hohn/codeql
1
0
Fork 0
mirror of https://github.com/github/codeql.git synced 2026-04-25 08:45:14 +02:00
Code Issues Packages Projects Releases Wiki Activity

JS: Auto-patch diff informed queries

Browse Source
This commit is contained in:
Asger F
2024-12-19 13:22:17 +01:00
parent d8b1d00905
commit fd763a0883
71 changed files with 173 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

2
javascript/ql/lib/semmle/javascript/security/dataflow/BrokenCryptoAlgorithmQuery.qll
View File

@@ -25,6 +25,8 @@ module BrokenCryptoAlgorithmConfig implements DataFlow::ConfigSig {
predicate isSink(DataFlow::Node sink) { sink instanceof Sink }
predicate isBarrier(DataFlow::Node node) { node instanceof Sanitizer }
predicate observeDiffInformedIncrementalMode() { any() }
}
/**

2
javascript/ql/lib/semmle/javascript/security/dataflow/BuildArtifactLeakQuery.qll
View File

@@ -30,6 +30,8 @@ module BuildArtifactLeakConfig implements DataFlow::ConfigSig {
contents = DataFlow::ContentSet::anyProperty() and
isSink(node)
}
predicate observeDiffInformedIncrementalMode() { any() }
}
/**

2
javascript/ql/lib/semmle/javascript/security/dataflow/CleartextLoggingQuery.qll
View File

@@ -41,6 +41,8 @@ module CleartextLoggingConfig implements DataFlow::ConfigSig {
contents = DataFlow::ContentSet::anyProperty() and
isSink(node)
}
predicate observeDiffInformedIncrementalMode() { any() }
}
/**

2
javascript/ql/lib/semmle/javascript/security/dataflow/CleartextStorageQuery.qll
View File

@@ -25,6 +25,8 @@ module ClearTextStorageConfig implements DataFlow::ConfigSig {
predicate isSink(DataFlow::Node sink) { sink instanceof Sink }
predicate isBarrier(DataFlow::Node node) { node instanceof Sanitizer }
predicate observeDiffInformedIncrementalMode() { any() }
}
module ClearTextStorageFlow = TaintTracking::Global<ClearTextStorageConfig>;

2
javascript/ql/lib/semmle/javascript/security/dataflow/ClientSideRequestForgeryQuery.qll
View File

@@ -31,6 +31,8 @@ module ClientSideRequestForgeryConfig implements DataFlow::ConfigSig {
predicate isAdditionalFlowStep(DataFlow::Node node1, DataFlow::Node node2) {
isAdditionalRequestForgeryStep(node1, node2)
}
predicate observeDiffInformedIncrementalMode() { any() }
}
/**

2
javascript/ql/lib/semmle/javascript/security/dataflow/ClientSideUrlRedirectQuery.qll
View File

@@ -54,6 +54,8 @@ module ClientSideUrlRedirectConfig implements DataFlow::StateConfigSig {
state1 = state2
)
}
predicate observeDiffInformedIncrementalMode() { any() }
}
/**

2
javascript/ql/lib/semmle/javascript/security/dataflow/CodeInjectionQuery.qll
View File

@@ -24,6 +24,8 @@ module CodeInjectionConfig implements DataFlow::ConfigSig {
// HTML sanitizers are insufficient protection against code injection
node1 = node2.(HtmlSanitizerCall).getInput()
}
predicate observeDiffInformedIncrementalMode() { any() }
}
/**

2
javascript/ql/lib/semmle/javascript/security/dataflow/CommandInjectionQuery.qll
View File

@@ -30,6 +30,8 @@ module CommandInjectionConfig implements DataFlow::ConfigSig {
predicate isSink(DataFlow::Node sink) { isSinkWithHighlight(sink, _) }
predicate isBarrier(DataFlow::Node node) { node instanceof Sanitizer }
predicate observeDiffInformedIncrementalMode() { any() }
}
/**

8
javascript/ql/lib/semmle/javascript/security/dataflow/ConditionalBypassQuery.qll
View File

