Commits

Breadcrumbs

History for

onc70997f

User selector

All users

All time

Commit History

Commits on Jan 31, 2020

• JS: address review comments for js/unsafe-jquery-plugin

  esbena

  committed
  c70997f

  Copy full SHA for c70997f

• JS: change severity to warning

  esbena

  committed
  eaff78b

  Copy full SHA for eaff78b

• JS: add query "Unsafe jQuery plugin"

  esbena

  committed
  fef918a

  Copy full SHA for fef918a

Commits on Jan 28, 2020

• Apply suggestions from code review

  Show description for 701d998
  

  asgerf

  and

  erik-krogh

  authored
  701d998

  Copy full SHA for 701d998

• Update javascript/ql/src/Security/CWE-352/MissingCsrfMiddleware.ql

  Show description for 310dd05
  

  asgerf

  and

  erik-krogh

  authored
  310dd05

  Copy full SHA for 310dd05

Commits on Jan 24, 2020

• JS: Recognize req.user a cookie access

  asgerf

  committed
  b98db62

  Copy full SHA for b98db62

Commits on Jan 23, 2020

• JS: Ignore calls and csrf/captcha access

  asgerf

  committed
  a68bb9f

  Copy full SHA for a68bb9f

• JS: Add test and dont check predecessors

  asgerf

  committed
  b1ec3e1

  Copy full SHA for b1ec3e1

• JS: Sharpen missing CSRF middleware query

  asgerf

  committed
  406c6eb

  Copy full SHA for 406c6eb

Commits on Jan 16, 2020

• Update javascript/ql/src/Security/CWE-400/PrototypePollutionUtility.qhelp

  Show description for 7a1d068
  

  asgerf

  and

  mchammer01

  authored
  7a1d068

  Copy full SHA for 7a1d068

Commits on Jan 14, 2020

• JS: Add change note and fix cwe tags

  asgerf

  committed
  2245882

  Copy full SHA for 2245882

• JS: Address review comments

  asgerf

  committed
  d76859b

  Copy full SHA for d76859b

• JS: Add sanitizer for "in" exprs

  

  asger-semmle

  authored and

  asgerf

  committed
  9bd3c4a

  Copy full SHA for 9bd3c4a

• JS: Guard against more FPs

  

  asger-semmle

  authored and

  asgerf

  committed
  bd9405a

  Copy full SHA for bd9405a

• JS: More sanitizers

  

  asger-semmle

  authored and

  asgerf

  committed
  738123d

  Copy full SHA for 738123d

• JS: Support Reflect.ownKeys

  

  asger-semmle

  authored and

  asgerf

  committed
  f7543ae

  Copy full SHA for f7543ae

• JS: Support enumeration through Object.entries

  

  asger-semmle

  authored and

  asgerf

  committed
  8af2333

  Copy full SHA for 8af2333

• JS: Do not require flow from key -> rhs

  

  asger-semmle

  authored and

  asgerf

  committed
  ac2f0a8

  Copy full SHA for ac2f0a8

• JS: Add another test and more barriers

  

  asger-semmle

  authored and

  asgerf

  committed
  96bf9db

  Copy full SHA for 96bf9db

• JS: Fix FPs from Object.create(null)

  

  asger-semmle

  authored and

  asgerf

  committed
  bc78710

  Copy full SHA for bc78710

• JS: Add PrototypePollutionUtility query

  

  asger-semmle

  authored and

  asgerf

  committed
  654f145

  Copy full SHA for 654f145

Commits on Nov 27, 2019

• update description

  erik-krogh

  committed
  e27a699

  Copy full SHA for e27a699

Commits on Nov 26, 2019

• small changes based on review feedback

  erik-krogh

  committed
  b5a5798

  Copy full SHA for b5a5798

• Merge remote-tracking branch 'upstream/master' into exceptionXss

  erik-krogh

  committed
  f284b3a

  Copy full SHA for f284b3a

• change doc based on review feedback

  erik-krogh

  committed
  7ee12a3

  Copy full SHA for 7ee12a3

Commits on Nov 22, 2019

• cleanup module imports and update expected outputs

  erik-krogh

  committed
  f40d792

  Copy full SHA for f40d792

• JavaScript: Simplify `DoubleEscaping`.

  Show description for 1951461
  

  Max Schaefer

  committed
  1951461

  Copy full SHA for 1951461

• JavaScript: Whitelist more harmless incomplete escapes.

  

  Max Schaefer

  committed
  ff002a7

  Copy full SHA for ff002a7

• JavaScript: Rephrase two predicates to help the optimiser.

  

  Max Schaefer

  committed
  659cc81

  Copy full SHA for 659cc81

• JavaScript: Introduce modelling of `String.prototype.replace` and use it in two queries.

  

  Max Schaefer

  committed
  db3eaa2

  Copy full SHA for db3eaa2

• JavaScript: Move `getAMatchedConstant(RegExpTerm)` into the library.

  

  Max Schaefer

  committed
  12ea81a

  Copy full SHA for 12ea81a

• JavaScript: Move `getStringValue(RegExpLiteral)` into the library.

  

  Max Schaefer

  committed
  a5a5deb

  Copy full SHA for a5a5deb

• JavaScript: Deal with escape-unescape-escape (and similar) chains.

  

  Max Schaefer

  committed
  0edb70f

  Copy full SHA for 0edb70f

• JavaScript: Deal with (un-)escaping on captured variables.

  

  Max Schaefer

  committed
  cb54618

  Copy full SHA for cb54618

• JavaScript: Fix regexes for escaping schemes.

  

  Max Schaefer

  committed
  61aa075

  Copy full SHA for 61aa075