Merge pull request #5585 from asgerf/js/more-metadata

Approved by esbena

javascript/ql/examples/queries/dataflow/BackendIdor/BackendIdor.ql

@@ -3,6 +3,7 @@
  * @description Finds cases where the 'userId' field in a request to another service
  *              is an arbitrary user-controlled value, indicating lack of authentication.
  * @kind path-problem
+ * @problem.severity error
  * @tags security
  * @id js/examples/backend-idor
  */

javascript/ql/examples/queries/dataflow/DecodingAfterSanitization/DecodingAfterSanitization.ql

@@ -3,6 +3,7 @@
  * @description Tracks the return value of 'escapeHtml' into 'decodeURI', indicating
  *              an ineffective sanitization attempt.
  * @kind path-problem
+ * @problem.severity error
  * @tags security
  * @id js/examples/decoding-after-sanitization
  */

javascript/ql/examples/queries/dataflow/DecodingAfterSanitization/DecodingAfterSanitizationGeneralized.ql

@@ -3,6 +3,7 @@
  * @description Tracks the return value of an HTML sanitizer into an escape-sequence decoder,
  *              indicating an ineffective sanitization attempt.
  * @kind path-problem
+ * @problem.severity error
  * @tags security
  * @id js/examples/decoding-after-sanitization-generalized
  */

javascript/ql/examples/queries/dataflow/EvalTaint/EvalTaintPath.ql

@@ -3,6 +3,7 @@
  * @description Tracks user-controlled values into 'eval' calls (special case of js/code-injection),
  *              and generates a visualizable path from the source to the sink.
  * @kind path-problem
+ * @problem.severity error
  * @tags security
  * @id js/examples/eval-taint-path
  */

javascript/ql/examples/queries/dataflow/InformationDisclosure/InformationDisclosure.ql

@@ -3,6 +3,7 @@
  * @description Tracks values from an 'authKey' property into a postMessage call with unrestricted origin,
  *              indicating a leak of sensitive information.
  * @kind path-problem
+ * @problem.severity warning
  * @tags security
  * @id js/examples/information-disclosure
  */

javascript/ql/examples/queries/dataflow/StoredXss/StoredXss.ql

@@ -2,6 +2,7 @@
  * @name Extension of standard query: Stored XSS
  * @description Extends the standard Stored XSS query with an additional source.
  * @kind path-problem
+ * @problem.severity error
  * @tags security
  * @id js/examples/stored-xss
  */

javascript/ql/examples/queries/dataflow/StoredXss/StoredXssTypeTracking.ql

@@ -3,6 +3,7 @@
  * @description Extends the standard Stored XSS query with an additional source,
  *              using TrackedNode to track MySQL connections globally.
  * @kind path-problem
+ * @problem.severity error
  * @tags security
  * @id js/examples/stored-xss-trackednode
  */

javascript/ql/examples/queries/dataflow/TemplateInjection/TemplateInjection.ql

@@ -2,6 +2,7 @@
  * @name Template injection
  * @description Tracks user-controlled values to an unescaped lodash template placeholder.
  * @kind path-problem
+ * @problem.severity error
  * @tags security
  * @id js/examples/template-injection
  */