github
/
codeql
зеркало из https://github.com/github/codeql.git
1
0
Форкнуть 0
Код Задачи Пакеты Проекты Релизы Вики Активность
12 906 коммитов 1 534 Ветки 130 Теги 471 MiB
Граф коммитов

3634 Коммитов

Автор SHA1 Сообщение Дата
Erik Krogh Kristensen 7af19559d4 add test case for location.split("?")[0] for DomBasedXss 2020-05-05 09:13:21 +02:00
Erik Krogh Kristensen 4dcf944ccd use StringSplitCall in TaintedPath 2020-05-05 09:13:21 +02:00
Erik Krogh Kristensen 22ec12b130 use split("?")[0] sanitizer is both DomBasedXSS and ClientSideUrlRedirect 2020-05-05 09:13:21 +02:00
Erik Krogh Kristensen 89f45372d1 introduce StringSplitCall and use it 2020-05-05 09:13:15 +02:00
John Doe 337be9c2e0 ssti query and help updated 2020-05-05 03:58:29 +03:00
John Doe 09922e5bb4 Merge branch 'master' of github.com:monkey-junkie/codeql 2020-05-05 03:44:23 +03:00
John Doe 895aa622bf ssti updated 2020-05-05 03:37:43 +03:00
monkey-junkie cd18842aa5
Update javascript/ql/src/experimental/Security/CWE-94/ServerSideTemplateInjection.qhelp 
Co-authored-by: Erik Krogh Kristensen <erik-krogh@github.com>
 2020-05-05 02:15:58 +03:00
monkey-junkie a60660617f
Update javascript/ql/src/experimental/Security/CWE-94/ServerSideTemplateInjection.qhelp 
Co-authored-by: Erik Krogh Kristensen <erik-krogh@github.com>
 2020-05-05 02:15:00 +03:00
Erik Krogh Kristensen eb7e0d6a62 still flag single-expression files that contain a function 2020-05-04 18:37:26 +02:00
semmle-qlci a805a63443
Merge pull request #3357 from erik-krogh/YetAnotherPerformancePatch 
Approved by asgerf, esbena
 2020-05-04 10:05:34 +01:00
semmle-qlci a0800cecc4
Merge pull request #3386 from erik-krogh/lessJQueryChaining 
Approved by asgerf
 2020-05-04 09:16:17 +01:00
Erik Krogh Kristensen 659d40e08d add test to make sure sanitizer is not too broad 2020-05-04 09:49:14 +02:00
Erik Krogh Kristensen c56063f857 recognize more split("?") sanitizers 2020-05-04 09:48:50 +02:00
Erik Krogh Kristensen 291134be66 add failing test 2020-05-04 09:48:29 +02:00
Erik Krogh Kristensen cee986fa76 skip expressions that are alone in a file for js/useless-expression 2020-05-04 09:08:41 +02:00
John Doe 68b57502f9 JS SSTI CWE-094 2020-05-03 02:42:45 +03:00
semmle-qlci c66ec3c981
Merge pull request #3380 from asger-semmle/js/cache-amd 
Approved by erik-krogh
 2020-05-02 20:18:22 +01:00
Erik Krogh Kristensen efbd74a4a4 remove more spurious jQuery objects by using externs 2020-05-01 18:54:32 +02:00
Erik Krogh Kristensen 2a1095abcc autoformat, and apply naming suggestion 2020-05-01 18:35:34 +02:00
Erik Krogh Kristensen 87365357ba remove spurious jQuery objects 2020-05-01 15:19:54 +02:00
Erik Krogh Kristensen 16823143dd refactor getAPropertyUsedInLoadStore 2020-05-01 09:58:11 +02:00
Erik Krogh Kristensen 1a42c9fd80
make predicates private 
Co-authored-by: Asger F <asgerf@github.com>
 2020-05-01 09:42:09 +02:00
semmle-qlci 2b055de4d6
Merge pull request #3154 from erik-krogh/ImplicitConv 
Approved by asgerf
 2020-04-29 16:05:19 +01:00
Erik Krogh Kristensen 2ef13ef6e8 cousing -> sibling 2020-04-29 14:30:03 +02:00
Erik Krogh Kristensen 8af08756b9 split store-steps into backwards and forwards, and prune even more. 2020-04-29 09:16:22 +02:00
Erik Krogh Kristensen 7aa421fd8a prune clearly infeasible store steps 2020-04-29 09:15:32 +02:00
Erik Krogh Kristensen 8cf71e59ce prune infeasible load steps 2020-04-29 09:13:49 +02:00
