Asger F
3f0d0e3a05
JS: Deprecate DataFlow::BarrierGuardNode
2024-12-03 14:30:50 +01:00
Asger F
0d79c7141c
JS: Update two more uses of SanitizerGuardNode
2024-12-03 14:30:35 +01:00
Asger F
f620191da4
JS: Deprecate SanitizerGuardNode
2024-12-03 14:30:33 +01:00
Asger F
2ae7386775
JS: Also apply new BarrierGuardLegacy pattern in Xss.qll
2024-12-03 14:30:32 +01:00
Asger F
21494fbdff
JS: Refactor BarrierGuardLegacy pattern to not depend on SanitizerGuardNode
...
Previously our barrier guard classes were direct descendents of SanitizerGuardNode which made it hard to deprecate that class.
Now our barrier guards are not descending from any shared class. Instead they are contributed to SanitizerGuardNode via a private helper class we can remove in the future.
2024-12-03 14:30:29 +01:00
Asger F
e6680dec8f
JS: Avoid use of LabeledSanitizerGuardNode in TaintedObject
...
Drive-by bugfix: Rename sanitizes -> blocksExpr.
This fixes a bug that caused the sanitizer guard not to work in df2.
The test output reflects the fact that the barrier guard works now.
2024-12-03 14:30:24 +01:00
Asger F
f758b67d30
JS: Openly recommend SummarizedCallable
2024-12-03 14:30:09 +01:00
Asger F
249104b8ae
JS: Update comments referring to old Configuration style
...
Also avoid the term "analysis-specific" because it's not a term we use anywhere else.
2024-12-03 14:30:08 +01:00
Asger F
13ee597848
JS: Add some proper documentation to SummarizedCallable
2024-12-03 14:30:07 +01:00
Asger F
988fa9c0ef
JS: Deprecate AdditionalSanitizerGuardNode
...
We're deprecating the class through an alias, but it is still the base class for a non-deprecated class, for backwards compatibility. For this reason we're also deprecating all of its member predicates so we can remove those in the future.
2024-12-03 14:30:06 +01:00
Asger F
0b1e859e70
JS: Remove uses of AdditionalSanitizerGuardNode
2024-12-03 14:30:05 +01:00
Asger F
c2abb0fbd0
JS: Remove reference to AdditionalSanitizerGuard from CachedStages
2024-12-03 14:30:04 +01:00
Asger F
82682d9a62
JS: Remove a non-deprecated reference to SanitizerGuardNode
2024-12-03 14:30:03 +01:00
Asger F
bc7753de29
JS: Remove non-deprecated reference to AdditionalBarrierGuardNode
2024-12-03 14:30:02 +01:00
Asger F
0cd2e3f9eb
JS: Deprecate old data flow library, except some guard-related nodes
2024-12-03 14:30:01 +01:00
Asger F
054558d7b5
JS: Include content properties in type-tracker properties
...
Reminder: we have two PropertyName classes because the one in Contents.qll can't depend on DataFlow::Node.
2024-12-03 09:58:54 +01:00
Asger F
cab8a40d00
JS: Fix accidental recursion
2024-11-29 14:23:57 +01:00
Asger F
2f0c80a98b
JS: Include summary steps in type tracking
2024-11-29 14:23:55 +01:00
Asger F
e34064e3b5
JS: Initial instantiation of sumamry type tracking
...
Instantiates the library without using it yet.
2024-11-29 14:23:50 +01:00
Asger F
df12f255ac
JS: Rename propagatesFlowExt -> propagatesFlow
2024-11-29 14:23:49 +01:00
Asger F
805fd0b46e
JS: Refine speculative step definition
2024-11-26 15:56:56 +01:00
Asger F
c94a01e6b6
JS: Remove reference to argsParseStep
...
This was removed as part of the PR that introduced threat models.
2024-11-26 15:36:47 +01:00
Asger F
bf62582f53
JS: Implement 'speculativeTaintStep'
...