@@ -24,6 +24,14 @@ module ConditionalBypassConfig implements DataFlow::ConfigSig {
// comparing a tainted expression against a constant gives a tainted result
node2.asExpr().(Comparison).hasOperands(node1.asExpr(), any(ConstantExpr c))
}
predicate observeDiffInformedIncrementalMode() {
// TODO(diff-informed): Manually verify if config can be diff-informed.
// ql/lib/semmle/javascript/security/dataflow/ConditionalBypassQuery.qll:104: Flow call outside 'select' clause
// ql/lib/semmle/javascript/security/dataflow/ConditionalBypassQuery.qll:113: Flow call outside 'select' clause
// ql/lib/semmle/javascript/security/dataflow/ConditionalBypassQuery.qll:115: Flow call outside 'select' clause
none()
}
}
/**

2
javascript/ql/lib/semmle/javascript/security/dataflow/CorsMisconfigurationForCredentialsQuery.qll
View File

@@ -23,6 +23,8 @@ module CorsMisconfigurationConfig implements DataFlow::ConfigSig {
node instanceof Sanitizer or
node = TaintTracking::AdHocWhitelistCheckSanitizer::getABarrierNode()
}
predicate observeDiffInformedIncrementalMode() { any() }
}
/**

2
javascript/ql/lib/semmle/javascript/security/dataflow/DeepObjectResourceExhaustionQuery.qll
View File

@@ -33,6 +33,8 @@ module DeepObjectResourceExhaustionConfig implements DataFlow::StateConfigSig {
) {
TaintedObject::isAdditionalFlowStep(node1, state1, node2, state2)
}
predicate observeDiffInformedIncrementalMode() { any() }
}
/**

7
javascript/ql/lib/semmle/javascript/security/dataflow/DifferentKindsComparisonBypassQuery.qll
View File

@@ -20,6 +20,13 @@ private module DifferentKindsComparisonBypassConfig implements DataFlow::ConfigS
predicate isSink(DataFlow::Node sink) { sink instanceof Sink }
predicate isBarrier(DataFlow::Node node) { node instanceof Sanitizer }
predicate observeDiffInformedIncrementalMode() {
// TODO(diff-informed): Manually verify if config can be diff-informed.
// ql/lib/semmle/javascript/security/dataflow/DifferentKindsComparisonBypassQuery.qll:39: Flow call outside 'select' clause
// ql/lib/semmle/javascript/security/dataflow/DifferentKindsComparisonBypassQuery.qll:40: Flow call outside 'select' clause
none()
}
}
/**

2
javascript/ql/lib/semmle/javascript/security/dataflow/DomBasedXssQuery.qll
View File

@@ -113,6 +113,8 @@ module DomBasedXssConfig implements DataFlow::StateConfigSig {
state1 = state2
)
}
predicate observeDiffInformedIncrementalMode() { any() }
}
/**

2
javascript/ql/lib/semmle/javascript/security/dataflow/ExceptionXssQuery.qll
View File

@@ -155,6 +155,8 @@ module ExceptionXssConfig implements DataFlow::StateConfigSig {
}
int accessPathLimit() { result = 1 }
predicate observeDiffInformedIncrementalMode() { any() }
}
/**

8
javascript/ql/lib/semmle/javascript/security/dataflow/ExternalAPIUsedWithUntrustedDataQuery.qll
View File

@@ -31,6 +31,14 @@ module ExternalAPIUsedWithUntrustedDataConfig implements DataFlow::ConfigSig {
// Also report values that escape while inside a property
isSink(node) and contents = DataFlow::ContentSet::anyProperty()
}
predicate observeDiffInformedIncrementalMode() {
// TODO(diff-informed): Manually verify if config can be diff-informed.
// ql/lib/semmle/javascript/security/dataflow/ExternalAPIUsedWithUntrustedDataQuery.qll:96: Flow call outside 'select' clause
// ql/lib/semmle/javascript/security/dataflow/ExternalAPIUsedWithUntrustedDataQuery.qll:99: Flow call outside 'select' clause
// ql/lib/semmle/javascript/security/dataflow/ExternalAPIUsedWithUntrustedDataQuery.qll:109: Flow call outside 'select' clause
none()
}
}
/**

2
javascript/ql/lib/semmle/javascript/security/dataflow/FileAccessToHttpQuery.qll
View File

@@ -24,6 +24,8 @@ module FileAccessToHttpConfig implements DataFlow::ConfigSig {
isSink(node) and
contents = DataFlow::ContentSet::anyProperty()
}
predicate observeDiffInformedIncrementalMode() { any() }
}
/**

