Skip to content

JS: Merge js-team-sprint #3765

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom
Merged
merged 156 commits into from
Jun 23, 2020
Merged

JS: Merge js-team-sprint #3765

merged 156 commits into from
Jun 23, 2020

Conversation

asgerf
Copy link
Contributor

@asgerf asgerf commented Jun 22, 2020

Merges master into the js-team-sprint branch (resolving a change note conflict) and then js-team-sprint into master.

The js-team-sprint branch contains the following PRs:
#3643, #3645, #3655, #3672, #3679, #3686, #3656, #3663, #3662, #3680, #3651, #3704, #3725, #3726, #3661, #3724, #3732, #3689, #3702, #3672, #3702, #3755, #3756, #3759, #3735

erik-krogh and others added 30 commits June 8, 2020 16:45
@erik-krogh
extend support for yargs for js/indirect-command-line-injection
0f06f04
@erik-krogh
add query to detect accidential leak of private files
167239e
@esbena
JS: initial version of IncompleteMultiCharacterSanitization.ql
2d24684
@erik-krogh
base the chaining on yargs on the methods that are NOT chained
c2fbcea
@asgerf
JS: Fix 'match' call in StringOps::RegExpTest
0345036
@erik-krogh
fix test
b04d701
@erik-krogh
Merge pull request github#3643 from erik-krogh/yargs
c580ada 
JS: extend support for yargs for js/indirect-command-line-injection
@erik-krogh
support rest-patterns inside property patterns
b510e47
@erik-krogh
refactor CleartextLogging to allow for reuse
896a9b0
@erik-krogh
introduce basic BuildArtifactLeak query
be71ddf
@erik-krogh
add taint-step for Array.reduce
9059616
@erik-krogh
simplify web.DefinePlugin sink
2af8739
@erik-krogh
remove dead FlowLabel
7050d9d
@erik-krogh
add taint-steps for copying properties of an object
a7f6f04
@erik-krogh
Merge pull request github#3645 from erik-krogh/infExposure
b6e0e66 
JS: add query to detect accidential leak of private files
@erik-krogh
add lValueFlowStep for rest-pattern nested inside a property-pattern …
b8a9ac3 
…(and removed old incorrect approach)
@asgerf
JS: Resolve package.json main module differently
806c9a3
@asgerf
JS: Explicitly handle export declarations in PackageExports
a923a40
@erik-krogh @asgerf
improve readability
eb00da5 
Co-authored-by: Asger F <asgerf@github.com>
@erik-krogh
add missing qldoc
2f9124f
@erik-krogh
Move rest-pattern inside property-pattern step to a taint-step
733e04c
@erik-krogh
introduce query to detect biased random number generators
111f6d4
@erik-krogh
add explanations about modulo by power of 2
16ec405
@erik-krogh
add support for secure-random
9189f23
@erik-krogh
refactor isAdditionalTaintStep to a utility predicate in InsecureRand…
9029dba 
…omness
@erik-krogh
use steps from InsecureRandomness, and use small-steps
7e8fd80
@erik-krogh
include the source of cryptographically random number in alert message
c4f6113
@esbena
JS: add initial version of ServerCrash.ql
1d39652
@semmle-qlci
Merge pull request github#3655 from asger-semmle/js/string-ops-regexp…
df79f2a 
…-test-fix

Approved by esbena
@asgerf
JS: Autoformat
07e90ff
esbena and others added 24 commits June 19, 2020 09:47
@esbena @mchammer01
Update javascript/ql/src/Security/CWE-770/ResourceExhaustion.qhelp
0463c42 
Co-authored-by: mc <42146119+mchammer01@users.noreply.github.com>
@esbena
JS: mention MITM
457588e
@semmle-qlci
Merge pull request github#3724 from erik-krogh/bad-random-polish
bfb2e9d 
Approved by mchammer01
@erik-krogh
Merge branch 'js-team-sprint' into priv-file-polish
a17d152
@semmle-qlci
Merge pull request github#3732 from erik-krogh/priv-file-polish
e13353f 
Approved by mchammer01
@erik-krogh
Merge branch 'js-team-sprint' into https-fix
0f5ef2c
@semmle-qlci
Merge pull request github#3689 from erik-krogh/https-fix
1548eca 
Approved by mchammer01
@asgerf
Merge pull request github#3702 from esbena/js/memory-exhaustion
eca5e2d 
JS: add query js/memory-exhaustion
@esbena @mchammer01
Apply suggestions from code review
3e89848 
Co-authored-by: mc <42146119+mchammer01@users.noreply.github.com>
@esbena
Update DisablingCertificateValidation.qhelp
f1dad0d
@esbena
Merge branch 'js-team-sprint' into js/insecure-http-options
0654823
@esbena
JS: polish js/incomplete-html-attribute-sanitization
3be094e
@esbena
Revert "Merge pull request github#3672 from esbena/js/server-crashing…
0a8d15c 
…-route-handler"

This reverts commit 243e3ad, reversing
changes made to df79f2a.
@esbena
Revert "Merge pull request github#3702 from esbena/js/memory-exhaustion"
9a0bbb3 
This reverts commit eca5e2d, reversing
changes made to 1548eca.
@esbena @asgerf
Update change-notes/1.25/analysis-javascript.md
d4ad9a8 
Co-authored-by: Asger F <asgerf@github.com>
@asgerf
Merge pull request github#3755 from esbena/js/polish-imcs
4a459c8 
JS: polish js/incomplete-html-attribute-sanitization
@asgerf
Merge branch 'js-team-sprint' into js/delay-slow-query-merge
7d54b02
@asgerf
Merge pull request github#3756 from esbena/js/delay-slow-query-merge
a067cd3 
JS: delay merging two slow queries
@asgerf
JS: Add new queries to security suite
8cc41a0
@asgerf
JS: Sort security suite
1efd71a
@semmle-qlci
Merge pull request github#3759 from asger-semmle/js/sprint-suite
69b44de 
Approved by erik-krogh
@asgerf
Merge branch 'js-team-sprint' into js/insecure-http-options
ca06f6d
@asgerf
Merge pull request github#3735 from esbena/js/insecure-http-options
2edeb4a 
JS: polish js/disabling-certificate-validation
@asgerf
Merge branch 'master' into js-team-sprint-merge2
b4f75ef
@asgerf asgerf added the JS label Jun 22, 2020
@asgerf asgerf requested review from mchammer01 and a team as code owners June 22, 2020 23:23
@asgerf asgerf merged commit 552b7ad into github:master Jun 23, 2020
@snyk-bot snyk-bot mentioned this pull request Apr 28, 2021
Merged
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers

@esbena esbena esbena approved these changes

@mchammer01 mchammer01 Awaiting requested review from mchammer01

Assignees
No one assigned
Labels
JS
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.
4 participants
@asgerf @esbena @erik-krogh @semmle-qlci