hohn/codeql
1
0
Fork 0
mirror of https://github.com/github/codeql.git synced 2026-06-06 14:07:06 +02:00
Code Issues Packages Projects Releases Wiki Activity
Files
7524d70e5d5d8d07d57700e6bea390ba201a2778
codeql/javascript/ql/lib/semmle/javascript/security/dataflow
History
Esben Sparre Andreasen c18686fcf7 Remove additional path-injection sinks
2022-09-23 17:17:43 +00:00
..
BrokenCryptoAlgorithm.qll
Packaging: Rafactor Javascript core libraries
2021-08-25 12:15:56 -07:00
BrokenCryptoAlgorithmCustomizations.qll
refactor the SensitiveExpr to be a dataflow node
2022-09-05 16:11:54 +02:00
BrokenCryptoAlgorithmQuery.qll
Packaging: Rafactor Javascript core libraries
2021-08-25 12:15:56 -07:00
BuildArtifactLeak.qll
Packaging: Rafactor Javascript core libraries
2021-08-25 12:15:56 -07:00
BuildArtifactLeakCustomizations.qll
Packaging: Rafactor Javascript core libraries
2021-08-25 12:15:56 -07:00
BuildArtifactLeakQuery.qll
Packaging: Rafactor Javascript core libraries
2021-08-25 12:15:56 -07:00
CleartextLogging.qll
Packaging: Rafactor Javascript core libraries
2021-08-25 12:15:56 -07:00
CleartextLoggingCustomizations.qll
add explicit this to all member calls
2021-11-01 09:51:15 +01:00
CleartextLoggingQuery.qll
Packaging: Rafactor Javascript core libraries
2021-08-25 12:15:56 -07:00
CleartextStorage.qll
Packaging: Rafactor Javascript core libraries
2021-08-25 12:15:56 -07:00
CleartextStorageCustomizations.qll
ensure consistent casing of names
2022-09-09 10:34:14 +02:00
CleartextStorageQuery.qll
Packaging: Rafactor Javascript core libraries
2021-08-25 12:15:56 -07:00
ClientSideRequestForgeryQuery.qll
Apply suggestions from code review
2022-02-21 16:24:50 +01:00
ClientSideUrlRedirect.qll
delete redundant imports
2022-04-22 12:55:28 +02:00
ClientSideUrlRedirectCustomizations.qll
simplify int check
2022-09-05 16:11:55 +02:00
ClientSideUrlRedirectQuery.qll
delete redundant imports
2022-04-22 12:55:28 +02:00
CodeInjection.qll
Packaging: Rafactor Javascript core libraries
2021-08-25 12:15:56 -07:00
CodeInjectionCustomizations.qll
Merge branch 'main' into js-followMsg
2022-09-12 13:21:16 +02:00
CodeInjectionQuery.qll
Packaging: Rafactor Javascript core libraries
2021-08-25 12:15:56 -07:00
CommandInjection.qll
Packaging: Rafactor Javascript core libraries
2021-08-25 12:15:56 -07:00
CommandInjectionCustomizations.qll
delete redundant imports
2022-04-22 12:55:28 +02:00
CommandInjectionQuery.qll
Packaging: Rafactor Javascript core libraries
2021-08-25 12:15:56 -07:00
ConditionalBypass.qll
Packaging: Rafactor Javascript core libraries
2021-08-25 12:15:56 -07:00
ConditionalBypassCustomizations.qll
Packaging: Rafactor Javascript core libraries
2021-08-25 12:15:56 -07:00
ConditionalBypassQuery.qll
Packaging: Rafactor Javascript core libraries
2021-08-25 12:15:56 -07:00
CorsMisconfigurationForCredentials.qll
Packaging: Rafactor Javascript core libraries
2021-08-25 12:15:56 -07:00
CorsMisconfigurationForCredentialsCustomizations.qll
ensure consistent casing of names
2022-09-09 10:34:14 +02:00
CorsMisconfigurationForCredentialsQuery.qll
Packaging: Rafactor Javascript core libraries
2021-08-25 12:15:56 -07:00