Erik Krogh Kristensen 435b5cf42d refactor how exploratoryFlowStep is used 2020-04-29 09:11:26 +02:00
Asger Feldthaus 9b014c36df JS: Avoid lots of unhelpful magic 2020-04-28 08:56:27 +01:00
Asger Feldthaus a8283593a9 JS: Make PropWrite not depend on SourceNode 2020-04-28 08:56:27 +01:00
Asger Feldthaus e3440c1410 JS: Cache AMD modules 2020-04-28 08:56:27 +01:00
Asger Feldthaus aa2a49d189 JS: Rewrite mayHaveStringValue to avoid misoptimization 2020-04-28 08:56:27 +01:00
Esben Sparre Andreasen 04b5a794f1
Merge pull request #3313 from esbena/js/typical-bad-sanitizer 
New query: Incomplete HTML attribute sanitization
 2020-04-27 14:31:13 +02:00
Esben Sparre Andreasen c0250894de
Apply suggestions from code review 
Co-Authored-By: mc <42146119+mchammer01@users.noreply.github.com>
 2020-04-27 12:37:39 +02:00
Erik Krogh Kristensen 1ad64bc619 introduce PropRef#mayHavePropertyName 2020-04-27 11:47:51 +02:00
Esben Sparre Andreasen 0a8e371b0e
Update javascript/ql/src/Security/CWE-116/IncompleteHtmlAttributeSanitization.qhelp 
Co-Authored-By: Asger F <asgerf@github.com>
 2020-04-27 09:09:26 +02:00
semmle-qlci cbe417f5eb
Merge pull request #3336 from erik-krogh/MoarJQuery 
Approved by esbena
 2020-04-25 15:17:55 +01:00
Esben Sparre Andreasen 58b5bd5cfd JS: fixup documentation 2020-04-24 10:56:53 +02:00
semmle-qlci 28cfe548d5
Merge pull request #3325 from erik-krogh/MoreEventClasses 
Approved by asgerf
 2020-04-24 09:02:27 +01:00
semmle-qlci 671e7c6637
Merge pull request #3335 from asger-semmle/js/cached-chained-methods 
Approved by esbena
 2020-04-24 08:28:05 +01:00
Esben Sparre Andreasen 6d6ec89ba8 JS: add qhelp 2020-04-24 09:18:09 +02:00
Esben Sparre Andreasen 708fd3d73f JS: add query to query suite 2020-04-24 09:17:46 +02:00
Esben Sparre Andreasen 89613dbd23 JS: add query for incomplete HTML attribute sanitization 2020-04-24 09:17:46 +02:00
Jonas Jensen d98e956c2b
Merge pull request #3322 from felicitymay/merge-124-master 
Merge rc/1.24 into master
 2020-04-24 08:48:54 +02:00
Erik Krogh Kristensen 19c6092998 autoformat 2020-04-23 20:59:34 +02:00
Erik Krogh Kristensen ea1628ef54
fix typo in jQuery.qll 
Co-Authored-By: Esben Sparre Andreasen <esbena@github.com>
 2020-04-23 20:58:49 +02:00
Erik Krogh Kristensen a71567da54 autoformat 2020-04-23 18:58:33 +02:00
Erik Krogh Kristensen ee43db1b58 slightly expand the $().each model 2020-04-23 16:49:47 +02:00
Erik Krogh Kristensen 448ed150df allow the empty string to flow to a JQuery XSS sink 2020-04-23 16:45:37 +02:00
Erik Krogh Kristensen 96896fd7f5 second round of UnsafeJQueryPlugin reuse 2020-04-23 15:12:32 +02:00
Erik Krogh Kristensen ea569dba78
update doc for JQuery plugin predicate 
Co-Authored-By: Esben Sparre Andreasen <esbena@github.com>
 2020-04-23 15:03:39 +02:00
Asger Feldthaus cafdcfa4de JS: Preserve reflective calls in getAMethodCall 2020-04-23 13:57:14 +01:00
Erik Krogh Kristensen 1954a60b6e reuse existing predicate from UnsafeJqueryPlugin 2020-04-23 14:25:34 +02:00
Erik Krogh Kristensen 09b6727e6d refactor $.each model 2020-04-23 14:24:56 +02:00
Erik Krogh Kristensen ce106981b3 add tests 2020-04-23 14:24:33 +02:00
Erik Krogh Kristensen e7d8cd8e8c Merge remote-tracking branch 'upstream/master' into MoarJQuery 2020-04-23 14:10:53 +02:00
semmle-qlci 36b28386f8
Merge pull request #3332 from erik-krogh/JGrowl 
Approved by esbena
 2020-04-23 13:06:00 +01:00
