hohn/codeql
1
0
Fork 0
mirror of https://github.com/github/codeql.git synced 2025-12-18 01:33:15 +01:00
Code Issues Packages Projects Releases Wiki Activity
Files
z80coder/query-pack-release-candidate-2
codeql/javascript/change-notes/2021-03-15-client-side-remote-flow-sources.md
Asger Feldthaus 3a68eceaaa JS: Fix typo in change note
2021-03-17 10:17:56 +00:00

478 B
Raw Permalink Blame History

lgtm,codescanning

  • The security queries now distinguish more clearly between different parts of window.location. When the taint source of an alert is based on window.location, the source will usually occur closer to where user-controlled data is obtained, such as at location.hash.
  • js/request-forgery no longer considers client-side path parameters to be a source due to the restricted character set usable in a path, resulting in fewer false-positive results.