mirror of
https://github.com/github/codeql.git
synced 2025-12-20 10:46:30 +01:00
unsecure -> insecure
This commit is contained in:
@@ -1,17 +1,17 @@
|
||||
/**
|
||||
* @name Download of sensitive file through unsecure connection
|
||||
* @description Downloading executables and other sensitive files over an unsecure connection
|
||||
* @name Download of sensitive file through insecure connection
|
||||
* @description Downloading executables and other sensitive files over an insecure connection
|
||||
* opens up for potential man-in-the-middle attacks.
|
||||
* @kind path-problem
|
||||
* @problem.severity error
|
||||
* @precision high
|
||||
* @id js/unsecure-download
|
||||
* @id js/insecure-download
|
||||
* @tags security
|
||||
* external/cwe/cwe-829
|
||||
*/
|
||||
|
||||
import javascript
|
||||
import semmle.javascript.security.dataflow.UnsecureDownload::UnsecureDownload
|
||||
import semmle.javascript.security.dataflow.InsecureDownload::InsecureDownload
|
||||
import DataFlow::PathGraph
|
||||
|
||||
from Configuration cfg, DataFlow::PathNode source, DataFlow::PathNode sink
|
||||
@@ -1,18 +1,18 @@
|
||||
/**
|
||||
* Provides a taint tracking configuration for reasoning about download of sensitive file through unsecure connection.
|
||||
* Provides a taint tracking configuration for reasoning about download of sensitive file through insecure connection.
|
||||
*
|
||||
* Note, for performance reasons: only import this file if
|
||||
* `UnsecureDownload::Configuration` is needed, otherwise
|
||||
* `UnsecureDownloadCustomizations` should be imported instead.
|
||||
* `InsecureDownload::Configuration` is needed, otherwise
|
||||
* `InsecureDownloadCustomizations` should be imported instead.
|
||||
*/
|
||||
|
||||
import javascript
|
||||
|
||||
module UnsecureDownload {
|
||||
import UnsecureDownloadCustomizations::UnsecureDownload
|
||||
module InsecureDownload {
|
||||
import InsecureDownloadCustomizations::InsecureDownload
|
||||
|
||||
/**
|
||||
* A taint tracking configuration for download of sensitive file through unsecure connection.
|
||||
* A taint tracking configuration for download of sensitive file through insecure connection.
|
||||
*/
|
||||
class Configuration extends DataFlow::Configuration {
|
||||
Configuration() { this = "HTTP/HTTPS" }
|
||||
@@ -1,19 +1,19 @@
|
||||
/**
|
||||
* Provides default sources, sinks and sanitizers for reasoning about
|
||||
* download of sensitive file through unsecure connection, as well as
|
||||
* download of sensitive file through insecure connection, as well as
|
||||
* extension points for adding your own.
|
||||
*/
|
||||
|
||||
import javascript
|
||||
|
||||
module UnsecureDownload {
|
||||
module InsecureDownload {
|
||||
/**
|
||||
* A data flow source for download of sensitive file through unsecure connection.
|
||||
* A data flow source for download of sensitive file through insecure connection.
|
||||
*/
|
||||
abstract class Source extends DataFlow::Node { }
|
||||
|
||||
/**
|
||||
* A data flow sink for download of sensitive file through unsecure connection.
|
||||
* A data flow sink for download of sensitive file through insecure connection.
|
||||
*/
|
||||
abstract class Sink extends DataFlow::Node {
|
||||
/**
|
||||
@@ -23,13 +23,13 @@ module UnsecureDownload {
|
||||
}
|
||||
|
||||
/**
|
||||
* A sanitizer for download of sensitive file through unsecure connection.
|
||||
* A sanitizer for download of sensitive file through insecure connection.
|
||||
*/
|
||||
abstract class Sanitizer extends DataFlow::Node { }
|
||||
|
||||
/**
|
||||
* A HTTP or FTP URL that refers to a file with a sensitive file extension,
|
||||
* seen as a source for download of sensitive file through unsecure connection.
|
||||
* seen as a source for download of sensitive file through insecure connection.
|
||||
*/
|
||||
class SensitiveFileUrl extends Source {
|
||||
SensitiveFileUrl() {
|
||||
@@ -55,7 +55,7 @@ module UnsecureDownload {
|
||||
|
||||
/**
|
||||
* A url downloaded by a client-request, seen as a sink for download of
|
||||
* sensitive file through unsecure connection.a
|
||||
* sensitive file through insecure connection.a
|
||||
*/
|
||||
class ClientRequestURL extends Sink {
|
||||
ClientRequest request;
|
||||
Reference in New Issue
Block a user