hohn/codeql
1
0
Fork 0
mirror of https://github.com/github/codeql.git synced 2026-03-21 06:57:09 +01:00
Code Issues Packages Projects Releases Wiki Activity
748 Commits 1,712 Branches 163 Tags
f3239cbec9ddd15b2e567b4761ee4e38aede0ae4
Commit Graph

136 Commits

Author SHA1 Message Date
Max Schaefer
f3239cbec9 JavaScript: Respect barriers on return edges. 2018-10-03 15:49:01 +01:00
semmle-qlci
b35f450b01 Merge pull request #162 from asger-semmle/partial-calls 
Approved by esben-semmle, xiemaisi
 2018-10-02 11:24:02 +01:00
semmle-qlci
829a5cc451 Merge pull request #259 from asger-semmle/open-redirect-expr 
Approved by xiemaisi
 2018-10-02 08:32:48 +01:00
Max Schaefer
92afcd32f8 Merge pull request #241 from asger-semmle/host-header-forgery 
JS: Add HostHeaderPoisoningInEmailGeneration query
 2018-10-02 08:32:00 +01:00
Asger F
9f07b1011d JS: bugfix in server-side redirect query 2018-10-01 12:34:13 +01:00
Asger F
e4c8653549 JS: Factor RequestHeaderAccess into separate class 2018-09-27 16:28:58 +01:00
semmle-qlci
df4bd36b0f Merge pull request #236 from aschackmull/xml-qll/use-concat 
Approved by hvitved, xiemaisi, yh-semmle
 2018-09-27 11:58:58 +01:00
Asger F
1b4fc93e9d JS: add HTTP::RequestInputAccess.getAHeaderName() 2018-09-27 10:20:35 +01:00
Asger F
f7775f36a8 JS: Add EmailClients lib 2018-09-27 10:20:35 +01:00
semmle-qlci
c36e7f07be Merge pull request #231 from asger-semmle/express-headers 
Approved by xiemaisi
 2018-09-26 15:40:58 +01:00
Asger F
f0886fd0bb JS: fix indefinite check on callback 2018-09-26 15:25:26 +01:00
Anders Schack-Mulligen
9198f5b9bd CPP/CSharp/Java/Javascript: Use concat in XMLParent.allCharactersString(). 2018-09-26 15:47:21 +02:00
Anders Schack-Mulligen
26c1397216 CPP/CSharp/Javascript: Clean up QLDoc and bring the different XML.qll files closer. 2018-09-26 15:36:20 +02:00
semmle-qlci
a93939b827 Merge pull request #230 from esben-semmle/js/ad-hoc-whitelisting 
Approved by xiemaisi
 2018-09-26 14:14:25 +01:00
Asger F
a47b1dc774 JS: recognize Express header access with dynamic name 2018-09-26 08:22:21 +01:00
Esben Sparre Andreasen
52061b35d8 JS: address review comments: improve regex, limit sanitizer usage 2018-09-26 09:20:07 +02:00
Asger F
ce11b5330d JS: recognize Express headers as RequestInputAccess 2018-09-26 07:58:44 +01:00
Asger F
0936cda0e9 JS: avoid expensive join_rhs in callInputStep 2018-09-25 10:16:40 +01:00
Asger F
52c913b325 JavaScript: cache AdditionalPartialInvokeNode 2018-09-25 10:16:40 +01:00
Asger F
3ca7d6b4bf JavaScript: address comments 2018-09-25 10:16:40 +01:00
Asger F
269bbc9a1a JavaScript: add flow steps through partial function application 2018-09-25 10:16:40 +01:00
semmle-qlci
46178271d1 Merge pull request #213 from asger-semmle/sendfile 
Approved by xiemaisi
 2018-09-24 11:32:46 +01:00
Esben Sparre Andreasen
42fc28bc55 JS: add ad hoc whitelist checks as sanitizers 2018-09-24 11:17:35 +02:00
semmle-qlci