Erik Krogh Kristensen 6897dda614 model that `this` in $().each(callback) is a DOM-node 2020-04-23 13:51:17 +02:00
Erik Krogh Kristensen 8de86967aa model that `this` in a jQuery plugin is a jQuery object 2020-04-23 13:48:54 +02:00
semmle-qlci 801ce89c67
Merge pull request #3099 from esbena/js/introduce-poi-utility 
Approved by erik-krogh
 2020-04-23 12:14:00 +01:00
Erik Krogh Kristensen d8c498bd15
add NOT OK comment 
Co-Authored-By: Esben Sparre Andreasen <esbena@github.com>
 2020-04-23 12:17:25 +02:00
Erik Krogh Kristensen e1423b0fa5 add test for jGrowl 2020-04-23 11:58:06 +02:00
Erik Krogh Kristensen 90652eeb25 add $.jGrowl as an XSS sink 2020-04-23 10:44:41 +02:00
semmle-qlci da3292606c
Merge pull request #3191 from erik-krogh/XssDom 
Approved by esbena, mchammer01
 2020-04-23 09:17:07 +01:00
Esben Sparre Andreasen a66b4b55fe
Update javascript/ql/src/experimental/poi/PoI.qll 
Co-Authored-By: Erik Krogh Kristensen <erik-krogh@github.com>
 2020-04-23 09:47:21 +02:00
Esben Sparre Andreasen 161c05dced
Apply suggestions from code review 
Co-Authored-By: Erik Krogh Kristensen <erik-krogh@github.com>
 2020-04-23 08:41:54 +02:00
Erik Krogh Kristensen 6ada588dd1 add support for util.inherits 2020-04-22 22:55:12 +02:00
Erik Krogh Kristensen 957e4073b0 use getABoundCallbackParameter in SocketIO 2020-04-22 21:56:34 +02:00
Erik Krogh Kristensen 40822e10b4 add SocketIO test case 2020-04-22 21:55:20 +02:00
Felicity Chapman 89bf35cd43 Merge branch 'rc/1.24' into merge-124-master 
Conflicts:
	change-notes/1.24/analysis-javascript.md
    Resolved in favor of the rc/1.24 branch
 2020-04-22 19:01:47 +01:00
Esben Sparre Andreasen a0e6562208 JS: address review feedback 2020-04-22 14:24:35 +02:00
Esben Sparre Andreasen 2747e2a0c7 JS: formatting 2020-04-22 14:24:35 +02:00
Esben Sparre Andreasen 2186ca7efc JS: address non-semantic review feedback 2020-04-22 14:24:35 +02:00
Esben Sparre Andreasen 27e5fce0ed JS: make the default `PoIConfiguration/enabled` inclusive 2020-04-22 14:24:34 +02:00
Esben Sparre Andreasen 3b45bcd285 JS: remove the standard PoI configurations 2020-04-22 14:24:34 +02:00
Esben Sparre Andreasen dd6378f1d0 JS: address PoI review comments 2020-04-22 14:24:34 +02:00
Esben Sparre Andreasen b2ca3d2bdc JS: improve PoI::alertQuery docstring 2020-04-22 14:24:34 +02:00
Esben Sparre Andreasen a386d2dcee JS: add missing expected output 2020-04-22 14:24:34 +02:00
Esben Sparre Andreasen 607d46e2f9 JS: improve PoI tests 2020-04-22 14:24:34 +02:00
Esben Sparre Andreasen c407cc072e JS: autoformat 2020-04-22 14:24:34 +02:00
Esben Sparre Andreasen e4ea089a0b JS: add experimental PoI module 2020-04-22 14:24:34 +02:00
Esben Sparre Andreasen ec73c97422 JS: refactor ClassifyFiles.qll from ClassifyFiles.ql 2020-04-22 14:24:34 +02:00
Erik Krogh Kristensen ac26741816 reuse existing SanitizerGuard from UnsafeJQueryPlugin 2020-04-22 14:16:15 +02:00
Erik Krogh Kristensen 0a29d132d0 reuse existing logic in DomBasedXss 2020-04-22 13:50:43 +02:00
Erik Krogh Kristensen ac44cb425e
Merge branch 'master' into js/call-graph-exploration 2020-04-22 10:49:26 +02:00
Erik Krogh Kristensen 7bfea946fd update links in xss-through-dom qhelp 2020-04-22 10:23:03 +02:00
Erik Krogh Kristensen 8811455d49 Merge remote-tracking branch 'upstream/master' into XssDom 2020-04-22 10:20:40 +02:00
Erik Krogh Kristensen 76503d3536 user controlled -> user-controlled 2020-04-22 10:08:01 +02:00
Erik Krogh Kristensen 947e9828da
