Napalys Klicius
|
d1e769ba54
|
Merge pull request #19422 from Napalys/js/shelljs
JS: Modeling of `ShellJS` functions
|
2025-05-02 14:18:44 +02:00 |
|
Napalys Klicius
|
d4b5ef6a66
|
Refactor process.env handling in CleartextLogging and IndirectCommandInjection modules to use ThreatModelSource
|
2025-05-01 11:14:15 +02:00 |
|
Napalys Klicius
|
33d8ffa83e
|
Added test cases for shelljs.env
|
2025-05-01 11:11:29 +02:00 |
|
Napalys Klicius
|
71f1b82a56
|
Added support for fastify.all
|
2025-04-30 14:54:09 +02:00 |
|
Napalys Klicius
|
6d61766366
|
Added test case for fastify.all
|
2025-04-30 14:50:35 +02:00 |
|
Napalys Klicius
|
18cea2d6a5
|
Added support for shelljs.cmd and async-shelljs.asyncExec
|
2025-04-30 13:37:02 +02:00 |
|
Napalys Klicius
|
25d04f1cdd
|
Added support for shelljs.which
|
2025-04-30 13:35:17 +02:00 |
|
Napalys Klicius
|
f6fae7ad60
|
Added test cases for cmd, which and asyncExec
|
2025-04-30 13:33:31 +02:00 |
|
Napalys Klicius
|
6de38b1827
|
Merge pull request #19300 from Napalys/js/fastify
JS: Added support for `fastify.addHook`
|
2025-04-29 18:32:25 +02:00 |
|
Napalys Klicius
|
73309fb9dd
|
Updated modeling of aws-sdk with MaD
|
2025-04-28 14:00:12 +02:00 |
|
Napalys Klicius
|
42d5b80e81
|
Added support for AWS.Credentials hardcoded credentials
|
2025-04-28 14:00:12 +02:00 |
|
Napalys Klicius
|
f69037c176
|
Added ability to detect direct write to global AWS.config
|
2025-04-28 14:00:12 +02:00 |
|
Napalys Klicius
|
05e4677fd1
|
Added ability to detect new AWS.ServiceName cases with hardcoded credentials
|
2025-04-28 14:00:12 +02:00 |
|
Napalys Klicius
|
e6450a17ec
|
Added test cases for individual AWS services, direct modification of global credentials and AWS.Credentials
|
2025-04-28 14:00:12 +02:00 |
|
Michael Nebel
|
2e0ce44fde
|
Javascript: Update test files.
|
2025-04-23 15:41:41 +02:00 |
|
Napalys
|
fdfdcc0d93
|
Undo unnecessary name tracking for request, response objects
|
2025-04-22 14:16:45 +02:00 |
|
Asger F
|
00661b62dc
|
JS: Add isMiddlewareSetup() hook to Routing model
|
2025-04-22 12:00:02 +02:00 |
|
Asger F
|
c2cab184ac
|
Merge pull request #19283 from asgerf/js/rest-pattern-fix
JS: Fix missing flow into rest pattern lvalue
|
2025-04-22 10:37:36 +02:00 |
|
Napalys
|
5c3556da66
|
Add user-controlled property tracking and update code injection alerts in Fastify hooks
|
2025-04-15 09:41:52 +02:00 |
|
Napalys
|
9b194ea613
|
Added addHook to RouteSetup thus now it is recognized now as rouute handler
|
2025-04-15 09:37:13 +02:00 |
|
Napalys
|
c175081698
|
Added test cases for fastify.addHook
|
2025-04-15 09:33:41 +02:00 |
|
Napalys Klicius
|
86313715a4
|
Merge pull request #19184 from Napalys/js/request_handlers
JS: Support for `Request` and `NextRequest`
|
2025-04-14 08:07:24 +02:00 |
|
Asger F
|
6c01709048
|
JS: Update more test output
|
2025-04-11 15:15:22 +02:00 |
|
Napalys Klicius
|
3d7c0201d9
|
Merge pull request #19231 from Napalys/js/typed_array
JS: Taint propagation from low-level `ArrayBuffer` to `Strings`
|
2025-04-11 11:29:01 +02:00 |
|
Napalys Klicius
|
d17d29a387
|
Merge pull request #19218 from Napalys/js/upgrade_websocket
JS: Refactor `WebSocket` to use `API` graphs
|
2025-04-11 10:05:54 +02:00 |
|
Napalys
|
678eccb417
|
Added searchParams.get as potential source for SSRF
|
2025-04-11 09:42:07 +02:00 |
|
Napalys
|
8674b61e5a
|
Added SSRF test case with searchParams for NextRequest
|
2025-04-11 09:26:16 +02:00 |
|
Napalys
|
6e09a65da0
|
Added support for NextRequest middleware SSRF.