2
javascript/ql/lib/semmle/javascript/security/dataflow/HardcodedCredentialsQuery.qll
View File

@@ -69,6 +69,8 @@ module HardcodedCredentialsConfig implements DataFlow::ConfigSig {
node2 = n.getACall()
)
}
predicate observeDiffInformedIncrementalMode() { any() }
}
/**

2
javascript/ql/lib/semmle/javascript/security/dataflow/HardcodedDataInterpretedAsCodeQuery.qll
View File

@@ -34,6 +34,8 @@ module HardcodedDataInterpretedAsCodeConfig implements DataFlow::StateConfigSig
state1 = [FlowState::modified(), FlowState::unmodified()] and
state2 = FlowState::modified()
}
predicate observeDiffInformedIncrementalMode() { any() }
}
/**

2
javascript/ql/lib/semmle/javascript/security/dataflow/HostHeaderPoisoningInEmailGenerationQuery.qll
View File

@@ -17,6 +17,8 @@ module HostHeaderPoisoningConfig implements DataFlow::ConfigSig {
}
predicate isSink(DataFlow::Node node) { exists(EmailSender email | node = email.getABody()) }
predicate observeDiffInformedIncrementalMode() { any() }
}
/**

2
javascript/ql/lib/semmle/javascript/security/dataflow/HttpToFileAccessQuery.qll
View File

@@ -17,6 +17,8 @@ module HttpToFileAccessConfig implements DataFlow::ConfigSig {
predicate isSink(DataFlow::Node sink) { sink instanceof Sink }
predicate isBarrier(DataFlow::Node node) { node instanceof Sanitizer }
predicate observeDiffInformedIncrementalMode() { any() }
}
/**

2
javascript/ql/lib/semmle/javascript/security/dataflow/ImproperCodeSanitizationQuery.qll
View File

@@ -19,6 +19,8 @@ module ImproperCodeSanitizationConfig implements DataFlow::ConfigSig {
predicate isSink(DataFlow::Node sink) { sink instanceof Sink }
predicate isBarrier(DataFlow::Node node) { node instanceof Sanitizer }
predicate observeDiffInformedIncrementalMode() { any() }
}
/**

2
javascript/ql/lib/semmle/javascript/security/dataflow/IncompleteHtmlAttributeSanitizationQuery.qll
View File

@@ -42,6 +42,8 @@ module IncompleteHtmlAttributeSanitizationConfig implements DataFlow::StateConfi
}
predicate isBarrier(DataFlow::Node n) { n instanceof Sanitizer }
predicate observeDiffInformedIncrementalMode() { any() }
}
/**

2
javascript/ql/lib/semmle/javascript/security/dataflow/IndirectCommandInjectionQuery.qll
View File

@@ -26,6 +26,8 @@ module IndirectCommandInjectionConfig implements DataFlow::ConfigSig {
predicate isSink(DataFlow::Node sink) { isSinkWithHighlight(sink, _) }
predicate isBarrier(DataFlow::Node node) { node instanceof Sanitizer }
predicate observeDiffInformedIncrementalMode() { any() }
}
/**

2
javascript/ql/lib/semmle/javascript/security/dataflow/InsecureDownloadQuery.qll
View File

@@ -23,6 +23,8 @@ module InsecureDownloadConfig implements DataFlow::StateConfigSig {
predicate isSink(DataFlow::Node sink, FlowState state) { sink.(Sink).getAFlowState() = state }
predicate isBarrier(DataFlow::Node node) { node instanceof Sanitizer }
predicate observeDiffInformedIncrementalMode() { any() }
}
/**

2
javascript/ql/lib/semmle/javascript/security/dataflow/InsecureRandomnessQuery.qll
View File

@@ -40,6 +40,8 @@ module InsecureRandomnessConfig implements DataFlow::ConfigSig {
// taint steps as additional flow steps.
TaintTracking::defaultTaintStep(node1, node2)
}
predicate observeDiffInformedIncrementalMode() { any() }
}
/**

2
javascript/ql/lib/semmle/javascript/security/dataflow/InsecureTemporaryFileQuery.qll
View File

