Commits

Breadcrumbs

History for

onpython/hdbcli

User selector

All users

All time

Commit history

Commits on Oct 13, 2023

• JS: Port UnsafeShellCommandConstruction

  asgerf

  committed
  ba9edb4View commit details

  Copy full SHA for ba9edb4

  View code at this pointBrowse repository at this point

• JS: Port ShellCommandInjectionFromEnvironment

  asgerf

  committed
  d446444View commit details

  Copy full SHA for d446444

  View code at this pointBrowse repository at this point

• JS: Port SecondOrderCommandInjection

  asgerf

  committed
  06835a8View commit details

  Copy full SHA for 06835a8

  View code at this pointBrowse repository at this point

• JS: Port IndirectCommandInjection

  asgerf

  committed
  8c00191View commit details

  Copy full SHA for 8c00191

  View code at this pointBrowse repository at this point

• JS: Port CommandInjection

  asgerf

  committed
  17233a6View commit details

  Copy full SHA for 17233a6

  View code at this pointBrowse repository at this point

Commits on Jul 13, 2023

• Apply suggestions from code review

  Show description for ae23724
  

  max-schaefer

  and

  subatoi

  authored
  ae23724View commit details

  Copy full SHA for ae23724

  View code at this pointBrowse repository at this point

Commits on Jul 10, 2023

• Add another example of when and how to use shell-quote.

  

  Max Schaefer

  committed
  63c45a0View commit details

  Copy full SHA for 63c45a0

  View code at this pointBrowse repository at this point

Commits on Jul 6, 2023

• Add example of manual sanitisation.

  

  Max Schaefer

  committed
  1d3e344View commit details

  Copy full SHA for 1d3e344

  View code at this pointBrowse repository at this point

• Fix spurious character in code example.

  

  Max Schaefer

  committed
  240e079View commit details

  Copy full SHA for 240e079

  View code at this pointBrowse repository at this point

• Update javascript/ql/src/Security/CWE-078/IndirectCommandInjection.qhelp

  Show description for 83a854c
  

  max-schaefer

  and

  erik-krogh

  authored
  83a854cView commit details

  Copy full SHA for 83a854c

  View code at this pointBrowse repository at this point

• Apply suggestions from code review

  Show description for 6fb41ad
  

  max-schaefer

  and

  erik-krogh

  authored
  6fb41adView commit details

  Copy full SHA for 6fb41ad

  View code at this pointBrowse repository at this point

Commits on Jul 5, 2023

• Address more review feedback.

  

  Max Schaefer

  committed
  f89992eView commit details

  Copy full SHA for f89992e

  View code at this pointBrowse repository at this point

• Apply suggestions from code review

  Show description for 921d8de
  

  max-schaefer

  and

  erik-krogh

  authored
  921d8deView commit details

  Copy full SHA for 921d8de

  View code at this pointBrowse repository at this point

Commits on Jul 4, 2023

• Clarify that splitting arguments on space is not safe.

  

  Max Schaefer

  committed
  5fb6b58View commit details

  Copy full SHA for 5fb6b58

  View code at this pointBrowse repository at this point

• Improve command-injection example and provide a fixed version.

  

  Max Schaefer

  committed
  74af0b1View commit details

  Copy full SHA for 74af0b1

  View code at this pointBrowse repository at this point

Commits on May 12, 2023

• JavaScript: Use synchronous APIs in examples for js/shell-command-constructed-from-input.

  max-schaefer

  authored
  2e7eb50View commit details

  Copy full SHA for 2e7eb50

  View code at this pointBrowse repository at this point

Commits on Feb 14, 2023

• don't call environment variables for command-line arguments

  erik-krogh

  committed
  393649bView commit details

  Copy full SHA for 393649b

  View code at this pointBrowse repository at this point

Commits on Dec 19, 2022

• JS: add heuristic variants of queries that use RemoteFlowSource

  erik-krogh

  committed
  442749bView commit details

  Copy full SHA for 442749b

  View code at this pointBrowse repository at this point

Commits on Nov 3, 2022

• add dash in description

  Show description for 1f51bd4
  

  erik-krogh

  and

  mchammer01

  authored
  1f51bd4View commit details

  Copy full SHA for 1f51bd4

  View code at this pointBrowse repository at this point

• fix minor issues in qhelp

  erik-krogh

  committed
  96ec54eView commit details

  Copy full SHA for 96ec54e

  View code at this pointBrowse repository at this point

• rewrite @description of second-order-command-injection

  erik-krogh

  committed
  b566688View commit details

  Copy full SHA for b566688

  View code at this pointBrowse repository at this point

Commits on Nov 1, 2022

• expand the explanation to include with arguments make the commands vulnerable

  erik-krogh

  committed
  6f3ca40View commit details

  Copy full SHA for 6f3ca40

  View code at this pointBrowse repository at this point

• fix the qhelp

  Show description for 8fd6424
  

  erik-krogh

  and

  asgerf

  committed
  8fd6424View commit details

  Copy full SHA for 8fd6424

  View code at this pointBrowse repository at this point

Commits on Oct 30, 2022

• add second-order-command-injection query

  erik-krogh

  committed
  fc21128View commit details

  Copy full SHA for fc21128

  View code at this pointBrowse repository at this point

Commits on Oct 7, 2022

• fix some more style-guide violations in the alert-messages

  erik-krogh

  committed
  368f847View commit details

  Copy full SHA for 368f847

  View code at this pointBrowse repository at this point

Commits on Sep 12, 2022

• apply suggestions from doc review

  erik-krogh

  committed
  6ec03d4View commit details

  Copy full SHA for 6ec03d4

  View code at this pointBrowse repository at this point

Commits on Sep 5, 2022

• make the alert messages of taint-tracking queries more consistent

  erik-krogh

  committed
  aa56ca3View commit details

  Copy full SHA for aa56ca3

  View code at this pointBrowse repository at this point

Commits on Aug 22, 2022

• update {js/py}/command-line-injection to match csharp/java

  erik-krogh

  committed
  9395f15View commit details

  Copy full SHA for 9395f15

  View code at this pointBrowse repository at this point

Commits on Oct 5, 2021

• JS: Lower security-severity of queries with speculative threat model

  Show description for 83ca4ef
  asgerf

  committed
  83ca4efView commit details

  Copy full SHA for 83ca4ef

  View code at this pointBrowse repository at this point

Commits on Aug 12, 2021

• JS: Migrate to *Query.qll convention

  asgerf

  committed
  f6da030View commit details

  Copy full SHA for f6da030

  View code at this pointBrowse repository at this point

Commits on Jun 15, 2021

• Update security-severity scores

  calumgrant

  committed
  771e686View commit details

  Copy full SHA for 771e686

  View code at this pointBrowse repository at this point

Commits on Jun 10, 2021

• Add security-severity metadata

  calumgrant

  committed
  a594afbView commit details

  Copy full SHA for a594afb

  View code at this pointBrowse repository at this point

Commits on Mar 18, 2021

• add link to source in alert-message for js/shell-command-constructed-from-input

  erik-krogh

  committed
  d998d06View commit details

  Copy full SHA for d998d06

  View code at this pointBrowse repository at this point

Commits on Jul 6, 2020

• fix typo in js/shell-command-constructed-from-input

  erik-krogh

  committed
  8585312View commit details

  Copy full SHA for 8585312

  View code at this pointBrowse repository at this point

Commits on May 21, 2020

• Apply suggestions from doc review

  Show description for b297837
  

  erik-krogh

  and

  mchammer01

  authored
  b297837View commit details

  Copy full SHA for b297837

  View code at this pointBrowse repository at this point