Update javascript/ql/src/Security/CWE-079/XssThroughDom.qhelp 
Co-Authored-By: mc <42146119+mchammer01@users.noreply.github.com>
 2020-04-22 10:07:50 +02:00
semmle-qlci 9fae953969
Merge pull request #3262 from asger-semmle/js/api-deprecation-and-renaming 
Approved by erik-krogh
 2020-04-21 15:45:13 +01:00
semmle-qlci 2fb711e460
Merge pull request #3169 from erik-krogh/Maps 
Approved by asgerf, esbena
 2020-04-21 12:12:06 +01:00
Erik Krogh Kristensen 59b94b3d1b revert back to having 2 separate cases in JQuery::MethodCall 2020-04-21 13:08:06 +02:00
Asger Feldthaus c04ba91a90 JS: Autoformat 2020-04-21 10:51:42 +01:00
Asger Feldthaus 39920c1b08 JS: Add forwarding libraries in old locations 2020-04-21 10:51:42 +01:00
Asger Feldthaus 9e4709148b JS: Move Forward/Backward exploration to explore folder 2020-04-21 10:51:41 +01:00
Asger Feldthaus 647a3d3a60 JS: Add note and debugging and exploration 2020-04-21 10:51:41 +01:00
Asger Feldthaus ffeda7f45a JS: Expand on doc a bit 2020-04-21 10:51:41 +01:00
Asger Feldthaus 066549f682 JS: Fix typo in qldoc 2020-04-21 10:51:41 +01:00
Asger F 291ebccfef Update javascript/ql/src/semmle/javascript/explore/CallGraph.qll 
Co-Authored-By: Max Schaefer <54907921+max-schaefer@users.noreply.github.com>
 2020-04-21 10:51:41 +01:00
Asger F 4c9ef8c570 Update javascript/ql/src/semmle/javascript/explore/CallGraph.qll 
Co-Authored-By: Max Schaefer <54907921+max-schaefer@users.noreply.github.com>
 2020-04-21 10:51:41 +01:00
Asger Feldthaus 759e1dfe45 JS: Add helper library for call graph exploration 2020-04-21 10:51:40 +01:00
semmle-qlci 53abf83229
Merge pull request #3304 from asger-semmle/js/typescript-unary-type-expr 
Approved by erik-krogh
 2020-04-21 10:38:59 +01:00
Asger Feldthaus 1703ffe6a1 JS: Cache some SourceNode getter methods differently 2020-04-21 10:33:07 +01:00
Asger Feldthaus 997b44928e JS: Autoformat 2020-04-21 10:14:28 +01:00
semmle-qlci 2ecef33c9d
Merge pull request #3299 from asger-semmle/js/flows-to-redundant-check 
Approved by esbena
 2020-04-21 10:00:34 +01:00
semmle-qlci 80c20cb66e
Merge pull request #3297 from asger-semmle/js/isambient-refactor 
Approved by esbena
 2020-04-21 09:36:14 +01:00
Asger Feldthaus 883846dfb6 JS: Fix extraction of negative number literal types 2020-04-20 16:17:15 +01:00
Asger Feldthaus 4fc79e38ec JS: Also fix typo in test case 2020-04-20 15:24:51 +01:00
Asger Feldthaus d4978905f8 JS: Use SendCallback/ReceiveCallback in getAck 2020-04-20 15:12:04 +01:00
Asger Feldthaus ca60e8264e JS: Autoformat 2020-04-20 14:42:41 +01:00
Erik Krogh Kristensen 9fc29ee0f8 update qhelp 2020-04-20 13:29:00 +02:00
Erik Krogh Kristensen 73b0aa4004 add more attributes potentially vulnerable to xss-through-dom 2020-04-20 13:29:00 +02:00
Erik Krogh Kristensen 12f4ce8111 merge two cases of jQuery method calls 2020-04-20 13:28:55 +02:00
Erik Krogh Kristensen 8b254f7b49 Merge remote-tracking branch 'upstream/master' into Maps 2020-04-20 13:00:39 +02:00
Asger Feldthaus bccc27f1e7 JS: Rephrase flowsTo to avoid redundant SourceNode::Range check 2020-04-20 10:57:52 +01:00
Erik Krogh Kristensen 2d3e42e6d6
update qhelp for xss-through-dom 
Co-Authored-By: Asger F <asgerf@github.com>
 2020-04-20 11:50:46 +02:00
Erik Krogh Kristensen c713ba7bfe fix typo 2020-04-20 10:51:42 +02:00
Asger Feldthaus bb9fea5a27 JS: Refactor isAmbient computation 2020-04-19 22:45:19 +01:00
