Asger F
e05e077b33
JS: Block jump steps through 'this' now that the capture lib handles 'this'
2024-10-29 08:31:57 +01:00
Asger F
16b08b74eb
JS: Add test showing potential for FPs when handling refinement guards
2024-10-29 08:31:55 +01:00
erik-krogh
2ee88f6774
fix the RAM setting on Windows
2024-10-28 20:39:34 +01:00
Rasmus Wriedt Larsen
1726287bf4
JS: Add e2e threat-model test
2024-10-25 15:03:44 +02:00
Rasmus Wriedt Larsen
d3ae4c930e
JS: Model newer yargs command-line parsing pattern
2024-10-25 15:03:43 +02:00
Rasmus Wriedt Larsen
3448751b4c
JS: Consolidate command-line argument modeling
...
Such that we can reuse the existing modeling, but have it globally
applied as a threat-model as well.
I Basically just moved the modeling. One important aspect is that this
changes is that the previously query-specific `argsParseStep` is now a
globally applied taint-step. This seems reasonable, if someone applied
the argument parsing to any user-controlled string, it seems correct to
propagate that taint for _any_ query.
2024-10-25 15:03:43 +02:00
Rasmus Wriedt Larsen
412e841d69
JS: Add environment threat-model source
2024-10-25 15:03:43 +02:00
Rasmus Wriedt Larsen
f733ac19a9
JS: Make (most) queries use ActiveThreatModelSource
...
7 cases looks something like this:
```
class RemoteFlowSourceAsSource extends Source instanceof RemoteFlowSource {
RemoteFlowSourceAsSource() { not this instanceof ClientSideRemoteFlowSource }
}
```
(some have variations like `not this.(ClientSideRemoteFlowSource).getKind().isPathOrUrl()`)
javascript/ql/lib/semmle/javascript/security/dataflow/ClientSideUrlRedirectCustomizations.qll
javascript/ql/lib/semmle/javascript/security/dataflow/CommandInjectionCustomizations.qll
javascript/ql/lib/semmle/javascript/security/dataflow/CorsMisconfigurationForCredentialsCustomizations.qll
javascript/ql/lib/semmle/javascript/security/dataflow/RegExpInjectionCustomizations.qll
javascript/ql/lib/semmle/javascript/security/dataflow/RequestForgeryCustomizations.qll
javascript/ql/lib/semmle/javascript/security/dataflow/ResourceExhaustionCustomizations.qll
javascript/ql/lib/semmle/javascript/security/dataflow/TaintedPathCustomizations.qll
2024-10-25 15:03:42 +02:00
Rasmus Wriedt Larsen
4b1c027359
JS: Integrate RemoteFlowSource with ThreatModelSource
2024-10-25 14:52:49 +02:00
Rasmus Wriedt Larsen
dbfbd2c00a
JS: Remove 'response' from default threat-models
...
I didn't want to put the configuration file in
`semmle/javascript/frameworks/**/*.model.yml`, so created `ext/` as in other
languages
2024-10-25 14:52:49 +02:00
Rasmus Wriedt Larsen
05dce8a0be
JS: Add test showing default active threat-models
2024-10-25 14:50:59 +02:00
Rasmus Wriedt Larsen
17a6d54e4d
JS: Setup basic support for threat-models
...
Integration with RemoteFlowSource is not straightforward, so postponing
that for later
Naming in other languages:
- `SourceNode` (for QL only modeling)
- `ThreatModelFlowSource` (for active sources from QL or data-extensions)
However, since we use `LocalSourceNode` in Python, and `SourceNode` in
JS (for local source nodes), it seems a bit confusing to follow the same
naming convention as other languages, and instead I came up with new names.
