Asger F
6aef571c17
JS: Bump extractor version string
2024-10-29 11:28:06 +01:00
Asger F
3cc6b11e6b
JS: Expand attribute regex to include some Vue attributes
2024-10-29 11:19:01 +01:00
Asger F
560b3da851
JS: Add test with some special Vue attributes
2024-10-29 11:18:17 +01:00
erik-krogh
2ee88f6774
fix the RAM setting on Windows
2024-10-28 20:39:34 +01:00
Rasmus Wriedt Larsen
1726287bf4
JS: Add e2e threat-model test
2024-10-25 15:03:44 +02:00
Rasmus Wriedt Larsen
d3ae4c930e
JS: Model newer yargs command-line parsing pattern
2024-10-25 15:03:43 +02:00
Rasmus Wriedt Larsen
3448751b4c
JS: Consolidate command-line argument modeling
...
Such that we can reuse the existing modeling, but have it globally
applied as a threat-model as well.
I Basically just moved the modeling. One important aspect is that this
changes is that the previously query-specific `argsParseStep` is now a
globally applied taint-step. This seems reasonable, if someone applied
the argument parsing to any user-controlled string, it seems correct to
propagate that taint for _any_ query.
2024-10-25 15:03:43 +02:00
Rasmus Wriedt Larsen
412e841d69
JS: Add environment threat-model source
2024-10-25 15:03:43 +02:00
Rasmus Wriedt Larsen
f733ac19a9
JS: Make (most) queries use ActiveThreatModelSource
...
7 cases looks something like this:
```
class RemoteFlowSourceAsSource extends Source instanceof RemoteFlowSource {
RemoteFlowSourceAsSource() { not this instanceof ClientSideRemoteFlowSource }
}
```
(some have variations like `not this.(ClientSideRemoteFlowSource).getKind().isPathOrUrl()`)
javascript/ql/lib/semmle/javascript/security/dataflow/ClientSideUrlRedirectCustomizations.qll
javascript/ql/lib/semmle/javascript/security/dataflow/CommandInjectionCustomizations.qll
javascript/ql/lib/semmle/javascript/security/dataflow/CorsMisconfigurationForCredentialsCustomizations.qll
javascript/ql/lib/semmle/javascript/security/dataflow/RegExpInjectionCustomizations.qll
javascript/ql/lib/semmle/javascript/security/dataflow/RequestForgeryCustomizations.qll
javascript/ql/lib/semmle/javascript/security/dataflow/ResourceExhaustionCustomizations.qll
javascript/ql/lib/semmle/javascript/security/dataflow/TaintedPathCustomizations.qll
2024-10-25 15:03:42 +02:00
Rasmus Wriedt Larsen
4b1c027359
JS: Integrate RemoteFlowSource with ThreatModelSource
2024-10-25 14:52:49 +02:00
Rasmus Wriedt Larsen
dbfbd2c00a
JS: Remove 'response' from default threat-models
...
I didn't want to put the configuration file in
`semmle/javascript/frameworks/**/*.model.yml`, so created `ext/` as in other
languages
2024-10-25 14:52:49 +02:00
Rasmus Wriedt Larsen
05dce8a0be
JS: Add test showing default active threat-models
2024-10-25 14:50:59 +02:00
Rasmus Wriedt Larsen
17a6d54e4d
JS: Setup basic support for threat-models
...
Integration with RemoteFlowSource is not straightforward, so postponing
that for later
Naming in other languages:
- `SourceNode` (for QL only modeling)
- `ThreatModelFlowSource` (for active sources from QL or data-extensions)
However, since we use `LocalSourceNode` in Python, and `SourceNode` in
JS (for local source nodes), it seems a bit confusing to follow the same
naming convention as other languages, and instead I came up with new names.
2024-10-25 14:50:59 +02:00
erik-krogh
073d6d8c14
have getId always return null if skipExtractingTypes is set
2024-10-23 16:50:23 +02:00
github-actions[bot]
079ab77a38
Post-release preparation for codeql-cli-2.19.2
2024-10-15 12:16:59 +00:00
github-actions[bot]
255f55cf1a
Release preparation for version 2.19.2
2024-10-15 10:29:25 +00:00
Tom Hvitved
d0ca39fb03
JS: Update expected test output
2024-10-04 08:35:33 +02:00
github-actions[bot]
e97878ed63
Post-release preparation for codeql-cli-2.19.1
2024-09-30 19:49:00 +00:00
github-actions[bot]
455c8c5953
Release preparation for version 2.19.1
2024-09-30 17:59:48 +00:00
Sid Gawri
e8c68fff7f
resolve id conflict with dom based xss test ql
2024-09-25 10:01:59 -04:00
github-actions[bot]
79be301984
Post-release preparation for codeql-cli-2.19.0
2024-09-16 14:09:32 +00:00
Chris Smowton
be02864281
Copyedit
2024-09-16 12:25:49 +01:00
github-actions[bot]
acdafd9646
Release preparation for version 2.19.0
2024-09-16 10:56:10 +00:00
Dave Bartolomeo
485fc04029
Initial merge from main
2024-09-15 08:55:31 -04:00
Asger F
07bd854868
Merge pull request #17401 from pwntester/js/actions/secrets-in-artifacts
...
