hohn/codeql
1
0
Fork 0
mirror of https://github.com/github/codeql.git synced 2026-05-28 10:01:25 +02:00
Code Issues Packages Projects Releases Wiki Activity
Files
cccd207ae7bdbc2f7e7b8e0085bb56d300973f9f
codeql/javascript/ql/lib/semmle/javascript/security/dataflow
History
Tom Hvitved 7a48409e38 JS: Recognize Fastify per-route rate limiting
2026-04-13 11:31:34 +02:00
..
BrokenCryptoAlgorithmCustomizations.qll
Port changes to JavaScript.
2023-10-26 14:47:24 +01:00
BrokenCryptoAlgorithmQuery.qll
JS: Resolve inserted TODOs
2025-01-23 13:02:52 +01:00
BuildArtifactLeakCustomizations.qll
JS: A few more deprecation updates
2024-12-16 15:35:50 +01:00
BuildArtifactLeakQuery.qll
JS: Auto-patch diff informed queries
2025-01-20 11:20:27 +01:00
CleartextLoggingCustomizations.qll
JS: An array of constants should be considered "filtered"
2025-09-10 11:07:32 +02:00
CleartextLoggingQuery.qll
JS: Auto-patch diff informed queries
2025-01-20 11:20:27 +01:00
CleartextStorageCustomizations.qll
Py/JS/RB: Use instanceof in more places
2022-12-12 16:06:57 +01:00
CleartextStorageQuery.qll
JS: Auto-patch diff informed queries
2025-01-20 11:20:27 +01:00
ClientSideRequestForgeryQuery.qll
JS: Resolve inserted TODOs
2025-01-23 13:02:52 +01:00
ClientSideUrlRedirectCustomizations.qll
Accept MaD sanitizers for queries with MaD sinks
2026-02-17 12:45:24 +00:00
ClientSideUrlRedirectQuery.qll
JS: Auto-patch diff informed queries
2025-01-20 11:20:27 +01:00
CodeInjectionCustomizations.qll
Accept MaD sanitizers for queries with MaD sinks
2026-02-17 12:45:24 +00:00
CodeInjectionQuery.qll
JS: Auto-patch diff informed queries
2025-01-20 11:20:27 +01:00
CommandInjectionCustomizations.qll
Accept MaD sanitizers for queries with MaD sinks
2026-02-17 12:45:24 +00:00
CommandInjectionQuery.qll
JS/CommandInjectionQuery
2025-10-28 09:40:09 +01:00
ConditionalBypassCustomizations.qll
JS: Make (most) queries use ActiveThreatModelSource
2024-10-25 15:03:42 +02:00
ConditionalBypassQuery.qll
JS: Update ConditionalBypassQuery.qll
2025-01-20 11:20:30 +01:00
CorsMisconfigurationForCredentialsCustomizations.qll
JS: Replace 'instanceof ClientSideRemoteFlowSource'
2025-01-22 10:45:49 +01:00
CorsMisconfigurationForCredentialsQuery.qll
JS: Resolve inserted TODOs
2025-01-23 13:02:52 +01:00
DeepObjectResourceExhaustionCustomizations.qll
JS: Migrate DeepObjectResourceExhaustion
2024-12-13 10:08:09 +01:00
DeepObjectResourceExhaustionQuery.qll
JS: Resolve inserted TODOs
2025-01-23 13:02:52 +01:00
DifferentKindsComparisonBypassCustomizations.qll
JS: Make implicit this receivers explicit
2023-05-03 15:31:00 +02:00
DifferentKindsComparisonBypassQuery.qll
JS: Update DifferentKindsComparisonBypassQuery.qll
2025-01-20 11:20:31 +01:00
DOM.qll
JS: Treat browser message events as client-side sources
2024-08-16 11:02:12 +02:00
DomBasedXssCustomizations.qll
Accept MaD sanitizers for queries with MaD sinks
2026-02-17 12:45:24 +00:00
DomBasedXssQuery.qll
JS: Auto-patch diff informed queries
2025-01-20 11:20:27 +01:00
ExceptionXssCustomizations.qll
JS: Add some missing qldoc
2024-12-16 15:35:44 +01:00
ExceptionXssQuery.qll
JS: Auto-patch diff informed queries
2025-01-20 11:20:27 +01:00
ExternalAPIUsedWithUntrustedDataCustomizations.qll
JS: Deprecate PathExpr and related classes
2025-04-29 13:23:47 +02:00
ExternalAPIUsedWithUntrustedDataQuery.qll
Use more flowTo.
