mirror of
https://github.com/github/codeql.git
synced 2026-03-27 09:48:16 +01:00
49 lines
4.4 KiB
Markdown
49 lines
4.4 KiB
Markdown
# Improvements to JavaScript analysis
|
|
|
|
## General improvements
|
|
|
|
* Support for the following frameworks and libraries has been improved:
|
|
- [express](https://www.npmjs.com/package/express)
|
|
- [fstream](https://www.npmjs.com/package/fstream)
|
|
- [jGrowl](https://github.com/stanlemon/jGrowl)
|
|
- [jQuery](https://jquery.com/)
|
|
- [marsdb](https://www.npmjs.com/package/marsdb)
|
|
- [minimongo](https://www.npmjs.com/package/minimongo/)
|
|
- [mssql](https://www.npmjs.com/package/mssql)
|
|
- [mysql](https://www.npmjs.com/package/mysql)
|
|
- [pg](https://www.npmjs.com/package/pg)
|
|
- [sequelize](https://www.npmjs.com/package/sequelize)
|
|
- [spanner](https://www.npmjs.com/package/spanner)
|
|
- [sqlite](https://www.npmjs.com/package/sqlite)
|
|
- [ssh2](https://www.npmjs.com/package/ssh2)
|
|
- [ssh2-streams](https://www.npmjs.com/package/ssh2-streams)
|
|
|
|
## New queries
|
|
|
|
| **Query** | **Tags** | **Purpose** |
|
|
|---------------------------------------------------------------------------------|-------------------------------------------------------------------|----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
|
|
| Cross-site scripting through DOM (`js/xss-through-dom`) | security, external/cwe/cwe-079, external/cwe/cwe-116 | Highlights potential XSS vulnerabilities where existing text from the DOM is used as HTML. Results are not shown on LGTM by default. |
|
|
| Incomplete HTML attribute sanitization (`js/incomplete-html-attribute-sanitization`) | security, external/cwe/cwe-20, external/cwe/cwe-079, external/cwe/cwe-116 | Highlights potential XSS vulnerabilities due to incomplete sanitization of HTML meta-characters. Results are shown on LGTM by default. |
|
|
| Unsafe expansion of self-closing HTML tag (`js/unsafe-html-expansion`) | security, external/cwe/cwe-079, external/cwe/cwe-116 | Highlights potential XSS vulnerabilities caused by unsafe expansion of self-closing HTML tags. |
|
|
|
|
## Changes to existing queries
|
|
|
|
| **Query** | **Expected impact** | **Change** |
|
|
|--------------------------------|------------------------------|---------------------------------------------------------------------------|
|
|
| Misspelled variable name (`js/misspelled-variable-name`) | Message changed | The message for this query now correctly identifies the misspelled variable in additional cases. |
|
|
| Uncontrolled data used in path expression (`js/path-injection`) | More results | This query now recognizes additional file system calls. |
|
|
| Uncontrolled command line (`js/command-line-injection`) | More results | This query now recognizes additional command execution calls. |
|
|
| Client-side URL redirect (`js/client-side-unvalidated-url-redirection`) | Less results | This query now recognizes additional safe patterns of doing URL redirects. |
|
|
| Client-side cross-site scripting (`js/xss`) | Less results | This query now recognizes additional safe strings based on URLs. |
|
|
| Incomplete URL scheme check (`js/incomplete-url-scheme-check`) | More results | This query now recognizes additional url scheme checks. |
|
|
| Prototype pollution in utility function (`js/prototype-pollution-utility`) | More results | This query now recognizes additional utility functions as vulnerable to prototype polution. |
|
|
| Expression has no effect (`js/useless-expression`) | Less results | This query no longer flags an expression when that expression is the only content of the containing file. |
|
|
| Unknown directive (`js/unknown-directive`) | Less results | This query no longer flags directives generated by the Babel compiler. |
|
|
| Code injection (`js/code-injection`) | More results | More potential vulnerabilities involving NoSQL code operators are now recognized. |
|
|
| Zip Slip (`js/zipslip`) | More results | This query now recognizes additional vulnerabilities. |
|
|
|
|
## Changes to libraries
|
|
|
|
* A library `semmle.javascript.explore.CallGraph` has been added to help write queries for exploring the call graph.
|
|
* Added data flow for `Map` and `Set`, and added matching type-tracking steps that can accessed using the `CollectionsTypeTracking` module.
|