DeepObjectResourceExhaustion.qll
Packaging: Rafactor Javascript core libraries
2021-08-25 12:15:56 -07:00
DeepObjectResourceExhaustionCustomizations.qll
Packaging: Rafactor Javascript core libraries
2021-08-25 12:15:56 -07:00
DeepObjectResourceExhaustionQuery.qll
use some Sanitizer classes that were unused in the query code
2022-03-13 23:54:53 +01:00
DifferentKindsComparisonBypass.qll
delete redundant imports
2022-04-22 12:55:28 +02:00
DifferentKindsComparisonBypassCustomizations.qll
ensure consistent casing of names
2022-09-09 10:34:14 +02:00
DifferentKindsComparisonBypassQuery.qll
delete redundant imports
2022-04-22 12:55:28 +02:00
DOM.qll
rename an upper-cased acronym
2022-09-05 16:11:55 +02:00
DomBasedXss.qll
Packaging: Rafactor Javascript core libraries
2021-08-25 12:15:56 -07:00
DomBasedXssCustomizations.qll
convert the AngularJS model to use DataFlow nodes
2022-09-05 16:11:54 +02:00
DomBasedXssQuery.qll
fix all ql/unmentioned-guard
2022-09-12 22:42:46 +02:00
ExceptionXss.qll
Packaging: Rafactor Javascript core libraries
2021-08-25 12:15:56 -07:00
ExceptionXssCustomizations.qll
Merge pull request #8606 from asgerf/js/api-graph-api
2022-05-30 10:49:14 +02:00
ExceptionXssQuery.qll
move the ExceptionXss sources into the Customizations file
2022-04-20 18:10:53 +02:00
ExternalAPIUsedWithUntrustedData.qll
make some acronyms camelCase
2022-08-22 21:22:35 +02:00
ExternalAPIUsedWithUntrustedDataCustomizations.qll
refactor miscellaneous expression uses to dataflow nodes
2022-09-05 16:11:55 +02:00
ExternalAPIUsedWithUntrustedDataQuery.qll
add missing qldoc (that was already missing?)
2022-08-22 21:22:39 +02:00
FileAccessToHttp.qll
Packaging: Rafactor Javascript core libraries
2021-08-25 12:15:56 -07:00
FileAccessToHttpCustomizations.qll
delete redundant imports
2022-04-22 12:55:28 +02:00
FileAccessToHttpQuery.qll
Packaging: Rafactor Javascript core libraries
2021-08-25 12:15:56 -07:00
HardcodedCredentials.qll
Packaging: Rafactor Javascript core libraries
2021-08-25 12:15:56 -07:00
HardcodedCredentialsCustomizations.qll
refactor the CredentialsExpr to be a dataflow node
2022-09-05 16:11:54 +02:00
HardcodedCredentialsQuery.qll
use some Sanitizer classes that were unused in the query code
2022-03-13 23:54:53 +01:00
HardcodedDataInterpretedAsCode.qll
Packaging: Rafactor Javascript core libraries
2021-08-25 12:15:56 -07:00
HardcodedDataInterpretedAsCodeCustomizations.qll
make the alert messages of taint-tracking queries more consistent
2022-09-05 14:04:52 +02:00
HardcodedDataInterpretedAsCodeQuery.qll
Packaging: Rafactor Javascript core libraries
2021-08-25 12:15:56 -07:00
HostHeaderPoisoningInEmailGeneration.qll
Packaging: Rafactor Javascript core libraries
2021-08-25 12:15:56 -07:00
HostHeaderPoisoningInEmailGenerationQuery.qll
ensure consistent casing of names
2022-09-09 10:34:14 +02:00
HttpToFileAccess.qll
Packaging: Rafactor Javascript core libraries
2021-08-25 12:15:56 -07:00
HttpToFileAccessCustomizations.qll
Add missing file doc comment
2022-03-22 11:10:09 +13:00
HttpToFileAccessQuery.qll
Share HttpToFileAccessQuery between JS and Ruby
2022-03-22 11:10:08 +13:00
