JS: Auto-patch diff informed queries

javascript/ql/src/Security/CWE-915/PrototypePollutingFunction.ql

@@ -283,6 +283,15 @@ module PropNameTrackingConfig implements DataFlow::StateConfigSig {
     // flows through any contents, apart from a capture content.
     result = 1
   }
+
+  predicate observeDiffInformedIncrementalMode() {
+    // TODO(diff-informed): Manually verify if config can be diff-informed.
+    // ql/src/Security/CWE-915/PrototypePollutingFunction.ql:516: Flow call outside 'select' clause
+    // ql/src/Security/CWE-915/PrototypePollutingFunction.ql:519: Flow call outside 'select' clause
+    // ql/src/Security/CWE-915/PrototypePollutingFunction.ql:520: Flow call outside 'select' clause
+    // ql/src/Security/CWE-915/PrototypePollutingFunction.ql:524: Flow call outside 'select' clause
+    none()
+  }
 }
 
 class FlowState = PropNameTrackingConfig::FlowState;

javascript/ql/src/experimental/Security/CWE-094-dataURL/CodeInjection.ql

@@ -87,6 +87,8 @@ module CodeInjectionConfig implements DataFlow::StateConfigSig {
     state1 = TTaint() and
     state2 = TUrlConstructor()
   }
+
+  predicate observeDiffInformedIncrementalMode() { any() }
 }
 
 module CodeInjectionFlow = TaintTracking::GlobalWithState<CodeInjectionConfig>;

javascript/ql/src/experimental/Security/CWE-099/EnvValueAndKeyInjection.ql

@@ -33,6 +33,8 @@ module EnvValueAndKeyInjectionConfig implements DataFlow::ConfigSig {
       )
     )
   }
+
+  predicate observeDiffInformedIncrementalMode() { any() }
 }
 
 module EnvValueAndKeyInjectionFlow = TaintTracking::Global<EnvValueAndKeyInjectionConfig>;

javascript/ql/src/experimental/Security/CWE-099/EnvValueInjection.ql

@@ -19,6 +19,8 @@ module EnvValueInjectionConfig implements DataFlow::ConfigSig {
   predicate isSink(DataFlow::Node sink) {
     sink = API::moduleImport("process").getMember("env").getAMember().asSink()
   }
+
+  predicate observeDiffInformedIncrementalMode() { any() }
 }
 
 module EnvValueInjectionFlow = TaintTracking::Global<EnvValueInjectionConfig>;

javascript/ql/src/experimental/Security/CWE-340/TokenBuiltFromUUID.ql

@@ -41,6 +41,8 @@ module TokenBuiltFromUuidConfig implements DataFlow::ConfigSig {
   predicate isSource(DataFlow::Node source) { source instanceof PredictableResultSource }
 
   predicate isSink(DataFlow::Node sink) { sink instanceof TokenAssignmentValueSink }
+
+  predicate observeDiffInformedIncrementalMode() { any() }
 }
 
 module TokenBuiltFromUuidFlow = TaintTracking::Global<TokenBuiltFromUuidConfig>;

javascript/ql/src/experimental/Security/CWE-347/decodeJwtWithoutVerification.ql

@@ -17,6 +17,8 @@ module UnverifiedDecodeConfig implements DataFlow::ConfigSig {
   predicate isSource(DataFlow::Node source) { source instanceof ActiveThreatModelSource }
 
   predicate isSink(DataFlow::Node sink) { sink = unverifiedDecode() }
+
+  predicate observeDiffInformedIncrementalMode() { any() }
 }
 
 module UnverifiedDecodeFlow = TaintTracking::Global<UnverifiedDecodeConfig>;
@@ -25,6 +27,8 @@ module VerifiedDecodeConfig implements DataFlow::ConfigSig {
   predicate isSource(DataFlow::Node source) { source instanceof ActiveThreatModelSource }
 
   predicate isSink(DataFlow::Node sink) { sink = verifiedDecode() }
+
+  predicate observeDiffInformedIncrementalMode() { any() }
 }
 
 module VerifiedDecodeFlow = TaintTracking::Global<VerifiedDecodeConfig>;

javascript/ql/src/experimental/Security/CWE-347/decodeJwtWithoutVerificationLocalSource.ql

@@ -23,6 +23,13 @@ module DecodeWithoutVerificationConfig implements DataFlow::ConfigSig {
     or
     sink = verifiedDecode()
   }
+
+  predicate observeDiffInformedIncrementalMode() {
+    // TODO(diff-informed): Manually verify if config can be diff-informed.
+    // ql/src/experimental/Security/CWE-347/decodeJwtWithoutVerificationLocalSource.ql:32: Flow call outside 'select' clause
+    // ql/src/experimental/Security/CWE-347/decodeJwtWithoutVerificationLocalSource.ql:42: Flow call outside 'select' clause
+    none()
+  }
 }
 
 module DecodeWithoutVerificationFlow = TaintTracking::Global<DecodeWithoutVerificationConfig>;

javascript/ql/src/experimental/Security/CWE-522-DecompressionBombs/DecompressionBombs.ql

@@ -24,6 +24,8 @@ module DecompressionBombConfig implements DataFlow::ConfigSig {
       addstep.isAdditionalTaintStep(node1, node2)
     )
   }
+
+  predicate observeDiffInformedIncrementalMode() { any() }
 }
 
 module DecompressionBombFlow = TaintTracking::Global<DecompressionBombConfig>;

javascript/ql/src/experimental/Security/CWE-918/SSRF.qll

@@ -28,6 +28,8 @@ module SsrfConfig implements DataFlow::ConfigSig {
   }
 
   predicate isBarrierOut(DataFlow::Node node) { strictSanitizingPrefixEdge(node, _) }
+
+  predicate observeDiffInformedIncrementalMode() { any() }
 }
 
 module SsrfFlow = TaintTracking::Global<SsrfConfig>;

javascript/ql/src/experimental/Security/CWE-942/CorsPermissiveConfigurationQuery.qll

@@ -33,6 +33,8 @@ module CorsPermissiveConfigurationConfig implements DataFlow::StateConfigSig {
   }
 
   predicate isBarrier(DataFlow::Node node) { node instanceof Sanitizer }
+
+  predicate observeDiffInformedIncrementalMode() { any() }
 }
 
 module CorsPermissiveConfigurationFlow =