mirror of https://github.com/github/codeql.git synced 2026-07-20 18:58:36 +02:00

Files

Max Schaefer e194021c3b Merge pull request #629 from esben-semmle/js/persistent-read-taint

JS: add persistent storage taint steps

2018-12-13 08:24:42 +00:00

Improvements to JavaScript analysis

General improvements

Support for popular libraries has been improved. Consequently, queries may produce more results on code bases that use the following features:
- client-side code, for example React
- cookies and webstorage, for example js-cookie
- server-side code, for example hapi
File classification has been improved to recognize additional generated files, for example files from HTML Tidy.
The taint tracking library now recognizes flow through persistent storage, this may give more results for the security queries.

Query	Tags	Purpose
Double escaping or unescaping (`js/double-escaping`)	correctness, security, external/cwe/cwe-116	Highlights potential double escaping or unescaping of special characters, indicating a possible violation of CWE-116. Results are shown on LGTM by default.
Incomplete URL substring sanitization	correctness, security, external/cwe/cwe-020	Highlights URL sanitizers that are likely to be incomplete, indicating a violation of CWE-020. Results shown on LGTM by default.
Incorrect suffix check (`js/incorrect-suffix-check`)	correctness, security, external/cwe/cwe-020	Highlights error-prone suffix checks based on `indexOf`, indicating a potential violation of CWE-20. Results are shown on LGTM by default.
Useless comparison test (`js/useless-comparison-test`)	correctness	Highlights code that is unreachable due to a numeric comparison that is always true or always false. Results are shown on LGTM by default.

Query	Expected impact	Change
Client-side cross-site scripting	More results	This rule now recognizes WinJS functions that are vulnerable to HTML injection.
Insecure randomness	More results	This rule now flags insecure uses of `crypto.pseudoRandomBytes`.
Unused parameter	Fewer false-positive results	This rule no longer flags parameters with leading underscore.
Unused variable, import, function or class	Fewer false-positive results	This rule now flags fewer variables that are implictly used by JSX elements, and no longer flags variables with leading underscore.