codeql

dataflow

JS: Fix missing flow into rest pattern lvalue

2025-04-11 08:37:09 +02:00

dependencies

delete old deprecations

2023-06-02 11:58:08 +02:00

endpoints

JS: Expose InternalModuleNaming

2024-04-25 13:33:17 +02:00

explore

JS: Deprecate forward/backward exploration modules

2025-01-03 11:41:39 +01:00

filters

JS: More aggressive test file classification

2024-11-19 13:23:32 +01:00

frameworks

Merge pull request #19422 from Napalys/js/shelljs

2025-05-02 14:18:44 +02:00

heuristics

JS: Make implicit this receivers explicit

2023-05-03 15:31:00 +02:00

internal

JS: Add type-tracking step through simple Promise.all() calls

2025-04-29 15:08:18 +02:00

linters

JS: Make implicit this receivers explicit

2023-05-11 11:50:56 +02:00

meta

JS: Make implicit this receivers explicit

2023-05-11 11:50:56 +02:00

security

Refactor process.env handling in CleartextLogging and IndirectCommandInjection modules to use ThreatModelSource

2025-05-01 11:14:15 +02:00

Actions.qll

Apply suggestions from code review

2023-05-09 16:27:32 +02:00

Aliases.qll

…

AMD.qll

Merge branch 'main' into js/shared-dataflow-merged

2024-03-13 14:27:16 +01:00

ApiGraphs.qll

JS: Make API graphs rely on type-tracking steps in general

2025-04-29 15:08:19 +02:00

Arrays.qll

Merge branch 'main' into js/shared-dataflow-merge-main

2024-12-19 10:14:38 +01:00

AST.qll

JS: Move Directive subclasses into Directive module

2024-03-26 09:39:37 +01:00

Base64.qll

JS: Make implicit this receivers explicit

2023-05-03 15:31:00 +02:00

BasicBlocks.qll

JS: Add qldoc to file

2024-10-22 12:46:09 +02:00

CanonicalNames.qll

JS: Make implicit this receivers explicit

2023-05-03 15:31:00 +02:00

CFG.qll

JS: Add DataFlow::Node.getLocation

2024-03-13 13:06:16 +01:00

CharacterEscapes.qll

JS: fix most ql/missing-parameter-qldoc issues

2022-03-16 22:56:52 +01:00

Classes.qll

JS: Treat private-field methods as private

2024-01-15 13:00:39 +01:00

Closure.qll

JS: Make implicit this receivers explicit

2023-05-03 15:31:00 +02:00

Collections.qll

Merge branch 'main' into js/shared-dataflow-merge-main

2024-12-19 10:14:38 +01:00

Comments.qll

JS: Add DataFlow::Node.getLocation

2024-03-13 13:06:16 +01:00

Concepts.qll

JS: Add ThreatModelSource#isCilentSideSource()

2025-01-22 10:45:48 +01:00

Constants.qll

JS: Make implicit this receivers explicit

2023-05-03 15:31:00 +02:00

DefensiveProgramming.qll

Py/JS/RB: Use instanceof in more places

2022-12-12 16:06:57 +01:00

DefUse.qll

delete old deprecations

2023-06-02 11:58:08 +02:00

DOM.qll

JS: Updates to DOM model

2025-04-02 10:14:03 +02:00

DynamicPropertyAccess.qll

JS: Make implicit this receivers explicit

2023-05-03 15:31:00 +02:00

E4X.qll

delete old deprecations

2023-06-02 11:58:08 +02:00

EmailClients.qll

JS: Make implicit this receivers explicit

2023-05-03 15:31:00 +02:00

Errors.qll

JS: Add DataFlow::Node.getLocation

2024-03-13 13:06:16 +01:00

ES2015Modules.qll

JS: Add store step into namespace re-export specifier

2024-04-17 14:14:12 +02:00

Expr.qll

JS: Added predicate to check if v flag is used on regular expression

2025-02-16 18:31:08 +01:00

Extend.qll

Adapt Webix modeling to support HTML use-cases

2023-06-28 15:26:30 +02:00

Externs.qll

JS: Update some deprecated calls to getName()

