Skip to content

Commit

Permalink
JS: Resolve inserted TODOs
Browse files Browse the repository at this point in the history
  • Loading branch information
@asgerf
asgerf committed Jan 23, 2025
1 parent 102b187 commit 6423033
Show file tree
Hide file tree
Showing 17 changed files with 105 additions and 80 deletions.
10 changes: 6 additions & 4 deletions javascript/ql/lib/semmle/javascript/security/dataflow/BrokenCryptoAlgorithmQuery.qll
View file
Original file line number Diff line number Diff line change
Expand Up @@ -26,10 +26,12 @@ module BrokenCryptoAlgorithmConfig implements DataFlow::ConfigSig {

predicate isBarrier(DataFlow::Node node) { node instanceof Sanitizer }

predicate observeDiffInformedIncrementalMode() {
// TODO(diff-informed): Manually verify if config can be diff-informed.
// ql/src/Security/CWE-327/BrokenCryptoAlgorithm.ql:27: Column 5 selects sink.getInitialization
none()
predicate observeDiffInformedIncrementalMode() { any() }

Location getASelectedSinkLocation(DataFlow::Node sink) {
result = sink.(Sink).getLocation()
or
result = sink.(Sink).getInitialization().getLocation()
}
}

Expand Down
10 changes: 6 additions & 4 deletions javascript/ql/lib/semmle/javascript/security/dataflow/ClientSideRequestForgeryQuery.qll
View file
Original file line number Diff line number Diff line change
Expand Up @@ -32,10 +32,12 @@ module ClientSideRequestForgeryConfig implements DataFlow::ConfigSig {
isAdditionalRequestForgeryStep(node1, node2)
}

predicate observeDiffInformedIncrementalMode() {
// TODO(diff-informed): Manually verify if config can be diff-informed.
// ql/src/Security/CWE-918/ClientSideRequestForgery.ql:24: Column 1 selects sink.getARequest
none()
predicate observeDiffInformedIncrementalMode() { any() }

Location getASelectedSinkLocation(DataFlow::Node sink) {
result = sink.(Sink).getLocation()
or
result = sink.(Sink).getARequest().getLocation()
}
}

Expand Down
12 changes: 7 additions & 5 deletions javascript/ql/lib/semmle/javascript/security/dataflow/CommandInjectionQuery.qll
View file
Original file line number Diff line number Diff line change
Expand Up @@ -31,11 +31,13 @@ module CommandInjectionConfig implements DataFlow::ConfigSig {

predicate isBarrier(DataFlow::Node node) { node instanceof Sanitizer }

predicate observeDiffInformedIncrementalMode() {
// TODO(diff-informed): Manually verify if config can be diff-informed.
// ql/src/Security/CWE-078/CommandInjection.ql:31: Column 1 does not select a source or sink originating from the flow call on line 24
// ql/src/experimental/heuristics/ql/src/Security/CWE-078/CommandInjection.ql:34: Column 1 does not select a source or sink originating from the flow call on line 26
none()
predicate observeDiffInformedIncrementalMode() { any() }

Location getASelectedSinkLocation(DataFlow::Node sink) {
exists(DataFlow::Node node |
isSinkWithHighlight(sink, node) and
result = node.getLocation()
)
}
}

Expand Down
11 changes: 6 additions & 5 deletions ...pt/ql/lib/semmle/javascript/security/dataflow/CorsMisconfigurationForCredentialsQuery.qll
View file
Original file line number Diff line number Diff line change
Expand Up @@ -24,11 +24,12 @@ module CorsMisconfigurationConfig implements DataFlow::ConfigSig {
node = TaintTracking::AdHocWhitelistCheckSanitizer::getABarrierNode()
}

predicate observeDiffInformedIncrementalMode() {
// TODO(diff-informed): Manually verify if config can be diff-informed.
// ql/src/Security/CWE-346/CorsMisconfigurationForCredentials.ql:22: Column 5 selects sink.getCredentialsHeader
// ql/src/experimental/heuristics/ql/src/Security/CWE-346/CorsMisconfigurationForCredentials.ql:25: Column 5 selects sink.getCredentialsHeader
none()
predicate observeDiffInformedIncrementalMode() { any() }

Location getASelectedSinkLocation(DataFlow::Node sink) {
result = sink.(Sink).getLocation()
or
result = sink.(Sink).getCredentialsHeader().getLocation()
}
}