Erik Krogh Kristensen 2632699397 Merge branch 'master' of git.semmle.com:Semmle/ql into Mispelled 2020-04-18 17:58:57 +02:00
Erik Krogh Kristensen 4a93b91d59 make maybePromisified private 2020-04-17 11:47:03 +02:00
Erik Krogh Kristensen 4f32157a78
rename `func` to `callback` 
Co-Authored-By: Esben Sparre Andreasen <esbena@github.com>
 2020-04-17 11:36:48 +02:00
Erik Krogh Kristensen 427c32f211 report a local variable as the misspelling if there any many occourances of the global 2020-04-17 11:25:23 +02:00
Erik Krogh Kristensen 1b80f46f30 add QHelp for js/xss-through-dom query 2020-04-17 10:54:21 +02:00
Erik Krogh Kristensen 14b551f887 Xss through DOM 2020-04-17 10:54:14 +02:00
Erik Krogh Kristensen 55edfed1ee support jQuery().get() returning a DOM node 2020-04-17 10:32:53 +02:00
Erik Krogh Kristensen dd9aec056c handle basic dynamic method dispatch for jQuery methods 2020-04-17 10:32:52 +02:00
Erik Krogh Kristensen eca98b42d2 basic support for util.promisify for NodeJSFileSystemAccess 2020-04-17 09:54:37 +02:00
Erik Krogh Kristensen ea0f6a367d refactor into maybePromisified predicate 2020-04-17 09:50:08 +02:00
Erik Krogh Kristensen 69a16af152 Merge branch 'master' into Maps 2020-04-15 20:41:22 +02:00
Erik Krogh Kristensen fd51142200 change succ in storeStep to be a `SourceNode` 2020-04-15 20:40:58 +02:00
Erik Krogh Kristensen e8dc77d508 add support for util.promisify with child_process calls 2020-04-15 19:16:30 +02:00
semmle-qlci bfd80b42a7
Merge pull request #3260 from asger-semmle/js/location-tweaks 
Approved by erik-krogh
 2020-04-15 10:47:35 +01:00
Asger F 34d40b5035
Merge pull request #3237 from asger-semmle/js/sparse-capture 
JS: Add CapturedVariableNode to avoid N^2 edges
 2020-04-15 10:42:48 +01:00
Asger Feldthaus 679259944f JS: Address review comments 2020-04-15 10:27:32 +01:00
Chris Gavin 4e981d8e70
Merge rc/1.24 into master. 2020-04-14 21:30:29 +01:00
Asger Feldthaus 1107e7c6a6 JS: Rename other uses of getURL 2020-04-14 19:45:09 +01:00
Asger Feldthaus 6668a7a546 JS: Add backwards-compatible predicates to SocketIO 2020-04-14 15:57:19 +01:00
Asger F c178eecd43
Update javascript/ql/src/semmle/javascript/Variables.qll 
Co-Authored-By: Erik Krogh Kristensen <erik-krogh@github.com>
 2020-04-14 14:40:21 +01:00
Felicity Chapman c570ebe5bd Merge branch 'rc/1.24' into update-references 2020-04-14 14:10:26 +01:00
Asger Feldthaus 3515a2b412 JS: Update test output 2020-04-14 10:31:31 +01:00
Asger Feldthaus 88667206fc JS: Remove default hasLocationInfo case 2020-04-14 10:03:10 +01:00
Asger Feldthaus 5da968e34c JS: Specialize ASTNode.getFile 2020-04-14 10:03:10 +01:00
Asger Feldthaus 244a304e1d JS: Implement getFile() directly instead of via locations 2020-04-14 10:03:10 +01:00
Asger Feldthaus dc084628cc JS: Avoid the special name getURL 2020-04-14 10:03:09 +01:00
Erik Krogh Kristensen 6827b84bdc change docstring to inline comment, and refer directly to array class 2020-04-14 10:32:16 +02:00
Erik Krogh Kristensen e47575ce5b more precise getChild for matching "../" 2020-04-14 10:24:08 +02:00
Pavel Avgustinov 6737e99d65
Merge pull request #3209 from hmakholm/baselib-extractor 
Add extractor field in base language QL packs
 2020-04-09 15:24:49 +01:00
Asger Feldthaus c070416fbe JS: Update test output 2020-04-09 12:24:11 +01:00
Asger Feldthaus 25d5cc78cb JS: Use entry location instead of whole container 2020-04-09 09:18:26 +01:00
Asger Feldthaus d9f81b082b JS: Autoformat 2020-04-09 07:45:00 +01:00
