BazookaMusic
0b7133c4ce
JS: Add prompt injection detection (CWE-1427) for OpenAI, Anthropic, and Google GenAI SDKs
...
Add experimental CodeQL query detecting prompt injection vulnerabilities
in JavaScript/TypeScript applications using AI SDK libraries.
Modeled frameworks:
- openai (OpenAI, AzureOpenAI): responses, chat.completions, completions,
images, embeddings, beta.assistants, beta.threads, audio APIs
- @openai/agents: Agent instructions, handoffDescription, run/Runner.run,
asTool, tool()
- @anthropic-ai/sdk: messages.create, beta.messages.create,
beta.agents.create/update
- @google/genai (GoogleGenAI): generateContent, generateContentStream,
generateImages, editImage, chats, live.connect
Includes role-based filtering (system/developer/assistant/model roles)
and constant-comparison sanitizer guard.
2026-04-30 17:39:09 +02:00
Tom Hvitved
11dcd90435
Shared: Use final aliases in ConcentsShared.qll
2025-08-05 14:53:52 +02:00
Jeroen Ketema
cbde11ddc9
Properly share ConceptsShared.qll
2025-07-14 16:30:45 +02:00
Asger F
3061d51b20
JS: Add ThreatModelSource#isCilentSideSource()
2025-01-22 10:45:48 +01:00
Rasmus Wriedt Larsen
2b6c27eb60
JS: Add initial file threat-model support
...
However, as indicated by the `MISSING` annotations, we could do better.
2024-10-29 15:14:39 +01:00
Rasmus Wriedt Larsen
3656864695
JS: Add database threat-model source modeling
2024-10-29 15:11:09 +01:00
Rasmus Wriedt Larsen
84f6b89ced
JS: Minor improvements to threat-model Concepts
...
Mirroring what was done for Python
2024-10-29 11:29:48 +01:00
Rasmus Wriedt Larsen
17a6d54e4d
JS: Setup basic support for threat-models
...
Integration with RemoteFlowSource is not straightforward, so postponing
that for later
Naming in other languages:
- `SourceNode` (for QL only modeling)
- `ThreatModelFlowSource` (for active sources from QL or data-extensions)
However, since we use `LocalSourceNode` in Python, and `SourceNode` in
JS (for local source nodes), it seems a bit confusing to follow the same
naming convention as other languages, and instead I came up with new names.
2024-10-25 14:50:59 +02:00
erik-krogh
baa31e1469
delete outdated deprecations
2024-04-25 22:19:28 +02:00
Anders Schack-Mulligen
8d97fe9ed3
JavaScript: Autoformat
2023-03-10 09:41:20 +01:00
Alex Ford
9cfd0f5f46
JS: fix qldoc
2023-02-16 11:00:37 +00:00
Alex Ford
1958b9dcd5
JS: add missing qldoc
2023-02-15 16:59:03 +00:00
Alex Ford
925b4a3fa8
JS: improve documentation on deprecated CryptographicOperation#getInput() predicate
2023-02-15 16:23:46 +00:00
Alex Ford
c7aaad9ed0
JS: avoid adding a deprecated CryptographicOperation#getInput to py/ruby
2023-02-15 16:23:46 +00:00
Alex Ford
983055b8f9
JS: Use shared CryptographicOperation concept and implement BlockMode getBlockMode()
2023-02-02 20:30:30 +00:00
Stephan Brandauer
09a28c428c
base implementation of Spanner model on models-as-data
2022-01-12 17:07:16 +01:00
Stephan Brandauer
132e0bf4b7
add database accesses as additional (heuristic) remote flow sources
2022-01-11 11:38:41 +01:00
Andrew Eisenberg
45d1fa7f01
Packaging: Rafactor Javascript core libraries
...
Extract the external facing `qll` files into the codeql/javascript-all
query pack.
2021-08-25 12:15:56 -07:00