Expand Down
13 changes: 9 additions & 4 deletions javascript/ql/lib/semmle/javascript/security/dataflow/DeepObjectResourceExhaustionQuery.qll
View file
Original file line number Diff line number Diff line change
Expand Up @@ -34,10 +34,15 @@ module DeepObjectResourceExhaustionConfig implements DataFlow::StateConfigSig {
TaintedObject::isAdditionalFlowStep(node1, state1, node2, state2)
}

predicate observeDiffInformedIncrementalMode() {
// TODO(diff-informed): Manually verify if config can be diff-informed.
// ql/src/Security/CWE-400/DeepObjectResourceExhaustion.ql:23: Column 7 does not select a source or sink originating from the flow call on line 19
none()
predicate observeDiffInformedIncrementalMode() { any() }

Location getASelectedSinkLocation(DataFlow::Node sink) {
result = sink.(Sink).getLocation()
or
exists(DataFlow::Node link |
sink.(Sink).hasReason(link, _) and
result = link.getLocation()
)
}
}

Expand Down
11 changes: 7 additions & 4 deletions javascript/ql/lib/semmle/javascript/security/dataflow/IndirectCommandInjectionQuery.qll
View file
Original file line number Diff line number Diff line change
Expand Up @@ -27,10 +27,13 @@ module IndirectCommandInjectionConfig implements DataFlow::ConfigSig {

predicate isBarrier(DataFlow::Node node) { node instanceof Sanitizer }

predicate observeDiffInformedIncrementalMode() {
// TODO(diff-informed): Manually verify if config can be diff-informed.
// ql/src/Security/CWE-078/IndirectCommandInjection.ql:29: Column 1 does not select a source or sink originating from the flow call on line 25
none()
predicate observeDiffInformedIncrementalMode() { any() }

Location getASelectedSinkLocation(DataFlow::Node sink) {
exists(DataFlow::Node node |
isSinkWithHighlight(sink, node) and
result = node.getLocation()
)
}
}

Expand Down
10 changes: 6 additions & 4 deletions javascript/ql/lib/semmle/javascript/security/dataflow/InsecureDownloadQuery.qll
View file
Original file line number Diff line number Diff line change
Expand Up @@ -24,10 +24,12 @@ module InsecureDownloadConfig implements DataFlow::StateConfigSig {

predicate isBarrier(DataFlow::Node node) { node instanceof Sanitizer }

predicate observeDiffInformedIncrementalMode() {
// TODO(diff-informed): Manually verify if config can be diff-informed.
// ql/src/Security/CWE-829/InsecureDownload.ql:21: Column 5 selects sink.getDownloadCall
none()
predicate observeDiffInformedIncrementalMode() { any() }

Location getASelectedSinkLocation(DataFlow::Node sink) {
result = sink.(Sink).getLocation()
or
result = sink.(Sink).getDownloadCall().getLocation()
}
}

Expand Down
9 changes: 1 addition & 8 deletions javascript/ql/lib/semmle/javascript/security/dataflow/NosqlInjectionQuery.qll
View file
Original file line number Diff line number Diff line change
Expand Up @@ -52,14 +52,7 @@ module NosqlInjectionConfig implements DataFlow::StateConfigSig {
state2 = state1
}

predicate observeDiffInformedIncrementalMode() {
// TODO(diff-informed): Manually verify if config can be diff-informed.
// ql/src/Security/CWE-089/SqlInjection.ql:35: Column 1 does not select a source or sink originating from the flow call on line 32
// ql/src/Security/CWE-089/SqlInjection.ql:35: Column 5 does not select a source or sink originating from the flow call on line 32
// ql/src/experimental/heuristics/ql/src/Security/CWE-089/SqlInjection.ql:37: Column 1 does not select a source or sink originating from the flow call on line 34
// ql/src/experimental/heuristics/ql/src/Security/CWE-089/SqlInjection.ql:37: Column 5 does not select a source or sink originating from the flow call on line 34
none()
}
predicate observeDiffInformedIncrementalMode() { any() }
}

