hohn/codeql
1
0
Fork 0
mirror of https://github.com/github/codeql.git synced 2026-04-24 08:15:14 +02:00
Code Issues Packages Projects Releases Wiki Activity

Merge pull request #17240 from knewbury01/knewbury01/fix-helmetrequiredsetting-model

Browse Source 
Update JS helmet model structure
This commit is contained in:
Asger F
2024-08-22 11:59:28 +02:00
committed by GitHub
parent bd69b96752 7dcdad066f
commit a1688f6a1a
4 changed files with 44 additions and 25 deletions
Download Patch File Download Diff File Expand all files Collapse all files

2
javascript/ql/src/Security/CWE-693/CUSTOMIZING.md
View File

@@ -24,7 +24,7 @@ A suitable [model pack](https://docs.github.com/en/code-security/codeql-cli/usin
name: my-org/javascript-helmet-insecure-config-model-pack
version: 1.0.0
extensionTargets:
codeql/java-all: '*'
codeql/javascript-all: '*'
dataExtensions:
- models/**/*.yml
```

24
javascript/ql/src/Security/CWE-693/InsecureHelmet.ql
View File

@@ -12,30 +12,8 @@
*/
import javascript
import DataFlow
import semmle.javascript.frameworks.ExpressModules
class HelmetProperty extends DataFlow::Node instanceof DataFlow::PropWrite {
ExpressLibraries::HelmetRouteHandler helmet;
HelmetProperty() {
this = helmet.(DataFlow::CallNode).getAnArgument().getALocalSource().getAPropertyWrite()
}
ExpressLibraries::HelmetRouteHandler getHelmet() { result = helmet }
predicate isFalse() { DataFlow::PropWrite.super.getRhs().mayHaveBooleanValue(false) }
string getName() { result = DataFlow::PropWrite.super.getPropertyName() }
predicate isImportantSecuritySetting() {
// read from data extensions to allow enforcing custom settings
// defaults are located in javascript/ql/lib/semmle/frameworks/helmet/Helmet.Required.Setting.model.yml
requiredHelmetSecuritySetting(this.getName())
}
}
extensible predicate requiredHelmetSecuritySetting(string name);
import semmle.javascript.frameworks.helmet.Helmet
from HelmetProperty helmetProperty, ExpressLibraries::HelmetRouteHandler helmet
where