hohn/codeql
1
0
Fork 0
mirror of https://github.com/github/codeql.git synced 2026-04-26 09:15:12 +02:00
Code Issues Packages Projects Releases Wiki Activity
Files
18c23ecfd479d26cc37d25979e31f1b7b16a8753
codeql/javascript/ql/test/query-tests/Security
History
Max Schaefer 18c23ecfd4 JavaScript: Introduce shared library for modelling XSS-relevant concepts. 
As its first application, this library makes it possible for `StoredXss` to reuse the `Source` classes of `DomBasedXss` and `ReflectedXss` without having to pull in their libraries (which contain their `Configuration` classes, causing `StoredXss` to recompute all flow information for the other two queries).
2019-02-08 09:53:51 +00:00
..
CWE-020
JS: use StringOps:: in js/incomplete-url-substring-sanitization
2019-02-05 15:17:55 +01:00
CWE-022
Merge pull request #691 from asger-semmle/sendfile-root
2018-12-19 16:06:15 +01:00
CWE-078
JavaScript: Add example of indirect command injection.
2019-01-11 10:24:41 +00:00
CWE-079
JavaScript: Introduce shared library for modelling XSS-relevant concepts.
2019-02-08 09:53:51 +00:00
CWE-089
JavaScript: Update expectd test output for security path queries to include nodes and edges query predicates.
2018-11-14 09:32:31 +00:00
CWE-094
JS: improve concatenation-sanitizer for property injection
2019-01-14 15:34:01 +00:00
CWE-116
JS: generalize js/incomplete-sanitization to handle ConstantString
2018-12-11 13:39:15 +01:00
CWE-134
JavaScript: Update expectd test output for security path queries to include nodes and edges query predicates.
2018-11-14 09:32:31 +00:00
CWE-200
JavaScript: Add query help for FileAccessToHttp query.
2018-12-05 13:12:52 +00:00
CWE-201
JavaScript: Extend suspiciousCredentials predicate to recognise authKey and similar.
2019-01-31 09:03:23 +00:00
CWE-209
JavaScript: Update expectd test output for security path queries to include nodes and edges query predicates.
2018-11-14 09:32:31 +00:00
CWE-312
JS: sharpen js/clear-text-logging (ODASA-7485)
2018-11-22 13:38:43 +01:00
CWE-313
QL code and tests for C#/C++/JavaScript.
2018-08-02 17:53:23 +01:00
CWE-327
JavaScript: Update expectd test output for security path queries to include nodes and edges query predicates.
2018-11-14 09:32:31 +00:00
CWE-338
JavaScript: Update expectd test output for security path queries to include nodes and edges query predicates.
2018-11-14 09:32:31 +00:00
CWE-346
JavaScript: Update expectd test output for security path queries to include nodes and edges query predicates.
2018-11-14 09:32:31 +00:00
CWE-352
JS: review comments
2018-09-21 14:46:21 +01:00
CWE-400
JavaScript: Restrict RemotePropertyInjection query to avoid double-reporting.
2018-11-28 08:16:31 +00:00
CWE-451
QL code and tests for C#/C++/JavaScript.
2018-08-02 17:53:23 +01:00
CWE-502
JavaScript: Update expectd test output for security path queries to include nodes and edges query predicates.
2018-11-14 09:32:31 +00:00
CWE-506
JavaScript: Address review comments.
2018-11-29 10:48:44 +00:00
CWE-601
JS: recognize sanitizing slashes in URL redirection queries
2018-11-16 10:43:25 +00:00
CWE-611
JavaScript: Update expectd test output for security path queries to include nodes and edges query predicates.
2018-11-14 09:32:31 +00:00
CWE-640
JavaScript: Update expectd test output for security path queries to include nodes and edges query predicates.
2018-11-14 09:32:31 +00:00
CWE-643
JavaScript: Update expectd test output for security path queries to include nodes and edges query predicates.
2018-11-14 09:32:31 +00:00
CWE-730
JavaScript: Update expectd test output for security path queries to include nodes and edges query predicates.
2018-11-14 09:32:31 +00:00
CWE-754
JS: fix typo
2019-01-14 15:34:01 +00:00
CWE-770
JS: add tests for improved js/missing-rate-limiting
2018-08-06 15:15:44 +02:00
CWE-776
JavaScript: Update expectd test output for security path queries to include nodes and edges query predicates.
2018-11-14 09:32:31 +00:00
CWE-798
JS: Dont flag empty string as hardcoded username
2019-01-28 13:01:52 +00:00
CWE-807
JavaScript: Update expectd test output for security path queries to include nodes and edges query predicates.
2018-11-14 09:32:31 +00:00
CWE-843
JavaScript: Update expectd test output for security path queries to include nodes and edges query predicates.
2018-11-14 09:32:31 +00:00
CWE-912
JavaScript: Add query help for HttpToFileAccess query.
2018-12-05 12:58:38 +00:00
CWE-916
JavaScript: Update expectd test output for security path queries to include nodes and edges query predicates.
2018-11-14 09:32:31 +00:00
CWE-918
JS: add "host" as a sink for js/request-forgery
2018-12-17 10:32:30 +01:00
Summaries
JavaScript: Fix semantic merge conflict.
2019-01-09 16:09:06 +00:00