Skip to content

Commit 5033507

Browse files
Michael Peyton JonesGitHub Enterprise
Michael Peyton Jones
authored and
GitHub Enterprise
committed
Merge pull request github#3 from pavel/integrate-master
 JavaScript: Pull in changes up to 53548a6024b51
2 parents 3ff43dc + eb94528 commit 5033507

75 files changed

Lines changed: 599 additions & 249 deletions

File tree

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

‎javascript/config/suites/javascript/security‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -13,10 +13,12 @@
1313
+ semmlecode-javascript-queries/Security/CWE-338/InsecureRandomness.ql: /Security/CWE/CWE-338
1414
+ semmlecode-javascript-queries/Security/CWE-346/CorsMisconfigurationForCredentials.ql: /Security/CWE/CWE-346
1515
+ semmlecode-javascript-queries/Security/CWE-352/MissingCsrfMiddleware.ql: /Security/CWE/CWE-352
16+
+ semmlecode-javascript-queries/Security/CWE-400/RemotePropertyInjection.ql: /Security/CWE/CWE-400
1617
+ semmlecode-javascript-queries/Security/CWE-502/UnsafeDeserialization.ql: /Security/CWE/CWE-502
1718
+ semmlecode-javascript-queries/Security/CWE-601/ClientSideUrlRedirect.ql: /Security/CWE/CWE-601
1819
+ semmlecode-javascript-queries/Security/CWE-601/ServerSideUrlRedirect.ql: /Security/CWE/CWE-601
1920
+ semmlecode-javascript-queries/Security/CWE-611/Xxe.ql: /Security/CWE/CWE-611
21+
+ semmlecode-javascript-queries/Security/CWE-643/XpathInjection.ql: /Security/CWE/CWE-643
2022
+ semmlecode-javascript-queries/Security/CWE-730/RegExpInjection.ql: /Security/CWE/CWE-730
2123
+ semmlecode-javascript-queries/Security/CWE-770/MissingRateLimiting.ql: /Security/CWE/CWE-770
2224
+ semmlecode-javascript-queries/Security/CWE-776/XmlBomb.ql: /Security/CWE/CWE-776

‎javascript/ql/src/Declarations/ArgumentsRedefined.ql‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -16,6 +16,7 @@ import Definitions
1616

1717
from DefiningIdentifier id, string name
1818
where not id.inExternsFile() and
19+
not id.isAmbient() and
1920
name = id.getName() and
2021
(name = "eval" or name = "arguments")
2122
select id, "Redefinition of " + name + "."

‎javascript/ql/src/Declarations/RedeclaredVariable.ql‎

Lines changed: 10 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -16,5 +16,14 @@ from Variable v, TopLevel tl, VarDecl decl, VarDecl redecl
1616
where decl = firstRefInTopLevel(v, Decl(), tl) and
1717
redecl = refInTopLevel(v, Decl(), tl) and
1818
redecl != decl and
19-
not tl.isExterns()
19+
not tl.isExterns() and
20+
21+
// Ignore redeclared ambient declarations, such as overloaded functions.
22+
not decl.isAmbient() and
23+
not redecl.isAmbient() and
24+
25+
// Redeclaring a namespace extends the previous definition.
26+
not decl = any(NamespaceDeclaration ns).getId() and
27+
not redecl = any(NamespaceDeclaration ns).getId()
28+
2029
select redecl, "This variable has already been declared $@.", decl, "here"

‎javascript/ql/src/Declarations/UnusedVariable.ql‎

Lines changed: 3 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -121,5 +121,7 @@ where v = vd.getVariable() and
121121
// exclude decorated functions and classes
122122
not isDecorated(vd) and
123123
// exclude names of enum members; they also define property names
124-
not isEnumMember(vd)
124+
not isEnumMember(vd) and
125+
// ignore ambient declarations - too noisy
126+
not vd.isAmbient()
125127
select vd, "Unused " + describe(vd) + "."

‎javascript/ql/src/Security/CWE-022/TaintedPath.ql‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -18,6 +18,6 @@ import javascript
1818
import semmle.javascript.security.dataflow.RemoteFlowSources
1919
import semmle.javascript.security.dataflow.TaintedPath::TaintedPath
2020

21-
from Configuration cfg, Source source, Sink sink
21+
from Configuration cfg, DataFlow::Node source, DataFlow::Node sink
2222
where cfg.hasFlow(source, sink)
2323
select sink, "This path depends on $@.", source, "a user-provided value"

‎javascript/ql/src/Security/CWE-078/CommandInjection.ql‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -15,6 +15,6 @@
1515
import javascript
1616
import semmle.javascript.security.dataflow.CommandInjection::CommandInjection
1717

18-
from Configuration cfg, Source source, Sink sink
18+
from Configuration cfg, DataFlow::Node source, DataFlow::Node sink
1919
where cfg.hasFlow(source, sink)
2020
select sink, "This command depends on $@.", source, "a user-provided value"

‎javascript/ql/src/Security/CWE-079/ReflectedXss.ql‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -14,7 +14,7 @@
1414
import javascript
1515
import semmle.javascript.security.dataflow.ReflectedXss::ReflectedXss
1616

17-
from Configuration xss, Source source, Sink sink
17+
from Configuration xss, DataFlow::Node source, DataFlow::Node sink
1818
where xss.hasFlow(source, sink)
1919
select sink, "Cross-site scripting vulnerability due to $@.",
2020
source, "user-provided value"

‎javascript/ql/src/Security/CWE-079/Xss.ql‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -14,7 +14,7 @@
1414
import javascript
1515
import semmle.javascript.security.dataflow.DomBasedXss::DomBasedXss
1616

17-
from Configuration xss, Source source, Sink sink
17+
from Configuration xss, DataFlow::Node source, DataFlow::Node sink
1818
where xss.hasFlow(source, sink)
1919
select sink, "Cross-site scripting vulnerability due to $@.",
2020
source, "user-provided value"

‎javascript/ql/src/Security/CWE-089/SqlInjection.ql‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -14,11 +14,11 @@ import javascript
1414
import semmle.javascript.security.dataflow.SqlInjection
1515
import semmle.javascript.security.dataflow.NosqlInjection
1616

17-
predicate sqlInjection(SqlInjection::Source source, SqlInjection::Sink sink) {
17+
predicate sqlInjection(DataFlow::Node source, DataFlow::Node sink) {
1818
any(SqlInjection::Configuration cfg).hasFlow(source, sink)
1919
}
2020

21-
predicate nosqlInjection(NosqlInjection::Source source, NosqlInjection::Sink sink) {
21+
predicate nosqlInjection(DataFlow::Node source, DataFlow::Node sink) {
2222
any(NosqlInjection::Configuration cfg).hasFlow(source, sink)
2323
}
2424

‎javascript/ql/src/Security/CWE-094/CodeInjection.ql‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -15,6 +15,6 @@
1515
import javascript
1616
import semmle.javascript.security.dataflow.CodeInjection::CodeInjection
1717

18-
from Configuration codeInjection, Source source, Sink sink
18+
from Configuration codeInjection, DataFlow::Node source, DataFlow::Node sink
1919
where codeInjection.hasFlow(source, sink)
2020
select sink, "$@ flows to here and is interpreted as code.", source, "User-provided value"

0 commit comments

Comments
 (0)