Commits

Breadcrumbs

History for

on9a1c1f4

User selector

All users

All time

Commit History

Commits on Nov 28, 2024

• JS: Added in RegExpCreationNode maybeGlobal predicate for more convenience.

  Napalys

  committed
  9a1c1f4

  Copy full SHA for 9a1c1f4

• JS: now Reg Exp injection treats unknownFlags as sanitization, MetacharEscapeSanitizer

  Napalys

  committed
  1d2e08a

  Copy full SHA for 1d2e08a

• JS: add test cases RegExp with unknown flags

  Napalys

  committed
  62194f5

  Copy full SHA for 62194f5

• JS: now RegExp with unknown flags is not flagged as an issue within password Clear text storage of sensitive information

  Napalys

  committed
  e673348

  Copy full SHA for e673348

• JS: fixed issue where MaskingReplacer would work only with regexp literals but not objects

  Napalys

  committed
  a2c4674

  Copy full SHA for a2c4674

• JS: add test cases with RegExp object for MaskingReplacer, currently gives wrong results

  Napalys

  committed
  1ca57cf

  Copy full SHA for 1ca57cf

• JS: xss does not flag anymore replace with RegExp unknown flags

  Napalys

  committed
  c71778f

  Copy full SHA for c71778f

• JS: add xss test cases with unknownflags for replace using RegExp

  Napalys

  committed
  dbae553

  Copy full SHA for dbae553

• JS: add test cases with unknown flags for double escaping, works as expected.

  Napalys

  committed
  fe28657

  Copy full SHA for fe28657

• JS: imcomplete sanization now handles properly maybe global

  Napalys

  committed
  98fd977

  Copy full SHA for 98fd977

• JS: incomplete sanitization now also works with RegExp objects

  Napalys

  committed
  1ae1748

  Copy full SHA for 1ae1748

• JS: Add test cases for RegExp object usage in replace within incomplete sanitization

  Napalys

  committed
  7631803

  Copy full SHA for 7631803

• JS: Added tests for ReDos with unknownFlags, everything seems to be good

  Napalys

  committed
  9c2366a

  Copy full SHA for 9c2366a

• JS: Fixed path query not flagging new RegExp with DotRemovingReplaceCall

  Napalys

  committed
  875478c

  Copy full SHA for 875478c

• JS: Added tests for DotRemovingReplaceCall with RegExp Object.

  Napalys

  committed
  aa557cf

  Copy full SHA for aa557cf

• JS: UnsafeShellCommand Using unknown flags in the RegExp object is no longer flagged as bad sanitization to reduce false positives.

  Napalys

  committed
  a0df33c

  Copy full SHA for a0df33c

• JS: Added test cases for unsafe shell command sanitization with RegExpr Object, instead of literal

  Napalys

  committed
  155f1fc

  Copy full SHA for 155f1fc

• JS: Now unknown flags are not flagged in taint paths

  Napalys

  committed
  23b18ae

  Copy full SHA for 23b18ae

• JS: Fixed docs description

  Napalys

  committed
  eca7a88

  Copy full SHA for eca7a88

• JS: Added test cases with new RegExp for Tainted paths, currently works only with literals

  Napalys

  committed
  7db6f7c

  Copy full SHA for 7db6f7c

• JS: protyte poluting now treats unknownFlags as potentially good sanitization.

  Napalys

  committed
  faef9dd

  Copy full SHA for faef9dd

• JS: Added test cases which cover new RegExp creation with replace on protytpe pulluting

  Napalys

  committed
  41fef0f

  Copy full SHA for 41fef0f

• JS: Now BadHtmlSanitizers new RegExp with unknown flags is also flagged.

  Napalys

  committed
  18c7b18

  Copy full SHA for 18c7b18

• JS: Added test case for bad sanitizer with unknown flags, currently not flagged.

  Napalys

  committed
  89f3b6f

  Copy full SHA for 89f3b6f

• JS: Now BadHtmlSanitizers also flags new RegExp as potential issue

  Napalys

  committed
  38be0e4

  Copy full SHA for 38be0e4

• JS: Added test case which is not flagged but should be abusing new RegExp with global flag

  Napalys

  committed
  41f21d4

  Copy full SHA for 41f21d4

Commits on Nov 25, 2024

• Update javascript/ql/src/Security/CWE-178/CaseSensitiveMiddlewarePath.ql

  Show description for d6372ae
  

  Napalys

  and

  erik-krogh

  committed
  d6372ae

  Copy full SHA for d6372ae

• JS: previously js/case-sensitive-middleware-path was not taking into consideration unknown flags

  Napalys

  committed
  e38b63e

  Copy full SHA for e38b63e

• JS: Added test case for CWE-178 RegExp with unknown flags

  Napalys

  committed
  178da21

  Copy full SHA for 178da21

Commits on Nov 21, 2024

• Merge pull request #18008 from Napalys/napalys/ES2024-group-functions

  Show description for 61e0086
  Napalys

  authored
  61e0086

  Copy full SHA for 61e0086

• Update javascript/ql/lib/semmle/javascript/Collections.qll

  Show description for 7ee0a7b
  

  Napalys

  and

  erik-krogh

  authored
  7ee0a7b

  Copy full SHA for 7ee0a7b

• Merge pull request #18047 from Napalys/napalys/ES2023-string-protytpe-toWellFormed

  Show description for edb9b47
  Napalys

  authored
  edb9b47

  Copy full SHA for edb9b47

• Merge pull request #18005 from Napalys/napalys/ES2022-find-functions

  Show description for 82ca369
  Napalys

  authored
  82ca369

  Copy full SHA for 82ca369

Commits on Nov 20, 2024

• Added change notes

  Napalys

  committed
  43eda58

  Copy full SHA for 43eda58

• JS: Add: String.protytpe.toWellFormed to StringManipulationTaintStep

  Napalys

  committed
  afc2d3e

  Copy full SHA for afc2d3e