Josh Brown
52d7a3bb99
Merge remote-tracking branch 'origin/main' into jb1/isLibraryFile-nomagic
2024-11-26 03:43:07 -08:00
Dilan Bhalla
eb56cb94b0
metadata fixes
2024-11-22 14:29:43 -08:00
Dilan Bhalla
e3a04757d7
msft extractor queries
2024-11-22 14:11:02 -08:00
Josh Brown
e60df2c50e
Merge branch 'main' into jb1/isLibraryFile-nomagic
2024-11-22 14:56:11 +11:00
Josh Brown
15f92fcda8
No magic isLibraryFile
2024-11-21 19:52:03 -08:00
Dilan
1e1fd4566c
Merge tag 'codeql-cli/latest'
...
Compatible with the latest released version of the CodeQL CLI
2024-11-07 17:59:18 +00:00
github-actions[bot]
cc7b724123
Release preparation for version 2.19.3
2024-11-04 16:37:28 +00:00
Rasmus Wriedt Larsen
c0ad9ba529
Merge branch 'main' into js-threat-models
2024-11-01 10:48:32 +01:00
Rasmus Wriedt Larsen
dc8e645594
JS: Convert remaining queries to use ActiveThreatModelSourceAsSource
2024-11-01 10:47:10 +01:00
Rasmus Wriedt Larsen
19fae76a94
JS: Remove dummy comment
...
Co-authored-by: Asger F <asgerf@github.com >
2024-11-01 10:24:22 +01:00
Rasmus Wriedt Larsen
61e60de969
JS: Model readline as a stdin threat-model source
...
Technically not always true, but my assumption is that +90% of the time
that's what it will be used for, so while we could be more precise by
adding a taint-step from the `input` part of the construction, I'm not
sure it's worth it in this case.
Furthermore, doing so would break with the current way we model
threat-model sources, and how sources are generally modeled in JS... so
for a very pretty setup it would require changing all the other `file`
threat-model sources to start at the constructors such as
`fs.createReadStream()` and have taint-propagation steps towards the
actual use (like we do in Python)...
I couldn't see an easy path forwards for doing this while keeping the
Concepts integration, so I opted for the simpler solution here.
2024-10-31 14:29:30 +01:00
Rasmus Wriedt Larsen
eca8bf5a35
JS: Do simple modeling of process.stdin as threat-model source
2024-10-31 14:26:45 +01:00
Rasmus Wriedt Larsen
34b86c39c1
JS: Model fs.promises.readFile as file source
...
You could argue that proper modeling be done in the same way as
`NodeJSFileSystemAccessRead` is done for the callback based `fs` API (in
NodeJSLib.qll). However, that work is straying from the core goals I'm
working towards right now, so I'll argue that "perfect is the enemy of
good", and leave this as is for now.
2024-10-31 14:09:38 +01:00
Rasmus Wriedt Larsen
971f53870e
JS: Include fs externs
...
Makes a difference due to the modeling of NodeJSFileSystemAccessRead depending on these, see
412e841d69/javascript/ql/lib/semmle/javascript/frameworks/NodeJSLib.qll (L479-L488)7cef4322e7/javascript/externs/nodejs/fs.js
2024-10-31 13:51:22 +01:00
Rasmus Wriedt Larsen
b47fa77dc6
JS: Add tests for stdin threat-model sources
2024-10-31 12:59:21 +01:00
Rasmus Wriedt Larsen
2b6c27eb60
JS: Add initial file threat-model support
...
However, as indicated by the `MISSING` annotations, we could do better.
2024-10-29 15:14:39 +01:00
Rasmus Wriedt Larsen
3656864695
JS: Add database threat-model source modeling
2024-10-29 15:11:09 +01:00
Tom Hvitved
1259b7e8e7
JS: Post-processing query for inline test expectations
2024-10-29 13:35:38 +01:00
Rasmus Wriedt Larsen
7c7420a9a4
JS: Add change-note
2024-10-29 11:35:56 +01:00
Rasmus Wriedt Larsen
84f6b89ced
JS: Minor improvements to threat-model Concepts
...
Mirroring what was done for Python
2024-10-29 11:29:48 +01:00
Asger F
6aef571c17
JS: Bump extractor version string
2024-10-29 11:28:06 +01:00
Asger F
3cc6b11e6b
JS: Expand attribute regex to include some Vue attributes
2024-10-29 11:19:01 +01:00
Asger F
560b3da851
JS: Add test with some special Vue attributes
2024-10-29 11:18:17 +01:00
erik-krogh
2ee88f6774
fix the RAM setting on Windows
2024-10-28 20:39:34 +01:00
Rasmus Wriedt Larsen
1726287bf4
JS: Add e2e threat-model test
2024-10-25 15:03:44 +02:00
Rasmus Wriedt Larsen
d3ae4c930e
JS: Model newer yargs command-line parsing pattern
2024-10-25 15:03:43 +02:00
Rasmus Wriedt Larsen
3448751b4c
JS: Consolidate command-line argument modeling
...
Such that we can reuse the existing modeling, but have it globally
applied as a threat-model as well.
