Aditya Sharad
|
f71e5ac338
|
Merge master into next.
|
2018-12-13 17:57:31 +00:00 |
|
Max Schaefer
|
e194021c3b
|
Merge pull request #629 from esben-semmle/js/persistent-read-taint
JS: add persistent storage taint steps
|
2018-12-13 08:24:42 +00:00 |
|
Aditya Sharad
|
f92456fcad
|
Merge master into next.
Conflict in `cpp/ql/test/library-tests/sideEffects/functions/sideEffects.expected`,
resolved by accepting test output (combining changes).
|
2018-12-12 17:26:18 +00:00 |
|
Asger F
|
a96c53f9b8
|
JS: restrict when a variable reference is considered a source
|
2018-12-12 12:28:26 +00:00 |
|
Esben Sparre Andreasen
|
28b4a78430
|
JS: introduce DOM::PersistentWebStorage
|
2018-12-06 14:53:22 +01:00 |
|
Max Schaefer
|
ef347b3870
|
JavaScript: Teach Xss query about WinJS HTML injection functions.
|
2018-12-06 09:13:21 +00:00 |
|
Pavel Avgustinov
|
16ec9f1aa4
|
Merge remote-tracking branch 'origin/next' into bump/master-next
|
2018-11-19 10:37:07 +00:00 |
|
Max Schaefer
|
9221b62ded
|
JavaScript: Update expectd test output for security path queries to include nodes and edges query predicates.
|
2018-11-14 09:32:31 +00:00 |
|
Max Schaefer
|
d57b5d9628
|
JavaScript: Remove ReflectdXssPath.ql, which is now spurious.
|
2018-11-14 09:16:40 +00:00 |
|
Aditya Sharad
|
761e5efd60
|
Merge master into next.
JavaScript semantic conflicts fixed by referring to the `LegacyLanguage` enum.
C++ conflicts fixed by accepting Qltest output.
|
2018-11-09 18:49:35 +00:00 |
|
Asger F
|
e0d5557ef4
|
JS: add email HTML body as XSS sink
|
2018-11-07 11:31:40 +00:00 |
|
Aditya Sharad
|
553c2f5d34
|
Merge master into next.
As of 2846d80f1c.
|
2018-11-06 11:52:51 +00:00 |
|
Max Schaefer
|
c75d785684
|
JavaScript: Fix modelling of _.partial.
Like `Function.prototype.bind` (but unlike `ramda.partial`) it takes the curried arguments as rest arguments, not as an array;
cf. https://lodash.com/docs/4.17.10#partial and https://underscorejs.org/#partial.
|
2018-10-31 06:31:59 -04:00 |
|
Tom Hvitved
|
b29b314f4e
|
Merge remote-tracking branch 'upstream/master' into mergeback-2018-10-11
|
2018-10-11 14:36:44 +02:00 |
|
Asger F
|
030bae9454
|
JS: Canonicalize ThisNode
|
2018-10-09 08:53:41 +01:00 |
|
Tom Hvitved
|
49644bfb47
|
Merge remote-tracking branch 'upstream/master' into mergeback-2018-10-08
|
2018-10-08 11:48:56 +02:00 |
|
Aditya Sharad
|
75680dbfef
|
Merge branch 'next' into qlucie/master
|
2018-09-26 12:08:33 +01:00 |
|
Asger F
|
269bbc9a1a
|
JavaScript: add flow steps through partial function application
|
2018-09-25 10:16:40 +01:00 |
|
alexet
|
b94df82833
|
JavaScript: Fix expected output due to qltest change.
|
2018-09-20 15:56:20 +01:00 |
|
Esben Sparre Andreasen
|
33f98dd1a7
|
JS: add query: js/stored-xss
|
2018-09-14 15:30:44 +02:00 |
|
Esben Sparre Andreasen
|
bbdf6b0f1d
|
JS: mark PrintfStyleCall as a taint step
|
2018-08-21 09:02:35 +02:00 |
|
Max Schaefer
|
199990feea
|
JavaScript: Add WebView-related taint sinks for CodeInjection, DomBasedXss and ServerSideUrlRedirect.
|
2018-08-10 15:59:27 +01:00 |
|
Pavel Avgustinov
|
b55526aa58
|
QL code and tests for C#/C++/JavaScript.
|
2018-08-02 17:53:23 +01:00 |
|