hohn/codeql
1
0
Fork 0
mirror of https://github.com/github/codeql.git synced 2026-07-29 06:46:46 +02:00
Code Issues Packages Projects Releases Wiki Activity

Merge branch 'main' into tausbn/swift-syntax-rs-sequenced

Browse Source
This commit is contained in:
Taus
2026-07-28 13:39:46 +02:00
committed by GitHub
parent ba26e1d029 07514086a1
commit a3d9492e8c
5 changed files with 17 additions and 4 deletions
Download Patch File Download Diff File Expand all files Collapse all files

2
MODULE.bazel
View File

@@ -19,7 +19,7 @@ bazel_dep(name = "rules_cc", version = "0.2.17")
bazel_dep(name = "rules_go", version = "0.60.0")
bazel_dep(name = "rules_java", version = "9.6.1")
bazel_dep(name = "rules_pkg", version = "1.2.0")
bazel_dep(name = "rules_nodejs", version = "6.7.3")
bazel_dep(name = "rules_nodejs", version = "6.7.5")
bazel_dep(name = "rules_python", version = "1.9.0")
bazel_dep(name = "rules_shell", version = "0.7.1")
bazel_dep(name = "bazel_skylib", version = "1.9.0")

4
javascript/ql/lib/semmle/javascript/security/dataflow/MissingRateLimiting.qll
View File

@@ -189,7 +189,9 @@ class RouteHandlerLimitedByRateLimiterFlexible extends RateLimitingMiddleware in
{ }
private class FastifyRateLimiter extends RateLimitingMiddleware {
FastifyRateLimiter() { this = DataFlow::moduleImport("fastify-rate-limit") }
FastifyRateLimiter() {
this = DataFlow::moduleImport(["fastify-rate-limit", "@fastify/rate-limit"])
}
}
/**

4
javascript/ql/src/change-notes/2026-07-22-fastify-rate-limit.md Normal file
View File

@@ -0,0 +1,4 @@
---
category: minorAnalysis
---
* The `js/missing-rate-limiting` query now recognizes the `@fastify/rate-limit` package as a rate limiter.

3
javascript/ql/test/query-tests/Security/CWE-770/MissingRateLimit/MissingRateLimiting.expected
View File

@@ -9,4 +9,5 @@
| tst.js:64:25:64:63 | functio ... req); } | This route handler performs $@, but is not rate-limited. | tst.js:64:46:64:60 | verifyUser(req) | authorization |
| tst.js:76:25:76:53 | catchAs ... ndler1) | This route handler performs $@, but is not rate-limited. | tst.js:14:40:14:46 | login() | authorization |
| tst.js:88:24:88:40 | expensiveHandler1 | This route handler performs $@, but is not rate-limited. | tst.js:14:40:14:46 | login() | authorization |
| tst.js:112:28:112:44 | expensiveHandler1 | This route handler performs $@, but is not rate-limited. | tst.js:14:40:14:46 | login() | authorization |
| tst.js:111:28:111:44 | expensiveHandler1 | This route handler performs $@, but is not rate-limited. | tst.js:14:40:14:46 | login() | authorization |
| tst.js:116:39:116:55 | expensiveHandler1 | This route handler performs $@, but is not rate-limited. | tst.js:14:40:14:46 | login() | authorization |

8
javascript/ql/test/query-tests/Security/CWE-770/MissingRateLimit/tst.js
View File

@@ -91,7 +91,6 @@ fastifyApp.get('/bar', expensiveHandler1);
// Fastify per-route rate limiting via config.rateLimit
const fastifyApp2 = require('fastify')();
fastifyApp2.register(require('@fastify/rate-limit'));
fastifyApp2.post('/login', {
config: {
@@ -110,3 +109,10 @@ fastifyApp2.post('/signup', {
}, expensiveHandler1); // OK - has per-route rateLimit directly in options
fastifyApp2.post('/other', expensiveHandler1); // $ Alert - no rate limiting
// rate limiting using the scoped package name
const fastifyApp3 = require('fastify')();
fastifyApp3.get('/before-rate-limit', expensiveHandler1); // $ Alert
fastifyApp3.register(require('@fastify/rate-limit'));
fastifyApp3.get('/after-rate-limit', expensiveHandler1);