codeql

CWE-020

Merge pull request #9712 from erik-krogh/badRange

2022-08-15 13:55:44 +02:00

CWE-022

update {rb/py/js/go}/path-injection to match java/csharp

2022-08-22 21:41:45 +02:00

CWE-073

JS: Migrate to *Query.qll convention

2021-08-12 09:30:18 +02:00

CWE-078

update {js/py}/command-line-injection to match csharp/java

2022-08-22 21:41:46 +02:00

CWE-079

refactor the js/xss query to use three flowlabels and one configuration

2022-03-16 22:32:08 +01:00

CWE-089

add cwe 090 (ldap injection) and cwe 943 (Improper Neutralization of Special Elements in Data Query Logic) to SqlInjection.ql

2021-10-01 09:01:29 +02:00

CWE-094

use small steps in TypeBackTracker correctly

2022-07-13 10:29:57 +02:00

CWE-116

Rename IncompleteMultiCharacterSanitization[Query]

2022-08-17 16:03:49 +12:00

CWE-117

JS: Migrate to *Query.qll convention

2021-08-12 09:30:18 +02:00

CWE-134

update js/tainted-format-string to match ruby/java

2022-08-22 21:41:46 +02:00

CWE-178

print the endpointExample in the alert-messsage, and only report one working example

2022-08-24 13:09:48 +02:00

CWE-200

fix some QL-for-QL warnings in JS

2022-07-14 09:45:44 +02:00

CWE-201

JS: Migrate to *Query.qll convention

2021-08-12 09:30:18 +02:00

CWE-209

add CWE-497 to js/stack-trace-exposure

2021-11-02 15:43:55 +01:00

CWE-295

JS: Rename Node.{getASource -> asSource, getASink -> asSink}

2022-05-24 11:57:30 +02:00

CWE-300

patch upper-case acronyms to be PascalCase

2022-03-11 11:10:33 +01:00

CWE-312

JS/PY: Remove CWE-315 form CleartextLogging

2021-11-24 14:59:18 +01:00

CWE-313

add a js/empty-password-in-configuration-file query

2022-01-19 10:48:45 +01:00

CWE-326

add qhelp

2021-11-02 14:45:33 +01:00

CWE-327

JS: Tag queries with CWE-328

2021-12-06 14:02:24 +01:00

CWE-338

update js/insecure-randomness to match csharp

2022-08-22 21:41:46 +02:00

CWE-346

add cwe-942 to js/cors-misconfiguration-for-credentials

2021-11-08 13:12:19 +01:00

CWE-347

add missing severities to JS queries

2022-03-16 10:40:34 +01:00

CWE-352

JS: Rename Node.{getASource -> asSource, getASink -> asSink}

2022-05-24 11:57:30 +02:00

CWE-367

move dot in qhelp

2022-02-01 14:34:30 +01:00

CWE-377

fix leftover todo in js/insecure-temporary-file

2022-09-06 10:05:50 +02:00

CWE-384

Merge branch 'main' into missDocParam

2022-07-13 09:58:04 +02:00

CWE-400

JS: Migrate to *Query.qll convention

2021-08-12 09:30:18 +02:00

CWE-451

Update security-severity scores

2021-06-15 13:25:17 +01:00

CWE-502

JS: Migrate to *Query.qll convention

2021-08-12 09:30:18 +02:00

CWE-506

JS: Migrate to *Query.qll convention

2021-08-12 09:30:18 +02:00

CWE-598

rewrite js/sensitive-get-query to use routing trees

2022-05-30 11:55:09 +02:00

CWE-601

JS: Migrate to *Query.qll convention

2021-08-12 09:30:18 +02:00

CWE-611

JS: Migrate to *Query.qll convention

2021-08-12 09:30:18 +02:00

CWE-614

add cwe-319 "Cleartext Transmission of Sensitive Information" to js/clear-text-cookie

2021-11-02 11:11:38 +01:00

CWE-640

JS: Migrate to *Query.qll convention

2021-08-12 09:30:18 +02:00

CWE-643

update {js/go/py}/xpath-injection to match csharp/java

2022-08-22 21:41:46 +02:00

CWE-730

patch upper-case acronyms to be PascalCase

2022-03-11 11:10:33 +01:00

CWE-754

modified query and added tests

2022-02-02 19:39:08 +05:30

CWE-770

fix typo in qldoc

2022-04-19 11:09:27 +02:00

CWE-776

JS: Migrate to *Query.qll convention

2021-08-12 09:30:18 +02:00

CWE-798

ignore deliberately hardcoded password strings

2022-02-16 09:47:01 +01:00

CWE-807

JS: Migrate to *Query.qll convention

2021-08-12 09:30:18 +02:00

CWE-829

JS: Migrate to *Query.qll convention

2021-08-12 09:30:18 +02:00

CWE-830

rename more acronyms

2022-08-25 20:52:27 +02:00

CWE-834

JS: Update score and add CWE-730 to LoopBoundInjection

2021-10-05 10:10:01 +02:00

CWE-843

Apply suggestions from code review

2022-01-04 10:07:34 +00:00

CWE-862

update the empty-password-in-config-file qhelp

2022-01-24 13:39:54 +01:00

CWE-912

JS: Lower security-severity of queries with speculative threat model

2021-10-05 10:10:01 +02:00

CWE-915

make a model for hasOwnProperty calls and similar

2022-05-24 14:13:53 +02:00

CWE-916

JS: Migrate to *Query.qll convention

2021-08-12 09:30:18 +02:00

CWE-918

JS: Minor fixup in the client-side request forgery qhelp

2022-02-23 10:54:26 +01:00

CWE-1004

fix good/bad mixup in ClientExposedCookie qhelp

2022-01-24 15:34:30 +01:00

CWE-1275

apply documentation suggestions

2022-01-25 12:14:16 +01:00