Napalys Klicius
8521c53a40
Renamed test directory to match the query name
...
Co-Authored-By: Asger F <316427+asgerf@users.noreply.github.com >
2025-06-03 14:12:12 +02:00
Napalys Klicius
d1869941c2
Renamed UnhandledStreamPipe.ql to a better fitting name and ID
...
As a side effect of merge `security-and-quality` does not contain anymore related new query.
Co-Authored-By: Asger F <316427+asgerf@users.noreply.github.com >
2025-06-03 13:57:10 +02:00
Napalys Klicius
f6e7059589
Merge branch 'main' into js/quality/stream_pipe
2025-06-03 13:48:41 +02:00
Napalys Klicius
298ef9ab12
Now able to track error handler registration via instance properties
2025-06-02 11:01:41 +02:00
Napalys Klicius
b9b62fa1c1
JS: Add URL from url package constructor taint step for request forgery detection
2025-05-30 18:32:02 +02:00
Napalys Klicius
19cc3e335f
JS: Add test case for RequestForgery with url wrapped via package URL
2025-05-30 18:26:47 +02:00
Napalys Klicius
f843cc02f6
Fix false positives in stream pipe analysis by improving error handler tracking via property access.
2025-05-30 18:08:04 +02:00
Napalys Klicius
5bb29b6e33
Now flags only .pipe calls which have an error somewhere down the stream, but not on the source stream.
2025-05-28 17:17:43 +02:00
Napalys Klicius
5214cc0407
Excluded ngrx, datorama, angular, react and langchain from stream pipe query.
2025-05-27 09:45:37 +02:00
Napalys Klicius
000e69fd48
Replaced fuzzy NonNodeStream MaD to a ql predicate to deal easier with submodules
2025-05-23 13:55:40 +02:00
Napalys Klicius
c6db32ed73
Add exceptions for arktype, execa, and highland to prevent them from being flagged by unhandled pipe error query
2025-05-23 12:34:11 +02:00
Napalys Klicius
15ff7cb41a
Added more test cases which common js libraries uses .pipe()
2025-05-23 12:30:49 +02:00
Napalys Klicius
b10a9481f3
Fixed false positives from strapi and rxjs/testing as well as when one passes function as second arg to pipe
2025-05-22 18:50:02 +02:00
Napalys Klicius
e6ae8bbde4
Added test cases where second parameter passed to pipe is a function and some popular library ones
2025-05-22 18:50:01 +02:00
Napalys Klicius
ac24fdd348
Add predicate to detect non-stream-like usage in sources of pipe calls
2025-05-22 18:49:59 +02:00
Napalys Klicius
5b1af0c0bd
Added detection of custom gulp-plumber sanitizer, thus one would not flag such instances.
2025-05-22 18:49:53 +02:00
Napalys Klicius
09220fce84
Fixed issue where pipe calls from rxjs package would been identified as pipe calls on streams
2025-05-22 12:33:36 +02:00
Napalys Klicius
d7f86db76c
Enhance PipeCall to exclude non-function and non-object arguments in pipe method detection
2025-05-22 12:31:27 +02:00
Napalys Klicius
4332de464a
Eliminate false positives by detecting non-stream objects returned from pipe() calls based on accessed properties
2025-05-22 12:31:26 +02:00
Napalys Klicius
5710f0cf51
Add test cases for non-stream field accesses and methods before and after pipe operations
2025-05-22 12:31:19 +02:00
Napalys Klicius
03d1f9a7d3
Restrict pipe detection to calls with 1-2 arguments
2025-05-21 11:41:22 +02:00
Napalys Klicius
30f2815503
Fixed issue where a custom pipe method which returns non stream would be flagged by the query
2025-05-21 11:41:19 +02:00
Napalys Klicius
ef1bde554a
Fixed issue where streams would not be tracked via chainable methods
2025-05-21 11:40:35 +02:00
Napalys Klicius
f39bf62fc6
test: Add edge cases for stream pipe error handling
...
Add tests for chained stream methods and non-stream pipe objects
2025-05-21 11:39:03 +02:00
Napalys Klicius
c27157f021
Add UnhandledStreamPipee Quality query and tests to detect missing error handlers in Node.js streams
2025-05-21 11:38:57 +02:00
Asger F
1e8a49f311
JS: More efficient nested package naming
2025-05-19 12:53:18 +02:00
Napalys Klicius
f6a8909bfe
Merge pull request #19356 from Napalys/js/merge_classes
...
