Max Schaefer d4fca84898 JavaScript: Improve XSS sanitizer detection. ...

We now use local data flow to detect more regexp-based sanitizers.

2019-09-23 17:07:06 +01:00

..

addEventListener.js

JS: Canonicalize ThisNode

2018-10-09 08:53:41 +01:00

cookies.js

QL code and tests for C#/C++/JavaScript.

2018-08-02 17:53:23 +01:00

etherpad.js

QL code and tests for C#/C++/JavaScript.

2018-08-02 17:53:23 +01:00

externs.js

QL code and tests for C#/C++/JavaScript.

2018-08-02 17:53:23 +01:00

formatting.js

JS: mark PrintfStyleCall as a taint step

2018-08-21 09:02:35 +02:00

jquery.js

QL code and tests for C#/C++/JavaScript.

2018-08-02 17:53:23 +01:00

nodemailer.js

JS: add email HTML body as XSS sink

2018-11-07 11:31:40 +00:00

partial.js

JavaScript: Fix modelling of _.partial.

2018-10-31 06:31:59 -04:00

promises.js

QL code and tests for C#/C++/JavaScript.

2018-08-02 17:53:23 +01:00

react-native.js

JavaScript: Add WebView-related taint sinks for CodeInjection, DomBasedXss and ServerSideUrlRedirect.

2018-08-10 15:59:27 +01:00

ReflectedXss.expected

JavaScript: Generalise ConstantComparison sanitisers.

2019-04-25 07:38:31 +01:00

ReflectedXss.js

QL code and tests for C#/C++/JavaScript.

2018-08-02 17:53:23 +01:00

ReflectedXss.qlref

QL code and tests for C#/C++/JavaScript.

2018-08-02 17:53:23 +01:00

ReflectedXssGood2.js

QL code and tests for C#/C++/JavaScript.

2018-08-02 17:53:23 +01:00

ReflectedXssGood.js

JS: make Express' res/req extend Node's res/req

2019-06-12 12:45:01 +02:00

ReflectedXssWithCustomSanitizer.expected

JavaScript: Generalise ConstantComparison sanitisers.

2019-04-25 07:38:31 +01:00

ReflectedXssWithCustomSanitizer.ql

Javascript: Autoformat.

2019-01-11 11:02:42 +01:00

sanitiser.js

JavaScript: Improve XSS sanitizer detection.

2019-09-23 17:07:06 +01:00

stored-xss.js

JS: introduce DOM::PersistentWebStorage

2018-12-06 14:53:22 +01:00

StoredXss.expected

JS: Update test output to reflect new edge relation

2019-06-25 16:41:29 +01:00

StoredXss.qlref

JS: add query: js/stored-xss

2018-09-14 15:30:44 +02:00

string-manipulations.js

QL code and tests for C#/C++/JavaScript.

2018-08-02 17:53:23 +01:00

translate.js

QL code and tests for C#/C++/JavaScript.

2018-08-02 17:53:23 +01:00

tst2.js

JavaScript: Generalise ConstantComparison sanitisers.

2019-04-25 07:38:31 +01:00

tst3.js

add setAttributeNS('xlink', 'href',..) example in XSS test

2019-09-09 09:41:08 +01:00

tst.js

JavaScript: Do not taint for-in loop variable.

2019-07-23 10:52:55 +01:00

v-html.vue

JS: add XSS vector for Vue's v-html

2019-02-25 12:17:56 +01:00

winjs.js

JavaScript: Teach Xss query about WinJS HTML injection functions.

2018-12-06 09:13:21 +00:00

xss-through-filenames.js

JS: add query: js/stored-xss

2018-09-14 15:30:44 +02:00

Xss.expected

add setAttributeNS('xlink', 'href',..) example in XSS test

2019-09-09 09:41:08 +01:00

Xss.qlref

QL code and tests for C#/C++/JavaScript.

2018-08-02 17:53:23 +01:00