2025-03-27 11:51:24 +01:00

Files.qll

JS: Add DataFlow::Node.getLocation

2024-03-13 13:06:16 +01:00

Functions.qll

JS: Move Directive subclasses into Directive module

2024-03-26 09:39:37 +01:00

GeneratedCode.qll

JavaScript: Autoformat

2023-03-10 09:41:20 +01:00

Generators.qll

JS: Summary/steps for iterators and generators

2023-10-13 12:42:41 +02:00

GlobalAccessPaths.qll

stop recursive fromRhs related to getLaterBaseAccess

2023-06-01 23:16:52 +02:00

HTML.qll

JS: Add DataFlow::Node.getLocation

2024-03-13 13:06:16 +01:00

HtmlSanitizers.qll

JS: Make implicit this receivers explicit

2023-05-03 15:31:00 +02:00

InclusionTests.qll

Remove pragma[assume_small_delta]

2023-06-30 11:09:29 -07:00

JSDoc.qll

JS: Restrict size of hasNameParts

2025-03-27 11:51:20 +01:00

JSON.qll

JS: Add DataFlow::Node.getLocation

2024-03-13 13:06:16 +01:00

JsonParsers.qll

JS: Rename Node.{getASource -> asSource, getASink -> asSink}

2022-05-24 11:57:30 +02:00

JsonSchema.qll

JS: Rename Node.{getASource -> asSource, getASink -> asSink}

2022-05-24 11:57:30 +02:00

JsonStringifiers.qll

delete outdated deprecations

2024-01-22 09:11:35 +01:00

JSX.qll

use my script to delete outdated deprecations

2024-09-03 20:30:58 +02:00

Lines.qll

JS: Add DataFlow::Node.getLocation

2024-03-13 13:06:16 +01:00

Locations.qll

JS: Add DataFlow::Node.getLocation

2024-03-13 13:06:16 +01:00

MembershipCandidates.qll

JS: Sharpen up EnumerationRegExp

2025-02-28 13:58:11 +01:00

Modules.qll

patch upper-case acronyms to be PascalCase

2022-03-11 11:10:33 +01:00

NodeJS.qll

JS: Update new xsjs-specific code to respect TEarlyStageNode

2024-08-22 13:22:35 +02:00

NodeModuleResolutionImpl.qll

use my script to delete outdated deprecations

2024-09-03 20:30:58 +02:00

NPM.qll

Merge pull request #15380 from asgerf/js/endpoint-naming

2024-02-14 10:48:13 +01:00

PackageExports.qll

also consider relative exports when finding library inputs

2023-02-14 21:08:13 +01:00

Paths.qll

JS: Add TEarlyStageNode

2023-10-13 12:42:39 +02:00

PrintAst.qll

Add support for XML attributes in the data flow graph

2023-12-14 11:33:53 -08:00

Promises.qll

JS: Move some promise-related store steps into PromiseFlow::storeStep

2025-03-13 12:53:04 +01:00

RangeAnalysis.qll

ensure consistent casing of names

2022-09-09 10:34:14 +02:00

Regexp.qll

Applied changes from comments.

2025-03-10 13:29:05 +01:00

RestrictedLocations.qll

JS: Add DataFlow::Node.getLocation

2024-03-13 13:06:16 +01:00

Routing.qll

JS: Add isMiddlewareSetup() hook to Routing model

2025-04-22 12:00:02 +02:00

SourceMaps.qll

use my script to delete outdated deprecations

2024-09-03 20:30:58 +02:00

SSA.qll

Address review comment

2024-03-13 20:03:01 +01:00

StandardLibrary.qll

Merge branch 'main' into js/shared-dataflow-merge-main

2024-12-19 10:14:38 +01:00

Stmt.qll

use my script to delete outdated deprecations

2024-09-03 20:30:58 +02:00

StringConcatenation.qll

…

StringOps.qll

Added support for matchAll in CWE-020 including new test cases

2024-11-05 08:51:24 +01:00

Templates.qll

JS: Make implicit this receivers explicit

2023-05-03 15:31:00 +02:00

Tokens.qll

JS: Add DataFlow::Node.getLocation

2024-03-13 13:06:16 +01:00

TypeAnnotations.qll

…

TypeScript.qll

JS: Unfold local type aliases in getAnUnderlyingType

2025-03-10 16:09:16 +01:00

Unit.qll

Replace all definitions of Unit by import codeql.util.Unit

2023-03-24 10:39:34 +01:00

Util.qll

…

Variables.qll

JS: Add DataFlow::Node.getLocation

2024-03-13 13:06:16 +01:00

ViewComponentInput.qll

JS: Use TypeScript types to restrict ViewComponentInputs in general

2025-01-22 10:45:47 +01:00

XML.qll

JS: Switch to shared XML.qll implementation

2024-03-19 13:17:50 +01:00

YAML.qll

use my script to delete outdated deprecations

2024-09-03 20:30:58 +02:00