@@ -19,6 +19,8 @@ module InsecureTemporaryFileConfig implements DataFlow::ConfigSig {
predicate isSink(DataFlow::Node sink) { sink instanceof Sink }
predicate isBarrier(DataFlow::Node node) { node instanceof Sanitizer }
predicate observeDiffInformedIncrementalMode() { any() }
}
/**

2
javascript/ql/lib/semmle/javascript/security/dataflow/InsufficientPasswordHashQuery.qll
View File

@@ -25,6 +25,8 @@ module InsufficientPasswordHashConfig implements DataFlow::ConfigSig {
predicate isSink(DataFlow::Node sink) { sink instanceof Sink }
predicate isBarrier(DataFlow::Node node) { node instanceof Sanitizer }
predicate observeDiffInformedIncrementalMode() { any() }
}
/**

2
javascript/ql/lib/semmle/javascript/security/dataflow/LogInjectionQuery.qll
View File

@@ -28,6 +28,8 @@ module LogInjectionConfig implements DataFlow::ConfigSig {
predicate isSink(DataFlow::Node sink) { sink instanceof Sink }
predicate isBarrier(DataFlow::Node node) { node instanceof Sanitizer }
predicate observeDiffInformedIncrementalMode() { any() }
}
/**

2
javascript/ql/lib/semmle/javascript/security/dataflow/LoopBoundInjectionQuery.qll
View File

@@ -38,6 +38,8 @@ module LoopBoundInjectionConfig implements DataFlow::StateConfigSig {
) {
TaintedObject::isAdditionalFlowStep(node1, state1, node2, state2)
}
predicate observeDiffInformedIncrementalMode() { any() }
}
/**

2
javascript/ql/lib/semmle/javascript/security/dataflow/NosqlInjectionQuery.qll
View File

@@ -51,6 +51,8 @@ module NosqlInjectionConfig implements DataFlow::StateConfigSig {
state1.isTaint() and
state2 = state1
}
predicate observeDiffInformedIncrementalMode() { any() }
}
/**

2
javascript/ql/lib/semmle/javascript/security/dataflow/PostMessageStarQuery.qll
View File

@@ -37,6 +37,8 @@ module PostMessageStarConfig implements DataFlow::ConfigSig {
// If an object leaks, all of its properties have leaked
isSink(node) and contents = DataFlow::ContentSet::anyProperty()
}
predicate observeDiffInformedIncrementalMode() { any() }
}
/**

2
javascript/ql/lib/semmle/javascript/security/dataflow/PrototypePollutingAssignmentQuery.qll
View File

@@ -113,6 +113,8 @@ module PrototypePollutingAssignmentConfig implements DataFlow::StateConfigSig {
or
node = DataFlow::MakeStateBarrierGuard<FlowState, BarrierGuard>::getABarrierNode(state)
}
predicate observeDiffInformedIncrementalMode() { any() }
}
/** Taint-tracking for reasoning about prototype-polluting assignments. */

2
javascript/ql/lib/semmle/javascript/security/dataflow/PrototypePollutionQuery.qll
View File

@@ -47,6 +47,8 @@ module PrototypePollutionConfig implements DataFlow::StateConfigSig {
predicate isBarrier(DataFlow::Node node, FlowState state) {
node = TaintedObject::SanitizerGuard::getABarrierNode(state)
}
predicate observeDiffInformedIncrementalMode() { any() }
}
/**

2
javascript/ql/lib/semmle/javascript/security/dataflow/ReflectedXssQuery.qll
View File

@@ -18,6 +18,8 @@ module ReflectedXssConfig implements DataFlow::ConfigSig {
predicate isBarrier(DataFlow::Node node) {
node instanceof Sanitizer or node = SharedXss::BarrierGuard::getABarrierNode()
}
predicate observeDiffInformedIncrementalMode() { any() }
}
/**

2
javascript/ql/lib/semmle/javascript/security/dataflow/RegExpInjectionQuery.qll
View File

@@ -19,6 +19,8 @@ module RegExpInjectionConfig implements DataFlow::ConfigSig {
predicate isSink(DataFlow::Node sink) { sink instanceof Sink }
predicate isBarrier(DataFlow::Node node) { node instanceof Sanitizer }
predicate observeDiffInformedIncrementalMode() { any() }
}
/**

2
javascript/ql/lib/semmle/javascript/security/dataflow/RemotePropertyInjectionQuery.qll
View File

