codeql

addEventListener.js

JS: Add XSS test case for new PostMessageEventHandler cases

2019-10-21 11:32:22 +01:00

cookies.js

QL code and tests for C#/C++/JavaScript.

2018-08-02 17:53:23 +01:00

encodeuri.js

JS: Block XSS flow through encodeURIComponent

2019-10-28 17:12:40 +00:00

etherpad.js

QL code and tests for C#/C++/JavaScript.

2018-08-02 17:53:23 +01:00

exception-xss.js

changes based on review

2020-01-30 14:04:04 +01:00

ExceptionXss.expected

update expected output of tests

2019-12-17 16:27:55 +01:00

ExceptionXss.qlref

Added query for detecting XSS that happens through an exception

2019-11-14 17:04:00 +01:00

externs.js

QL code and tests for C#/C++/JavaScript.

2018-08-02 17:53:23 +01:00

formatting.js

JS: mark PrintfStyleCall as a taint step

2018-08-21 09:02:35 +02:00

jquery.js

QL code and tests for C#/C++/JavaScript.

2018-08-02 17:53:23 +01:00

nodemailer.js

JS: add email HTML body as XSS sink

2018-11-07 11:31:40 +00:00

partial.js

JavaScript: Fix modelling of _.partial.

2018-10-31 06:31:59 -04:00

promises.js

QL code and tests for C#/C++/JavaScript.

2018-08-02 17:53:23 +01:00

react-native.js

JavaScript: Add WebView-related taint sinks for CodeInjection, DomBasedXss and ServerSideUrlRedirect.

2018-08-10 15:59:27 +01:00

ReflectedXss.expected

JS: Update some queries that used data as source

2020-03-18 11:55:13 +00:00

ReflectedXss.js

QL code and tests for C#/C++/JavaScript.

2018-08-02 17:53:23 +01:00

ReflectedXss.qlref

QL code and tests for C#/C++/JavaScript.

2018-08-02 17:53:23 +01:00

ReflectedXssContentTypes.js

refactor header checks to be based on dominance

2020-03-03 12:04:31 +01:00

ReflectedXssGood2.js

QL code and tests for C#/C++/JavaScript.

2018-08-02 17:53:23 +01:00

ReflectedXssGood.js

JS: make Express' res/req extend Node's res/req

2019-06-12 12:45:01 +02:00

ReflectedXssWithCustomSanitizer.expected

update expected output

2020-03-03 10:04:57 +01:00

ReflectedXssWithCustomSanitizer.ql

Javascript: Autoformat.

2019-01-11 11:02:42 +01:00

sanitiser.js

JavaScript: Improve XSS sanitizer detection.

2019-09-23 17:07:06 +01:00

stored-xss.js

JS: introduce DOM::PersistentWebStorage

2018-12-06 14:53:22 +01:00

StoredXss.expected

JS: add security tests for malicious torrents

2019-11-14 13:54:19 +01:00

StoredXss.qlref

JS: add query: js/stored-xss

2018-09-14 15:30:44 +02:00

string-manipulations.js

QL code and tests for C#/C++/JavaScript.

2018-08-02 17:53:23 +01:00

translate.js

QL code and tests for C#/C++/JavaScript.

2018-08-02 17:53:23 +01:00

tst2.js

JavaScript: Generalise ConstantComparison sanitisers.

2019-04-25 07:38:31 +01:00

tst3.js

add setAttributeNS('xlink', 'href',..) example in XSS test

2019-09-09 09:41:08 +01:00

tst.js

add test case for location.split("?")[0] for DomBasedXss

2020-05-05 09:13:21 +02:00

typeahead.js

add sources and sinks for typeahead.js

2019-11-25 10:46:54 +01:00

unsafe-jquery-plugin.js

JS: address review comments for js/unsafe-jquery-plugin

2020-01-31 19:33:04 +01:00

UnsafeJQueryPlugin.expected

JS: address review comments for js/unsafe-jquery-plugin

2020-01-31 19:33:04 +01:00

UnsafeJQueryPlugin.qlref

JS: add query "Unsafe jQuery plugin"

2020-01-31 19:33:04 +01:00

v-html.vue

JS: add XSS vector for Vue's v-html

2019-02-25 12:17:56 +01:00

winjs.js

JavaScript: Teach Xss query about WinJS HTML injection functions.

2018-12-06 09:13:21 +00:00

xss-through-dom.js

allow the empty string to flow to a JQuery XSS sink

2020-04-23 16:45:37 +02:00

xss-through-filenames.js

JS: add query: js/stored-xss

2018-09-14 15:30:44 +02:00

xss-through-torrent.js

JS: add security tests for malicious torrents

2019-11-14 13:54:19 +01:00

Xss.expected

add test case for location.split("?")[0] for DomBasedXss

2020-05-05 09:13:21 +02:00

Xss.qlref

QL code and tests for C#/C++/JavaScript.

2018-08-02 17:53:23 +01:00

XssThroughDom.expected

allow the empty string to flow to a JQuery XSS sink

2020-04-23 16:45:37 +02:00

XssThroughDom.qlref

Xss through DOM

2020-04-17 10:54:14 +02:00

XssWithAdditionalSources.expected

update expected output

2020-05-05 09:13:21 +02:00

XssWithAdditionalSources.ql

JS: Really autoformat everything

2020-03-02 10:48:33 +00:00