Max Schaefer
f9d704bdcf
JavaScript: Add example of indirect command injection.
2019-01-11 10:24:41 +00:00
Max Schaefer
7d2d33840a
JavaScript: Track flow through forwarding higher-order calls.
2019-01-11 09:15:58 +00:00
Max Schaefer
59bac829b1
JavaScript: Refactor flowsIntoHigherOrderCall predicate.
2019-01-11 08:34:09 +00:00
Max Schaefer
edc5117dfd
JavaScript: Track flow into (simple) higher-order function calls.
...
The only case we support for now are functions that invoke one of their arguments, passing another argument as input.
2019-01-11 08:11:15 +00:00
Max Schaefer
414ab8ea8c
JavaScript: Refactor argumentPassing.
2019-01-11 07:57:58 +00:00
semmle-qlci
f474fdd0f9
Merge pull request #731 from xiemaisi/js/performance-fiddling
...
Approved by asger-semmle, esben-semmle
2019-01-10 10:01:02 +00:00
Max Schaefer
97e6c75b94
JavaScript: Remove a few other deprecated predicates and classes.
2019-01-09 09:23:59 +00:00
Max Schaefer
db8e436046
JavaScript: Remove deprecated flow tracking predicates.
2019-01-09 09:23:59 +00:00
Max Schaefer
8a93c6aa65
JavaScript: Remove a few deprecated classes.
2019-01-09 09:23:59 +00:00
Max Schaefer
5d1d94ebf1
JavaScript: Remove deprecated old call graph library.
2019-01-09 09:23:59 +00:00
Max Schaefer
db713fb359
JavaScript: Remove deprecated backward-compatibility layer in security libraries.
2019-01-09 09:23:59 +00:00
Max Schaefer
feb9693fea
JavaScript: Remove old data flow library.
2019-01-09 09:23:59 +00:00
Max Schaefer
8951eaead3
JavaScript: Improve caching of getACallee and related predicates.
2019-01-08 09:42:44 +00:00
Max Schaefer
627583fffa
JavaScript: Refactor UselessConditional for performance.
2019-01-08 09:40:49 +00:00
Max Schaefer
de429752d1
JavaScript: Restructure implementation of DataFlow::SourceNode.
...
It now uses a facade pattern similar to `InvokeNode`: the range of the class is defined by an abstract class `DataFlow::SourceNode::Range`, while the actual behaviour is defined by the (no longer abstract) `SourceNode` class itself.
Clients that want to add new source nodes need to extend `DataFlow::SourceNode::Range`, those that want to refine the behaviour of existing source nodes should extend `DataFlow::SourceNode` itself.
While this is technically a breaking API change, I think separating the two aspects in this way is cleaner and makes it easier to use, and improves performance as well.
2019-01-08 08:01:20 +00:00
Max Schaefer
31bb39a810
JavaScript: Autoformat all QL files.
2019-01-07 10:15:45 +00:00
Max Schaefer
b4f400fb23
Merge remote-tracking branch 'upstream/next' into qlucie/master
2019-01-04 10:35:57 +00:00
semmle-qlci
8174fb51ae
Merge pull request #705 from asger-semmle/loop-index-concurrent-modification
...
Approved by mc-semmle, xiemaisi
2019-01-03 17:06:12 +00:00
semmle-qlci
6c768263d2
Merge pull request #716 from xiemaisi/js/cosmetics
...
Approved by esben-semmle
2019-01-03 16:11:50 +00:00
Asger F
f24313a215
JS: address doc review
2019-01-03 10:49:36 +00:00
Max Schaefer
0a2df6c00d
JavaScript: Highlight id attribute (not entire element) in AmbiguousIdAttribute.
2019-01-02 11:44:02 +00:00
Asger F
9f22da4557
JS: rename query to "Loop iteration skipped due to shifting"
2019-01-02 11:34:06 +00:00
Asger F
8c3b44a525
JS: address comments
2019-01-02 11:12:52 +00:00
Max Schaefer
a9844b2eda
JavaScript: Fix performance regression in IncorrectSuffixCheck.