Javascript: Query to detect GITHUB_TOKEN leaked in artifacts
2024-09-11 15:54:36 +02:00
Sid Shankar
bc70d5ceb1
Adds change note
2024-09-11 00:52:21 +00:00
Sid Shankar
3516117215
Adds test for arbitrary specifiers in TS files
...
Adds test for arbitrary identifiers used in imports and exports
2024-09-11 00:37:49 +00:00
Sid Shankar
785af12f1c
Renames test file
2024-09-11 00:28:44 +00:00
Sid Shankar
aa787a9cb1
Handles arbitrary module identifiers
...
This commit enables support for arbitrary names for identifier and namespace imports and exports
2024-09-11 00:27:42 +00:00
Sid Shankar
2c74b5ee50
Updates TS extractor dependency to 5.6.2
2024-09-11 00:22:17 +00:00
Alvaro Muñoz
061d58ae4a
Update javascript/ql/src/change-notes/2024-09-06-new-actions-artifact-leak-query.md
...
Co-authored-by: Asger F <asgerf@github.com >
2024-09-10 22:18:04 +02:00
github-actions[bot]
97edff3f70
Post-release preparation for codeql-cli-2.18.4
2024-09-09 18:45:46 +00:00
github-actions[bot]
91537cdf9a
Release preparation for version 2.18.4
2024-09-09 16:08:48 +00:00
Alvaro Muñoz
d34a0ba306
Add change note
2024-09-06 23:28:57 +02:00
Alvaro Muñoz
5d1da861a2
fix: Use YamlScalar for booleans
2024-09-06 23:21:41 +02:00
Alvaro Muñoz
5df3af2272
Fix alert message
2024-09-06 23:06:57 +02:00
Alvaro Muñoz
d9e8792d33
[javascript] Query to detect GITHUB_TOKEN leaked in artifacts
2024-09-06 22:55:58 +02:00
erik-krogh
e2b16bd8f9
add some change-notes
2024-09-03 22:06:07 +02:00
erik-krogh
0fdd06fff5
use my script to delete outdated deprecations
2024-09-03 20:30:58 +02:00
Henry Mercer
3490067316
Merge branch 'main' into henrymercer/rc-3.15-mergeback
2024-08-29 19:48:01 +01:00
Cornelius Riemenschneider
b7b475d13b
JS: Move all integration tests.
...
We no longer need the platform-specific directories, so simplify the test organization.
If you don't want this change, just skip merging this PR.
It's purely optional.
The PR also deletes a spurious qlpack.yml that I missed when converting the tests to pytest.
2024-08-28 10:43:08 +02:00
Asger F
a1688f6a1a
Merge pull request #17240 from knewbury01/knewbury01/fix-helmetrequiredsetting-model
...
Update JS helmet model structure
2024-08-22 11:59:28 +02:00
Asger F
09aca6b47e
Merge pull request #17212 from mbaluda/main
...
Add support for importing NPM modules in XSJS sources
2024-08-22 10:54:33 +02:00
github-actions[bot]
0724fd7ce2
Post-release preparation for codeql-cli-2.18.3
2024-08-21 18:25:54 +00:00
github-actions[bot]
17cd9624fb
Release preparation for version 2.18.3
2024-08-21 17:13:52 +00:00
Asger F
7a7ab457a9
JS: Delete unneeded test code (and shift line numbers)
2024-08-16 14:38:54 +02:00
Asger F
9ee7599aeb
JS: Move AngularJSTemplateUrlSink to ClientSideUrlRedirection query
...
This is not perfect but at least we can be consistent about keeping URLs-that-lead-to-xss in the same query
2024-08-16 14:37:13 +02:00
Asger F
699d3a0a0a
JS: Update a RegExp injection test
...
RegExpInjection does not use client-side sources, but one of its tests was using postMessage events
as the taint source. Updating the test to use a different taint source.
2024-08-16 14:20:34 +02:00
Asger F
467256d465
JS: Add change note
2024-08-16 11:06:59 +02:00
Asger F
2d264052b3
JS: Treat browser message events as client-side sources
2024-08-16 11:02:12 +02:00
