Asger F
52ba91a7f8
JS: Updates to nodes/edges in tests
...
Only changes to nodes/edges for various reasons, no actual result changes
2024-10-29 08:32:13 +01:00
Asger F
1243188825
JS: Update CleartextLogging with fixed FP
2024-10-29 08:32:11 +01:00
Asger F
18b39460f5
JS: Add regained results in UnsafeJQueryPlugin
...
These were marked as 'NOT OK' in the test file, but weren't previously flagged for some reason
2024-10-29 08:32:10 +01:00
Asger F
d3e70c1e97
JS: Add in-barrier to XSS query
...
This is a bit of a bandaid to cover issues with the push() method on next/router being
treated as an array push, which causes it to flow into other taint sources.
2024-10-29 08:32:08 +01:00
Asger F
1b85feb1fa
JS: Add imprecise post-update steps for when a captured var/this is not tracked precisely
...
With the capture library we sometimes bails out of handling certain functions for scalability reasons.
This means we have a notion of "captured but imprecisely-tracked" variables and 'this'. In these cases we go back to propagating flow from a post-update node to the local source.
2024-10-29 08:32:07 +01:00
Asger F
d557c7689c
JS: Update a test that now has more precise output
2024-10-29 08:32:06 +01:00
Asger F
ad52b71922
JS: Update immutable.js test to clarify why it stopped working
...
The Immutable model uses the 'd' and 'f' properties to model Map content, but the test doesn't actually mention those properties, so they were missing from the PropertyName class.
The flow was previously found spuriously by the regular Map model, which also adds flow through the get/set calls. This flow is however no longer found since it relied on a step from post-update back to getALocalSource which is no longer present.
2024-10-29 08:32:03 +01:00
Asger F
c0997c28cb
JS: Reveal issue with immutable.js test
...
Fixed in the next commit
2024-10-29 08:32:02 +01:00
Asger F
4473e6d977
JS: Update test with some post-update consistency checks gone
...
For a constructor call, the return value acts as the post-update node for the 'this' argument. The fact that constructor calls are sometimes PostUpdateNodes causes some of these harmless alerts.
The warnings have disappeared in some cases because we no longer target getALocalSource() so the target is no longer the constructor call.
2024-10-29 08:32:01 +01:00
Asger F
cb874945bf
Test updates from introduction of implicit 'this'
2024-10-29 08:31:59 +01:00
Asger F
bd94fe1574
JS: Explain false positive in test case
2024-10-29 08:31:58 +01:00
Asger F
16b08b74eb
JS: Add test showing potential for FPs when handling refinement guards
2024-10-29 08:31:55 +01:00
Asger F
e784813c3b
JS: Make barrier guards work with use-use flow
2024-10-22 12:46:19 +02:00
Asger F
81af9a1658
Fix missing flow through super calls
2024-10-22 12:46:17 +02:00
Asger F
12370e9210
JS: Use VariableOrThis in variable capture as well
2024-10-22 12:46:16 +02:00
Asger F
0ebe8bdd91
JS: Add test for missing capture flow for 'this'
2024-10-22 12:46:15 +02:00
Asger F
d31499d727
JS: introduce implicit this uses in general
2024-10-22 12:46:14 +02:00
Asger F
8dc0505f84
JS: Add test for missing flow into 'this' in field initializers
2024-10-22 12:46:13 +02:00
Asger F
c3c003b275
JS: Fix post-update flow into 'this'
2024-10-22 12:46:11 +02:00
Asger F
9fc99d6f9d
JS: Fix store into object literals that have a post-update node
2024-10-22 12:46:11 +02:00
Asger F
d626e79ed3
JS: Add two test cases for missing flow
2024-10-22 12:46:10 +02:00
Asger F
78e961cef3
JS: Add use-use flow
2024-10-22 12:46:01 +02:00
Asger F
81e74d8bb5
JS: Add test case for spurious flow from lack of use-use
2024-10-22 12:46:00 +02:00
Asger F
12e316b99d
JS: Update test output after merging in 'main'
...
