Commits

Commit history

1. Commits on Oct 23, 2026

   • Replace dead link in many qhelp files.

     geoffw0

     committed
     e0654e0View commit details

     Copy full SHA for e0654e0

     View code at this pointBrowse repository at this point
2. Commits on Oct 13, 2023

   • JS: Port UnsafeShellCommandConstruction

     asgerf

     committed
     ba9edb4View commit details

     Copy full SHA for ba9edb4

     View code at this pointBrowse repository at this point

   • JS: Port ShellCommandInjectionFromEnvironment

     asgerf

     committed
     d446444View commit details

     Copy full SHA for d446444

     View code at this pointBrowse repository at this point

   • JS: Port SecondOrderCommandInjection

     asgerf

     committed
     06835a8View commit details

     Copy full SHA for 06835a8

     View code at this pointBrowse repository at this point

   • JS: Port IndirectCommandInjection

     asgerf

     committed
     8c00191View commit details

     Copy full SHA for 8c00191

     View code at this pointBrowse repository at this point

   • JS: Port CommandInjection

     asgerf

     committed
     17233a6View commit details

     Copy full SHA for 17233a6

     View code at this pointBrowse repository at this point
3. Commits on Jul 13, 2023

   • Apply suggestions from code review

     Show description for ae23724
     

     max-schaefer

     and

     subatoi

     authored
     ae23724View commit details

     Copy full SHA for ae23724

     View code at this pointBrowse repository at this point
4. Commits on Jul 10, 2023

   • Add another example of when and how to use shell-quote.

     

     Max Schaefer

     committed
     63c45a0View commit details

     Copy full SHA for 63c45a0

     View code at this pointBrowse repository at this point
5. Commits on Jul 6, 2023

   • Add example of manual sanitisation.

     

     Max Schaefer

     committed
     1d3e344View commit details

     Copy full SHA for 1d3e344

     View code at this pointBrowse repository at this point

   • Fix spurious character in code example.

     

     Max Schaefer

     committed
     240e079View commit details

     Copy full SHA for 240e079

     View code at this pointBrowse repository at this point

   • Update javascript/ql/src/Security/CWE-078/IndirectCommandInjection.qhelp

     Show description for 83a854c
     

     max-schaefer

     and

     erik-krogh

     authored
     83a854cView commit details

     Copy full SHA for 83a854c

     View code at this pointBrowse repository at this point

   • Apply suggestions from code review

     Show description for 6fb41ad
     

     max-schaefer

     and

     erik-krogh

     authored
     6fb41adView commit details

     Copy full SHA for 6fb41ad

     View code at this pointBrowse repository at this point
6. Commits on Jul 5, 2023

   • Address more review feedback.

     

     Max Schaefer

     committed
     f89992eView commit details

     Copy full SHA for f89992e

     View code at this pointBrowse repository at this point

   • Apply suggestions from code review

     Show description for 921d8de
     

     max-schaefer

     and

     erik-krogh

     authored
     921d8deView commit details

     Copy full SHA for 921d8de

     View code at this pointBrowse repository at this point
7. Commits on Jul 4, 2023

   • Clarify that splitting arguments on space is not safe.

     

     Max Schaefer

     committed
     5fb6b58View commit details

     Copy full SHA for 5fb6b58

     View code at this pointBrowse repository at this point

   • Improve command-injection example and provide a fixed version.

