Commits

Breadcrumbs

History for

onmain

User selector

All users

All time

Commit History

Commits on Jun 23, 2025

• JS: Remove js/actions/command-injection

  Show description for 76b7228
  asgerf

  committed
  76b7228

  Copy full SHA for 76b7228

• JS: Remove js/actions/actions-artifact-leak

  Show description for 9dcb61e
  asgerf

  committed
  9dcb61e

  Copy full SHA for 9dcb61e

Commits on May 19, 2025

• Lower the precision of a range of harcoded password queries to remove them from query suites.

  michaelnebel

  committed
  03ecd24

  Copy full SHA for 03ecd24

Commits on May 2, 2025

• Merge pull request #19422 from Napalys/js/shelljs

  Show description for d1e769b
  Napalys

  authored
  d1e769b

  Copy full SHA for d1e769b

Commits on May 1, 2025

• Refactor process.env handling in CleartextLogging and IndirectCommandInjection modules to use ThreatModelSource

  Napalys

  committed
  d4b5ef6

  Copy full SHA for d4b5ef6

Commits on Apr 30, 2025

• Fix cwe tags to include leading zero

  owen-mc

  committed
  cf614a5

  Copy full SHA for cf614a5

Commits on Apr 4, 2025

• Updated `SocketClass` to use API Graphs.

  Napalys

  committed
  e16a20e

  Copy full SHA for e16a20e

Commits on Apr 2, 2025

• JS: Protect against bad join in BadRandomness

  Show description for 78b2538
  asgerf

  committed
  78b2538

  Copy full SHA for 78b2538

Commits on Feb 4, 2025

• JS: Simplify config in PrototypePollutingFunction.ql.

  aschackmull

  committed
  db1ed67

  Copy full SHA for db1ed67

Commits on Jan 29, 2025

• Merge pull request #18397 from aegilops/angular-sources-sinks

  Show description for f8694a3
  asgerf

  authored
  f8694a3

  Copy full SHA for f8694a3

Commits on Jan 27, 2025

• fix example in clear-text-logging qhelp to actually be bad

  erik-krogh

  committed
  37a1727

  Copy full SHA for 37a1727

Commits on Jan 24, 2025

• Updated expected test result files using HEAD version of codeql

  aegilops

  committed
  d248551

  Copy full SHA for d248551

Commits on Jan 23, 2025

• Merge

  aegilops

  committed
  522f3d1

  Copy full SHA for 522f3d1

Commits on Jan 21, 2025

• remove redundant cast

  erik-krogh

  committed
  2f1bd75

  Copy full SHA for 2f1bd75

• support that two `indexOf()` calls use the same string-concatenation in `getAnEquivalentIndexOfCall()`

  erik-krogh

  committed
  17afab7

  Copy full SHA for 17afab7

• ensure an `indexOf` call is equivalent with itself. (`getAUse()` is used later to find matching `indexOf` calls)

  erik-krogh

  committed
  d5529e3

  Copy full SHA for d5529e3

Commits on Jan 20, 2025

• JS: Update PrototypePollutingFunction.ql

  asgerf

  committed
  8fe622f

  Copy full SHA for 8fe622f

• JS: Auto-patch diff informed queries

  asgerf

  committed
  fd763a0

  Copy full SHA for fd763a0

Commits on Jan 6, 2025

• JS: Restrict AP length in prototype-polluting function

  asgerf

  committed
  0cdda87

  Copy full SHA for 0cdda87

Commits on Dec 19, 2024

• Merge branch 'main' into js/shared-dataflow-merge-main

  asgerf

  committed
  3acd481

  Copy full SHA for 3acd481

Commits on Dec 16, 2024

• JS: Migrate PrototypePollutingFunction

  asgerf

  committed
  73af3f3

  Copy full SHA for 73af3f3

Commits on Dec 13, 2024

• JS: Follow naming convention in InsecureModuleFlow module

  asgerf

  committed
  4e25036

  Copy full SHA for 4e25036

Commits on Dec 3, 2024

• JS: Update a reference to AdditionalSanitizerGuardNode

  Show description for 04a3a67
  asgerf

  committed
  04a3a67

  Copy full SHA for 04a3a67

Commits on Nov 29, 2024

• JS: follow proper code standards for get predicates

  Show description for 9d4e737
  

  Napalys

  and

  asgerf

  committed
  9d4e737

  Copy full SHA for 9d4e737

• JS: fixed bad alert messages when it came to incomplete sanitization for new RegExp objects

  Napalys

  committed
  3171f38

  Copy full SHA for 3171f38

Commits on Nov 28, 2024

• JS: imcomplete sanization now handles properly maybe global

  Napalys

  committed
  98fd977

  Copy full SHA for 98fd977

• JS: incomplete sanitization now also works with RegExp objects

  Napalys

  committed
  1ae1748

  Copy full SHA for 1ae1748

Commits on Nov 25, 2024

• Update javascript/ql/src/Security/CWE-178/CaseSensitiveMiddlewarePath.ql

  Show description for d6372ae
  

  Napalys

  and

  erik-krogh

  committed
  d6372ae

  Copy full SHA for d6372ae

• JS: previously js/case-sensitive-middleware-path was not taking into consideration unknown flags

  Napalys

  committed
  e38b63e

  Copy full SHA for e38b63e

Commits on Nov 20, 2024

• Merge branch 'main' into js/shared-dataflow-merge-main

  asgerf

  committed
  d52bc97

  Copy full SHA for d52bc97

Commits on Nov 14, 2024

• Merge pull request #17910 from Napalys/napalys/matchAll-support

  Show description for c8c15a0
  Napalys

  authored
  c8c15a0

  Copy full SHA for c8c15a0

Commits on Nov 5, 2024

• fix: add "actions" tag to ActionsArtifactLeak

  Show description for 881fe0b
  mbarbero

  authored
  881fe0b

  Copy full SHA for 881fe0b

• Update javascript/ql/src/Security/CWE-020/MissingRegExpAnchor.ql

  Show description for 5e8b1b0
  

  Napalys

  and

  erik-krogh

  authored
  5e8b1b0

  Copy full SHA for 5e8b1b0

• Added support for matchAll in CWE-020 including new test cases

  Napalys

  committed
  ccee34d

  Copy full SHA for ccee34d

Commits on Sep 18, 2024

• Merge branch 'main' into js/shared-dataflow-merge-main

  asgerf

  committed
  1cd00a1

  Copy full SHA for 1cd00a1