Asger Feldthaus 47934310ef JS: Hide captured nodes in path explanations 2020-04-08 19:58:36 +01:00
semmle-qlci 404f7225a1
Merge pull request #3196 from asger-semmle/js/unnecessary-source-node-range 
Approved by esbena
 2020-04-08 18:44:02 +01:00
Asger Feldthaus 5ab595da2e JS: Autoformat 2020-04-08 12:40:00 +01:00
Felicity Chapman dacbc1376c Update some out of date information 2020-04-08 10:36:04 +01:00
Asger Feldthaus 4ca3ac5ee9 JS: Add another warning 2020-04-08 10:30:45 +01:00
Asger F 4acb9da2cf
Update javascript/ql/src/semmle/javascript/frameworks/LazyCache.qll 
Co-Authored-By: Esben Sparre Andreasen <esbena@github.com>
 2020-04-08 10:30:21 +01:00
Asger Feldthaus 171b131eb1 JS: Add test for SourceNode not depending on flowsTo 2020-04-08 10:23:47 +01:00
Asger Feldthaus 1f496d3c6b JS: Add CapturedVariableNode 2020-04-07 19:02:46 +01:00
Henning Makholm d1ff3211ef Add extractor fields to test qlpack.yml files. 2020-04-06 19:21:41 +02:00
Henning Makholm bf579dedd4 Add extractor field in base language QL packs 2020-04-06 18:48:01 +02:00
Asger Feldthaus 7da0345c6a JS: Autoformat 2020-04-06 12:30:04 +01:00
Asger Feldthaus 2c6beadf68 JS: Recognize more forms of scheme checks 2020-04-06 12:30:03 +01:00
Robert 1096e5d947
Merge pull request #3163 from robertbrignull/code_scanning_suites 
Add code-scanning suites
 2020-04-06 08:45:40 +01:00
semmle-qlci a8098a2b2d
Merge pull request #3197 from erik-krogh/NormalPathSanitizer 
Approved by asgerf
 2020-04-03 16:33:18 +01:00
Erik Krogh Kristensen 9c2053168b writing out the truth table for DotDotSlashPrefixRemovingReplace 2020-04-03 15:46:47 +02:00
semmle-qlci 676da02118
Merge pull request #3192 from asger-semmle/js/missing-await-not-delete 
Approved by esbena
 2020-04-03 13:21:48 +01:00
Erik Krogh Kristensen 94751c1b31 dst can be relative for "../" replace call 2020-04-03 11:08:31 +02:00
semmle-qlci dc774e0eac
Merge pull request #3166 from erik-krogh/DeadLocal 
Approved by asgerf
 2020-04-03 09:36:20 +01:00
Erik Krogh Kristensen e46cde17a1 add a "../" removing taint-step for js/path-injection 2020-04-03 09:42:05 +02:00
Asger Feldthaus ffbbdd7779 JS: Autoformat 2020-04-02 23:04:24 +01:00
Asger Feldthaus 93971e9433 JS: Make local flow not depend on SourceNode 2020-04-02 23:03:29 +01:00
Asger Feldthaus 346867f425 JS: Remove Import->SourceNode dependency from AMD 2020-04-02 23:03:29 +01:00
Asger Feldthaus 3804d3fcfd JS: Remove Import->SourceNode dependency from lazy cache 2020-04-02 23:03:20 +01:00
Erik Krogh Kristensen 845020d2ae change getReceiver to getAMethodCall 2020-04-02 20:28:27 +02:00
Erik Krogh Kristensen 2c0bae4937
Apply suggestions from code review 
Co-Authored-By: Esben Sparre Andreasen <esbena@github.com>
 2020-04-02 20:28:04 +02:00
Asger Feldthaus 8f930fc3e6 JS: Remove recursive SourceNode from AngularJS 2020-04-02 12:25:33 +01:00
Asger Feldthaus ee106b1103 JS: Remove tautological SourceNode::Range subclasses 2020-04-02 12:21:17 +01:00
Asger Feldthaus 3a9d047cf5 JS: Ignore delete expressions in js/missing-await 2020-04-02 11:35:09 +01:00
Asger Feldthaus ccce0205b4 JS: Add test 2020-04-02 11:34:07 +01:00
Erik Krogh Kristensen 75b183bc33 update expected output 2020-04-01 20:46:49 +02:00
Erik Krogh Kristensen 32b86ab91a autoformat 2020-04-01 20:44:47 +02:00
Erik Krogh Kristensen 957b60f84b split fuzzy read/writes on collections into 2 pseudo-properties 2020-04-01 14:25:41 +02:00
