Napalys
72a69cfa17
Added change notes
2024-11-19 08:24:36 +01:00
Napalys
213ce225e0
JS: Add: taint step for Object.groupBy function, fixed test cases from 8ae05d8be4
2024-11-18 12:58:07 +01:00
Napalys
c02ad65fdc
JS: Add: taint step for Map.groupBy function
2024-11-18 12:50:06 +01:00
Napalys
1304ab7065
Added change notes
2024-11-18 08:05:51 +01:00
Napalys
fcb65534a8
JS: Add: Array.protype.findLast as taint step
2024-11-15 14:10:01 +01:00
Napalys
bed1f25b3f
JS: Fix: Now Array.prototype.with is properly flagged as taint step
2024-11-15 10:35:34 +01:00
Napalys
631a3770ec
JS: Add: change notes
2024-11-15 09:16:21 +01:00
Napalys Klicius
6fa3ff39a0
Merge branch 'main' into napalys/toSpliced-support
2024-11-14 16:56:32 +01:00
Napalys Klicius
c8c15a0899
Merge pull request #17910 from Napalys/napalys/matchAll-support
...
JS: Support for matchAll
2024-11-14 15:36:20 +01:00
Napalys
b333f523df
JS: Fix: now one can determine regex via Array.prototype.toSpliced function call.
2024-11-14 15:35:03 +01:00
Napalys
84234d59b9
JS: Fix: Ensure toSpliced with spread operator is flagged
2024-11-13 17:21:34 +01:00
Napalys
2df3d1b251
JS: Fix: Ensure toSpliced is flagged by taint tracking in test suite ( ed44358143)
2024-11-13 15:58:20 +01:00
Napalys
df4b596180
Added toSpliced as part ArraySliceStep and ArraySpliceStep, fixed tests from 2d9bc43506
2024-11-13 13:47:34 +01:00
Napalys
b4c84d3d3c
Added taint step for toSpliced, handles test from a65f80ef76
2024-11-13 12:41:41 +01:00
Napalys
5f8ff125e9
Added change notes
2024-11-12 12:21:39 +01:00
Napalys
7427a24ca1
Added test case for Array.prototype.toReversed, which is currently not flagged as a taint sink.
2024-11-12 12:02:37 +01:00
Napalys
3f0a54c2e8
Added support for Array.prototype.toSorted function
2024-11-12 12:02:04 +01:00
Napalys Klicius
6266dab518
Merge pull request #17951 from Napalys/napalys/reverse-support
...
JS: Added support for reverse function
2024-11-12 10:09:18 +01:00
Napalys
00790bf3f4
Added change notes
2024-11-11 15:43:54 +01:00
Napalys Klicius
42f7f73ae1
Update ArrayInPlaceManipulationTaintStep documentation
2024-11-11 15:38:57 +01:00
Napalys
ae57c12b15
Added change notes
2024-11-11 10:38:14 +01:00
Napalys
81bc7cd19f
Refactored SortTaintStep to ArrayInPlaceManipulationTaintStep to support both sort and reverse functions. Fixed newly added test case. from 8026a99db7
2024-11-11 08:32:03 +01:00
Napalys
f1c6dc1d9b
Moved SortTaintStep to more appropriate home TaintTracking->Arrays
2024-11-11 08:32:01 +01:00
Napalys
70cf1a57bc
Now catches usage of RegExp. after matchAll usage.
2024-11-08 08:59:31 +01:00
Napalys
dbd57e3870
Fixed issue where TaintTracking was not catching matchAll vulnerability
2024-11-07 13:40:10 +01:00
Napalys
514375dbf9
Fixes false positives from commit 42600c93ff
2024-11-07 13:00:54 +01:00
Napalys
449cee91c8
Fixes false positives from commit 445552d3b53ec9592e8e3892cb337d1004b6a432
2024-11-07 10:33:13 +01:00
Napalys Klicius
7825a46085
Merge branch 'github:main' into napalys/matchAll-support
2024-11-05 09:31:30 +01:00
Napalys
ccee34d6d3
Added support for matchAll in CWE-020 including new test cases
2024-11-05 08:51:24 +01:00
github-actions[bot]
f107d16b4e
Post-release preparation for codeql-cli-2.19.3
2024-11-04 17:20:08 +00:00
github-actions[bot]
cc7b724123
Release preparation for version 2.19.3
2024-11-04 16:37:28 +00:00
Rasmus Wriedt Larsen
dc8e645594
JS: Convert remaining queries to use ActiveThreatModelSourceAsSource
2024-11-01 10:47:10 +01:00
Rasmus Wriedt Larsen
19fae76a94
JS: Remove dummy comment
...
Co-authored-by: Asger F <asgerf@github.com >
2024-11-01 10:24:22 +01:00
Rasmus Wriedt Larsen
61e60de969
JS: Model readline as a stdin threat-model source
...
Technically not always true, but my assumption is that +90% of the time
that's what it will be used for, so while we could be more precise by
adding a taint-step from the `input` part of the construction, I'm not
sure it's worth it in this case.