HttpToFileAccessSpecific.qll
ensure consistent casing of names
2022-09-09 10:34:14 +02:00
ImproperCodeSanitization.qll
Packaging: Rafactor Javascript core libraries
2021-08-25 12:15:56 -07:00
ImproperCodeSanitizationCustomizations.qll
patch upper-case acronyms to be PascalCase
2022-03-11 11:10:33 +01:00
ImproperCodeSanitizationQuery.qll
Packaging: Rafactor Javascript core libraries
2021-08-25 12:15:56 -07:00
IncompleteHtmlAttributeSanitization.qll
Packaging: Rafactor Javascript core libraries
2021-08-25 12:15:56 -07:00
IncompleteHtmlAttributeSanitizationCustomizations.qll
delete redundant imports
2022-04-22 12:55:28 +02:00
IncompleteHtmlAttributeSanitizationQuery.qll
Packaging: Rafactor Javascript core libraries
2021-08-25 12:15:56 -07:00
IndirectCommandArgument.qll
use more set literals
2022-01-20 16:06:34 +01:00
IndirectCommandInjection.qll
Packaging: Rafactor Javascript core libraries
2021-08-25 12:15:56 -07:00
IndirectCommandInjectionCustomizations.qll
JS: Rename Node.{getASource -> asSource, getASink -> asSink}
2022-05-24 11:57:30 +02:00
IndirectCommandInjectionQuery.qll
Packaging: Rafactor Javascript core libraries
2021-08-25 12:15:56 -07:00
InsecureDownload.qll
Packaging: Rafactor Javascript core libraries
2021-08-25 12:15:56 -07:00
InsecureDownloadCustomizations.qll
patch upper-case acronyms to be PascalCase
2022-03-11 11:10:33 +01:00
InsecureDownloadQuery.qll
Merge branch 'main' into deadCode
2022-03-15 09:19:14 +01:00
InsecureRandomness.qll
Packaging: Rafactor Javascript core libraries
2021-08-25 12:15:56 -07:00
InsecureRandomnessCustomizations.qll
add taint-step in js/insecure-randomness for selecting a random element
2022-09-08 15:00:00 +02:00
InsecureRandomnessQuery.qll
Packaging: Rafactor Javascript core libraries
2021-08-25 12:15:56 -07:00
InsecureTemporaryFileCustomizations.qll
add support for fs-extra methods in insecure-temporary-file
2022-02-02 15:14:43 +01:00
InsecureTemporaryFileQuery.qll
add query for detecting insecure temprary files
2022-01-18 14:54:56 +01:00
InsufficientPasswordHash.qll
Packaging: Rafactor Javascript core libraries
2021-08-25 12:15:56 -07:00
InsufficientPasswordHashCustomizations.qll
refactor the SensitiveExpr to be a dataflow node
2022-09-05 16:11:54 +02:00
InsufficientPasswordHashQuery.qll
Packaging: Rafactor Javascript core libraries
2021-08-25 12:15:56 -07:00
LogInjection.qll
Packaging: Rafactor Javascript core libraries
2021-08-25 12:15:56 -07:00
LogInjectionQuery.qll
Packaging: Rafactor Javascript core libraries
2021-08-25 12:15:56 -07:00
LoopBoundInjection.qll
Packaging: Rafactor Javascript core libraries
2021-08-25 12:15:56 -07:00
LoopBoundInjectionCustomizations.qll
JS: fix ql/field-only-used-in-charpred within JavaScript
2022-01-20 09:41:13 +01:00
LoopBoundInjectionQuery.qll
Packaging: Rafactor Javascript core libraries
2021-08-25 12:15:56 -07:00
MissingRateLimiting.qll
update the predicates on Express::RouteHandler to use dataflow nodes
2022-09-05 16:11:54 +02:00
NosqlInjection.qll
Packaging: Rafactor Javascript core libraries
2021-08-25 12:15:56 -07:00
NosqlInjectionCustomizations.qll