Erik Krogh Kristensen b1bf7f9f3d introduce pseudoProperty helper predicates 2020-04-01 14:08:56 +02:00
Asger Feldthaus 541ff40d24 JS: Bump extractor version string 2020-04-01 12:26:30 +01:00
Asger Feldthaus b5e110e39e JS: Fix value of numeric literals containing underscores 2020-04-01 12:24:42 +01:00
Asger Feldthaus 9888f15a29 JS: Add test showing root cause of problem 2020-04-01 12:21:27 +01:00
Asger Feldthaus 2d864aaf1b JS: Add failing test 2020-04-01 12:21:25 +01:00
Erik Krogh Kristensen 59840149e8 introduce a PseudoProperty type in Collections.qll 2020-04-01 12:16:09 +02:00
Erik Krogh Kristensen b2b009cdd9 qldoc adjustment 2020-04-01 11:34:25 +02:00
Erik Krogh Kristensen 1be326a37b add a CopyStep type-tracking step, for loadStoreSteps that loads and stores the same property 2020-04-01 11:21:05 +02:00
Erik Krogh Kristensen 9fc8ed17cd remove unused import 2020-04-01 11:18:11 +02:00
Erik Krogh Kristensen a188c6f804 qldoc changes and renaming 2020-04-01 11:12:54 +02:00
Erik Krogh Kristensen 49a8a48a72 autoformat 2020-03-31 20:27:05 +02:00
Erik Krogh Kristensen cec2cd3b14 update expected output 2020-03-31 14:05:05 +02:00
Erik Krogh Kristensen 64c813612f autoformat 2020-03-31 13:56:01 +02:00
Erik Krogh Kristensen 8ae55fb1c4 add top level QLDoc to MapAndSet.qll 2020-03-31 13:55:34 +02:00
Erik Krogh Kristensen 45797dc729 autoformat 2020-03-31 13:53:00 +02:00
Erik Krogh Kristensen 3784b180d8 changes based on review 2020-03-31 12:07:55 +02:00
Erik Krogh Kristensen 546431c83d dataflow and typetracking steps for Maps and Sets 2020-03-31 11:21:34 +02:00
Erik Krogh Kristensen 25aea900b6 add more dataflow steps for Arrays 2020-03-31 11:21:25 +02:00
Erik Krogh Kristensen a02213e745 change LoadStoreStep such that it can store in different property 2020-03-31 11:20:57 +02:00
semmle-qlci 0feb7f87e4
Merge pull request #2761 from erik-krogh/UrlSearch 
Approved by asgerf
 2020-03-31 09:46:48 +01:00
semmle-qlci 5c920eb625
Merge pull request #3120 from asger-semmle/js/prefer-typescript-file 
Approved by esbena
 2020-03-31 09:32:14 +01:00
semmle-qlci 73dd4c8686
Merge pull request #3133 from asger-semmle/js/dictionary-taint-step-regression 
Approved by esbena
 2020-03-31 09:28:55 +01:00
Erik Krogh Kristensen 40fd1825e9 autoformat 2020-03-31 09:08:32 +02:00
Erik Krogh Kristensen 7938bc4ed0 improve alert message for js/useless-assignment-to-local 2020-03-30 20:19:50 +02:00
semmle-qlci fce04f0bd0
Merge pull request #3127 from erik-krogh/PromiseTrack 
Approved by asgerf
 2020-03-30 11:56:33 +01:00
Asger Feldthaus a317b87b81 JS: Fix perf issue in DictionaryTaintStep 2020-03-30 11:23:47 +01:00
Erik Krogh Kristensen f55005a0ec more precise warning message for implicit string/number conversions 2020-03-30 11:17:56 +02:00
Robert Brignull 90fad6f762 add code scanning suites 2020-03-27 17:03:23 +00:00
Erik Krogh Kristensen 4864e77430 Merge branch 'master' of git.semmle.com:Semmle/ql into UrlSearch 2020-03-27 15:59:29 +01:00
Erik Krogh Kristensen 0ebbd80745 autoformat 2020-03-27 14:54:34 +01:00
semmle-qlci fad902fc9b
Merge pull request #3095 from erik-krogh/MorePerf 
Approved by asgerf
 2020-03-27 12:51:37 +00:00
semmle-qlci 9b3400337b
Merge pull request #3130 from erik-krogh/PreciseSteps 
Approved by asgerf
 2020-03-27 12:18:28 +00:00
semmle-qlci 1975a83cdd
Merge pull request #3116 from max-schaefer/js/postgres-type-tracking 
Approved by asgerf