I Basically just moved the modeling. One important aspect is that this
changes is that the previously query-specific `argsParseStep` is now a
globally applied taint-step. This seems reasonable, if someone applied
the argument parsing to any user-controlled string, it seems correct to
propagate that taint for _any_ query.
2024-10-25 15:03:43 +02:00
Rasmus Wriedt Larsen
412e841d69
JS: Add environment threat-model source
2024-10-25 15:03:43 +02:00
Rasmus Wriedt Larsen
f733ac19a9
JS: Make (most) queries use ActiveThreatModelSource
...
7 cases looks something like this:
```
class RemoteFlowSourceAsSource extends Source instanceof RemoteFlowSource {
RemoteFlowSourceAsSource() { not this instanceof ClientSideRemoteFlowSource }
}
```
(some have variations like `not this.(ClientSideRemoteFlowSource).getKind().isPathOrUrl()`)
javascript/ql/lib/semmle/javascript/security/dataflow/ClientSideUrlRedirectCustomizations.qll
javascript/ql/lib/semmle/javascript/security/dataflow/CommandInjectionCustomizations.qll
javascript/ql/lib/semmle/javascript/security/dataflow/CorsMisconfigurationForCredentialsCustomizations.qll
javascript/ql/lib/semmle/javascript/security/dataflow/RegExpInjectionCustomizations.qll
javascript/ql/lib/semmle/javascript/security/dataflow/RequestForgeryCustomizations.qll
javascript/ql/lib/semmle/javascript/security/dataflow/ResourceExhaustionCustomizations.qll
javascript/ql/lib/semmle/javascript/security/dataflow/TaintedPathCustomizations.qll
2024-10-25 15:03:42 +02:00
Rasmus Wriedt Larsen
4b1c027359
JS: Integrate RemoteFlowSource with ThreatModelSource
2024-10-25 14:52:49 +02:00
Rasmus Wriedt Larsen
dbfbd2c00a
JS: Remove 'response' from default threat-models
...
I didn't want to put the configuration file in
`semmle/javascript/frameworks/**/*.model.yml`, so created `ext/` as in other
languages
2024-10-25 14:52:49 +02:00
Rasmus Wriedt Larsen
05dce8a0be
JS: Add test showing default active threat-models
2024-10-25 14:50:59 +02:00
Rasmus Wriedt Larsen
17a6d54e4d
JS: Setup basic support for threat-models
...
Integration with RemoteFlowSource is not straightforward, so postponing
that for later
Naming in other languages:
- `SourceNode` (for QL only modeling)
- `ThreatModelFlowSource` (for active sources from QL or data-extensions)
However, since we use `LocalSourceNode` in Python, and `SourceNode` in
JS (for local source nodes), it seems a bit confusing to follow the same
naming convention as other languages, and instead I came up with new names.
2024-10-25 14:50:59 +02:00
erik-krogh
073d6d8c14
have getId always return null if skipExtractingTypes is set
2024-10-23 16:50:23 +02:00
Dilan
7ad49cf3ff
Merge tag 'codeql-cli/latest'
...
Compatible with the latest released version of the CodeQL CLI
2024-10-21 17:59:16 +00:00
github-actions[bot]
ca0345324e
Release preparation for version 2.19.2
2024-10-18 15:16:21 +00:00
Arthur Baars
eb515f884b
Revert "Release preparation for version 2.19.2"
2024-10-18 17:06:20 +02:00
github-actions[bot]
079ab77a38
Post-release preparation for codeql-cli-2.19.2
2024-10-15 12:16:59 +00:00
github-actions[bot]
255f55cf1a
Release preparation for version 2.19.2
2024-10-15 10:29:25 +00:00
Dilan
878bd5b098
Merge tag 'codeql-cli/latest'
...
Compatible with the latest released version of the CodeQL CLI
2024-10-04 20:59:08 +00:00
Tom Hvitved
d0ca39fb03
JS: Update expected test output
2024-10-04 08:35:33 +02:00
github-actions[bot]
fe54961b84
Release preparation for version 2.19.1
2024-10-02 18:30:42 +00:00
Angela P Wen
e8dd6a88e7
Revert "Release preparation for version 2.19.1"
2024-10-01 10:19:28 -07:00
github-actions[bot]
e97878ed63
Post-release preparation for codeql-cli-2.19.1
2024-09-30 19:49:00 +00:00
github-actions[bot]
455c8c5953
Release preparation for version 2.19.1
2024-09-30 17:59:48 +00:00
Sid Gawri
e8c68fff7f
resolve id conflict with dom based xss test ql
2024-09-25 10:01:59 -04:00
Dilan Bhalla
14ce258807
2.19.0 upgrade
2024-09-18 14:28:42 -07:00
github-actions[bot]
79be301984
Post-release preparation for codeql-cli-2.19.0
2024-09-16 14:09:32 +00:00
Chris Smowton
be02864281
Copyedit
2024-09-16 12:25:49 +01:00
github-actions[bot]
acdafd9646
Release preparation for version 2.19.0
2024-09-16 10:56:10 +00:00
