Commits

Breadcrumbs

History for

oncodeql-cli/latest

User selector

All users

All time

Commit History

Commits on Oct 13, 2023

• JS: Port UnsafeShellCommandConstruction

  asgerf

  committed
  ba9edb4

  Copy full SHA for ba9edb4

• JS: Port ShellCommandInjectionFromEnvironment

  asgerf

  committed
  d446444

  Copy full SHA for d446444

• JS: Port SecondOrderCommandInjection

  asgerf

  committed
  06835a8

  Copy full SHA for 06835a8

• JS: Port IndirectCommandInjection

  asgerf

  committed
  8c00191

  Copy full SHA for 8c00191

• JS: Port CommandInjection

  asgerf

  committed
  17233a6

  Copy full SHA for 17233a6

Commits on Jul 13, 2023

• Apply suggestions from code review

  Show description for ae23724
  

  max-schaefer

  and

  subatoi

  authored
  ae23724

  Copy full SHA for ae23724

Commits on Jul 10, 2023

• Add another example of when and how to use shell-quote.

  

  Max Schaefer

  committed
  63c45a0

  Copy full SHA for 63c45a0

Commits on Jul 6, 2023

• Add example of manual sanitisation.

  

  Max Schaefer

  committed
  1d3e344

  Copy full SHA for 1d3e344

• Fix spurious character in code example.

  

  Max Schaefer

  committed
  240e079

  Copy full SHA for 240e079

• Update javascript/ql/src/Security/CWE-078/IndirectCommandInjection.qhelp

  Show description for 83a854c
  

  max-schaefer

  and

  erik-krogh

  authored
  83a854c

  Copy full SHA for 83a854c

• Apply suggestions from code review

  Show description for 6fb41ad
  

  max-schaefer

  and

  erik-krogh

  authored
  6fb41ad

  Copy full SHA for 6fb41ad

Commits on Jul 5, 2023

• Address more review feedback.

  

  Max Schaefer

  committed
  f89992e

  Copy full SHA for f89992e

• Apply suggestions from code review

  Show description for 921d8de
  

  max-schaefer

  and

  erik-krogh

  authored
  921d8de

  Copy full SHA for 921d8de

Commits on Jul 4, 2023

• Clarify that splitting arguments on space is not safe.

  

  Max Schaefer

  committed
  5fb6b58

  Copy full SHA for 5fb6b58

• Improve command-injection example and provide a fixed version.

  

  Max Schaefer

  committed
  74af0b1

  Copy full SHA for 74af0b1

Commits on May 12, 2023

• JavaScript: Use synchronous APIs in examples for js/shell-command-constructed-from-input.

  max-schaefer

  authored
  2e7eb50

  Copy full SHA for 2e7eb50

Commits on Feb 14, 2023

• don't call environment variables for command-line arguments

  erik-krogh

  committed
  393649b

  Copy full SHA for 393649b

Commits on Dec 19, 2022

• JS: add heuristic variants of queries that use RemoteFlowSource

  erik-krogh

  committed
  442749b

  Copy full SHA for 442749b

Commits on Nov 3, 2022

• add dash in description

  Show description for 1f51bd4
  

  erik-krogh

  and

  mchammer01

  authored
  1f51bd4

  Copy full SHA for 1f51bd4

• fix minor issues in qhelp

  erik-krogh

  committed
  96ec54e

  Copy full SHA for 96ec54e

• rewrite @description of second-order-command-injection

  erik-krogh

  committed
  b566688

  Copy full SHA for b566688

Commits on Nov 1, 2022

• expand the explanation to include with arguments make the commands vulnerable

  erik-krogh

  committed
  6f3ca40

  Copy full SHA for 6f3ca40

• fix the qhelp

  Show description for 8fd6424
  

  erik-krogh

  and

  asgerf

  committed
  8fd6424

  Copy full SHA for 8fd6424

Commits on Oct 30, 2022

• add second-order-command-injection query

  erik-krogh

  committed
  fc21128

  Copy full SHA for fc21128

Commits on Oct 7, 2022

• fix some more style-guide violations in the alert-messages

  erik-krogh

  committed
  368f847

  Copy full SHA for 368f847

Commits on Sep 12, 2022

• apply suggestions from doc review

  erik-krogh

  committed
  6ec03d4

  Copy full SHA for 6ec03d4

Commits on Sep 5, 2022

• make the alert messages of taint-tracking queries more consistent

  erik-krogh

  committed
  aa56ca3

  Copy full SHA for aa56ca3

Commits on Aug 22, 2022

• update {js/py}/command-line-injection to match csharp/java

  erik-krogh

  committed
  9395f15

  Copy full SHA for 9395f15

Commits on Oct 5, 2021

• JS: Lower security-severity of queries with speculative threat model

  Show description for 83ca4ef
  asgerf

  committed
  83ca4ef

  Copy full SHA for 83ca4ef

Commits on Aug 12, 2021

• JS: Migrate to *Query.qll convention

  asgerf

  committed
  f6da030

  Copy full SHA for f6da030

Commits on Jun 15, 2021

• Update security-severity scores

  calumgrant

  committed
  771e686

  Copy full SHA for 771e686

Commits on Jun 10, 2021

• Add security-severity metadata

  calumgrant

  committed
  a594afb

  Copy full SHA for a594afb

Commits on Mar 18, 2021

• add link to source in alert-message for js/shell-command-constructed-from-input

  erik-krogh

  committed
  d998d06

  Copy full SHA for d998d06

Commits on Jul 6, 2020

• fix typo in js/shell-command-constructed-from-input

  erik-krogh

  committed
  8585312

  Copy full SHA for 8585312

Commits on May 21, 2020

• Apply suggestions from doc review

  Show description for b297837
  

  erik-krogh

  and

  mchammer01

  authored
  b297837

  Copy full SHA for b297837

Pagination

Previous

Next