2024-10-25 14:50:59 +02:00
erik-krogh
073d6d8c14
have getId always return null if skipExtractingTypes is set
2024-10-23 16:50:23 +02:00
Asger F
958602e43e
JS: Cache getARead (as per instructions in the SSA library)
2024-10-22 12:46:20 +02:00
Asger F
e784813c3b
JS: Make barrier guards work with use-use flow
2024-10-22 12:46:19 +02:00
Asger F
67fdd864c9
JS: Add TODO
2024-10-22 12:46:18 +02:00
Asger F
81af9a1658
Fix missing flow through super calls
2024-10-22 12:46:17 +02:00
Asger F
12370e9210
JS: Use VariableOrThis in variable capture as well
2024-10-22 12:46:16 +02:00
Asger F
0ebe8bdd91
JS: Add test for missing capture flow for 'this'
2024-10-22 12:46:15 +02:00
Asger F
d31499d727
JS: introduce implicit this uses in general
2024-10-22 12:46:14 +02:00
Asger F
8dc0505f84
JS: Add test for missing flow into 'this' in field initializers
2024-10-22 12:46:13 +02:00
Asger F
c3c003b275
JS: Fix post-update flow into 'this'
2024-10-22 12:46:11 +02:00
Asger F
9fc99d6f9d
JS: Fix store into object literals that have a post-update node
2024-10-22 12:46:11 +02:00
Asger F
d626e79ed3
JS: Add two test cases for missing flow
2024-10-22 12:46:10 +02:00
Asger F
992c144559
JS: Add qldoc to file
2024-10-22 12:46:09 +02:00
Asger F
beaacf96b3
JS: Rename Internal -> Cached since whole file is internal now
2024-10-22 12:46:08 +02:00
Asger F
3fca27bee2
JS: Fix indentation
...
Only formatting changes
2024-10-22 12:46:07 +02:00
Asger F
ed0af958a9
JS: Add Public module and only expose that
...
Indentation will be fixed in next commit
2024-10-22 12:46:06 +02:00
Asger F
3b663bd2f6
JS: Remove BasicBlockInternal module and mark relevant predicates as public
...
This exposes the predicates publicly, but will be hidden again in the next commit.
2024-10-22 12:46:04 +02:00
Asger F
211b42d0ce
JS: Move BasicBlocks.qll -> internal/BasicBlocksInternal.qll
2024-10-22 12:46:03 +02:00
Asger F
9e600424cc
JS: Remove unused predicate
2024-10-22 12:46:02 +02:00
Asger F
78e961cef3
JS: Add use-use flow
2024-10-22 12:46:01 +02:00
Asger F
81e74d8bb5
JS: Add test case for spurious flow from lack of use-use
2024-10-22 12:46:00 +02:00
Asger F
7363b578b1
JS: Instantiate shared SSA library
...
JS: Remove with statement comment
2024-10-22 12:45:58 +02:00
Asger F
a258489551
JS: Refactor some internal methods to make them easier to alias
...
We need these to return the dominator instead of declaring it in the parameter list, so that we can use it directly to fulfill part of the signature for the SSA library.
We can't rewrite it with an inline predicate since the SSA module calls with a transitive closure '*', which does not permit inline predicates.
2024-10-22 12:45:57 +02:00
Asger F
443987b484
Merge branch 'main' into js/shared-dataflow-merge-main
2024-10-22 10:30:53 +02:00
github-actions[bot]
079ab77a38
Post-release preparation for codeql-cli-2.19.2
2024-10-15 12:16:59 +00:00
github-actions[bot]
255f55cf1a
Release preparation for version 2.19.2
2024-10-15 10:29:25 +00:00
Asger F
12e316b99d
JS: Update test output after merging in 'main'
...
- Paths are now relative to the test case, not the qlpack
- Paths going through an implicit reads have changed slightly
2024-10-08 10:11:15 +02:00
Asger F
e2e91ac7d9
Merge branch 'main' into js/shared-dataflow-merge-main
2024-10-08 09:28:26 +02:00
Tom Hvitved
d0ca39fb03
JS: Update expected test output
2024-10-04 08:35:33 +02:00
Asger F
5d2ce172eb
JS: Update a test to handle AdditionalSanitizerGuardNode
2024-10-02 14:44:42 +02:00
Asger F
6cbe04dcb7
JS: Consistently use the shared XSS barrier guards in the XSS queries
...
Previously only reflected XSS used shared barrier guards.
2024-10-02 14:44:17 +02:00
Asger F
341bacfe55
JS: Fix bug causing re-evaluation of cached barriers
2024-10-02 14:43:18 +02:00
github-actions[bot]
e97878ed63
Post-release preparation for codeql-cli-2.19.1
2024-09-30 19:49:00 +00:00
github-actions[bot]
455c8c5953
Release preparation for version 2.19.1
2024-09-30 17:59:48 +00:00
Sid Gawri
e8c68fff7f
resolve id conflict with dom based xss test ql
2024-09-25 10:01:59 -04:00
Asger F
1cd00a118c
Merge branch 'main' into js/shared-dataflow-merge-main
2024-09-18 14:57:50 +02:00
Asger F
7ba6995854
JS: Clarify a comment
2024-09-17 15:59:04 +02:00
github-actions[bot]
79be301984
Post-release preparation for codeql-cli-2.19.0
2024-09-16 14:09:32 +00:00