It is a mandatory part of the interface now; just providing a bare-bones implementation for rather than 'none()'
2024-11-26 15:36:46 +01:00
Asger F
82d61e4194
Merge branch 'js/shared-dataflow-branch' into js/shared-dataflow-merge-main
2024-11-26 15:36:16 +01:00
Asger F
9dad2d62d7
JS: Update DataFlowConsistency
2024-11-21 12:54:11 +01:00
Asger F
ce00bd2cc9
JS: More docs
2024-11-21 11:06:43 +01:00
Asger F
4e62a512c5
JS: Only apply exception propagator when no other summary applies
...
Previously a few Promise-related methods were special-cased, which is no longer needed.
2024-11-21 11:01:05 +01:00
Asger F
948d21ca07
JS: Propagate exceptions from summarized callables by default
2024-11-21 10:24:31 +01:00
Asger F
dcdb2e5133
JS: Fix callback check so it works without parameters
2024-11-21 10:24:29 +01:00
Asger F
d52bc971b8
Merge branch 'main' into js/shared-dataflow-merge-main
2024-11-20 14:05:03 +01:00
Asger F
d1c9e47d23
JS: More aggressive test file classification
2024-11-19 13:23:32 +01:00
Asger F
01669908f2
JS: Block InsecureRandomness flow into test files
2024-11-19 13:23:31 +01:00
Asger F
80a5a5909e
JS: Use getUnderlyingValue() a few places in VariableCapture
2024-11-19 13:23:29 +01:00
Asger F
023dcce400
JS: Disable variable capture heuristic
...
Bailing out can be more expensive as the resulting jump steps themselves
cause perf issues. The limit of 100 variables per scope has also been
added in the interim, which handles the cases that this needed to cover.
2024-11-18 13:44:10 +01:00
Asger F
37676f41aa
JS: Remove jump steps from IIFE steps
2024-11-18 13:38:34 +01:00
Asger F
7acc5689cf
JS: Port exception steps to a universal summary
2024-11-18 13:27:58 +01:00
Napalys
1304ab7065
Added change notes
2024-11-18 08:05:51 +01:00
Napalys
bed1f25b3f
JS: Fix: Now Array.prototype.with is properly flagged as taint step
2024-11-15 10:35:34 +01:00
Napalys
631a3770ec
JS: Add: change notes
2024-11-15 09:16:21 +01:00
Napalys Klicius
6fa3ff39a0
Merge branch 'main' into napalys/toSpliced-support
2024-11-14 16:56:32 +01:00
Napalys Klicius
c8c15a0899
Merge pull request #17910 from Napalys/napalys/matchAll-support
...
JS: Support for matchAll
2024-11-14 15:36:20 +01:00
Napalys
b333f523df
JS: Fix: now one can determine regex via Array.prototype.toSpliced function call.
2024-11-14 15:35:03 +01:00
Napalys
84234d59b9
JS: Fix: Ensure toSpliced with spread operator is flagged
2024-11-13 17:21:34 +01:00
Napalys
2df3d1b251
JS: Fix: Ensure toSpliced is flagged by taint tracking in test suite ( ed44358143)
2024-11-13 15:58:20 +01:00
Napalys
df4b596180
Added toSpliced as part ArraySliceStep and ArraySpliceStep, fixed tests from 2d9bc43506
2024-11-13 13:47:34 +01:00
Napalys
b4c84d3d3c
Added taint step for toSpliced, handles test from a65f80ef76
2024-11-13 12:41:41 +01:00
Napalys
5f8ff125e9
Added change notes
2024-11-12 12:21:39 +01:00
Napalys
7427a24ca1
Added test case for Array.prototype.toReversed, which is currently not flagged as a taint sink.
2024-11-12 12:02:37 +01:00
Napalys
3f0a54c2e8
Added support for Array.prototype.toSorted function
2024-11-12 12:02:04 +01:00
Asger F
80ee372ddf
JS: Replace an unused value with _
2024-11-12 11:24:17 +01:00