update the SQL/NoSQL models to use dataflow nodes
2022-09-05 16:11:54 +02:00
NosqlInjectionQuery.qll
update the SQL/NoSQL models to use dataflow nodes
2022-09-05 16:11:54 +02:00
PostMessageStar.qll
Packaging: Rafactor Javascript core libraries
2021-08-25 12:15:56 -07:00
PostMessageStarCustomizations.qll
refactor the SensitiveExpr to be a dataflow node
2022-09-05 16:11:54 +02:00
PostMessageStarQuery.qll
Packaging: Rafactor Javascript core libraries
2021-08-25 12:15:56 -07:00
PropertyInjectionShared.qll
Packaging: Rafactor Javascript core libraries
2021-08-25 12:15:56 -07:00
PrototypePollutingAssignment.qll
Packaging: Rafactor Javascript core libraries
2021-08-25 12:15:56 -07:00
PrototypePollutingAssignmentCustomizations.qll
recognize an access to the arguments object as library-input
2022-08-22 08:29:24 +02:00
PrototypePollutingAssignmentQuery.qll
add to isSanitizerGuard
2022-09-13 07:27:51 +02:00
PrototypePollution.qll
Packaging: Rafactor Javascript core libraries
2021-08-25 12:15:56 -07:00
PrototypePollutionCustomizations.qll
delete all deprecations that are over 14 months old
2022-03-09 18:28:07 +01:00
PrototypePollutionQuery.qll
Packaging: Rafactor Javascript core libraries
2021-08-25 12:15:56 -07:00
ReflectedXss.qll
Packaging: Rafactor Javascript core libraries
2021-08-25 12:15:56 -07:00
ReflectedXssCustomizations.qll
ensure consistent casing of names
2022-09-09 10:34:14 +02:00
ReflectedXssQuery.qll
move initialization of sanitizer-guards to Query.qll files
2022-04-20 18:10:53 +02:00
RegExpInjection.qll
Packaging: Rafactor Javascript core libraries
2021-08-25 12:15:56 -07:00
RegExpInjectionCustomizations.qll
Packaging: Rafactor Javascript core libraries
2021-08-25 12:15:56 -07:00
RegExpInjectionQuery.qll
Packaging: Rafactor Javascript core libraries
2021-08-25 12:15:56 -07:00
RemoteFlowSources.qll
JS: Rename Node.{getASource -> asSource, getASink -> asSink}
2022-05-24 11:57:30 +02:00
RemotePropertyInjection.qll
Packaging: Rafactor Javascript core libraries
2021-08-25 12:15:56 -07:00
RemotePropertyInjectionCustomizations.qll
Merge pull request #10286 from erik-krogh/js-followMsg
2022-09-20 16:12:45 +02:00
RemotePropertyInjectionQuery.qll
Packaging: Rafactor Javascript core libraries
2021-08-25 12:15:56 -07:00
RequestForgery.qll
Packaging: Rafactor Javascript core libraries
2021-08-25 12:15:56 -07:00
RequestForgeryCustomizations.qll
JS: Merge sources to one class
2022-02-21 16:26:02 +01:00
RequestForgeryQuery.qll
JS: Add ClientSideRequestForgery and split request-forgery results between the two
2022-02-16 13:35:01 +01:00
ResourceExhaustionCustomizations.qll
JS: Simplify
2022-05-24 14:18:06 +02:00
ResourceExhaustionQuery.qll
move the sanitizer-guard to the Query.qll file
2022-04-13 09:58:33 +02:00
ServerSideUrlRedirect.qll
Packaging: Rafactor Javascript core libraries
2021-08-25 12:15:56 -07:00
ServerSideUrlRedirectCustomizations.qll
ensure consistent casing of names
2022-09-09 10:34:14 +02:00
ServerSideUrlRedirectQuery.qll
move LocalUrlSanitizingGuard out of the customizations file
2022-04-20 18:10:52 +02:00
ShellCommandInjectionFromEnvironment.qll
Packaging: Rafactor Javascript core libraries