2025-12-03 14:12:08 +01:00
FileAccessToHttpCustomizations.qll
delete redundant imports
2022-04-22 12:55:28 +02:00
FileAccessToHttpQuery.qll
JS: Auto-patch diff informed queries
2025-01-20 11:20:27 +01:00
HardcodedCredentialsCustomizations.qll
Accept MaD sanitizers for queries with MaD sinks
2026-02-17 12:45:24 +00:00
HardcodedCredentialsQuery.qll
JS: Auto-patch diff informed queries
2025-01-20 11:20:27 +01:00
HardcodedDataInterpretedAsCodeCustomizations.qll
JS: Add some missing qldoc
2024-12-16 15:35:44 +01:00
HardcodedDataInterpretedAsCodeQuery.qll
JS: Auto-patch diff informed queries
2025-01-20 11:20:27 +01:00
HostHeaderPoisoningInEmailGenerationQuery.qll
JS: Auto-patch diff informed queries
2025-01-20 11:20:27 +01:00
HttpToFileAccessCustomizations.qll
Add missing file doc comment
2022-03-22 11:10:09 +13:00
HttpToFileAccessQuery.qll
JS: Auto-patch diff informed queries
2025-01-20 11:20:27 +01:00
HttpToFileAccessSpecific.qll
Py/JS/RB: Use instanceof in more places
2022-12-12 16:06:57 +01:00
ImproperCodeSanitizationCustomizations.qll
delete old deprecations
2023-06-02 11:58:08 +02:00
ImproperCodeSanitizationQuery.qll
JS: Auto-patch diff informed queries
2025-01-20 11:20:27 +01:00
IncompleteHtmlAttributeSanitizationCustomizations.qll
Revert "javascript: remove sanitizer to be replaced by model"
2026-02-17 14:39:04 +00:00
IncompleteHtmlAttributeSanitizationQuery.qll
JS: Auto-patch diff informed queries
2025-01-20 11:20:27 +01:00
IndirectCommandArgument.qll
use more set literals
2022-01-20 16:06:34 +01:00
IndirectCommandInjectionCustomizations.qll
Refactor process.env handling in CleartextLogging and IndirectCommandInjection modules to use ThreatModelSource
2025-05-01 11:14:15 +02:00
IndirectCommandInjectionQuery.qll
JS/IndirectCommandInjectionQuery
2025-10-28 09:40:11 +01:00
InsecureDownloadCustomizations.qll
JS: A few more deprecation updates
2024-12-16 15:35:50 +01:00
InsecureDownloadQuery.qll
JS: Resolve inserted TODOs
2025-01-23 13:02:52 +01:00
InsecureRandomnessCustomizations.qll
Py/JS/RB: Use instanceof in more places
2022-12-12 16:06:57 +01:00
InsecureRandomnessQuery.qll
JS: Auto-patch diff informed queries
2025-01-20 11:20:27 +01:00
InsecureTemporaryFileCustomizations.qll
add support for fs-extra methods in insecure-temporary-file
2022-02-02 15:14:43 +01:00
InsecureTemporaryFileQuery.qll
JS: Auto-patch diff informed queries
2025-01-20 11:20:27 +01:00
InsufficientPasswordHashCustomizations.qll
JS: Use shared CryptographicOperation concept and implement BlockMode getBlockMode()
2023-02-02 20:30:30 +00:00
InsufficientPasswordHashQuery.qll
JS: Auto-patch diff informed queries
2025-01-20 11:20:27 +01:00
LogInjectionQuery.qll
Accept MaD sanitizers for queries with MaD sinks
2026-02-17 12:45:24 +00:00
LoopBoundInjectionCustomizations.qll
JS: Migrate LoopBoundInjection
2024-12-13 10:08:11 +01:00
LoopBoundInjectionQuery.qll
JS: Auto-patch diff informed queries
2025-01-20 11:20:27 +01:00
MissingRateLimiting.qll
JS: Recognize Fastify per-route rate limiting
2026-04-13 11:31:34 +02:00
NosqlInjectionCustomizations.qll
Accept MaD sanitizers for queries with MaD sinks
2026-02-17 12:45:24 +00:00
NosqlInjectionQuery.qll
JS: Resolve inserted TODOs
2025-01-23 13:02:52 +01:00
PostMessageStarCustomizations.qll
