hohn/codeql
1
0
Fork 0
mirror of https://github.com/github/codeql.git synced 2026-07-12 15:05:33 +02:00
Code Issues Packages Projects Releases Wiki Activity
Files
f87cd164ce309363ed97ec68594fbd168616a286
codeql/javascript/ql/src/Security
History
Erik Krogh Kristensen cf94c93b1a Merge pull request #8481 from erik-krogh/schemeChain 
JS: recognize string replacement chains as scheme checks in js/incomplete-url-scheme-check
2022-03-25 11:13:10 +01:00
..
CWE-020
Merge pull request #8481 from erik-krogh/schemeChain
2022-03-25 11:13:10 +01:00
CWE-022
JS: Migrate to *Query.qll convention
2021-08-12 09:30:18 +02:00
CWE-073
JS: Migrate to *Query.qll convention
2021-08-12 09:30:18 +02:00
CWE-078
JS: Lower security-severity of queries with speculative threat model
2021-10-05 10:10:01 +02:00
CWE-079
refactor the js/xss query to use three flowlabels and one configuration
2022-03-16 22:32:08 +01:00
CWE-089
add cwe 090 (ldap injection) and cwe 943 (Improper Neutralization of Special Elements in Data Query Logic) to SqlInjection.ql
2021-10-01 09:01:29 +02:00
CWE-094
add missing severities to JS queries
2022-03-16 10:40:34 +01:00
CWE-116
patch upper-case acronyms to be PascalCase
2022-03-11 11:10:33 +01:00
CWE-117
JS: Migrate to *Query.qll convention
2021-08-12 09:30:18 +02:00
CWE-134
JS: Make TaintedFormatString have same severity as LogInjection
2021-10-05 10:10:01 +02:00
CWE-200
patch upper-case acronyms to be PascalCase
2022-03-11 11:10:33 +01:00
CWE-201
JS: Migrate to *Query.qll convention
2021-08-12 09:30:18 +02:00
CWE-209
add CWE-497 to js/stack-trace-exposure
2021-11-02 15:43:55 +01:00
CWE-295
add some API-nodes to js/disabling-certificate-validation
2022-03-14 21:33:13 +01:00
CWE-300
patch upper-case acronyms to be PascalCase
2022-03-11 11:10:33 +01:00
CWE-312
JS/PY: Remove CWE-315 form CleartextLogging
2021-11-24 14:59:18 +01:00
CWE-313
add a js/empty-password-in-configuration-file query
2022-01-19 10:48:45 +01:00
CWE-326
add qhelp
2021-11-02 14:45:33 +01:00
CWE-327
JS: Tag queries with CWE-328
2021-12-06 14:02:24 +01:00
CWE-338
JS: Migrate to *Query.qll convention
2021-08-12 09:30:18 +02:00
CWE-346
add cwe-942 to js/cors-misconfiguration-for-credentials
2021-11-08 13:12:19 +01:00
CWE-347
add missing severities to JS queries
2022-03-16 10:40:34 +01:00
CWE-352
fix some instances of ql/pred-doc-style for JS
2022-02-21 15:02:21 +01:00
CWE-367
move dot in qhelp
2022-02-01 14:34:30 +01:00
CWE-384
Update javascript/ql/src/Security/CWE-384/SessionFixation.qhelp
2021-11-10 08:24:46 +01:00
CWE-400
JS: Migrate to *Query.qll convention
2021-08-12 09:30:18 +02:00
CWE-451
Update security-severity scores
2021-06-15 13:25:17 +01:00
CWE-502
JS: Migrate to *Query.qll convention
2021-08-12 09:30:18 +02:00
CWE-506
JS: Migrate to *Query.qll convention
2021-08-12 09:30:18 +02:00
CWE-598
improve qhelp
2021-11-08 12:02:39 +01:00
CWE-601
JS: Migrate to *Query.qll convention
2021-08-12 09:30:18 +02:00
CWE-611
JS: Migrate to *Query.qll convention
2021-08-12 09:30:18 +02:00
CWE-614
add cwe-319 "Cleartext Transmission of Sensitive Information" to js/clear-text-cookie
2021-11-02 11:11:38 +01:00
CWE-640
JS: Migrate to *Query.qll convention
2021-08-12 09:30:18 +02:00
CWE-643
JS: Migrate to *Query.qll convention
2021-08-12 09:30:18 +02:00
CWE-730
patch upper-case acronyms to be PascalCase
2022-03-11 11:10:33 +01:00
CWE-754
modified query and added tests
2022-02-02 19:39:08 +05:30
CWE-770
JS: Rename getAUseSite -> getRouteInstallation
2021-12-15 16:21:41 +01:00
CWE-776
JS: Migrate to *Query.qll convention
2021-08-12 09:30:18 +02:00
CWE-798
ignore deliberately hardcoded password strings
2022-02-16 09:47:01 +01:00
CWE-807
JS: Migrate to *Query.qll convention
2021-08-12 09:30:18 +02:00
CWE-829
JS: Migrate to *Query.qll convention
2021-08-12 09:30:18 +02:00
CWE-830
apply docreview feedback
2022-02-23 11:21:22 +01:00
CWE-834
JS: Update score and add CWE-730 to LoopBoundInjection
2021-10-05 10:10:01 +02:00
CWE-843
Apply suggestions from code review
2022-01-04 10:07:34 +00:00
CWE-862
update the empty-password-in-config-file qhelp
2022-01-24 13:39:54 +01:00
CWE-912
JS: Lower security-severity of queries with speculative threat model
2021-10-05 10:10:01 +02:00
CWE-915
support more property writes in js/prototype-pollution-utility, and generalize ObjectDefinePropertyAsPropWrite
2022-02-22 13:23:34 +01:00
CWE-916
JS: Migrate to *Query.qll convention
2021-08-12 09:30:18 +02:00
CWE-918
JS: Minor fixup in the client-side request forgery qhelp
2022-02-23 10:54:26 +01:00
CWE-1004
fix good/bad mixup in ClientExposedCookie qhelp
2022-01-24 15:34:30 +01:00
CWE-1275
apply documentation suggestions
2022-01-25 12:14:16 +01:00