hohn/codeql
1
0
Fork 0
mirror of https://github.com/github/codeql.git synced 2026-04-16 04:24:01 +02:00
Code Issues Packages Projects Releases Wiki Activity
Files
53b63bed00a877a6fd9feb2876efd31f99e3d4d7
codeql/javascript/ql/lib/semmle/javascript/security/dataflow
History
Napalys Klicius 9ca0fe4cbf Update RegExp handling and add test case 
Co-authored-by: erik-krogh <erik-krogh@github.com>
2024-11-28 14:13:40 +01:00
..
BrokenCryptoAlgorithmCustomizations.qll
Port changes to JavaScript.
2023-10-26 14:47:24 +01:00
BrokenCryptoAlgorithmQuery.qll
Packaging: Rafactor Javascript core libraries
2021-08-25 12:15:56 -07:00
BuildArtifactLeakCustomizations.qll
Packaging: Rafactor Javascript core libraries
2021-08-25 12:15:56 -07:00
BuildArtifactLeakQuery.qll
JS: Replace ClearTextLogging::isSanitizerEdge with a node
2023-07-11 14:20:17 +02:00
CleartextLoggingCustomizations.qll
Update RegExp handling and add test case
2024-11-28 14:13:40 +01:00
CleartextLoggingQuery.qll
JS: Replace ClearTextLogging::isSanitizerEdge with a node
2023-07-11 14:20:17 +02:00
CleartextStorageCustomizations.qll
Py/JS/RB: Use instanceof in more places
2022-12-12 16:06:57 +01:00
CleartextStorageQuery.qll
Packaging: Rafactor Javascript core libraries
2021-08-25 12:15:56 -07:00
ClientSideRequestForgeryQuery.qll
JS: Replace sanitizing prefix edge with node
2023-07-11 14:48:13 +02:00
ClientSideUrlRedirectCustomizations.qll
JS: Convert remaining queries to use ActiveThreatModelSourceAsSource
2024-11-01 10:47:10 +01:00
ClientSideUrlRedirectQuery.qll
JS: Replace sanitizing prefix edge with node
2023-07-11 14:48:13 +02:00
CodeInjectionCustomizations.qll
JS: Make (most) queries use ActiveThreatModelSource
2024-10-25 15:03:42 +02:00
CodeInjectionQuery.qll
Packaging: Rafactor Javascript core libraries
2021-08-25 12:15:56 -07:00
CommandInjectionCustomizations.qll
JS: Convert remaining queries to use ActiveThreatModelSourceAsSource
2024-11-01 10:47:10 +01:00
CommandInjectionQuery.qll
JS: Make implicit this receivers explicit
2023-05-03 15:31:00 +02:00
ConditionalBypassCustomizations.qll
JS: Make (most) queries use ActiveThreatModelSource
2024-10-25 15:03:42 +02:00
ConditionalBypassQuery.qll
JS: Make implicit this receivers explicit
2023-05-03 15:31:00 +02:00
CorsMisconfigurationForCredentialsCustomizations.qll
JS: Convert remaining queries to use ActiveThreatModelSourceAsSource
2024-11-01 10:47:10 +01:00
CorsMisconfigurationForCredentialsQuery.qll
Packaging: Rafactor Javascript core libraries
2021-08-25 12:15:56 -07:00
DeepObjectResourceExhaustionCustomizations.qll
JS: Make (most) queries use ActiveThreatModelSource
2024-10-25 15:03:42 +02:00
DeepObjectResourceExhaustionQuery.qll
use some Sanitizer classes that were unused in the query code
2022-03-13 23:54:53 +01:00
DifferentKindsComparisonBypassCustomizations.qll
JS: Make implicit this receivers explicit
2023-05-03 15:31:00 +02:00
DifferentKindsComparisonBypassQuery.qll
JS: Make implicit this receivers explicit
2023-05-03 15:31:00 +02:00
DOM.qll
JS: Treat browser message events as client-side sources
2024-08-16 11:02:12 +02:00
DomBasedXssCustomizations.qll
JS: Make (most) queries use ActiveThreatModelSource
2024-10-25 15:03:42 +02:00
DomBasedXssQuery.qll
delete outdated deprecations
2024-01-22 09:11:35 +01:00
ExceptionXssCustomizations.qll
Py/JS/RB: Use instanceof in more places
2022-12-12 16:06:57 +01:00
ExceptionXssQuery.qll
move the ExceptionXss sources into the Customizations file
2022-04-20 18:10:53 +02:00
ExternalAPIUsedWithUntrustedDataCustomizations.qll
delete old deprecations
2023-06-02 11:58:08 +02:00
ExternalAPIUsedWithUntrustedDataQuery.qll
JS: Use sanitizerIn in ExtenralAPIUsedWithUntrustedData
2023-07-11 14:50:29 +02:00
FileAccessToHttpCustomizations.qll