/**
Expand Down
13 changes: 9 additions & 4 deletions javascript/ql/lib/semmle/javascript/security/dataflow/PrototypePollutionQuery.qll
View file
Original file line number Diff line number Diff line change
Expand Up @@ -48,10 +48,15 @@ module PrototypePollutionConfig implements DataFlow::StateConfigSig {
node = TaintedObject::SanitizerGuard::getABarrierNode(state)
}

predicate observeDiffInformedIncrementalMode() {
// TODO(diff-informed): Manually verify if config can be diff-informed.
// ql/src/Security/CWE-915/PrototypePollutingMergeCall.ql:30: Column 7 does not select a source or sink originating from the flow call on line 26
none()
predicate observeDiffInformedIncrementalMode() { any() }

Location getASelectedSinkLocation(DataFlow::Node sink) {
result = sink.(Sink).getLocation()
or
exists(Locatable loc |
sink.(Sink).dependencyInfo(_, loc) and
result = loc.getLocation()
)
}
}

Expand Down
10 changes: 6 additions & 4 deletions javascript/ql/lib/semmle/javascript/security/dataflow/RequestForgeryQuery.qll
View file
Original file line number Diff line number Diff line change
Expand Up @@ -27,10 +27,12 @@ module RequestForgeryConfig implements DataFlow::ConfigSig {
isAdditionalRequestForgeryStep(node1, node2)
}

predicate observeDiffInformedIncrementalMode() {
// TODO(diff-informed): Manually verify if config can be diff-informed.
// ql/src/Security/CWE-918/RequestForgery.ql:21: Column 1 selects sink.getARequest
none()
predicate observeDiffInformedIncrementalMode() { any() }

Location getASelectedSinkLocation(DataFlow::Node sink) {
result = sink.(Sink).getLocation()
or
result = sink.(Sink).getARequest().getLocation()
}
}

Expand Down
11 changes: 7 additions & 4 deletions .../ql/lib/semmle/javascript/security/dataflow/ShellCommandInjectionFromEnvironmentQuery.qll
View file
Original file line number Diff line number Diff line change
Expand Up @@ -28,10 +28,13 @@ module ShellCommandInjectionFromEnvironmentConfig implements DataFlow::ConfigSig

predicate isBarrier(DataFlow::Node node) { node instanceof Sanitizer }

predicate observeDiffInformedIncrementalMode() {
// TODO(diff-informed): Manually verify if config can be diff-informed.
// ql/src/Security/CWE-078/ShellCommandInjectionFromEnvironment.ql:30: Column 1 does not select a source or sink originating from the flow call on line 26
none()
predicate observeDiffInformedIncrementalMode() { any() }

Location getASelectedSinkLocation(DataFlow::Node sink) {
exists(DataFlow::Node node |
isSinkWithHighlight(sink, node) and
result = node.getLocation()
)
}
}

Expand Down
9 changes: 1 addition & 8 deletions javascript/ql/lib/semmle/javascript/security/dataflow/SqlInjectionQuery.qll
View file
Original file line number Diff line number Diff line change
Expand Up @@ -32,14 +32,7 @@ module SqlInjectionConfig implements DataFlow::ConfigSig {
)
}

predicate observeDiffInformedIncrementalMode() {
// TODO(diff-informed): Manually verify if config can be diff-informed.
// ql/src/Security/CWE-089/SqlInjection.ql:35: Column 1 does not select a source or sink originating from the flow call on line 28
// ql/src/Security/CWE-089/SqlInjection.ql:35: Column 5 does not select a source or sink originating from the flow call on line 28
// ql/src/experimental/heuristics/ql/src/Security/CWE-089/SqlInjection.ql:37: Column 1 does not select a source or sink originating from the flow call on line 30
// ql/src/experimental/heuristics/ql/src/Security/CWE-089/SqlInjection.ql:37: Column 5 does not select a source or sink originating from the flow call on line 30
none()
}
predicate observeDiffInformedIncrementalMode() { any() }
}

/**
Expand Down
10 changes: 6 additions & 4 deletions javascript/ql/lib/semmle/javascript/security/dataflow/UnsafeCodeConstruction.qll
View file
Original file line number Diff line number Diff line change
Expand Up @@ -33,10 +33,12 @@ module UnsafeCodeConstruction {

DataFlow::FlowFeature getAFeature() { result instanceof DataFlow::FeatureHasSourceCallContext }

predicate observeDiffInformedIncrementalMode() {
// TODO(diff-informed): Manually verify if config can be diff-informed.
// ql/src/Security/CWE-094/UnsafeCodeConstruction.ql:26: Column 7 selects sink.getCodeSink
none()
predicate observeDiffInformedIncrementalMode() { any() }

