| FazBrowse GitHub Viewer | Trending | | Home |
| Tools: [Download Repo ZIP] [View Raw Code] [Original HTTPS Page] |
Angular-specific taint sources and sinks are now recognized by the security queries.
Support for React has improved, with better handling of react hooks, react-router path parameters, lazy-loaded components, and components transformed using react-redux and/or styled-components.
Dynamic imports are now analyzed more precisely.
Support for the following frameworks and libraries has been improved:
Analyzing files with the ".cjs" extension is now supported.
ES2021 features are now supported.
| Query | Tags | Purpose |
|---|
| Query | Expected impact | Change |
|---|---|---|
| Potentially unsafe external link (js/unsafe-external-link) | Fewer results | This query no longer flags URLs constructed using a template system where only the hash or query part of the URL is dynamic. |
| Incomplete URL substring sanitization (js/incomplete-url-substring-sanitization) | More results | This query now recognizes additional URLs when the substring check is an inclusion check. |
| Ambiguous HTML id attribute (js/duplicate-html-id) | Results no longer shown | Precision tag reduced to "low". The query is no longer run by default. |
| Unused loop iteration variable (js/unused-loop-variable) | Fewer results | This query no longer flags variables in a destructuring array assignment that are not the last variable in the destructed array. |
| Unsafe shell command constructed from library input (js/shell-command-constructed-from-input) | More results | This query now recognizes more commands where colon, dash, and underscore are used. |
| Unsafe jQuery plugin (js/unsafe-jquery-plugin) | More results | This query now detects more unsafe uses of nested option properties. |
| Client-side URL redirect (js/client-side-unvalidated-url-redirection) | More results | This query now recognizes some unsafe uses of importScripts() inside WebWorkers. |
| Missing CSRF middleware (js/missing-token-validation) | More results | This query now recognizes writes to cookie and session variables as potentially vulnerable to CSRF attacks. |
| Missing CSRF middleware (js/missing-token-validation) | Fewer results | This query now recognizes more ways of protecting against CSRF attacks. |
| Client-side cross-site scripting (js/xss) | More results | This query now tracks data flow from location.hash more precisely. |
| Back | FazBrowse Home | New Git URL |