@@ -23,6 +23,8 @@ module RemotePropertyInjectionConfig implements DataFlow::ConfigSig {
node instanceof Sanitizer or
node = StringConcatenation::getRoot(any(ConstantString str).flow())
}
predicate observeDiffInformedIncrementalMode() { any() }
}
/**

2
javascript/ql/lib/semmle/javascript/security/dataflow/RequestForgeryQuery.qll
View File

@@ -26,6 +26,8 @@ module RequestForgeryConfig implements DataFlow::ConfigSig {
predicate isAdditionalFlowStep(DataFlow::Node node1, DataFlow::Node node2) {
isAdditionalRequestForgeryStep(node1, node2)
}
predicate observeDiffInformedIncrementalMode() { any() }
}
/**

2
javascript/ql/lib/semmle/javascript/security/dataflow/ResourceExhaustionQuery.qll
View File

@@ -27,6 +27,8 @@ module ResourceExhaustionConfig implements DataFlow::ConfigSig {
predicate isAdditionalFlowStep(DataFlow::Node node1, DataFlow::Node node2) {
isNumericFlowStep(node1, node2)
}
predicate observeDiffInformedIncrementalMode() { any() }
}
/**

2
javascript/ql/lib/semmle/javascript/security/dataflow/SecondOrderCommandInjectionQuery.qll
View File

@@ -47,6 +47,8 @@ module SecondOrderCommandInjectionConfig implements DataFlow::StateConfigSig {
TaintTracking::defaultTaintStep(node1, node2) and
state1 = state2
}
predicate observeDiffInformedIncrementalMode() { any() }
}
/**

2
javascript/ql/lib/semmle/javascript/security/dataflow/ServerSideUrlRedirectQuery.qll
View File

@@ -30,6 +30,8 @@ module ServerSideUrlRedirectConfig implements DataFlow::ConfigSig {
node2 = call
)
}
predicate observeDiffInformedIncrementalMode() { any() }
}
/**

2
javascript/ql/lib/semmle/javascript/security/dataflow/ShellCommandInjectionFromEnvironmentQuery.qll
View File

@@ -27,6 +27,8 @@ module ShellCommandInjectionFromEnvironmentConfig implements DataFlow::ConfigSig
predicate isSink(DataFlow::Node sink) { isSinkWithHighlight(sink, _) }
predicate isBarrier(DataFlow::Node node) { node instanceof Sanitizer }
predicate observeDiffInformedIncrementalMode() { any() }
}
/**

2
javascript/ql/lib/semmle/javascript/security/dataflow/SqlInjectionQuery.qll
View File

@@ -31,6 +31,8 @@ module SqlInjectionConfig implements DataFlow::ConfigSig {
node2 = call
)
}
predicate observeDiffInformedIncrementalMode() { any() }
}
/**

2
javascript/ql/lib/semmle/javascript/security/dataflow/StackTraceExposureQuery.qll
View File

@@ -28,6 +28,8 @@ module StackTraceExposureConfig implements DataFlow::ConfigSig {
}
predicate isSink(DataFlow::Node snk) { snk instanceof Sink }
predicate observeDiffInformedIncrementalMode() { any() }
}
/**

2
javascript/ql/lib/semmle/javascript/security/dataflow/StoredXssQuery.qll
View File

@@ -18,6 +18,8 @@ module StoredXssConfig implements DataFlow::ConfigSig {
predicate isBarrier(DataFlow::Node node) {
node instanceof Sanitizer or node = Shared::BarrierGuard::getABarrierNode()
}
predicate observeDiffInformedIncrementalMode() { any() }
}
/**

2
javascript/ql/lib/semmle/javascript/security/dataflow/TaintedFormatStringQuery.qll
View File

@@ -19,6 +19,8 @@ module TaintedFormatStringConfig implements DataFlow::ConfigSig {
predicate isSink(DataFlow::Node sink) { sink instanceof Sink }
predicate isBarrier(DataFlow::Node node) { node instanceof Sanitizer }
predicate observeDiffInformedIncrementalMode() { any() }
}
/**

2
javascript/ql/lib/semmle/javascript/security/dataflow/TaintedPathQuery.qll
View File

@@ -47,6 +47,8 @@ module TaintedPathConfig implements DataFlow::StateConfigSig {
) {
TaintedPath::isAdditionalFlowStep(node1, state1, node2, state2)
}
predicate observeDiffInformedIncrementalMode() { any() }
}
/**