Location getASelectedSinkLocation(DataFlow::Node sink) {
result = sink.(Sink).getLocation()
or
result = sink.(Sink).getCodeSink().getLocation()
}
}

Expand Down
10 changes: 6 additions & 4 deletions javascript/ql/lib/semmle/javascript/security/dataflow/UnsafeHtmlConstructionQuery.qll
View file
Original file line number Diff line number Diff line change
Expand Up @@ -61,10 +61,12 @@ module UnsafeHtmlConstructionConfig implements DataFlow::StateConfigSig {

DataFlow::FlowFeature getAFeature() { result instanceof DataFlow::FeatureHasSourceCallContext }

predicate observeDiffInformedIncrementalMode() {
// TODO(diff-informed): Manually verify if config can be diff-informed.
// ql/src/Security/CWE-079/UnsafeHtmlConstruction.ql:25: Column 7 selects sink.getSink
none()
predicate observeDiffInformedIncrementalMode() { any() }

Location getASelectedSinkLocation(DataFlow::Node sink) {
result = sink.(Sink).getLocation()
or
result = sink.(Sink).getSink().getLocation()
}
}

Expand Down
10 changes: 6 additions & 4 deletions javascript/ql/lib/semmle/javascript/security/dataflow/UnsafeJQueryPluginQuery.qll
View file
Original file line number Diff line number Diff line change
Expand Up @@ -37,10 +37,12 @@ module UnsafeJQueryPluginConfig implements DataFlow::ConfigSig {
node = any(StringReplaceCall call).getRawReplacement()
}

predicate observeDiffInformedIncrementalMode() {
// TODO(diff-informed): Manually verify if config can be diff-informed.
// ql/src/Security/CWE-079/UnsafeJQueryPlugin.ql:25: Column 5 selects source.getPlugin
none()
predicate observeDiffInformedIncrementalMode() { any() }

Location getASelectedSourceLocation(DataFlow::Node source) {
result = source.(Source).getLocation()
or
result = source.(Source).getPlugin().getLocation()
}
}

Expand Down
13 changes: 8 additions & 5 deletions ...script/ql/lib/semmle/javascript/security/dataflow/UnsafeShellCommandConstructionQuery.qll
View file
Original file line number Diff line number Diff line change
Expand Up @@ -26,11 +26,14 @@ module UnsafeShellCommandConstructionConfig implements DataFlow::ConfigSig {

DataFlow::FlowFeature getAFeature() { result instanceof DataFlow::FeatureHasSourceCallContext }

predicate observeDiffInformedIncrementalMode() {
// TODO(diff-informed): Manually verify if config can be diff-informed.
// ql/src/Security/CWE-078/UnsafeShellCommandConstruction.ql:24: Column 1 selects sink.getAlertLocation
// ql/src/Security/CWE-078/UnsafeShellCommandConstruction.ql:26: Column 7 selects sink.getCommandExecution
none()
predicate observeDiffInformedIncrementalMode() { any() }

Location getASelectedSinkLocation(DataFlow::Node sink) {
result = sink.(Sink).getLocation()
or
result = sink.(Sink).getAlertLocation().getLocation()
or
result = sink.(Sink).getCommandExecution().getLocation()
}
}

Expand Down
13 changes: 8 additions & 5 deletions javascript/ql/lib/semmle/javascript/security/regexp/PolynomialReDoSQuery.qll
View file
Original file line number Diff line number Diff line change
Expand Up @@ -26,11 +26,14 @@ module PolynomialReDoSConfig implements DataFlow::ConfigSig {

int fieldFlowBranchLimit() { result = 1 } // library inputs are too expensive on some projects

predicate observeDiffInformedIncrementalMode() {
// TODO(diff-informed): Manually verify if config can be diff-informed.
// ql/src/Performance/PolynomialReDoS.ql:31: Column 1 selects sink.getHighlight
// ql/src/Performance/PolynomialReDoS.ql:33: Column 5 selects sink.getRegExp
none()
predicate observeDiffInformedIncrementalMode() { any() }

Location getASelectedSinkLocation(DataFlow::Node sink) {
result = sink.(Sink).getLocation()
or
result = sink.(Sink).getHighlight().getLocation()
or
result = sink.(Sink).getRegExp().getLocation()
}
}

Expand Down

0 comments on commit 6423033

Please sign in to comment.