hohn/codeql
1
0
Fork 0
mirror of https://github.com/github/codeql.git synced 2025-12-18 01:33:15 +01:00
Code Issues Packages Projects Releases Wiki Activity
Files
c20ee76826e10318f8f39c6fae901b743c2e8254
codeql/javascript/ql/test/query-tests/Security
History
Erik Krogh Kristensen 53b26eba17 Merge pull request #8724 from erik-krogh/postMessage 
JS: promote the `js/missing-origin-verification` query
2022-05-09 12:28:58 +02:00
..
CWE-020
include startsWith/endsWith checks in js/missing-origin-check
2022-04-25 15:28:50 +02:00
CWE-022
handlebars taint step: conservatively assume unknown templates have no flow to helpers
2022-04-13 09:27:59 +02:00
CWE-073
JS: Use routing trees to detect deeply tainted req.body
2021-12-07 10:46:18 +01:00
CWE-078
support that the base is not a method-call in getAChainedMethodCall
2022-03-09 11:12:04 +01:00
CWE-079
Merge pull request #8724 from erik-krogh/postMessage
2022-05-09 12:28:58 +02:00
CWE-089
JS: Recognize "sql" option as a query string
2022-01-13 13:04:41 +01:00
CWE-094
add values written to the global scope as exports
2022-02-07 13:34:18 +01:00
CWE-116
add a bad-tag-filter query for Python and JavaScript
2021-09-21 15:04:03 +02:00
CWE-117
Merge branch 'main' into logs
2021-07-16 11:21:25 +02:00
CWE-134
JavaScript: Update expected output.
2019-10-29 15:36:24 +00:00
CWE-200
model serve-handler in js/exposure-of-private-files
2021-06-08 09:52:56 +02:00
CWE-201
JavaScript: Update expected output.
2019-10-29 15:36:24 +00:00
CWE-209
JavaScript: Update expected output.
2019-10-29 15:36:24 +00:00
CWE-295
add some API-nodes to js/disabling-certificate-validation
2022-03-14 21:33:13 +01:00
CWE-300
add js/http-dependency query
2022-01-19 10:05:39 +01:00
CWE-312
JS: Update test output
2022-04-07 13:23:26 +02:00
CWE-313
update tests for password patterns
2022-02-16 13:22:19 +01:00
CWE-326
don't include mode-of-operation into the algorithm names
2021-11-03 14:54:50 +01:00
CWE-327
add qhelp to js/biased-cryptographic-random
2020-06-16 11:10:09 +02:00
CWE-338
fix casing on the uid regexp
2021-05-13 23:04:30 +02:00
CWE-346
update inconsistency comment for CWE-346
2020-07-08 10:01:04 +02:00
CWE-347
update expected output
2022-01-28 12:21:33 +01:00
CWE-352
JS: Fix handling of fastify-plugin
2021-12-15 16:04:46 +01:00
CWE-367
add a js/file-system-race query
2022-01-28 09:41:12 +01:00
CWE-384
add js/session-fixation query
2021-11-03 13:04:41 +01:00
CWE-400
JS: Add DeepResourceExhaustion test
2021-03-02 13:56:43 +00:00
CWE-451
QL code and tests for C#/C++/JavaScript.
2018-08-02 17:53:23 +01:00
CWE-502
JavaScript: Update expected output.
2019-10-29 15:36:24 +00:00
CWE-506
Document and format event-stream-orig.js
2022-02-04 09:27:47 +01:00
CWE-598
add test that requires flowToExpr
2021-11-08 12:25:45 +01:00
CWE-601
split interpretsArgumentsAsURL out of interpretsArgumentsAsHTML, and use it to generalize AttributeUrlSink
2022-03-16 22:32:08 +01:00
CWE-611
JS: Update expectations with new sources
2021-03-16 13:28:12 +00:00
CWE-614
assume that setting the secure/httpOnly flag to some unknown value is good
2021-10-26 13:47:28 +02:00
CWE-640
JavaScript: Update expected output.
2019-10-29 15:36:24 +00:00
CWE-643
JS: Update expectations with new sources
2021-03-16 13:28:12 +00:00
CWE-730
JS: Update RegExpInjection test case
2021-06-22 12:00:04 +02:00
CWE-754
update expected files
2022-02-04 12:28:17 +00:00
CWE-770
update expected output of rate-limit query after test reorg
2022-04-19 14:27:24 +02:00
CWE-776
JS: Update expectations with new sources
2021-03-16 13:28:12 +00:00
CWE-798
ignore deliberately hardcoded password strings
2022-02-16 09:47:01 +01:00
CWE-807
JS: add js/conditional-bypass example as a test case
2020-12-22 09:34:25 +01:00
CWE-829
recognize sensitive files by file-system writes
2020-06-25 15:19:42 +02:00
CWE-830
CWE 830 polish error messages
2022-02-22 11:41:54 +01:00
CWE-834
move comments to match alert location for CWE-834
2020-07-08 10:16:04 +02:00
CWE-843
JS: Add type confusion sink for prototype pollution checks
2020-12-07 10:16:38 +00:00
CWE-862
add a js/empty-password-in-configuration-file query
2022-01-19 10:48:45 +01:00
CWE-912
JavaScript: Update expected output.
2019-10-29 15:36:24 +00:00
CWE-915
fix a FN for prototype polluting function query
2022-04-28 22:00:09 +02:00
CWE-916
JavaScript: Update expected output.
2019-10-29 15:36:24 +00:00
CWE-918
JS: Add consistency test
2022-02-16 13:35:01 +01:00
CWE-1004
add session{key,id} as sensitive info
2021-10-26 13:46:59 +02:00
CWE-1275
add a js/samesite-none-cookie cookie
2022-01-24 21:39:41 +01:00
Summaries
JavaScript: Move flow summaries to experimental.
2020-03-09 12:57:20 +00:00