2
javascript/ql/lib/semmle/javascript/security/dataflow/TemplateObjectInjectionQuery.qll
View File

@@ -45,6 +45,8 @@ module TemplateObjectInjectionConfig implements DataFlow::StateConfigSig {
TaintTracking::defaultTaintStep(node1, node2) and
state1 = state2
}
predicate observeDiffInformedIncrementalMode() { any() }
}
/**

2
javascript/ql/lib/semmle/javascript/security/dataflow/TypeConfusionThroughParameterTamperingQuery.qll
View File

@@ -27,6 +27,8 @@ module TypeConfusionConfig implements DataFlow::ConfigSig {
predicate isBarrier(DataFlow::Node node) {
node instanceof Barrier or node = DataFlow::MakeBarrierGuard<BarrierGuard>::getABarrierNode()
}
predicate observeDiffInformedIncrementalMode() { any() }
}
/**

2
javascript/ql/lib/semmle/javascript/security/dataflow/UnsafeCodeConstruction.qll
View File

@@ -32,6 +32,8 @@ module UnsafeCodeConstruction {
}
DataFlow::FlowFeature getAFeature() { result instanceof DataFlow::FeatureHasSourceCallContext }
predicate observeDiffInformedIncrementalMode() { any() }
}
/**

2
javascript/ql/lib/semmle/javascript/security/dataflow/UnsafeDeserializationQuery.qll
View File

@@ -18,6 +18,8 @@ module UnsafeDeserializationConfig implements DataFlow::ConfigSig {
predicate isSink(DataFlow::Node sink) { sink instanceof Sink }
predicate isBarrier(DataFlow::Node node) { node instanceof Sanitizer }
predicate observeDiffInformedIncrementalMode() { any() }
}
/**

2
javascript/ql/lib/semmle/javascript/security/dataflow/UnsafeDynamicMethodAccessQuery.qll
View File

@@ -75,6 +75,8 @@ module UnsafeDynamicMethodAccessConfig implements DataFlow::StateConfigSig {
TaintTracking::defaultTaintStep(node1, node2) and
state1 = state2
}
predicate observeDiffInformedIncrementalMode() { any() }
}
/**

2
javascript/ql/lib/semmle/javascript/security/dataflow/UnsafeHtmlConstructionQuery.qll
View File

@@ -60,6 +60,8 @@ module UnsafeHtmlConstructionConfig implements DataFlow::StateConfigSig {
}
DataFlow::FlowFeature getAFeature() { result instanceof DataFlow::FeatureHasSourceCallContext }
predicate observeDiffInformedIncrementalMode() { any() }
}
/**

2
javascript/ql/lib/semmle/javascript/security/dataflow/UnsafeJQueryPluginQuery.qll
View File

@@ -36,6 +36,8 @@ module UnsafeJQueryPluginConfig implements DataFlow::ConfigSig {
// prefixing through a poor-mans templating system:
node = any(StringReplaceCall call).getRawReplacement()
}
predicate observeDiffInformedIncrementalMode() { any() }
}
/**

2
javascript/ql/lib/semmle/javascript/security/dataflow/UnsafeShellCommandConstructionQuery.qll
View File

@@ -25,6 +25,8 @@ module UnsafeShellCommandConstructionConfig implements DataFlow::ConfigSig {
}
DataFlow::FlowFeature getAFeature() { result instanceof DataFlow::FeatureHasSourceCallContext }
predicate observeDiffInformedIncrementalMode() { any() }
}
/**

2
javascript/ql/lib/semmle/javascript/security/dataflow/UnvalidatedDynamicMethodCallQuery.qll
View File

@@ -91,6 +91,8 @@ module UnvalidatedDynamicMethodCallConfig implements DataFlow::StateConfigSig {
TaintTracking::defaultTaintStep(node1, node2) and
state1 = state2
}
predicate observeDiffInformedIncrementalMode() { any() }
}
/**

2
javascript/ql/lib/semmle/javascript/security/dataflow/XmlBombQuery.qll
View File

@@ -19,6 +19,8 @@ module XmlBombConfig implements DataFlow::ConfigSig {
predicate isSink(DataFlow::Node sink) { sink instanceof Sink }
predicate isBarrier(DataFlow::Node node) { node instanceof Sanitizer }
predicate observeDiffInformedIncrementalMode() { any() }
}
/**