4aca8f4fd3 Merge pull request #201 from asger-semmle/string-concatenation-squashed 
Approved by esben-semmle
 2018-09-19 21:59:17 +01:00
Asger F
9384b85bcc JavaScript: ensure prefix sanitizers work for array.join() 2018-09-17 14:31:26 +01:00
Asger F
e2cdf5d7ed JavaScript: add string concatenation library 2018-09-17 12:47:37 +01:00
Asger F
b20fd3c084 JS: recognize res.sendfile as alias for res.sendFile in Express 2018-09-17 11:31:10 +01:00
Esben Sparre Andreasen
444a09a17c JS: add models of five file system libraries 2018-09-14 15:30:44 +02:00
Esben Sparre Andreasen
33f98dd1a7 JS: add query: js/stored-xss 2018-09-14 15:30:44 +02:00
Esben Sparre Andreasen
e2fac8a03c JS: introduce concept: FileNameSource 2018-09-14 11:09:29 +02:00
Esben Sparre Andreasen
6d3c1a1d22 JS: introduce fsModuleMember 2018-09-14 11:09:29 +02:00
Esben Sparre Andreasen
8de269e1fb JS: add support for fs-extra in NodeJSFileSystemAccess 2018-09-14 11:09:29 +02:00
semmle-qlci
abbadf24f0 Merge pull request #192 from esben-semmle/js/additional-array-taint-steps 
Approved by asger-semmle
 2018-09-14 10:02:36 +01:00
Esben Sparre Andreasen
4c13e6b46b JS: add additional array-specific taint steps 2018-09-13 21:36:53 +02:00
Esben Sparre Andreasen
763da72ce5 JS: modernize old array taint steps 2018-09-13 15:52:25 +02:00
Esben Sparre Andreasen
ea37665ec6 JS: move array-specific taint steps to separate class 2018-09-13 15:52:25 +02:00
semmle-qlci
3d022298dc Merge pull request #186 from Semmle/rc/1.18 
Approved by esben-semmle
 2018-09-13 12:34:54 +01:00
semmle-qlci
9e0ba51280 Merge pull request #179 from esben-semmle/js/classify-multi-license-fix 
Approved by asger-semmle
 2018-09-11 21:30:10 +01:00
semmle-qlci
b17aeb689c Merge pull request #118 from esben-semmle/js/request-forgery 
Approved by asger-semmle
 2018-09-11 16:28:59 +01:00
Esben Sparre Andreasen
43c65e02ec JS: classify bundle files based on multiple license comments 2018-09-11 15:40:24 +02:00
Asger F
3d444f3dc6 JavaScript: fix CFG for EnhancedForStmt 2018-09-11 12:15:01 +01:00
Aditya Sharad
f27945216f Merge rc/1.18 into master. 2018-09-05 15:32:30 +01:00
Esben Sparre Andreasen
f63a3b3f39 JS: add missing abstract modifier 2018-09-05 09:20:45 +02:00
Esben Sparre Andreasen
89887e7dc8 JS: address review comments 2018-09-05 09:20:45 +02:00
Esben Sparre Andreasen
2306afdebf JS: use extensible architecture for Electron- and NodeClientRequest 2018-09-05 09:20:45 +02:00
Esben Sparre Andreasen
2dd8e95a51 JS: remove unused getOptions method 2018-09-05 09:20:45 +02:00
Esben Sparre Andreasen
d578c7422d JS: docstring cleanup 2018-09-05 09:20:45 +02:00
Esben Sparre Andreasen
0da14fccbd JS: renaming UrlRequests.qll -> ClientRequests.qll 2018-09-05 09:20:45 +02:00
Esben Sparre Andreasen
6d78350fee JS: s/URLRequest/ClientRequest, merge with NodeJSLib::ClientRequest 2018-09-05 09:20:45 +02:00
Esben Sparre Andreasen
b9d825b379 JS: better matching of String.prototype.search in js/regex-injection 2018-09-05 08:35:00 +02:00