2021-08-25 12:15:56 -07:00
ShellCommandInjectionFromEnvironmentCustomizations.qll
Packaging: Rafactor Javascript core libraries
2021-08-25 12:15:56 -07:00
ShellCommandInjectionFromEnvironmentQuery.qll
Packaging: Rafactor Javascript core libraries
2021-08-25 12:15:56 -07:00
SqlInjection.qll
Packaging: Rafactor Javascript core libraries
2021-08-25 12:15:56 -07:00
SqlInjectionCustomizations.qll
update the SQL/NoSQL models to use dataflow nodes
2022-09-05 16:11:54 +02:00
SqlInjectionQuery.qll
rename LDAP to Ldap
2021-10-27 19:05:56 +02:00
StackTraceExposure.qll
Packaging: Rafactor Javascript core libraries
2021-08-25 12:15:56 -07:00
StackTraceExposureCustomizations.qll
ensure consistent casing of names
2022-09-09 10:34:14 +02:00
StackTraceExposureQuery.qll
Packaging: Rafactor Javascript core libraries
2021-08-25 12:15:56 -07:00
StoredXss.qll
Packaging: Rafactor Javascript core libraries
2021-08-25 12:15:56 -07:00
StoredXssCustomizations.qll
fix qldoc in StoredXssCustomizations
2022-04-21 09:11:08 +02:00
StoredXssQuery.qll
move storedXss sources to the Customizations file
2022-04-20 18:17:49 +02:00
TaintedFormatString.qll
Packaging: Rafactor Javascript core libraries
2021-08-25 12:15:56 -07:00
TaintedFormatStringCustomizations.qll
Share TaintedFormatString between Ruby and JS
2022-03-21 12:51:46 +13:00
TaintedFormatStringQuery.qll
Share TaintedFormatString between Ruby and JS
2022-03-21 12:51:46 +13:00
TaintedFormatStringSpecific.qll
Share TaintedFormatString between Ruby and JS
2022-03-21 12:51:46 +13:00
TaintedPath.qll
Packaging: Rafactor Javascript core libraries
2021-08-25 12:15:56 -07:00
TaintedPathCustomizations.qll
Remove additional path-injection sinks
2022-09-23 17:17:43 +00:00
TaintedPathQuery.qll
Packaging: Rafactor Javascript core libraries
2021-08-25 12:15:56 -07:00
TemplateObjectInjection.qll
Packaging: Rafactor Javascript core libraries
2021-08-25 12:15:56 -07:00
TemplateObjectInjectionCustomizations.qll
deprecate the HTTP flowsTo predicates to avoid confusion with SourceNode::flowsTo
2022-09-05 15:44:12 +02:00
TemplateObjectInjectionQuery.qll
Packaging: Rafactor Javascript core libraries
2021-08-25 12:15:56 -07:00
TypeConfusionThroughParameterTampering.qll
Packaging: Rafactor Javascript core libraries
2021-08-25 12:15:56 -07:00
TypeConfusionThroughParameterTamperingCustomizations.qll
ensure consistent casing of names
2022-09-09 10:34:14 +02:00
TypeConfusionThroughParameterTamperingQuery.qll
JS: Call super in isBarrier() override
2022-09-07 13:40:30 +02:00
UnsafeCodeConstruction.qll
JS: fix typos in comments
2022-05-12 16:02:19 +01:00
UnsafeCodeConstructionCustomizations.qll
recognize an access to the arguments object as library-input
2022-08-22 08:29:24 +02:00
UnsafeDeserialization.qll
delete redundant imports
2022-04-22 12:55:28 +02:00
UnsafeDeserializationCustomizations.qll
delete redundant imports
2022-04-22 12:55:28 +02:00
UnsafeDeserializationQuery.qll
delete redundant imports
2022-04-22 12:55:28 +02:00
UnsafeDynamicMethodAccess.qll
Packaging: Rafactor Javascript core libraries
2021-08-25 12:15:56 -07:00
UnsafeDynamicMethodAccessCustomizations.qll
