Commits

Breadcrumbs

History for

on64f00fd

User selector

All users

All time

Commit History

Commits on Jun 2, 2025

• Update javascript/ql/src/Quality/UnhandledStreamPipe.ql

  Show description for 64f00fd
  

  Napalys

  and

  asgerf

  committed
  64f00fd

  Copy full SHA for 64f00fd

• Update javascript/ql/src/Quality/UnhandledStreamPipe.ql

  Show description for 3cbc414
  

  Napalys

  and

  asgerf

  authored
  3cbc414

  Copy full SHA for 3cbc414

• Now able to track error handler registration via instance properties

  Napalys

  committed
  298ef9a

  Copy full SHA for 298ef9a

Commits on May 30, 2025

• Fix false positives in stream pipe analysis by improving error handler tracking via property access.

  Napalys

  committed
  f843cc0

  Copy full SHA for f843cc0

Commits on May 28, 2025

• Fixed ql warning `Expression can be replaced with a cast`

  Napalys

  committed
  d3b2a57

  Copy full SHA for d3b2a57

• Make predicates private and clarify stream reference naming.

  Napalys

  committed
  2e2b9a9

  Copy full SHA for 2e2b9a9

• Exclude `.pipe` detection which are in a test file.

  Napalys

  committed
  f8f5d8f

  Copy full SHA for f8f5d8f

• Now flags only `.pipe` calls which have an error somewhere down the stream, but not on the source stream.

  Napalys

  committed
  5bb29b6

  Copy full SHA for 5bb29b6

Commits on May 27, 2025

• Excluded `ngrx`, `datorama`, `angular`, `react` and `langchain` from stream pipe query.

  Napalys

  committed
  5214cc0

  Copy full SHA for 5214cc0

Commits on May 26, 2025

• Added `maintainability` and `error-handling` tags

  Napalys

  committed
  e964b17

  Copy full SHA for e964b17

Commits on May 23, 2025

• Replaced fuzzy `NonNodeStream` MaD to a ql predicate to deal easier with submodules

  Napalys

  committed
  000e69f

  Copy full SHA for 000e69f

• Added `qhelp` for `UnhandledStreamPipe` query

  Napalys

  committed
  248f83c

  Copy full SHA for 248f83c

• Add exceptions for `arktype`, `execa`, and `highland` to prevent them from being flagged by unhandled pipe error query

  Napalys

  committed
  c6db32e

  Copy full SHA for c6db32e

• Added more test cases which common `js` libraries uses `.pipe()`

  Napalys

  committed
  15ff7cb

  Copy full SHA for 15ff7cb

Commits on May 22, 2025

• Fixed false positives from `strapi` and `rxjs/testing` as well as when one passes function as second arg to `pipe`

  Napalys

  committed
  b10a948

  Copy full SHA for b10a948

• Added test cases where second parameter passed to `pipe` is a function and some popular library ones

  Napalys

  committed
  e6ae8bb

  Copy full SHA for e6ae8bb

• Add predicate to detect non-stream-like usage in sources of pipe calls

  Napalys

  committed
  ac24fdd

  Copy full SHA for ac24fdd

• Added detection of custom `gulp-plumber` sanitizer, thus one would not flag such instances.

  Napalys

  committed
  5b1af0c

  Copy full SHA for 5b1af0c

• Added `UnhandledStreamPipe` to `javascript-security-and-quality.qls` and `javascript-code-quality.qls`

  Napalys

  committed
  b104871

  Copy full SHA for b104871

• Fixed issue where `pipe` calls from `rxjs` package would been identified as `pipe` calls on streams

  Napalys

  committed
  09220fc

  Copy full SHA for 09220fc

• Enhance PipeCall to exclude non-function and non-object arguments in pipe method detection

  Napalys

  committed
  d7f86db

  Copy full SHA for d7f86db

• Eliminate false positives by detecting non-stream objects returned from `pipe()` calls based on accessed properties

  Napalys

  committed
  4332de4

  Copy full SHA for 4332de4

• Add test cases for non-stream field accesses and methods before and after pipe operations

  Napalys

  committed
  5710f0c

  Copy full SHA for 5710f0c

Commits on May 21, 2025

• Restrict pipe detection to calls with 1-2 arguments

  Napalys

  committed
  03d1f9a

  Copy full SHA for 03d1f9a

• Fixed issue where a custom `pipe` method which returns non stream would be flagged by the query

  Napalys

  committed
  30f2815

  Copy full SHA for 30f2815

• Fixed issue where streams would not be tracked via chainable methods

  Napalys

  committed
  ef1bde5

  Copy full SHA for ef1bde5

• test: Add edge cases for stream pipe error handling

  Show description for f39bf62
  Napalys

  committed
  f39bf62

  Copy full SHA for f39bf62

• Add `UnhandledStreamPipee` Quality query and tests to detect missing error handlers in `Node.js` streams

  Napalys

  committed
  c27157f

  Copy full SHA for c27157f

Commits on May 2, 2025

• Merge pull request #19422 from Napalys/js/shelljs

  Show description for d1e769b
  Napalys

  authored
  d1e769b

  Copy full SHA for d1e769b

• Update javascript/ql/lib/semmle/javascript/frameworks/ShellJS.qll

  Show description for 871e93d
  

  Napalys

  and

  asgerf

  authored
  871e93d

  Copy full SHA for 871e93d

• Merge pull request #19413 from tamasvajk/quality/query-suite-selector

  Show description for cb1c373
  tamasvajk

  authored
  cb1c373

  Copy full SHA for cb1c373

Commits on May 1, 2025

• Merge pull request #19429 from owen-mc/fix-cwe-tags-missing-leading-zero

  Show description for e054948
  owen-mc

  authored
  e054948

  Copy full SHA for e054948

• Add change notes

  owen-mc

  committed
  0863c87

  Copy full SHA for 0863c87

• Address comments

  Napalys

  committed
  68a9dd9

  Copy full SHA for 68a9dd9

• Refactor process.env handling in CleartextLogging and IndirectCommandInjection modules to use ThreatModelSource

  Napalys

  committed
  d4b5ef6

  Copy full SHA for d4b5ef6