2019-01-02 10:23:16 +00:00
Esben Sparre Andreasen
c57f8a6d6e
Merge pull request #691 from asger-semmle/sendfile-root
...
JS: Recognize 'root' option in Express res.sendFile
2018-12-19 16:06:15 +01:00
semmle-qlci
495a1fcf3b
Merge pull request #698 from asger-semmle/remove-cookie-as-source
...
Approved by esben-semmle
2018-12-19 15:05:44 +00:00
semmle-qlci
b11b714152
Merge pull request #696 from esben-semmle/js/host-request-forgery
...
Approved by asger-semmle
2018-12-19 15:04:08 +00:00
Asger F
ce18aca62b
JS: update expected output
2018-12-19 11:30:46 +00:00
Asger F
78334af354
JS: remove cookie source; rely on persistent flow steps instead
2018-12-19 11:23:51 +00:00
Asger F
0e40717358
JS: recognize res.sendfile root option
2018-12-19 10:25:15 +00:00
Asger F
f84301e476
JS: add tests with res.sendFile root option
2018-12-19 10:25:15 +00:00
Asger F
f9d7f8ba11
JS: fix links in qhelp
2018-12-19 10:10:56 +00:00
Asger F
f57454951b
JS: move <ul> outside of <p> element
2018-12-18 14:15:12 +00:00
Asger F
7f538e82c0
JS: add test case for non-whitelisted use of location
2018-12-18 13:55:05 +00:00
Asger F
02978c97f1
JS: whitelist $(location) in simple cases
2018-12-18 13:11:42 +00:00
Asger F
c17eca90a1
JS: add test case for $(location)
2018-12-18 13:06:12 +00:00
semmle-qlci
c37d655fe8
Merge pull request #697 from esben-semmle/js/fix-heuristics-compilation-time
...
Approved by asger-semmle
2018-12-18 09:07:36 +00:00
Asger F
280382e91e
JS: whitelist if array access at another index is seen
2018-12-17 15:19:26 +00:00
Asger F
5040d3e26c
JS: add query for loop index bug
2018-12-17 13:35:44 +00:00
Jonas Jensen
5ac5aa0c2a
Merge remote-tracking branch 'upstream/master' into mergeback-20181217
2018-12-17 13:42:45 +01:00
Esben Sparre Andreasen
4a631b42d4
JS: use .lastIndexOf in js/incomplete-url-substring-sanitization
2018-12-17 13:22:31 +01:00
Asger F
7adf1d9958
Merge pull request #631 from esben-semmle/js/bad-url-regexing
...
JS: add query: js/incomplete-url-regexp
2018-12-17 11:53:22 +00:00
Esben Sparre Andreasen
50cba92f5f
JS: remove slow test Security/heuristics/AdditionalCommandInjections
2018-12-17 10:58:46 +01:00
Esben Sparre Andreasen
c6b4e29b93
JS: add "host" as a sink for js/request-forgery
2018-12-17 10:32:30 +01:00
Esben Sparre Andreasen
60fe0176ed
JS: add ClientRequest::getHost
2018-12-17 10:32:30 +01:00
Esben Sparre Andreasen
3a5962aa34
JS: minor fixups in ClientRequests.qll
2018-12-17 10:32:30 +01:00
Esben Sparre Andreasen
487b8c52c6
JS: fix <p></p> issue
2018-12-14 13:04:10 +01:00
Max Schaefer
5ccad6ffc2
JavaScript: Minor improvements.
2018-12-14 11:56:59 +00:00
Aditya Sharad
7bc729a7dc
Merge master into next.
2018-12-14 10:16:47 +00:00
Esben Sparre Andreasen
bb3e3a541d
JS: address doc review comments
2018-12-14 10:24:30 +01:00
