Napalys Klicius
7ee0a7b398
Update javascript/ql/lib/semmle/javascript/Collections.qll
...
Co-authored-by: Erik Krogh Kristensen <erik-krogh@github.com >
2024-11-21 14:02:42 +01:00
Napalys Klicius
edb9b47111
Merge pull request #18047 from Napalys/napalys/ES2023-string-protytpe-toWellFormed
...
JS: Added taint-step String.prototype.toWellFormed ES2023 feature
2024-11-21 14:01:21 +01:00
Asger F
9dad2d62d7
JS: Update DataFlowConsistency
2024-11-21 12:54:11 +01:00
Asger F
ce00bd2cc9
JS: More docs
2024-11-21 11:06:43 +01:00
Asger F
4e62a512c5
JS: Only apply exception propagator when no other summary applies
...
Previously a few Promise-related methods were special-cased, which is no longer needed.
2024-11-21 11:01:05 +01:00
Asger F
948d21ca07
JS: Propagate exceptions from summarized callables by default
2024-11-21 10:24:31 +01:00
Asger F
dcdb2e5133
JS: Fix callback check so it works without parameters
2024-11-21 10:24:29 +01:00
Napalys
afc2d3e6d2
JS: Add: String.protytpe.toWellFormed to StringManipulationTaintStep
2024-11-20 17:42:25 +01:00
Napalys
64c45debdb
JS: removed unnecessary getALocalSource from ArrayCallBackDataFlowStep
2024-11-20 14:57:00 +01:00
Napalys
9dbf7d1828
JS: removed unnecessary getALocalSource from ArrayCallBackDataTaintStep
2024-11-20 14:54:06 +01:00
Asger F
d52bc971b8
Merge branch 'main' into js/shared-dataflow-merge-main
2024-11-20 14:05:03 +01:00
Napalys Klicius
a957e00fe5
Merge branch 'main' into napalys/ES2024-group-functions
2024-11-20 14:03:31 +01:00
Napalys
58faa2d71e
JS: Add: dataflow step for static method of groupBy from Map.
2024-11-20 13:34:11 +01:00
Napalys
28ead4011a
JS: Add: taint step to handle propagation of data flow from the array to callback
2024-11-19 14:15:15 +01:00
Asger F
d1c9e47d23
JS: More aggressive test file classification
2024-11-19 13:23:32 +01:00
Asger F
01669908f2
JS: Block InsecureRandomness flow into test files
2024-11-19 13:23:31 +01:00
Asger F
80a5a5909e
JS: Use getUnderlyingValue() a few places in VariableCapture
2024-11-19 13:23:29 +01:00
Napalys
c03d69af1e
JS: Add: dataflow step for find, findLast, findLastIndex callback functions
2024-11-19 09:42:11 +01:00
Napalys
1b0f8aa657
JS: removed unnecessary findlast module import
2024-11-19 09:30:05 +01:00
Asger F
023dcce400
JS: Disable variable capture heuristic
...
Bailing out can be more expensive as the resulting jump steps themselves
cause perf issues. The limit of 100 variables per scope has also been
added in the interim, which handles the cases that this needed to cover.
2024-11-18 13:44:10 +01:00
Asger F
37676f41aa
JS: Remove jump steps from IIFE steps
2024-11-18 13:38:34 +01:00
Asger F
7acc5689cf
JS: Port exception steps to a universal summary
2024-11-18 13:27:58 +01:00
Napalys
213ce225e0
JS: Add: taint step for Object.groupBy function, fixed test cases from 8ae05d8be4
2024-11-18 12:58:07 +01:00
Napalys
c02ad65fdc
JS: Add: taint step for Map.groupBy function
2024-11-18 12:50:06 +01:00
Napalys
fcb65534a8
JS: Add: Array.protype.findLast as taint step
2024-11-15 14:10:01 +01:00
Napalys
bed1f25b3f
JS: Fix: Now Array.prototype.with is properly flagged as taint step
2024-11-15 10:35:34 +01:00
Napalys Klicius
6fa3ff39a0
Merge branch 'main' into napalys/toSpliced-support
2024-11-14 16:56:32 +01:00
Napalys Klicius
c8c15a0899
Merge pull request #17910 from Napalys/napalys/matchAll-support
...