     

     Max Schaefer

     committed
     74af0b1View commit details

     Copy full SHA for 74af0b1

     View code at this pointBrowse repository at this point
8. Commits on May 12, 2023

   • JavaScript: Use synchronous APIs in examples for js/shell-command-constructed-from-input.

     max-schaefer

     authored
     2e7eb50View commit details

     Copy full SHA for 2e7eb50

     View code at this pointBrowse repository at this point
9. Commits on Feb 14, 2023

   • don't call environment variables for command-line arguments

     erik-krogh

     committed
     393649bView commit details

     Copy full SHA for 393649b

     View code at this pointBrowse repository at this point
10. Commits on Dec 19, 2022

    • JS: add heuristic variants of queries that use RemoteFlowSource

      erik-krogh

      committed
      442749bView commit details

      Copy full SHA for 442749b

      View code at this pointBrowse repository at this point
11. Commits on Nov 3, 2022

    • add dash in description

      Show description for 1f51bd4
      

      erik-krogh

      and

      mchammer01

      authored
      1f51bd4View commit details

      Copy full SHA for 1f51bd4

      View code at this pointBrowse repository at this point

    • fix minor issues in qhelp

      erik-krogh

      committed
      96ec54eView commit details

      Copy full SHA for 96ec54e

      View code at this pointBrowse repository at this point

    • rewrite @description of second-order-command-injection

      erik-krogh

      committed
      b566688View commit details

      Copy full SHA for b566688

      View code at this pointBrowse repository at this point
12. Commits on Nov 1, 2022

    • expand the explanation to include with arguments make the commands vulnerable

      erik-krogh

      committed
      6f3ca40View commit details

      Copy full SHA for 6f3ca40

      View code at this pointBrowse repository at this point

    • fix the qhelp

      Show description for 8fd6424
      

      erik-krogh

      and

      asgerf

      committed
      8fd6424View commit details

      Copy full SHA for 8fd6424

      View code at this pointBrowse repository at this point
13. Commits on Oct 30, 2022

    • add second-order-command-injection query

      erik-krogh

      committed
      fc21128View commit details

      Copy full SHA for fc21128

      View code at this pointBrowse repository at this point
14. Commits on Oct 7, 2022

    • fix some more style-guide violations in the alert-messages

      erik-krogh

      committed
      368f847View commit details

      Copy full SHA for 368f847

      View code at this pointBrowse repository at this point
15. Commits on Sep 12, 2022

    • apply suggestions from doc review

      erik-krogh

      committed
      6ec03d4View commit details

      Copy full SHA for 6ec03d4

      View code at this pointBrowse repository at this point
16. Commits on Sep 5, 2022

    • make the alert messages of taint-tracking queries more consistent

      erik-krogh

      committed
      aa56ca3View commit details

      Copy full SHA for aa56ca3

      View code at this pointBrowse repository at this point
17. Commits on Aug 22, 2022

    • update {js/py}/command-line-injection to match csharp/java

      erik-krogh

      committed
      9395f15View commit details

      Copy full SHA for 9395f15

      View code at this pointBrowse repository at this point
18. Commits on Oct 5, 2021

    • JS: Lower security-severity of queries with speculative threat model

      Show description for 83ca4ef
      asgerf

      committed
      83ca4efView commit details

      Copy full SHA for 83ca4ef

      View code at this pointBrowse repository at this point
19. Commits on Aug 12, 2021

    • JS: Migrate to *Query.qll convention

      asgerf

      committed
      f6da030View commit details

      Copy full SHA for f6da030

      View code at this pointBrowse repository at this point
20. Commits on Jun 15, 2021

    • Update security-severity scores

      calumgrant

      committed
      771e686View commit details

      Copy full SHA for 771e686

      View code at this pointBrowse repository at this point
21. Commits on Jun 10, 2021

    • Add security-severity metadata

      calumgrant

      committed
      a594afbView commit details

      Copy full SHA for a594afb

      View code at this pointBrowse repository at this point
22. Commits on Mar 18, 2021

    • add link to source in alert-message for js/shell-command-constructed-from-input

      erik-krogh

      committed
      d998d06View commit details

      Copy full SHA for d998d06

      View code at this pointBrowse repository at this point
23. Commits on Jul 6, 2020

    • fix typo in js/shell-command-constructed-from-input

      erik-krogh

      committed
      8585312View commit details

      Copy full SHA for 8585312

      View code at this pointBrowse repository at this point