger F	61a7ee9387	JS: Use getABoundFunctionValue instead of type-tracking	2023-03-28 12:56:03 +02:00
smiddy007	2caab8748e	Merge branch 'improve-insufficient-pw-hash-query' of https://github.com/smiddy007/codeql into improve-insufficient-pw-hash-query	2023-03-27 15:20:24 -04:00
smiddy007	57ab5a06ae	autoformatted	2023-03-27 15:20:08 -04:00
smiddy007	64b56ef107	Merge branch 'main' into improve-insufficient-pw-hash-query	2023-03-27 12:07:21 -04:00
smiddy007	3ef5f3070f	small change	2023-03-27 12:02:35 -04:00
Asger F	92a681213d	JS: Step through jQuery callback return values	2023-03-27 11:17:27 +02:00
smiddy007	4980948613	changenote	2023-03-26 23:07:32 -04:00
smiddy007	cef6b95b15	Fixed Conflicts due to recent changes to file	2023-03-26 22:32:34 -04:00
smiddy007	ccf152df00	Added support for progressive hashing in crypto-js module	2023-03-26 21:29:55 -04:00
Jeroen Ketema	a87a9438c7	Replace all definitions of Unit by import codeql.util.Unit	2023-03-24 10:39:34 +01:00
erik-krogh	2bba9057a0	better callgraph support for global variables	2023-03-22 13:49:33 +01:00
Erik Krogh Kristensen	663d4e8e3b	Merge pull request #12592 from erik-krogh/rhsRegress ... JS: Fix performance regression in the `GetLaterAccess` module.	2023-03-22 12:55:56 +01:00
Erik Krogh Kristensen	bdab57b9d3	Update javascript/ql/lib/semmle/javascript/GlobalAccessPaths.qll ... Co-authored-by: Asger F <asgerf@github.com>	2023-03-22 10:19:48 +01:00
erik-krogh	c023af7308	manual recursion, and other join-order	2023-03-21 15:22:10 +01:00
erik-krogh	070468ab68	fix performance	2023-03-21 15:19:38 +01:00