JS: Merge `ES6Class` to `FunctionStyleClass`
2025-05-16 10:31:33 +02:00
Asger F
169ae19015
Merge pull request #19391 from asgerf/js/typescript-path-resolution
...
JS: Overhaul import resolution
2025-05-13 15:46:38 +02:00
Asger F
aea676df3c
Merge pull request #19445 from asgerf/js/summaries-with-fallback
...
JS: Generate flow summaries from summaryModels; only generate steps as a fallback
2025-05-13 14:49:38 +02:00
Napalys Klicius
d1e769ba54
Merge pull request #19422 from Napalys/js/shelljs
...
JS: Modeling of `ShellJS` functions
2025-05-02 14:18:44 +02:00
Asger F
b8be1bcee8
JS: Avoid duplication with constructor body
2025-05-02 13:44:03 +02:00
Asger F
16fc8c3d9e
JS: Benign test updates
2025-05-02 11:09:19 +02:00
Asger F
a44bdf3be2
JS: Generate summaries from summaryModel, and only generate steps as a fallback
2025-05-01 15:22:47 +02:00
Napalys Klicius
d4b5ef6a66
Refactor process.env handling in CleartextLogging and IndirectCommandInjection modules to use ThreatModelSource
2025-05-01 11:14:15 +02:00
Napalys Klicius
33d8ffa83e
Added test cases for shelljs.env
2025-05-01 11:11:29 +02:00
Napalys Klicius
9bab59363c
Fix class instance method detection in constructor receiver
2025-05-01 09:14:39 +02:00
Napalys Klicius
7430d0e5e0
Added failing test with method as field
2025-05-01 09:14:37 +02:00
Napalys Klicius
e9ee7134ef
Refactor prototype reference retrieval in ClassNode and update expected test output
2025-04-30 18:51:39 +02:00
Napalys Klicius
71f1b82a56
Added support for fastify.all
2025-04-30 14:54:09 +02:00
Napalys Klicius
6d61766366
Added test case for fastify.all
2025-04-30 14:50:35 +02:00
Napalys Klicius
18cea2d6a5
Added support for shelljs.cmd and async-shelljs.asyncExec
2025-04-30 13:37:02 +02:00
Napalys Klicius
25d04f1cdd
Added support for shelljs.which
2025-04-30 13:35:17 +02:00
Napalys Klicius
f6fae7ad60
Added test cases for cmd, which and asyncExec
2025-04-30 13:33:31 +02:00
Napalys Klicius
6de38b1827
Merge pull request #19300 from Napalys/js/fastify
...
JS: Added support for `fastify.addHook`
2025-04-29 18:32:25 +02:00
Asger F
b0f73f1cbd
JS: Update test output now that we import .d.ts files more liberally
2025-04-29 16:06:39 +02:00
Asger F
70a5ec5607
JS: Add package.json files in tests relying on node_modules
...
We don't extract node_modules folders by default so these tests aren't
that relevant anymore, and we no longer follow node_modules resolution
rules directly.
Instead, these imports are resolved based on the monorepo support which
simply requires a package.json file to exist. There is not a good enough
reason to support node_modules directly, so we're accepting some
minor regression in these tests.
2025-04-29 16:06:38 +02:00
Asger F
be5de9c080
JS: Update test output
...
path.resolve() and template expressions are now working.
Previously they could not be resolved because Import.getImportedPath() returned a PathExpr,
and these were not instances of PathExpr.
2025-04-29 16:06:35 +02:00
Asger F
ed2a832a55
JS: Deprecate PathExpr and related classes
2025-04-29 13:23:47 +02:00
Asger F
d724874969
JS: Implement babel-plugin-root-import as a PathMapping
2025-04-29 13:23:40 +02:00
Asger F
e4420f63fb
JS: Move babel-root-import test
...
This moves the test for the babel `root-import` plugin into the new
unit test for import resolution, so we only have one set of tests to
maintain.
The actual implementation is added in the next commit.
2025-04-29 13:23:38 +02:00