delete redundant imports
2022-04-22 12:55:28 +02:00
FileAccessToHttpQuery.qll
Packaging: Rafactor Javascript core libraries
2021-08-25 12:15:56 -07:00
HardcodedCredentialsCustomizations.qll
apply autoformat to HardcodedCredentialsCustomizations.qll
2024-08-05 14:25:15 +02:00
HardcodedCredentialsQuery.qll
remove a part of code related to debugging :)
2024-08-07 20:37:20 +02:00
HardcodedDataInterpretedAsCodeCustomizations.qll
Py/JS/RB: Use instanceof in more places
2022-12-12 16:06:57 +01:00
HardcodedDataInterpretedAsCodeQuery.qll
Packaging: Rafactor Javascript core libraries
2021-08-25 12:15:56 -07:00
HostHeaderPoisoningInEmailGenerationQuery.qll
ensure consistent casing of names
2022-09-09 10:34:14 +02:00
HttpToFileAccessCustomizations.qll
Add missing file doc comment
2022-03-22 11:10:09 +13:00
HttpToFileAccessQuery.qll
Share HttpToFileAccessQuery between JS and Ruby
2022-03-22 11:10:08 +13:00
HttpToFileAccessSpecific.qll
Py/JS/RB: Use instanceof in more places
2022-12-12 16:06:57 +01:00
ImproperCodeSanitizationCustomizations.qll
delete old deprecations
2023-06-02 11:58:08 +02:00
ImproperCodeSanitizationQuery.qll
Packaging: Rafactor Javascript core libraries
2021-08-25 12:15:56 -07:00
IncompleteHtmlAttributeSanitizationCustomizations.qll
JavaScript: Autoformat
2023-03-10 09:41:20 +01:00
IncompleteHtmlAttributeSanitizationQuery.qll
JS: Make implicit this receivers explicit
2023-05-03 15:31:00 +02:00
IndirectCommandArgument.qll
use more set literals
2022-01-20 16:06:34 +01:00
IndirectCommandInjectionCustomizations.qll
JS: Consolidate command-line argument modeling
2024-10-25 15:03:43 +02:00
IndirectCommandInjectionQuery.qll
JS: Consolidate command-line argument modeling
2024-10-25 15:03:43 +02:00
InsecureDownloadCustomizations.qll
delete old deprecations
2023-06-02 11:58:08 +02:00
InsecureDownloadQuery.qll
Merge branch 'main' into deadCode
2022-03-15 09:19:14 +01:00
InsecureRandomnessCustomizations.qll
Py/JS/RB: Use instanceof in more places
2022-12-12 16:06:57 +01:00
InsecureRandomnessQuery.qll
JS: Update InsecureRandomness
2023-07-11 14:56:43 +02:00
InsecureTemporaryFileCustomizations.qll
add support for fs-extra methods in insecure-temporary-file
2022-02-02 15:14:43 +01:00
InsecureTemporaryFileQuery.qll
add query for detecting insecure temprary files
2022-01-18 14:54:56 +01:00
InsufficientPasswordHashCustomizations.qll
JS: Use shared CryptographicOperation concept and implement BlockMode getBlockMode()
2023-02-02 20:30:30 +00:00
InsufficientPasswordHashQuery.qll
Packaging: Rafactor Javascript core libraries
2021-08-25 12:15:56 -07:00
LogInjectionQuery.qll
Add support for log injection in MaD
2023-07-28 22:37:56 +00:00
LoopBoundInjectionCustomizations.qll
JavaScript: Autoformat
2023-03-10 09:41:20 +01:00
LoopBoundInjectionQuery.qll
remove redundant imports for JS
2023-12-08 16:56:54 +01:00
MissingRateLimiting.qll
Update javascript/ql/lib/semmle/javascript/security/dataflow/MissingRateLimiting.qll
2023-10-26 13:06:52 +01:00
NosqlInjectionCustomizations.qll
JS: Make (most) queries use ActiveThreatModelSource
2024-10-25 15:03:42 +02:00
NosqlInjectionQuery.qll
update the SQL/NoSQL models to use dataflow nodes
2022-09-05 16:11:54 +02:00
PostMessageStarCustomizations.qll
Py/JS/RB: Use instanceof in more places
2022-12-12 16:06:57 +01:00
PostMessageStarQuery.qll
Packaging: Rafactor Javascript core libraries
2021-08-25 12:15:56 -07:00
PropertyInjectionShared.qll
Packaging: Rafactor Javascript core libraries
2021-08-25 12:15:56 -07:00
PrototypePollutingAssignmentCustomizations.qll
Py/JS/RB: Use instanceof in more places
2022-12-12 16:06:57 +01:00
PrototypePollutingAssignmentQuery.qll
JS: protyte poluting now treats unknownFlags as potentially good sanitization.
