Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

JS: Move cookie queries out of experimental. #6855

Draft
wants to merge 16 commits into
base: main
Choose a base branch
from
Draft

JS: Move cookie queries out of experimental. #6855

wants to merge 16 commits into from

Conversation

@erik-krogh
Copy link
Contributor

@erik-krogh erik-krogh commented Oct 11, 2021 •
edited

I also considered adding models for tough-cookie and cookiejar, but neither of them actually sets a cookie, they are libraries mostly for parsing and reasoning about cookies.

The results for missing secure looks pretty good.
And some with missing httpOnly.

TODO: Evaluation looks OK-ish.
I need to look at the results.
@erik-krogh erik-krogh force-pushed the secCookie branch 4 times, most recently from cd9a8e2 to f5a63ab Oct 12, 2021
erik-krogh added 15 commits Oct 12, 2021
@erik-krogh
refactor, cleanup, and improvements in experimental cookie queries
6f53e58
@erik-krogh
prepare move to non-experimental
8b58454
@erik-krogh
port experimental cookie models to non-experimental
6537eaa
@erik-krogh
delete the experimental query library for cookie queries
0ce6cdd
@erik-krogh
combine test files
bf069ff
@erik-krogh
only report clear-text cookies for sensitive cookies
73ba48f
@erik-krogh
documentation overhaul for clear-text-cookie
5f9418b
@erik-krogh
documentation overhaul on client-exposed-cookie (and restricting it t…
b8f14d2 
…o server-side)
@erik-krogh
add more cookie models
8c61ff6
@erik-krogh
update tests so it's clear which cookies are insecure
25ab8e9
@erik-krogh
add session{key,id} as sensitive info
6b6d523
@erik-krogh
refactor most of the `isSensitive` predicates into a common helper pr…
7617336 
…edicate
@erik-krogh
add test for the `cookie` npm package
cce0a63
@erik-krogh
fix typos in qhelp
0fa5263
@erik-krogh
assume that setting the secure/httpOnly flag to some unknown value is…
ff04df1 
… good
@erik-krogh
cache `SensitiveExpr`
af5f5ea
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers
No reviews
Assignees
No one assigned
Labels
Awaiting evaluation documentation JS Python WIP
Projects
None yet
Milestone
No milestone
Linked issues

Successfully merging this pull request may close these issues.

None yet

1 participant
@erik-krogh