JS: A few more deprecation updates
2024-12-16 15:35:50 +01:00
PostMessageStarQuery.qll
JS: Auto-patch diff informed queries
2025-01-20 11:20:27 +01:00
PropertyInjectionShared.qll
Packaging: Rafactor Javascript core libraries
2021-08-25 12:15:56 -07:00
PrototypePollutingAssignmentCustomizations.qll
JS: Add some missing qldoc
2024-12-16 15:35:44 +01:00
PrototypePollutingAssignmentQuery.qll
JS: Auto-patch diff informed queries
2025-01-20 11:20:27 +01:00
PrototypePollutionCustomizations.qll
JS: Migrate PrototypePollutingMergeCall
2024-12-13 10:08:13 +01:00
PrototypePollutionQuery.qll
JS: Resolve inserted TODOs
2025-01-23 13:02:52 +01:00
ReflectedXssCustomizations.qll
Accept MaD sanitizers for queries with MaD sinks
2026-02-17 12:45:24 +00:00
ReflectedXssQuery.qll
JS: Auto-patch diff informed queries
2025-01-20 11:20:27 +01:00
RegExpInjectionCustomizations.qll
Exlucde environmental variables from default detection in regexp injection
2025-07-31 12:09:30 +02:00
RegExpInjectionQuery.qll
JS: Auto-patch diff informed queries
2025-01-20 11:20:27 +01:00
RemoteFlowSources.qll
JS: Address PR review comments
2026-03-13 14:58:04 +01:00
RemotePropertyInjectionCustomizations.qll
JS: Make (most) queries use ActiveThreatModelSource
2024-10-25 15:03:42 +02:00
RemotePropertyInjectionQuery.qll
JS: add enumeration taint flow to Remote Property Injection query
2025-08-27 10:23:03 +00:00
RequestForgeryCustomizations.qll
Accept MaD sanitizers for queries with MaD sinks
2026-02-17 12:45:24 +00:00
RequestForgeryQuery.qll
JS: Resolve inserted TODOs
2025-01-23 13:02:52 +01:00
ResourceExhaustionCustomizations.qll
JS: Replace 'instanceof ClientSideRemoteFlowSource'
2025-01-22 10:45:49 +01:00
ResourceExhaustionQuery.qll
JS: Auto-patch diff informed queries
2025-01-20 11:20:27 +01:00
SecondOrderCommandInjectionCustomizations.qll
JS: Add overlay[global] to abstract classes with fields
2026-01-07 11:05:41 +01:00
SecondOrderCommandInjectionQuery.qll
JS: Auto-patch diff informed queries
2025-01-20 11:20:27 +01:00
ServerSideUrlRedirectCustomizations.qll
Accept MaD sanitizers for queries with MaD sinks
2026-02-17 12:45:24 +00:00
ServerSideUrlRedirectQuery.qll
JS: Fix barrier guards for ServerSideUrlRedirect
2025-02-28 13:28:43 +01:00
ShellCommandInjectionFromEnvironmentCustomizations.qll
Py/JS/RB: Use instanceof in more places
2022-12-12 16:06:57 +01:00
ShellCommandInjectionFromEnvironmentQuery.qll
Constrain location overrides to actual sources/sinks
2025-10-28 09:42:20 +01:00
SqlInjectionCustomizations.qll
Accept MaD sanitizers for queries with MaD sinks
2026-02-17 12:45:24 +00:00
SqlInjectionQuery.qll
JS: Resolve inserted TODOs
2025-01-23 13:02:52 +01:00
StackTraceExposureCustomizations.qll
ensure consistent casing of names
2022-09-09 10:34:14 +02:00
StackTraceExposureQuery.qll
JS: Auto-patch diff informed queries
2025-01-20 11:20:27 +01:00
StoredXssCustomizations.qll
JS: Remove unnecessary BarrierGuardLegacy class
2024-03-13 11:05:23 +01:00
StoredXssQuery.qll
JS: Auto-patch diff informed queries
2025-01-20 11:20:27 +01:00
TaintedFormatStringCustomizations.qll
Share TaintedFormatString between Ruby and JS
2022-03-21 12:51:46 +13:00
TaintedFormatStringQuery.qll
JS: Auto-patch diff informed queries
2025-01-20 11:20:27 +01:00
TaintedFormatStringSpecific.qll