2024-11-28 11:26:38 +01:00
PrototypePollutionCustomizations.qll
remove redundant imports for JS
2023-12-08 16:56:54 +01:00
PrototypePollutionQuery.qll
remove redundant imports for JS
2023-12-08 16:56:54 +01:00
ReflectedXssCustomizations.qll
delete outdated deprecations
2024-01-22 09:11:35 +01:00
ReflectedXssQuery.qll
JavaScript: Autoformat
2023-03-10 09:41:20 +01:00
RegExpInjectionCustomizations.qll
JS: now Reg Exp injection treats unknownFlags as sanitization, MetacharEscapeSanitizer
2024-11-28 11:26:58 +01:00
RegExpInjectionQuery.qll
Packaging: Rafactor Javascript core libraries
2021-08-25 12:15:56 -07:00
RemoteFlowSources.qll
JS: Integrate RemoteFlowSource with ThreatModelSource
2024-10-25 14:52:49 +02:00
RemotePropertyInjectionCustomizations.qll
JS: Make (most) queries use ActiveThreatModelSource
2024-10-25 15:03:42 +02:00
RemotePropertyInjectionQuery.qll
Packaging: Rafactor Javascript core libraries
2021-08-25 12:15:56 -07:00
RequestForgeryCustomizations.qll
JS: Convert remaining queries to use ActiveThreatModelSourceAsSource
2024-11-01 10:47:10 +01:00
RequestForgeryQuery.qll
JS: Replace sanitizing prefix edge with node
2023-07-11 14:48:13 +02:00
ResourceExhaustionCustomizations.qll
JS: Convert remaining queries to use ActiveThreatModelSourceAsSource
2024-11-01 10:47:10 +01:00
ResourceExhaustionQuery.qll
JS: Update ResourceExhaustion
2023-07-11 14:56:53 +02:00
SecondOrderCommandInjectionCustomizations.qll
Remove pragma[assume_small_delta]
2023-06-30 11:09:29 -07:00
SecondOrderCommandInjectionQuery.qll
JS: fix two typos
2022-11-23 14:38:12 +01:00
ServerSideUrlRedirectCustomizations.qll
JS: Add sinks mentioned in doc
2022-12-13 11:33:12 +01:00
ServerSideUrlRedirectQuery.qll
JS: Replace sanitizing prefix edge with node
2023-07-11 14:48:13 +02:00
ShellCommandInjectionFromEnvironmentCustomizations.qll
Py/JS/RB: Use instanceof in more places
2022-12-12 16:06:57 +01:00
ShellCommandInjectionFromEnvironmentQuery.qll
JS: Make implicit this receivers explicit
2023-05-03 15:31:00 +02:00
SqlInjectionCustomizations.qll
JS: Make (most) queries use ActiveThreatModelSource
2024-10-25 15:03:42 +02:00
SqlInjectionQuery.qll
JS: Step through HTML sanitizers in SQL injection query
2023-03-06 15:10:26 +01:00
StackTraceExposureCustomizations.qll
ensure consistent casing of names
2022-09-09 10:34:14 +02:00
StackTraceExposureQuery.qll
Packaging: Rafactor Javascript core libraries
2021-08-25 12:15:56 -07:00
StoredXssCustomizations.qll
JavaScript: Autoformat
2023-03-10 09:41:20 +01:00
StoredXssQuery.qll
JavaScript: Autoformat
2023-03-10 09:41:20 +01:00
TaintedFormatStringCustomizations.qll
Share TaintedFormatString between Ruby and JS
2022-03-21 12:51:46 +13:00
TaintedFormatStringQuery.qll
Share TaintedFormatString between Ruby and JS
2022-03-21 12:51:46 +13:00
TaintedFormatStringSpecific.qll
Share TaintedFormatString between Ruby and JS
2022-03-21 12:51:46 +13:00
TaintedPathCustomizations.qll
JS: Fixed path query not flagging new RegExp with DotRemovingReplaceCall
2024-11-28 11:26:45 +01:00
TaintedPathQuery.qll
Packaging: Rafactor Javascript core libraries
2021-08-25 12:15:56 -07:00
TemplateObjectInjectionCustomizations.qll