2
javascript/ql/lib/semmle/javascript/security/dataflow/XpathInjectionQuery.qll
View File

@@ -20,6 +20,8 @@ module XpathInjectionConfig implements DataFlow::ConfigSig {
predicate isSink(DataFlow::Node sink) { sink instanceof Sink }
predicate isBarrier(DataFlow::Node node) { node instanceof Sanitizer }
predicate observeDiffInformedIncrementalMode() { any() }
}
/**

2
javascript/ql/lib/semmle/javascript/security/dataflow/XssThroughDomQuery.qll
View File

@@ -28,6 +28,8 @@ module XssThroughDomConfig implements DataFlow::ConfigSig {
node2 = DataFlow::globalVarRef("URL").getAMemberCall("createObjectURL") and
node1 = node2.(DataFlow::InvokeNode).getArgument(0)
}
predicate observeDiffInformedIncrementalMode() { any() }
}
/**

2
javascript/ql/lib/semmle/javascript/security/dataflow/XxeQuery.qll
View File

@@ -19,6 +19,8 @@ module XxeConfig implements DataFlow::ConfigSig {
predicate isSink(DataFlow::Node sink) { sink instanceof Sink }
predicate isBarrier(DataFlow::Node node) { node instanceof Sanitizer }
predicate observeDiffInformedIncrementalMode() { any() }
}
/**

2
javascript/ql/lib/semmle/javascript/security/dataflow/ZipSlipQuery.qll
View File

@@ -44,6 +44,8 @@ module ZipSlipConfig implements DataFlow::StateConfigSig {
) {
TaintedPath::isAdditionalFlowStep(node1, state1, node2, state2)
}
predicate observeDiffInformedIncrementalMode() { any() }
}
/** A taint tracking configuration for unsafe archive extraction. */

2
javascript/ql/lib/semmle/javascript/security/regexp/PolynomialReDoSQuery.qll
View File

@@ -25,6 +25,8 @@ module PolynomialReDoSConfig implements DataFlow::ConfigSig {
predicate isAdditionalFlowStep(DataFlow::Node node1, DataFlow::Node node2) { none() }
int fieldFlowBranchLimit() { result = 1 } // library inputs are too expensive on some projects
predicate observeDiffInformedIncrementalMode() { any() }
}
/** Taint-tracking for reasoning about polynomial regular expression denial-of-service attacks. */

9
javascript/ql/src/Security/CWE-915/PrototypePollutingFunction.ql
View File

@@ -283,6 +283,15 @@ module PropNameTrackingConfig implements DataFlow::StateConfigSig {
// flows through any contents, apart from a capture content.
result = 1
}
predicate observeDiffInformedIncrementalMode() {
// TODO(diff-informed): Manually verify if config can be diff-informed.
// ql/src/Security/CWE-915/PrototypePollutingFunction.ql:516: Flow call outside 'select' clause
// ql/src/Security/CWE-915/PrototypePollutingFunction.ql:519: Flow call outside 'select' clause
// ql/src/Security/CWE-915/PrototypePollutingFunction.ql:520: Flow call outside 'select' clause
// ql/src/Security/CWE-915/PrototypePollutingFunction.ql:524: Flow call outside 'select' clause
none()
}
}
class FlowState = PropNameTrackingConfig::FlowState;

2
javascript/ql/src/experimental/Security/CWE-094-dataURL/CodeInjection.ql
View File

@@ -87,6 +87,8 @@ module CodeInjectionConfig implements DataFlow::StateConfigSig {
state1 = TTaint() and
state2 = TUrlConstructor()
}
predicate observeDiffInformedIncrementalMode() { any() }
}
module CodeInjectionFlow = TaintTracking::GlobalWithState<CodeInjectionConfig>;

2
javascript/ql/src/experimental/Security/CWE-099/EnvValueAndKeyInjection.ql
View File

@@ -33,6 +33,8 @@ module EnvValueAndKeyInjectionConfig implements DataFlow::ConfigSig {
)
)
}
predicate observeDiffInformedIncrementalMode() { any() }
}
module EnvValueAndKeyInjectionFlow = TaintTracking::Global<EnvValueAndKeyInjectionConfig>;