JS: Support for matchAll
2024-11-14 15:36:20 +01:00
Napalys
b333f523df
JS: Fix: now one can determine regex via Array.prototype.toSpliced function call.
2024-11-14 15:35:03 +01:00
Napalys
84234d59b9
JS: Fix: Ensure toSpliced with spread operator is flagged
2024-11-13 17:21:34 +01:00
Napalys
2df3d1b251
JS: Fix: Ensure toSpliced is flagged by taint tracking in test suite ( ed44358143)
2024-11-13 15:58:20 +01:00
Napalys
df4b596180
Added toSpliced as part ArraySliceStep and ArraySpliceStep, fixed tests from 2d9bc43506
2024-11-13 13:47:34 +01:00
Napalys
b4c84d3d3c
Added taint step for toSpliced, handles test from a65f80ef76
2024-11-13 12:41:41 +01:00
Napalys
7427a24ca1
Added test case for Array.prototype.toReversed, which is currently not flagged as a taint sink.
2024-11-12 12:02:37 +01:00
Napalys
3f0a54c2e8
Added support for Array.prototype.toSorted function
2024-11-12 12:02:04 +01:00
Asger F
80ee372ddf
JS: Replace an unused value with _
2024-11-12 11:24:17 +01:00
Asger F
637baabe37
JS: Clarify why there are no SSA definitions
2024-11-12 11:23:35 +01:00
Napalys Klicius
6266dab518
Merge pull request #17951 from Napalys/napalys/reverse-support
...
JS: Added support for reverse function
2024-11-12 10:09:18 +01:00
Napalys Klicius
42f7f73ae1
Update ArrayInPlaceManipulationTaintStep documentation
2024-11-11 15:38:57 +01:00
Napalys
81bc7cd19f
Refactored SortTaintStep to ArrayInPlaceManipulationTaintStep to support both sort and reverse functions. Fixed newly added test case. from 8026a99db7
2024-11-11 08:32:03 +01:00
Napalys
f1c6dc1d9b
Moved SortTaintStep to more appropriate home TaintTracking->Arrays
2024-11-11 08:32:01 +01:00
Napalys
70cf1a57bc
Now catches usage of RegExp. after matchAll usage.
2024-11-08 08:59:31 +01:00
Napalys
dbd57e3870
Fixed issue where TaintTracking was not catching matchAll vulnerability
2024-11-07 13:40:10 +01:00
Napalys
514375dbf9
Fixes false positives from commit 42600c93ff
2024-11-07 13:00:54 +01:00
Napalys
449cee91c8
Fixes false positives from commit 445552d3b53ec9592e8e3892cb337d1004b6a432
2024-11-07 10:33:13 +01:00
Napalys Klicius
7825a46085
Merge branch 'github:main' into napalys/matchAll-support
2024-11-05 09:31:30 +01:00
Napalys
ccee34d6d3
Added support for matchAll in CWE-020 including new test cases
2024-11-05 08:51:24 +01:00
Rasmus Wriedt Larsen
dc8e645594
JS: Convert remaining queries to use ActiveThreatModelSourceAsSource
2024-11-01 10:47:10 +01:00
Rasmus Wriedt Larsen
19fae76a94
JS: Remove dummy comment
...
Co-authored-by: Asger F <asgerf@github.com >
2024-11-01 10:24:22 +01:00
Rasmus Wriedt Larsen
61e60de969
JS: Model readline as a stdin threat-model source
...
Technically not always true, but my assumption is that +90% of the time
that's what it will be used for, so while we could be more precise by
adding a taint-step from the `input` part of the construction, I'm not
sure it's worth it in this case.
Furthermore, doing so would break with the current way we model
threat-model sources, and how sources are generally modeled in JS... so
for a very pretty setup it would require changing all the other `file`
threat-model sources to start at the constructors such as
`fs.createReadStream()` and have taint-propagation steps towards the
actual use (like we do in Python)...
I couldn't see an easy path forwards for doing this while keeping the
Concepts integration, so I opted for the simpler solution here.
2024-10-31 14:29:30 +01:00