Share TaintedFormatString between Ruby and JS
2022-03-21 12:51:46 +13:00
TaintedPathCustomizations.qll
Accept MaD sanitizers for queries with MaD sinks
2026-02-17 12:45:24 +00:00
TaintedPathQuery.qll
JS: Auto-patch diff informed queries
2025-01-20 11:20:27 +01:00
TemplateObjectInjectionCustomizations.qll
JS: Migrate TemplateObjectInjection
2024-12-13 10:08:16 +01:00
TemplateObjectInjectionQuery.qll
JS: Auto-patch diff informed queries
2025-01-20 11:20:27 +01:00
TypeConfusionThroughParameterTamperingCustomizations.qll
JS: Refactor BarrierGuardLegacy pattern to not depend on SanitizerGuardNode
2024-12-03 14:30:29 +01:00
TypeConfusionThroughParameterTamperingQuery.qll
JS: Auto-patch diff informed queries
2025-01-20 11:20:27 +01:00
UnsafeCodeConstruction.qll
JS: Resolve inserted TODOs
2025-01-23 13:02:52 +01:00
UnsafeCodeConstructionCustomizations.qll
fix some more style-guide violations in the alert-messages
2022-10-07 11:22:22 +02:00
UnsafeDeserializationCustomizations.qll
Accept MaD sanitizers for queries with MaD sinks
2026-02-17 12:45:24 +00:00
UnsafeDeserializationQuery.qll
JS: Auto-patch diff informed queries
2025-01-20 11:20:27 +01:00
UnsafeDynamicMethodAccessCustomizations.qll
JS: Add some missing qldoc
2024-12-16 15:35:44 +01:00
UnsafeDynamicMethodAccessQuery.qll
JS: Auto-patch diff informed queries
2025-01-20 11:20:27 +01:00
UnsafeHtmlConstructionCustomizations.qll
JS: Add overlay[global] to abstract classes with fields
2026-01-07 11:05:41 +01:00
UnsafeHtmlConstructionQuery.qll
JS: Resolve inserted TODOs
2025-01-23 13:02:52 +01:00
UnsafeJQueryPluginCustomizations.qll
JS: A few more deprecation updates
2024-12-16 15:35:50 +01:00
UnsafeJQueryPluginQuery.qll
JS: Resolve inserted TODOs
2025-01-23 13:02:52 +01:00
UnsafeShellCommandConstructionCustomizations.qll
Merge branch 'main' into js/shared-dataflow-merge-main
2024-12-19 10:14:38 +01:00
UnsafeShellCommandConstructionQuery.qll
JS: Resolve inserted TODOs
2025-01-23 13:02:52 +01:00
UnvalidatedDynamicMethodCallCustomizations.qll
JS: Exclude some sinks in UnvalidatedDynamicMethodCall
2025-01-06 10:32:11 +01:00
UnvalidatedDynamicMethodCallQuery.qll
JS: Auto-patch diff informed queries
2025-01-20 11:20:27 +01:00
UrlConcatenation.qll
JS: Update two more uses of SanitizerGuardNode
2024-12-03 14:30:35 +01:00
XmlBombCustomizations.qll
JS: Make (most) queries use ActiveThreatModelSource
2024-10-25 15:03:42 +02:00
XmlBombQuery.qll
JS: Auto-patch diff informed queries
2025-01-20 11:20:27 +01:00
XpathInjectionCustomizations.qll
Py/JS/RB: Use instanceof in more places
2022-12-12 16:06:57 +01:00
XpathInjectionQuery.qll
JS: Auto-patch diff informed queries
2025-01-20 11:20:27 +01:00
Xss.qll
JS: Removed encodeURI from request forgery sanitizer list
2025-06-16 13:08:11 +02:00
XssThroughDomCustomizations.qll
JS: Support [(ngModel)]
2025-01-17 10:26:57 +01:00
XssThroughDomQuery.qll
JS: Auto-patch diff informed queries
2025-01-20 11:20:27 +01:00
XxeCustomizations.qll
JS: Make (most) queries use ActiveThreatModelSource
2024-10-25 15:03:42 +02:00
XxeQuery.qll
JS: Auto-patch diff informed queries
2025-01-20 11:20:27 +01:00
ZipSlipCustomizations.qll
JS: FlowLabel -> FlowState in ZipSlip
2024-12-10 11:16:07 +01:00
ZipSlipQuery.qll
JS: Auto-patch diff informed queries
2025-01-20 11:20:27 +01:00