|
2025-04-11 08:43:36 +02:00 |
|
Napalys
|
734ad2d767
|
Removed legacy Consistency check as it is redundant now with inline test expectations.
|
2025-04-11 08:43:08 +02:00 |
|
Napalys
|
208487f236
|
Added middleware test
|
2025-04-11 08:39:47 +02:00 |
|
Asger F
|
719456e27d
|
JS: Fix missing flow into rest pattern lvalue
|
2025-04-11 08:37:09 +02:00 |
|
Asger F
|
7703b1fab5
|
JS: Add test for missing getALocalSource flow for rest pattern
|
2025-04-11 08:37:07 +02:00 |
|
Napalys Klicius
|
43bf0beae9
|
Merge pull request #19263 from Napalys/js/make-dir-lib
JS: Add support for `make-dir` package
|
2025-04-10 15:09:43 +02:00 |
|
Napalys
|
86b64afa13
|
Added NextResponse to the ResponseCall class it models similar near idential behaviour.
|
2025-04-10 15:06:44 +02:00 |
|
Napalys
|
8acb0243ad
|
Added test cases for NextResponse and Response
|
2025-04-10 14:57:40 +02:00 |
|
Napalys
|
63a3953b0c
|
Enhance Next.js API endpoint handling for compatibility with both Pages and App Router structures.
|
2025-04-10 14:48:17 +02:00 |
|
Napalys
|
81cba7fa2f
|
Added test cases with missing alerts for Request and NextRequest.
|
2025-04-10 14:43:48 +02:00 |
|
Asger F
|
eac14b9837
|
Merge pull request #19200 from asgerf/js/web-response
JS: Add sinks for calls to 'new Response()'
|
2025-04-10 14:41:32 +02:00 |
|
Napalys
|
171a84609e
|
Applied copilot suggestion.
|
2025-04-10 14:13:48 +02:00 |
|
Napalys
|
ce2fc25cdb
|
Added make-dir model as data
|
2025-04-09 14:42:29 +02:00 |
|
Napalys
|
674f40b35f
|
Added test cases for make-dir package.
|
2025-04-09 14:41:12 +02:00 |
|
Napalys
|
0c52b5ad95
|
Added summary flow for StringFromCharCode
|
2025-04-09 14:24:43 +02:00 |
|
Napalys Klicius
|
f02783a9c6
|
Merge pull request #19210 from Napalys/js/mkdirp
JS: Modeling of `mkdirp` functions
|
2025-04-09 13:43:37 +02:00 |
|
Napalys
|
a3e4e62eac
|
Removed taint from ArrayBuffer constructor as it accepts length
|
2025-04-09 13:27:13 +02:00 |
|
Napalys
|
b8802a29f4
|
Added open package model as data.
|
2025-04-08 08:12:30 +02:00 |
|
Napalys
|
df89739085
|
Added test cases for open package.
|
2025-04-08 08:10:10 +02:00 |
|
Napalys
|
b97c61864e
|
Add flow summaries and entry points for TextDecoder
|
2025-04-07 18:15:19 +02:00 |
|
Napalys
|
f28478e876
|
Add test cases from TypedArrays to strings.
|
2025-04-07 18:13:52 +02:00 |
|
Napalys
|
f4277204b7
|
Add flow summaries and entry points for ArrayBuffer and SharedArrayBuffer
|
2025-04-07 18:12:35 +02:00 |
|
Napalys
|
0e099474c5
|
Added test cases for ArrayBuffer and SharedArrayBuffer
|
2025-04-07 18:07:54 +02:00 |
|