Commits

Breadcrumbs

History for

onc6db32e

User selector

All users

All time

Commit History

Commits on May 23, 2025

• Add exceptions for `arktype`, `execa`, and `highland` to prevent them from being flagged by unhandled pipe error query

  Napalys

  committed
  c6db32e

  Copy full SHA for c6db32e

• Added more test cases which common `js` libraries uses `.pipe()`

  Napalys

  committed
  15ff7cb

  Copy full SHA for 15ff7cb

Commits on May 22, 2025

• Fixed false positives from `strapi` and `rxjs/testing` as well as when one passes function as second arg to `pipe`

  Napalys

  committed
  b10a948

  Copy full SHA for b10a948

• Added test cases where second parameter passed to `pipe` is a function and some popular library ones

  Napalys

  committed
  e6ae8bb

  Copy full SHA for e6ae8bb

• Add predicate to detect non-stream-like usage in sources of pipe calls

  Napalys

  committed
  ac24fdd

  Copy full SHA for ac24fdd

• Added detection of custom `gulp-plumber` sanitizer, thus one would not flag such instances.

  Napalys

  committed
  5b1af0c

  Copy full SHA for 5b1af0c

• Added `UnhandledStreamPipe` to `javascript-security-and-quality.qls` and `javascript-code-quality.qls`

  Napalys

  committed
  b104871

  Copy full SHA for b104871

• Fixed issue where `pipe` calls from `rxjs` package would been identified as `pipe` calls on streams

  Napalys

  committed
  09220fc

  Copy full SHA for 09220fc

• Enhance PipeCall to exclude non-function and non-object arguments in pipe method detection

  Napalys

  committed
  d7f86db

  Copy full SHA for d7f86db

• Eliminate false positives by detecting non-stream objects returned from `pipe()` calls based on accessed properties

  Napalys

  committed
  4332de4

  Copy full SHA for 4332de4

• Add test cases for non-stream field accesses and methods before and after pipe operations

  Napalys

  committed
  5710f0c

  Copy full SHA for 5710f0c

Commits on May 21, 2025

• Restrict pipe detection to calls with 1-2 arguments

  Napalys

  committed
  03d1f9a

  Copy full SHA for 03d1f9a

• Fixed issue where a custom `pipe` method which returns non stream would be flagged by the query

  Napalys

  committed
  30f2815

  Copy full SHA for 30f2815

• Fixed issue where streams would not be tracked via chainable methods

  Napalys

  committed
  ef1bde5

  Copy full SHA for ef1bde5

• test: Add edge cases for stream pipe error handling

  Show description for f39bf62
  Napalys

  committed
  f39bf62

  Copy full SHA for f39bf62

• Add `UnhandledStreamPipee` Quality query and tests to detect missing error handlers in `Node.js` streams

  Napalys

  committed
  c27157f

  Copy full SHA for c27157f

Commits on May 2, 2025

• Merge pull request #19422 from Napalys/js/shelljs

  Show description for d1e769b
  Napalys

  authored
  d1e769b

  Copy full SHA for d1e769b

• Update javascript/ql/lib/semmle/javascript/frameworks/ShellJS.qll

  Show description for 871e93d
  

  Napalys

  and

  asgerf

  authored
  871e93d

  Copy full SHA for 871e93d

• Merge pull request #19413 from tamasvajk/quality/query-suite-selector

  Show description for cb1c373
  tamasvajk

  authored
  cb1c373

  Copy full SHA for cb1c373

Commits on May 1, 2025

• Merge pull request #19429 from owen-mc/fix-cwe-tags-missing-leading-zero

  Show description for e054948
  owen-mc

  authored
  e054948

  Copy full SHA for e054948

• Add change notes

  owen-mc

  committed
  0863c87

  Copy full SHA for 0863c87

• Address comments

  Napalys

  committed
  68a9dd9

  Copy full SHA for 68a9dd9

• Refactor process.env handling in CleartextLogging and IndirectCommandInjection modules to use ThreatModelSource

  Napalys

  committed
  d4b5ef6

  Copy full SHA for d4b5ef6

• Added test cases for shelljs.env

  Napalys

  committed
  33d8ffa

  Copy full SHA for 33d8ffa

• Added change note

  Napalys

  committed
  602500e

  Copy full SHA for 602500e

• Added model for shelljs.env

  Napalys

  committed
  40d176a

  Copy full SHA for 40d176a

Commits on Apr 30, 2025

• Fix cwe tags to include leading zero

  owen-mc

  committed
  cf614a5

  Copy full SHA for cf614a5

• Added change note

  Napalys

  committed
  9624a41

  Copy full SHA for 9624a41

• Added support for `fastify.all`

  Napalys

  committed
  71f1b82

  Copy full SHA for 71f1b82

• Added test case for `fastify.all`

  Napalys

  committed
  6d61766

  Copy full SHA for 6d61766

• Merge pull request #19412 from asgerf/js/promise-all

  Show description for 8ebbfb1
  asgerf

  authored
  8ebbfb1

  Copy full SHA for 8ebbfb1

• Added support for `shelljs.cmd` and `async-shelljs.asyncExec`

  Napalys

  committed
  18cea2d

  Copy full SHA for 18cea2d

• Added support for `shelljs.which`

  Napalys

  committed
  25d04f1

  Copy full SHA for 25d04f1

• Added test cases for `cmd`, `which` and `asyncExec`

  Napalys

  committed
  f6fae7a

  Copy full SHA for f6fae7a

• JS: Change note

  asgerf

  committed
  da5d799

  Copy full SHA for da5d799