2
javascript/ql/src/experimental/Security/CWE-099/EnvValueInjection.ql
View File

@@ -19,6 +19,8 @@ module EnvValueInjectionConfig implements DataFlow::ConfigSig {
predicate isSink(DataFlow::Node sink) {
sink = API::moduleImport("process").getMember("env").getAMember().asSink()
}
predicate observeDiffInformedIncrementalMode() { any() }
}
module EnvValueInjectionFlow = TaintTracking::Global<EnvValueInjectionConfig>;

2
javascript/ql/src/experimental/Security/CWE-340/TokenBuiltFromUUID.ql
View File

@@ -41,6 +41,8 @@ module TokenBuiltFromUuidConfig implements DataFlow::ConfigSig {
predicate isSource(DataFlow::Node source) { source instanceof PredictableResultSource }
predicate isSink(DataFlow::Node sink) { sink instanceof TokenAssignmentValueSink }
predicate observeDiffInformedIncrementalMode() { any() }
}
module TokenBuiltFromUuidFlow = TaintTracking::Global<TokenBuiltFromUuidConfig>;

4
javascript/ql/src/experimental/Security/CWE-347/decodeJwtWithoutVerification.ql
View File

@@ -17,6 +17,8 @@ module UnverifiedDecodeConfig implements DataFlow::ConfigSig {
predicate isSource(DataFlow::Node source) { source instanceof ActiveThreatModelSource }
predicate isSink(DataFlow::Node sink) { sink = unverifiedDecode() }
predicate observeDiffInformedIncrementalMode() { any() }
}
module UnverifiedDecodeFlow = TaintTracking::Global<UnverifiedDecodeConfig>;
@@ -25,6 +27,8 @@ module VerifiedDecodeConfig implements DataFlow::ConfigSig {
predicate isSource(DataFlow::Node source) { source instanceof ActiveThreatModelSource }
predicate isSink(DataFlow::Node sink) { sink = verifiedDecode() }
predicate observeDiffInformedIncrementalMode() { any() }
}
module VerifiedDecodeFlow = TaintTracking::Global<VerifiedDecodeConfig>;

7
javascript/ql/src/experimental/Security/CWE-347/decodeJwtWithoutVerificationLocalSource.ql
View File

@@ -23,6 +23,13 @@ module DecodeWithoutVerificationConfig implements DataFlow::ConfigSig {
or
sink = verifiedDecode()
}
predicate observeDiffInformedIncrementalMode() {
// TODO(diff-informed): Manually verify if config can be diff-informed.
// ql/src/experimental/Security/CWE-347/decodeJwtWithoutVerificationLocalSource.ql:32: Flow call outside 'select' clause
// ql/src/experimental/Security/CWE-347/decodeJwtWithoutVerificationLocalSource.ql:42: Flow call outside 'select' clause
none()
}
}
module DecodeWithoutVerificationFlow = TaintTracking::Global<DecodeWithoutVerificationConfig>;

2
javascript/ql/src/experimental/Security/CWE-522-DecompressionBombs/DecompressionBombs.ql
View File

@@ -24,6 +24,8 @@ module DecompressionBombConfig implements DataFlow::ConfigSig {
addstep.isAdditionalTaintStep(node1, node2)
)
}
predicate observeDiffInformedIncrementalMode() { any() }
}
module DecompressionBombFlow = TaintTracking::Global<DecompressionBombConfig>;

2
javascript/ql/src/experimental/Security/CWE-918/SSRF.qll
View File

@@ -28,6 +28,8 @@ module SsrfConfig implements DataFlow::ConfigSig {
}
predicate isBarrierOut(DataFlow::Node node) { strictSanitizingPrefixEdge(node, _) }
predicate observeDiffInformedIncrementalMode() { any() }
}
module SsrfFlow = TaintTracking::Global<SsrfConfig>;

2
javascript/ql/src/experimental/Security/CWE-942/CorsPermissiveConfigurationQuery.qll
View File

@@ -33,6 +33,8 @@ module CorsPermissiveConfigurationConfig implements DataFlow::StateConfigSig {
}
predicate isBarrier(DataFlow::Node node) { node instanceof Sanitizer }
predicate observeDiffInformedIncrementalMode() { any() }
}
module CorsPermissiveConfigurationFlow =