From 3be094ea5b2e4d9d5c3ac2038dde7174bdab19b1 Mon Sep 17 00:00:00 2001 From: Esben Sparre Andreasen Date: Mon, 8 Jun 2020 10:20:26 +0200 Subject: [PATCH] JS: polish js/incomplete-html-attribute-sanitization --- change-notes/1.25/analysis-javascript.md | 1 + javascript/config/suites/javascript/security | 1 + .../IncompleteMultiCharacterSanitization.qhelp | 18 +----------------- 3 files changed, 3 insertions(+), 17 deletions(-) diff --git a/change-notes/1.25/analysis-javascript.md b/change-notes/1.25/analysis-javascript.md index cc2297365b6..9a0c516de5c 100644 --- a/change-notes/1.25/analysis-javascript.md +++ b/change-notes/1.25/analysis-javascript.md @@ -42,6 +42,7 @@ | Storage of sensitive information in build artifact (`js/build-artifact-leak`) | security, external/cwe/cwe-312 | Highlights storage of sensitive information in build artifacts. Results are shown on LGTM by default. | | Improper code sanitization (`js/bad-code-sanitization`) | security, external/cwe/cwe-094, external/cwe/cwe-079, external/cwe/cwe-116 | Highlights string concatenation where code is constructed without proper sanitization. Results are shown on LGTM by default. | | Resource exhaustion (`js/resource-exhaustion`) | security, external/cwe/cwe-770 | Highlights operations that may cause the resources of the application to be exhausted. Results are shown on LGTM by default. | +| Incomplete multi-character sanitization (`js/incomplete-multi-character-sanitization`) | correctness, security, external/cwe/cwe-20, external/cwe/cwe-116 | Highlights sanitizers that removes dangerous substrings incompletely. Results are shown on LGTM by default. | ## Changes to existing queries diff --git a/javascript/config/suites/javascript/security b/javascript/config/suites/javascript/security index 65bea14986e..d5d6f5f6294 100644 --- a/javascript/config/suites/javascript/security +++ b/javascript/config/suites/javascript/security @@ -19,6 +19,7 @@ + semmlecode-javascript-queries/Security/CWE-094/CodeInjection.ql: /Security/CWE/CWE-094 + semmlecode-javascript-queries/Security/CWE-094/UnsafeDynamicMethodAccess.ql: /Security/CWE/CWE-094 + semmlecode-javascript-queries/Security/CWE-116/IncompleteSanitization.ql: /Security/CWE/CWE-116 ++ semmlecode-javascript-queries/Security/CWE-116/IncompleteMultiCharacterSanitization.ql: /Security/CWE/CWE-116 + semmlecode-javascript-queries/Security/CWE-116/IncompleteHtmlAttributeSanitization.ql: /Security/CWE/CWE-116 + semmlecode-javascript-queries/Security/CWE-116/DoubleEscaping.ql: /Security/CWE/CWE-116 + semmlecode-javascript-queries/Security/CWE-134/TaintedFormatString.ql: /Security/CWE/CWE-134 diff --git a/javascript/ql/src/Security/CWE-116/IncompleteMultiCharacterSanitization.qhelp b/javascript/ql/src/Security/CWE-116/IncompleteMultiCharacterSanitization.qhelp index 911f4a9ca9e..d1e955fefea 100644 --- a/javascript/ql/src/Security/CWE-116/IncompleteMultiCharacterSanitization.qhelp +++ b/javascript/ql/src/Security/CWE-116/IncompleteMultiCharacterSanitization.qhelp @@ -3,22 +3,6 @@ "qhelp.dtd"> - - - - - - - - - - - - - - -
  • OWASP Top 10: A1 Injection.
    • - -     +