CodeQL CI
722b1a24f6
Merge pull request #4087 from erik-krogh/thisJsx
...
Approved by asgerf
2020-08-25 10:20:32 +01:00
CodeQL CI
844abc51e8
Merge pull request #4108 from erik-krogh/packType
...
Approved by asgerf
2020-08-25 10:17:28 +01:00
CodeQL CI
e2c6a01c00
Merge pull request #4097 from erik-krogh/createRequire
...
Approved by esbena
2020-08-24 15:57:10 +01:00
Erik Krogh Kristensen
309346841a
Merge branch 'main' into packType
2020-08-24 12:44:24 +02:00
Erik Krogh Kristensen
65a1769d43
Merge branch 'main' into asyncCalls
2020-08-21 14:58:27 +02:00
CodeQL CI
29183fa0a1
Merge pull request #4067 from erik-krogh/noBin
...
Approved by esbena
2020-08-20 23:07:02 +01:00
Erik Krogh Kristensen
68f7942820
Merge branch 'main' into noBin
2020-08-20 15:58:15 +02:00
Erik Krogh Kristensen
372e1a3d84
support the "type" field on package.json files while extracting
2020-08-20 14:26:15 +02:00
Erik Krogh Kristensen
8f68f512df
deprecate TrackedNodes.qll
2020-08-20 11:26:22 +02:00
Erik Krogh Kristensen
3d5c1560e4
basic support for .cjs files
2020-08-19 10:53:57 +02:00
Erik Krogh Kristensen
103f739d16
add test for types of modules
2020-08-19 10:52:38 +02:00
Erik Krogh Kristensen
1e65ed2228
support module.createRequire
2020-08-18 14:43:03 +02:00
Erik Krogh Kristensen
d1b3963e2d
correctly treat ES2015 modules as being in strict-mode in the extractor
2020-08-18 10:13:20 +02:00
Erik Krogh Kristensen
eb5dfe8438
autoformat
2020-08-17 22:46:20 +02:00
Erik Krogh Kristensen
c28889225a
skip binary files when extracting JavaScript
2020-08-17 15:21:15 +02:00
CodeQL CI
c917cd02bd
Merge pull request #4054 from erik-krogh/urlIncludes
...
Approved by esbena
2020-08-17 13:54:25 +01:00
Erik Krogh Kristensen
6f28ddf1f8
proper support for this inside a JSX-name
2020-08-17 14:23:42 +02:00
Erik Krogh Kristensen
15a74493e0
more permissive path elements in js/incomplete-url-substring-sanitization
2020-08-13 11:46:13 +02:00
Erik Krogh Kristensen
3fb9c28806
adjust comment about slash position
2020-08-13 11:46:13 +02:00
CodeQL CI
66541f260b
Merge pull request #4012 from erik-krogh/getId
...
Approved by asgerf, esbena
2020-08-12 13:28:18 +01:00
Erik Krogh Kristensen
1d111c3e1f
expand what urls are detected by js/incomplete-url-substring-sanitization
2020-08-12 14:25:35 +02:00
Erik Krogh Kristensen
9bcac10d9e
summarize exceptions thrown by immidiatly awaited function calls
2020-08-10 13:28:25 +02:00
Erik Krogh Kristensen
30dc77e538
update expected output
2020-08-08 21:26:45 +02:00
Erik Krogh Kristensen
aab2e6f803
update name of test file
2020-08-07 18:20:22 +02:00
Erik Krogh Kristensen
8f06e9651f
update expected output
2020-08-07 17:40:58 +02:00
Erik Krogh Kristensen
b9a98f51ea
update existing tests to work with FunctionReturnNode
2020-08-07 17:40:02 +02:00
Erik Krogh Kristensen
0edb46c20d
improve precision for load/store steps with async functions
2020-08-07 17:39:59 +02:00
Erik Krogh Kristensen
26ef2f34da
add precise return-flow for async functions
2020-08-07 17:33:26 +02:00
Erik Krogh Kristensen
cc94c5ec60
remove imprecise return-flow from async functions
2020-08-07 17:33:24 +02:00
Erik Krogh Kristensen
0004c28fe8
introduce and use FunctionReturnNode
2020-08-07 17:32:25 +02:00
Erik Krogh Kristensen
f1dc36244c
update tests and queries that used getId()
2020-08-05 14:32:09 +00:00
Erik Krogh Kristensen
f70cb2e7b3
add test for new JSON serializers
2020-08-05 12:14:56 +02:00
CodeQL CI
8855ab8c8c
Merge pull request #3835 from Raz0r/js/xss-protocol-sinks
...
Approved by erik-krogh
2020-08-03 15:40:05 +01:00
CodeQL CI
a4f8b19ae4
Merge pull request #3876 from erik-krogh/CWE078-Correctness
...
Approved by esbena
2020-08-03 15:38:51 +01:00
CodeQL CI
c8e5db189a
Merge pull request #3913 from erik-krogh/topmost
...
Approved by asgerf
2020-08-03 13:18:22 +01:00
Erik Krogh Kristensen
f5cc14f980
fix typo
2020-08-03 13:49:21 +02:00
CodeQL CI
0bbdc70cdb
Merge pull request #3864 from erik-krogh/exprString
...
Approved by asgerf, esbena
2020-08-03 09:25:17 +01:00
Max Schaefer
91762ec274
JavaScript: Add partial model for opener.
...
3.5M weekly downloads.
Note that we do not treat the first argument as a command-injection sink. While it is possible to inject commands that way, it is more likely to cause false positives where the user input is concatenated with some prefix that makes the opening heuristic decide to treat it as a URL.
2020-07-27 11:42:32 +01:00
Max Schaefer
9aa26fa4bc
JavaScript: Add model for foreground-child.
...
>1M weekly downloads, so seems worth doing.
2020-07-27 11:37:06 +01:00
Max Schaefer
2f842042ea
JavaScript: Model another execa function relevant for command injection.
2020-07-27 11:34:04 +01:00
semmle-qlci
e167b87150
Merge pull request #3932 from max-schaefer/portals-additions
...
Approved by esbena
2020-07-09 11:43:45 +01:00
Max Schaefer
7a1410e0d5
JavaScript: Update and expand tests.
2020-07-09 09:25:52 +01:00
Erik Krogh Kristensen
022cafebd3
make sure the consisntecy-checking library does not mix configurations
2020-07-08 10:28:41 +02:00
Erik Krogh Kristensen
ec38df69b3
update consistency comments for CWE-918
2020-07-08 10:24:55 +02:00
Erik Krogh Kristensen
c5285f7418
update inconsistency comment for CWE-843
2020-07-08 10:16:43 +02:00
Erik Krogh Kristensen
45b6906a0d
move comments to match alert location for CWE-834
2020-07-08 10:16:04 +02:00
Erik Krogh Kristensen
71a3d49d2b
update comments to match alert location for CWE-807
2020-07-08 10:15:26 +02:00
Erik Krogh Kristensen
d814e73023
update comment position to match alert location for CWE-798
2020-07-08 10:12:12 +02:00
Erik Krogh Kristensen
bcffc97de7
update comment position to match alert location for CWE-776
2020-07-08 10:10:31 +02:00
Erik Krogh Kristensen
2235634347
update consistency comments for CWE-754
2020-07-08 10:08:51 +02:00
