CodeQL CI 39ec7132af Merge pull request #7049 from asgerf/js/routing-trees ...

Approved by erik-krogh

2021-12-17 12:26:38 +00:00

..

CWE-020

update expected output

2021-11-15 13:50:12 +01:00

CWE-022

add file write model for express-fileupload mv

2021-12-10 15:05:34 +01:00

CWE-073

JS: Use routing trees to detect deeply tainted req.body

2021-12-07 10:46:18 +01:00

CWE-078

add a getMaybePromisifiedCall method in API graphs, and use it to model child_process

2021-08-25 10:27:09 +02:00

CWE-079

JS: Use return value of trusted type policy callback as a sink

2021-12-14 13:28:46 +01:00

CWE-089

update test output for additional DatabaseAccesses

2021-12-13 13:42:28 +01:00

CWE-094

JS: Remove use of deprecated API

2021-08-12 09:30:43 +02:00

CWE-116

add a bad-tag-filter query for Python and JavaScript

2021-09-21 15:04:03 +02:00

CWE-117

Merge branch 'main' into logs

2021-07-16 11:21:25 +02:00

CWE-134

JavaScript: Update expected output.

2019-10-29 15:36:24 +00:00

CWE-200

model serve-handler in js/exposure-of-private-files

2021-06-08 09:52:56 +02:00

CWE-201

JavaScript: Update expected output.

2019-10-29 15:36:24 +00:00

CWE-209

JavaScript: Update expected output.

2019-10-29 15:36:24 +00:00

CWE-295

support all ClientRequests in js/disabling-certificate-validation

2021-04-12 15:06:10 +02:00

CWE-312

add support for the debug library

2021-06-02 23:11:15 +02:00

CWE-313

JS: whitelist some hardcoded dummy-passwords in two queries

2019-09-16 10:11:43 +02:00

CWE-326

don't include mode-of-operation into the algorithm names

2021-11-03 14:54:50 +01:00

CWE-327

add qhelp to js/biased-cryptographic-random

2020-06-16 11:10:09 +02:00

CWE-338

fix casing on the uid regexp

2021-05-13 23:04:30 +02:00

CWE-346

update inconsistency comment for CWE-346

2020-07-08 10:01:04 +02:00

CWE-352

JS: Fix handling of fastify-plugin

2021-12-15 16:04:46 +01:00

CWE-384

add js/session-fixation query

2021-11-03 13:04:41 +01:00

CWE-400

JS: Add DeepResourceExhaustion test

2021-03-02 13:56:43 +00:00

CWE-451

QL code and tests for C#/C++/JavaScript.

2018-08-02 17:53:23 +01:00

CWE-502

JavaScript: Update expected output.

2019-10-29 15:36:24 +00:00

CWE-506

update inconsistency comment for CWE-506

2020-07-08 10:01:40 +02:00

CWE-598

add test that requires flowToExpr

2021-11-08 12:25:45 +01:00

CWE-601

refactor the history library model, add support for the global variable

2021-06-07 15:42:13 +02:00

CWE-611

JS: Update expectations with new sources

2021-03-16 13:28:12 +00:00

CWE-614

assume that setting the secure/httpOnly flag to some unknown value is good

2021-10-26 13:47:28 +02:00

CWE-640

JavaScript: Update expected output.

2019-10-29 15:36:24 +00:00

CWE-643

JS: Update expectations with new sources

2021-03-16 13:28:12 +00:00

CWE-730

JS: Update RegExpInjection test case

2021-06-22 12:00:04 +02:00

CWE-754

update consistency comments for CWE-754

2020-07-08 10:08:51 +02:00

CWE-770

JS: Add test for fastify-rate-limit

2021-12-15 16:18:22 +01:00

CWE-776

JS: Update expectations with new sources

2021-03-16 13:28:12 +00:00

CWE-798

don't report dummy authentication headers as hardcoded-crendentials

2021-08-02 22:56:14 +02:00

CWE-807

JS: add js/conditional-bypass example as a test case

2020-12-22 09:34:25 +01:00

CWE-829

recognize sensitive files by file-system writes

2020-06-25 15:19:42 +02:00

CWE-834

move comments to match alert location for CWE-834

2020-07-08 10:16:04 +02:00

CWE-843

JS: Add type confusion sink for prototype pollution checks

2020-12-07 10:16:38 +00:00

CWE-912

JavaScript: Update expected output.

2019-10-29 15:36:24 +00:00

CWE-915

Merge branch 'main' into protoLib

2021-11-04 12:53:53 +01:00

CWE-916

JavaScript: Update expected output.

2019-10-29 15:36:24 +00:00

CWE-918

add taint-step for URL construction in js/request-forgery

2021-04-08 11:10:33 +02:00

CWE-1004

add session{key,id} as sensitive info

2021-10-26 13:46:59 +02:00

Summaries

JavaScript: Move flow summaries to experimental.

2020-03-09 12:57:20 +00:00