semmle-qlci 6602b4dbda Merge pull request #992 from xiemaisi/js/socket.io ...

Approved by asger-semmle

2019-02-27 18:43:40 +00:00

..

CWE-020

JS: use StringOps:: in js/incomplete-url-substring-sanitization

2019-02-05 15:17:55 +01:00

CWE-022

JS: add taint steps for fs.realpath and fs.realpathSync

2019-02-21 09:48:35 +01:00

CWE-078

JavaScript: Add example of indirect command injection.

2019-01-11 10:24:41 +00:00

CWE-079

JS: add XSS vector for Vue's v-html

2019-02-25 12:17:56 +01:00

CWE-089

JavaScript: Add basic model of socket.io.

2019-02-26 15:53:29 +00:00

CWE-094

JS: improve concatenation-sanitizer for property injection

2019-01-14 15:34:01 +00:00

CWE-116

JavaScript: Improve alert location and message for IncompleteSanitization.

2019-02-08 09:13:40 +00:00

CWE-134

JavaScript: Update expectd test output for security path queries to include nodes and edges query predicates.

2018-11-14 09:32:31 +00:00

CWE-200

JavaScript: Add query help for FileAccessToHttp query.

2018-12-05 13:12:52 +00:00

CWE-201

JavaScript: Extend suspiciousCredentials predicate to recognise authKey and similar.

2019-01-31 09:03:23 +00:00

CWE-209

JavaScript: Update expectd test output for security path queries to include nodes and edges query predicates.

2018-11-14 09:32:31 +00:00

CWE-312

JavaScript: Update qhelp example for CleartextStorage.

2019-02-08 08:43:22 +00:00

CWE-313

QL code and tests for C#/C++/JavaScript.

2018-08-02 17:53:23 +01:00

CWE-327

JavaScript: Update expectd test output for security path queries to include nodes and edges query predicates.

2018-11-14 09:32:31 +00:00

CWE-338

JavaScript: Update expectd test output for security path queries to include nodes and edges query predicates.

2018-11-14 09:32:31 +00:00

CWE-346

JavaScript: Update expectd test output for security path queries to include nodes and edges query predicates.

2018-11-14 09:32:31 +00:00

CWE-352

JS: review comments

2018-09-21 14:46:21 +01:00

CWE-400

JavaScript: Restrict RemotePropertyInjection query to avoid double-reporting.

2018-11-28 08:16:31 +00:00

CWE-451

QL code and tests for C#/C++/JavaScript.

2018-08-02 17:53:23 +01:00

CWE-502

JavaScript: Update expectd test output for security path queries to include nodes and edges query predicates.

2018-11-14 09:32:31 +00:00

CWE-506

JavaScript: Address review comments.

2018-11-29 10:48:44 +00:00

CWE-601

JS: recognize sanitizing slashes in URL redirection queries

2018-11-16 10:43:25 +00:00

CWE-611

JavaScript: Update expectd test output for security path queries to include nodes and edges query predicates.

2018-11-14 09:32:31 +00:00

CWE-640

JavaScript: Update expectd test output for security path queries to include nodes and edges query predicates.

2018-11-14 09:32:31 +00:00

CWE-643

JavaScript: Update expectd test output for security path queries to include nodes and edges query predicates.

2018-11-14 09:32:31 +00:00

CWE-730

JavaScript: Update expectd test output for security path queries to include nodes and edges query predicates.

2018-11-14 09:32:31 +00:00

CWE-754

JS: fix typo

2019-01-14 15:34:01 +00:00

CWE-770

JS: add tests for improved js/missing-rate-limiting

2018-08-06 15:15:44 +02:00

CWE-776

JavaScript: Update expectd test output for security path queries to include nodes and edges query predicates.

2018-11-14 09:32:31 +00:00

CWE-798

JS: Dont flag empty string as hardcoded username

2019-01-28 13:01:52 +00:00

CWE-807

JavaScript: Update expectd test output for security path queries to include nodes and edges query predicates.

2018-11-14 09:32:31 +00:00

CWE-843

JavaScript: Update expectd test output for security path queries to include nodes and edges query predicates.

2018-11-14 09:32:31 +00:00

CWE-912

JavaScript: Add query help for HttpToFileAccess query.

2018-12-05 12:58:38 +00:00

CWE-916

JavaScript: Update expectd test output for security path queries to include nodes and edges query predicates.

2018-11-14 09:32:31 +00:00

CWE-918

JS: model URI and XHR methods from closure library

2019-02-08 15:18:27 +00:00

Summaries

JavaScript: Update expected output for ExtractSinkSummaries query.

2019-02-08 08:43:22 +00:00