 2020-03-27 09:23:52 +00:00
Erik Krogh Kristensen 58af63d8cc add test case for XSS on url suffix 2020-03-27 10:02:24 +01:00
Erik Krogh Kristensen d3e1a258fa autoformat 2020-03-27 09:34:56 +01:00
Erik Krogh Kristensen be11418c77 autoformat 2020-03-27 00:18:41 +01:00
Erik Krogh Kristensen 6b507c6933 add urlSuffix support to DomBasedXSS 2020-03-26 15:47:59 +01:00
Erik Krogh Kristensen a850616927 delete Xss.actual 2020-03-26 15:40:37 +01:00
Erik Krogh Kristensen e2d2c2341e autoformat and update expected output 2020-03-26 15:38:00 +01:00
Erik Krogh Kristensen baf50c832c more precise charpreds in taint steps 2020-03-26 15:30:43 +01:00
Asger Feldthaus 816968d102 JS: Rename test files to avoid clash 2020-03-26 11:59:57 +00:00
Erik Krogh Kristensen 1cefa12315 update expected output 2020-03-25 23:54:57 +01:00
Erik Krogh Kristensen 8f45c8fe83 use LoadStoreStep for type-tracking promises 2020-03-25 23:54:57 +01:00
Erik Krogh Kristensen 1a2983fe39 support small steps for promise tracking 2020-03-25 23:54:57 +01:00
Erik Krogh Kristensen 00181e059b add tests for type-tracking promises 2020-03-25 23:54:56 +01:00
Erik Krogh Kristensen 9a78d38df0 add a new LoadStoreStep as a StepSummary for TypeTracking 2020-03-25 23:54:56 +01:00
semmle-qlci e7fd97e72b
Merge pull request #3119 from erik-krogh/SockJS 
Approved by esbena
 2020-03-25 21:36:29 +00:00
Erik Krogh Kristensen 4b0bc6b2b3 autoformat 2020-03-25 19:47:41 +01:00
Asger Feldthaus ad1e0ec50b JS: Inline variable again 2020-03-25 14:01:33 +00:00
Asger Feldthaus 54021a1c30 JS: Update old entry point and add a test 2020-03-25 13:24:18 +00:00
Asger Feldthaus a78f1b864b JS: Fix trailing whitespace 2020-03-25 12:45:48 +00:00
Asger Feldthaus 6c9e35c22e JS: Skip .js files with a same-named .ts file next to it 2020-03-25 12:45:37 +00:00
semmle-qlci cf5b1f0cd5
Merge pull request #3019 from erik-krogh/ArrayStep 
Approved by asgerf
 2020-03-25 12:08:44 +00:00
Erik Krogh Kristensen abcdfe3c53 use LibraryName class for websocket library names 2020-03-25 13:06:21 +01:00
Erik Krogh Kristensen f2b9e2019c remove isRelevant from flowStep 2020-03-25 09:46:07 +01:00
Erik Krogh Kristensen 6f0e507242 outline predicate to fix join-ordering 2020-03-25 09:44:03 +01:00
Erik Krogh Kristensen 3000486b35 add more isRelevant calls 2020-03-25 09:42:24 +01:00
Erik Krogh Kristensen 1d8e103322 autoformat 2020-03-25 00:19:23 +01:00
Max Schaefer efbcec09ef JavaScript: Add type tracking to Postgres model. 2020-03-24 17:30:07 +00:00
Erik Krogh Kristensen 36981f385a Merge branch 'master' of git.semmle.com:Semmle/ql into MorePathSinks 2020-03-24 11:20:33 +01:00
semmle-qlci 4c9a6b73ee
Merge pull request #3107 from erik-krogh/FArgs 
Approved by esbena
 2020-03-24 08:32:56 +00:00
Erik Krogh Kristensen fa710c5864 Merge remote-tracking branch 'upstream/master' into UrlSearch 2020-03-24 00:23:15 +01:00
Erik Krogh Kristensen 5b4f091257 add test for remote flow sources in WebSockets 2020-03-23 23:58:20 +01:00
Erik Krogh Kristensen 6a1491d83d add SockJS to the existing WebSocket model 2020-03-23 23:56:11 +01:00
Erik Krogh Kristensen 9a18dc32c1 autoformat WebSocket tests 2020-03-23 23:49:26 +01:00
Erik Krogh Kristensen 7b7eddff1e remove previous SockJS implementation, and move example to WebSocket test 2020-03-23 23:45:05 +01:00
Asger F a1e032bee6
Merge pull request #3098 from kyprizel/master 
Experimental SockJS support
 2020-03-23 22:39:10 +00:00