- Paths are now relative to the test case, not the qlpack
- Paths going through an implicit reads have changed slightly
2024-10-08 10:11:15 +02:00
Asger F
e2e91ac7d9
Merge branch 'main' into js/shared-dataflow-merge-main
2024-10-08 09:28:26 +02:00
Tom Hvitved
d0ca39fb03
JS: Update expected test output
2024-10-04 08:35:33 +02:00
Asger F
5d2ce172eb
JS: Update a test to handle AdditionalSanitizerGuardNode
2024-10-02 14:44:42 +02:00
Asger F
6cbe04dcb7
JS: Consistently use the shared XSS barrier guards in the XSS queries
...
Previously only reflected XSS used shared barrier guards.
2024-10-02 14:44:17 +02:00
Sid Gawri
e8c68fff7f
resolve id conflict with dom based xss test ql
2024-09-25 10:01:59 -04:00
Asger F
1cd00a118c
Merge branch 'main' into js/shared-dataflow-merge-main
2024-09-18 14:57:50 +02:00
Asger F
1df69ec1d2
JS: Actually don't propagate into array element 0
...
Preserving tainted-url-suffix into array element 0 seemed like a good idea, but didn't work out so well.
2024-09-12 13:42:36 +02:00
Asger F
0e4e0f4fdd
JS: Preverse tainted-url-suffix when stepping into prefix
...
A URL of form https://example.com?evil#bar will contain '?evil' after splitting out the '#' suffix, and vice versa.
2024-09-12 13:42:28 +02:00
Asger F
74ab346348
JS: Do not include taint steps in TaintedUrlSuffix::step
...
TaintedUrlSuffix is currently only used in TaintTracking configs meaning it is already propagated
by taint steps. The inclusion of these taint steps here however meant that implicit reads could appear prior to any of these steps.
This was is problematic for PropRead steps as an expression like x[0] could spuriously read from array element 1 via the path:
x [element 1]
x [empty access path] (after implicit read)
x[0] (taint step through PropRead)
2024-09-12 13:42:25 +02:00
Asger F
2712bf821a
JS: Fix a bug in isSafeClientSideUrlProperty
2024-09-12 13:42:23 +02:00
Asger F
e1bed42481
JS: Add inline expectation test specifically for TaintedUrlSuffix
2024-09-12 13:42:20 +02:00
Asger F
cf90c83604
JS: Accept changes to nodes/edges results
2024-09-12 13:42:19 +02:00
Asger F
3b09bc548e
JS: Add taint step for shift()
2024-09-12 13:42:17 +02:00
Asger F
3ea1134cc1
JS: Add inline test for .shift() method
2024-09-12 13:42:16 +02:00
Asger F
7790f68fe2
JS: Make the TaintedUrlSuffix library use optional steps/barriers
2024-09-12 13:35:36 +02:00
Asger F
07bd854868
Merge pull request #17401 from pwntester/js/actions/secrets-in-artifacts
...
Javascript: Query to detect GITHUB_TOKEN leaked in artifacts
2024-09-11 15:54:36 +02:00
Sid Shankar
3516117215
Adds test for arbitrary specifiers in TS files
...
Adds test for arbitrary identifiers used in imports and exports
2024-09-11 00:37:49 +00:00
Sid Shankar
785af12f1c
Renames test file
2024-09-11 00:28:44 +00:00
Asger F
0ddb1c87f5
JS: Test update indicating a problem with .split()
2024-09-10 13:14:37 +02:00
Asger F
e0ca1b0482
JS: Benign test updates
2024-09-10 13:07:24 +02:00
Asger F
55d4e7e742
JS: Use ArrayElementKnown when reading a constant array index
2024-09-09 13:26:25 +02:00
Asger F
094112c905
Merge pull request #17213 from asgerf/jss/spread-argument
...
JS: Improve handling of spread arguments and rest parameters [shared data flow branch]
2024-09-09 13:15:22 +02:00
Alvaro Muñoz
5d1da861a2
fix: Use YamlScalar for booleans
2024-09-06 23:21:41 +02:00
Alvaro Muñoz
d9e8792d33
[javascript] Query to detect GITHUB_TOKEN leaked in artifacts
2024-09-06 22:55:58 +02:00
Asger F
fb9732a33f
JS: Add another test and TODO about an issue with constant array indices
2024-09-06 08:43:11 +02:00
Asger F
1da68aac73
JS: Benign test output change
...
This happened as a result of the bugfix in the previous commit
2024-09-06 08:43:10 +02:00