JS: Make (most) queries use ActiveThreatModelSource
2024-10-25 15:03:42 +02:00
TemplateObjectInjectionQuery.qll
Packaging: Rafactor Javascript core libraries
2021-08-25 12:15:56 -07:00
TypeConfusionThroughParameterTamperingCustomizations.qll
ensure consistent casing of names
2022-09-09 10:34:14 +02:00
TypeConfusionThroughParameterTamperingQuery.qll
JS: Make implicit this receivers explicit
2023-05-03 15:31:00 +02:00
UnsafeCodeConstruction.qll
JS: fix typos in comments
2022-05-12 16:02:19 +01:00
UnsafeCodeConstructionCustomizations.qll
fix some more style-guide violations in the alert-messages
2022-10-07 11:22:22 +02:00
UnsafeDeserializationCustomizations.qll
JS: Make (most) queries use ActiveThreatModelSource
2024-10-25 15:03:42 +02:00
UnsafeDeserializationQuery.qll
delete redundant imports
2022-04-22 12:55:28 +02:00
UnsafeDynamicMethodAccessCustomizations.qll
JS: Make (most) queries use ActiveThreatModelSource
2024-10-25 15:03:42 +02:00
UnsafeDynamicMethodAccessQuery.qll
JS: Make implicit this receivers explicit
2023-05-03 15:31:00 +02:00
UnsafeHtmlConstructionCustomizations.qll
delete old deprecations
2023-06-02 11:58:08 +02:00
UnsafeHtmlConstructionQuery.qll
Update UnsafeHtmlConstructionQuery.qll
2023-10-20 17:57:23 +08:00
UnsafeJQueryPluginCustomizations.qll
JS: Make implicit this receivers explicit
2023-05-03 15:31:00 +02:00
UnsafeJQueryPluginQuery.qll
JS: Update UnsafeJQueryPlugin
2023-07-11 15:01:33 +02:00
UnsafeShellCommandConstructionCustomizations.qll
JS: UnsafeShellCommand Using unknown flags in the RegExp object is no longer flagged as bad sanitization to reduce false positives.
2024-11-28 11:26:43 +01:00
UnsafeShellCommandConstructionQuery.qll
use the number guard in existing queries that contained typeof checks
2022-02-09 09:51:57 +01:00
UnvalidatedDynamicMethodCallCustomizations.qll
JS: Make (most) queries use ActiveThreatModelSource
2024-10-25 15:03:42 +02:00
UnvalidatedDynamicMethodCallQuery.qll
JS: Remove the unused edge-sanitizer hook in UnvalidatedDynamicMethodCall
2023-07-12 09:26:37 +02:00
UrlConcatenation.qll
JS: Make implicit this receivers explicit
2023-05-03 15:31:00 +02:00
XmlBombCustomizations.qll
JS: Make (most) queries use ActiveThreatModelSource
2024-10-25 15:03:42 +02:00
XmlBombQuery.qll
Packaging: Rafactor Javascript core libraries
2021-08-25 12:15:56 -07:00
XpathInjectionCustomizations.qll
Py/JS/RB: Use instanceof in more places
2022-12-12 16:06:57 +01:00
XpathInjectionQuery.qll
Packaging: Rafactor Javascript core libraries
2021-08-25 12:15:56 -07:00
Xss.qll
JS: xss does not flag anymore replace with RegExp unknown flags
2024-11-28 11:26:53 +01:00
XssThroughDomCustomizations.qll
delete outdated deprecations
2024-01-22 09:11:35 +01:00
XssThroughDomQuery.qll
JS: Replace isOptionallySanitizedEdge with a node
2023-07-11 12:57:33 +02:00
XxeCustomizations.qll
JS: Make (most) queries use ActiveThreatModelSource
2024-10-25 15:03:42 +02:00
XxeQuery.qll
Packaging: Rafactor Javascript core libraries
2021-08-25 12:15:56 -07:00
ZipSlipCustomizations.qll
JS: Rename Node.{getASource -> asSource, getASink -> asSink}
2022-05-24 11:57:30 +02:00
ZipSlipQuery.qll
Packaging: Rafactor Javascript core libraries
2021-08-25 12:15:56 -07:00