fix most ql-for-ql warnings in JS
2022-02-11 17:57:37 +01:00
UnsafeDynamicMethodAccessQuery.qll
Packaging: Rafactor Javascript core libraries
2021-08-25 12:15:56 -07:00
UnsafeHtmlConstruction.qll
Packaging: Rafactor Javascript core libraries
2021-08-25 12:15:56 -07:00
UnsafeHtmlConstructionCustomizations.qll
recognize an access to the arguments object as library-input
2022-08-22 08:29:24 +02:00
UnsafeHtmlConstructionQuery.qll
fix all ql/unmentioned-guard
2022-09-12 22:42:46 +02:00
UnsafeJQueryPlugin.qll
Packaging: Rafactor Javascript core libraries
2021-08-25 12:15:56 -07:00
UnsafeJQueryPluginCustomizations.qll
move the DomBasedXss sources/sinks into the Customizations file
2022-04-20 18:10:53 +02:00
UnsafeJQueryPluginQuery.qll
move the DomBasedXss sources/sinks into the Customizations file
2022-04-20 18:10:53 +02:00
UnsafeShellCommandConstruction.qll
Packaging: Rafactor Javascript core libraries
2021-08-25 12:15:56 -07:00
UnsafeShellCommandConstructionCustomizations.qll
recognize an access to the arguments object as library-input
2022-08-22 08:29:24 +02:00
UnsafeShellCommandConstructionQuery.qll
use the number guard in existing queries that contained typeof checks
2022-02-09 09:51:57 +01:00
UnvalidatedDynamicMethodCall.qll
Packaging: Rafactor Javascript core libraries
2021-08-25 12:15:56 -07:00
UnvalidatedDynamicMethodCallCustomizations.qll
use some Sanitizer classes that were unused in the query code
2022-03-13 23:54:53 +01:00
UnvalidatedDynamicMethodCallQuery.qll
use some Sanitizer classes that were unused in the query code
2022-03-13 23:54:53 +01:00
UrlConcatenation.qll
Packaging: Rafactor Javascript core libraries
2021-08-25 12:15:56 -07:00
XmlBomb.qll
Packaging: Rafactor Javascript core libraries
2021-08-25 12:15:56 -07:00
XmlBombCustomizations.qll
convert the AngularJS model to use DataFlow nodes
2022-09-05 16:11:54 +02:00
XmlBombQuery.qll
Packaging: Rafactor Javascript core libraries
2021-08-25 12:15:56 -07:00
XpathInjection.qll
Packaging: Rafactor Javascript core libraries
2021-08-25 12:15:56 -07:00
XpathInjectionCustomizations.qll
Packaging: Rafactor Javascript core libraries
2021-08-25 12:15:56 -07:00
XpathInjectionQuery.qll
Packaging: Rafactor Javascript core libraries
2021-08-25 12:15:56 -07:00
Xss.qll
make some acronyms camelCase
2022-08-22 21:22:35 +02:00
XssThroughDom.qll
Packaging: Rafactor Javascript core libraries
2021-08-25 12:15:56 -07:00
XssThroughDomCustomizations.qll
rename more acronyms
2022-08-25 20:52:27 +02:00
XssThroughDomQuery.qll
rewrite qldoc based on review
2022-06-28 13:23:44 +02:00
Xxe.qll
Packaging: Rafactor Javascript core libraries
2021-08-25 12:15:56 -07:00
XxeCustomizations.qll
convert the AngularJS model to use DataFlow nodes
2022-09-05 16:11:54 +02:00
XxeQuery.qll
Packaging: Rafactor Javascript core libraries
2021-08-25 12:15:56 -07:00
ZipSlip.qll
Packaging: Rafactor Javascript core libraries
2021-08-25 12:15:56 -07:00
ZipSlipCustomizations.qll
JS: Rename Node.{getASource -> asSource, getASink -> asSink}
2022-05-24 11:57:30 +02:00
ZipSlipQuery.qll
Packaging: Rafactor Javascript core libraries
2021-08-25 12:15:56 -07:00