Furthermore, doing so would break with the current way we model
threat-model sources, and how sources are generally modeled in JS... so
for a very pretty setup it would require changing all the other `file`
threat-model sources to start at the constructors such as
`fs.createReadStream()` and have taint-propagation steps towards the
actual use (like we do in Python)...
I couldn't see an easy path forwards for doing this while keeping the
Concepts integration, so I opted for the simpler solution here.
2024-10-31 14:29:30 +01:00
Rasmus Wriedt Larsen
eca8bf5a35
JS: Do simple modeling of process.stdin as threat-model source
2024-10-31 14:26:45 +01:00
Rasmus Wriedt Larsen
34b86c39c1
JS: Model fs.promises.readFile as file source
...
You could argue that proper modeling be done in the same way as
`NodeJSFileSystemAccessRead` is done for the callback based `fs` API (in
NodeJSLib.qll). However, that work is straying from the core goals I'm
working towards right now, so I'll argue that "perfect is the enemy of
good", and leave this as is for now.
2024-10-31 14:09:38 +01:00
Rasmus Wriedt Larsen
2b6c27eb60
JS: Add initial file threat-model support
...
However, as indicated by the `MISSING` annotations, we could do better.
2024-10-29 15:14:39 +01:00
Rasmus Wriedt Larsen
3656864695
JS: Add database threat-model source modeling
2024-10-29 15:11:09 +01:00
Rasmus Wriedt Larsen
7c7420a9a4
JS: Add change-note
2024-10-29 11:35:56 +01:00
Rasmus Wriedt Larsen
84f6b89ced
JS: Minor improvements to threat-model Concepts
...
Mirroring what was done for Python
2024-10-29 11:29:48 +01:00
Rasmus Wriedt Larsen
d3ae4c930e
JS: Model newer yargs command-line parsing pattern
2024-10-25 15:03:43 +02:00
Rasmus Wriedt Larsen
3448751b4c
JS: Consolidate command-line argument modeling
...
Such that we can reuse the existing modeling, but have it globally
applied as a threat-model as well.
I Basically just moved the modeling. One important aspect is that this
changes is that the previously query-specific `argsParseStep` is now a
globally applied taint-step. This seems reasonable, if someone applied
the argument parsing to any user-controlled string, it seems correct to
propagate that taint for _any_ query.
2024-10-25 15:03:43 +02:00
Rasmus Wriedt Larsen
412e841d69
JS: Add environment threat-model source
2024-10-25 15:03:43 +02:00
Rasmus Wriedt Larsen
f733ac19a9
JS: Make (most) queries use ActiveThreatModelSource
...
7 cases looks something like this:
```
class RemoteFlowSourceAsSource extends Source instanceof RemoteFlowSource {
RemoteFlowSourceAsSource() { not this instanceof ClientSideRemoteFlowSource }
}
```
(some have variations like `not this.(ClientSideRemoteFlowSource).getKind().isPathOrUrl()`)
javascript/ql/lib/semmle/javascript/security/dataflow/ClientSideUrlRedirectCustomizations.qll
javascript/ql/lib/semmle/javascript/security/dataflow/CommandInjectionCustomizations.qll
javascript/ql/lib/semmle/javascript/security/dataflow/CorsMisconfigurationForCredentialsCustomizations.qll
javascript/ql/lib/semmle/javascript/security/dataflow/RegExpInjectionCustomizations.qll
javascript/ql/lib/semmle/javascript/security/dataflow/RequestForgeryCustomizations.qll
javascript/ql/lib/semmle/javascript/security/dataflow/ResourceExhaustionCustomizations.qll
javascript/ql/lib/semmle/javascript/security/dataflow/TaintedPathCustomizations.qll
2024-10-25 15:03:42 +02:00
Rasmus Wriedt Larsen
4b1c027359
JS: Integrate RemoteFlowSource with ThreatModelSource
2024-10-25 14:52:49 +02:00
Rasmus Wriedt Larsen
dbfbd2c00a
JS: Remove 'response' from default threat-models
...
I didn't want to put the configuration file in
`semmle/javascript/frameworks/**/*.model.yml`, so created `ext/` as in other
languages
2024-10-25 14:52:49 +02:00
Rasmus Wriedt Larsen
17a6d54e4d
JS: Setup basic support for threat-models
...
Integration with RemoteFlowSource is not straightforward, so postponing
that for later
Naming in other languages:
- `SourceNode` (for QL only modeling)
- `ThreatModelFlowSource` (for active sources from QL or data-extensions)
However, since we use `LocalSourceNode` in Python, and `SourceNode` in
JS (for local source nodes), it seems a bit confusing to follow the same
naming convention as other languages, and instead I came up with new names.
2024-10-25 14:50:59 +02:00
github-actions[bot]
079ab77a38
Post-release preparation for codeql-cli-2.19.2
2024-10-15 12:16:59 +00:00
github-actions[bot]
255f55cf1a
Release preparation for version 2.19.2
2024-10-15 10:29:25 +00:00
github-actions[bot]
e97878ed63
Post-release preparation for codeql-cli-2.19.1
2024-09-30 19:49:00 +00:00
