Tiago Pascoal
150854603b
Single quote was preventing the shell from expanding the BODY variable
...
While this prevents the attack highlighted in the query help it also prevents it from working.
Double quotes will allow the expansion of the variable while still preventing the attack
2023-06-20 11:38:27 +01:00
Jaroslav Lobačevski
5aa71352dc
Update javascript/ql/src/Security/CWE-094/ExpressionInjection.qhelp
...
Co-authored-by: Asger F <asgerf@github.com >
2023-05-09 12:23:52 +02:00
jarlob
6e9f54ef55
Use double curly braces
2023-04-21 19:03:38 +02:00
jarlob
e9dee3a185
Move actions/github-script out of Actions.qll
2023-04-14 14:26:23 +02:00
jarlob
3724ea1a7b
Extract where parts into predicates
2023-04-14 10:49:56 +02:00
jarlob
ac1c20673d
Encapsulate github-script
2023-04-14 10:23:49 +02:00
jarlob
d80c541da6
Encapsulate composite actions
2023-04-14 10:06:35 +02:00
jarlob
94065764d5
Make predicate name clearer
2023-04-14 01:05:21 +02:00
jarlob
79218a3946
Use YamlMapping for modeling Env
2023-04-14 00:56:51 +02:00
jarlob
dd52ef85cd
Rename Env
2023-04-13 23:41:31 +02:00
jarlob
7573c615f6
Fix warnings
2023-04-06 23:07:22 +02:00
jarlob
9c7eecf547
Add support for composite actions
2023-04-06 22:53:59 +02:00
jarlob
40635e60d1
Improve documentation
2023-04-05 10:26:02 +02:00
jarlob
9fba7d31f1
Improve documentation
2023-04-05 10:24:07 +02:00
jarlob
eef1973b93
Change UI message
2023-04-05 10:05:24 +02:00
jarlob
5c5b9f99a8
Add simple taint tracking for env variables
2023-04-05 10:03:46 +02:00
jarlob
8ea418216c
Look for script injections in actions/github-script
2023-04-03 23:13:28 +02:00
jarlob
ba5747dff3
fix formatting
2023-04-03 15:10:27 +02:00
jarlob
99d634c8a4
Add more sources, more unit tests, fixes to the GitHub Actions injection query
2023-04-03 15:02:02 +02:00
erik-krogh
442749bb7f
JS: add heuristic variants of queries that use RemoteFlowSource
2022-12-19 12:01:22 +01:00
Erik Krogh Kristensen
bbdda9ef70
Merge pull request #10727 from erik-krogh/js-last-msg
...
JS: fix some more style-guide violations in the alert-messages
2022-10-27 15:48:12 +02:00
Josh Soref
9d6ea28448
spelling: the
...
Signed-off-by: Josh Soref <2119212+jsoref@users.noreply.github.com >
2022-10-12 04:40:26 -04:00
erik-krogh
368f84785b
fix some more style-guide violations in the alert-messages
2022-10-07 11:22:22 +02:00
Nick Rolfe
ed74e0aad1
JS/Python/Ruby: s/a HTML/an HTML/
2022-09-30 10:37:52 +01:00
erik-krogh
6ec03d4738
apply suggestions from doc review
2022-09-12 13:16:39 +02:00
erik-krogh
aa56ca37ae
make the alert messages of taint-tracking queries more consistent
2022-09-05 14:04:52 +02:00
Erik Krogh Kristensen
fd10947ca0
use small steps in TypeBackTracker correctly
2022-07-13 10:29:57 +02:00
Erik Krogh Kristensen
2550988006
change @id from js/actions/injection to js/actions/command-injection
2022-05-17 09:25:05 +02:00
Nick Rolfe
1115227f9d
Merge remote-tracking branch 'origin/main' into nickrolfe/misspelling
2022-05-12 16:10:27 +01:00
Nick Rolfe
2ed42c327c
JS: fix typos in comments
2022-05-12 16:02:19 +01:00
Erik Krogh Kristensen
fef4455ccc
apply suggestion from doc review
...
Co-authored-by: Steve Guntrip <12534592+stevecat@users.noreply.github.com >
2022-05-12 13:28:45 +02:00
Erik Krogh Kristensen
0c0e280637
update the qhelp to mention that the GITHUB_TOKEN only sometimes has write-access
2022-05-05 12:12:29 +02:00
Erik Krogh Kristensen
c0152a46bc
rename getAReferencedExpression to getASimpleReferenceExpression and add examples of what it can parse
2022-05-05 11:02:47 +02:00
Erik Krogh Kristensen
8e2b00d209
make the big disjunctions more readable by using a set literal
2022-05-04 16:15:17 +02:00
Erik Krogh Kristensen
31a4de902e
add missing security severity
2022-05-04 16:15:17 +02:00
Erik Krogh Kristensen
df4bfef8c7
expand the qhelp for js/actions/injection
2022-05-04 16:14:59 +02:00
Erik Krogh Kristensen
48fb01f9f7
set js/actions/injection as a high precision warning query
2022-05-04 16:14:54 +02:00
Erik Krogh Kristensen
2a65d1d3ec
move js/actions/injection out of experimental
2022-05-04 16:14:19 +02:00
Erik Krogh Kristensen
2442beaf9a
add missing severities to JS queries
2022-03-16 10:40:34 +01:00
Ethan Palm
2f7f9d9032
Move explanation of example above sample code
2022-02-09 10:45:24 -08:00
Erik Krogh Kristensen
aa95dd4ec7
fix typo
...
Co-authored-by: Esben Sparre Andreasen <esbena@github.com >
2022-02-08 00:19:40 +01:00
Erik Krogh Kristensen
6f28cb9201
lower the precision of js/unsafe-code-construction
2022-02-07 13:35:29 +01:00
Erik Krogh Kristensen
eb133f59f6
update qhelp to focus on properly documenting potentially unsafe library functions
2022-02-07 13:34:18 +01:00
Erik Krogh Kristensen
d77c28f6a7
add qhelp for unsafe-code-construction
2022-02-07 13:34:18 +01:00
Erik Krogh Kristensen
198a464346
add js/unsafe-code-construction query
2022-02-07 13:34:18 +01:00
Asger Feldthaus
3a20ca96c4
JS: Update CWE tags and severity score of code injection query
...
The derived security-severity score of the JS code injection query
was much lower than for other languages (6.1 versus 9.3), possibly due
some differences in CWE tags, such as the inclusion of CWE-079.
We also add the more specific CWE-095 ("eval injection") for consistency
with other languages. It is a child of CWE-094 ("code injection") which
was already tagged.
2021-10-05 10:12:19 +02:00
Asger Feldthaus
f6da030572
JS: Migrate to *Query.qll convention
2021-08-12 09:30:18 +02:00
Calum Grant
771e686946
Update security-severity scores
2021-06-15 13:25:17 +01:00
Calum Grant
a594afb828
Add security-severity metadata
2021-06-10 20:11:08 +01:00
Asger Feldthaus
96c6e4d8d8
JS: Update with new AdditionalTaintStep subclasses
2021-03-17 13:29:16 +00:00
