Skip to content

Commit aeb8cc6

Browse files
author
Max Schaefer
committed
JavaScript: Reclassify PostMessageStar as CWE-201.
1 parent 769e407 commit aeb8cc6

File tree

12 files changed

+4
-3
lines changed

12 files changed

+4
-3
lines changed

‎change-notes/1.20/analysis-javascript.md‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -14,7 +14,7 @@
1414

1515
| **Query** | **Tags** | **Purpose** |
1616
|-----------------------------------------------|------------------------------------------------------|-----------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
17-
| Cross-window communication with unrestricted target origin (`js/cross-window-information-leak`) | security, external/cwe/359 | Highlights code that sends potentially sensitive information to another window without restricting the receiver window's origin. Results are shown on LGTM by default. |
17+
| Cross-window communication with unrestricted target origin (`js/cross-window-information-leak`) | security, external/cwe/201, external/cwe/359 | Highlights code that sends potentially sensitive information to another window without restricting the receiver window's origin, indicating a possible violation of [CWE-201](https://cwe.mitre.org/data/definitions/201.html). Results are shown on LGTM by default. |
1818
| Double escaping or unescaping (`js/double-escaping`) | correctness, security, external/cwe/cwe-116 | Highlights potential double escaping or unescaping of special characters, indicating a possible violation of [CWE-116](https://cwe.mitre.org/data/definitions/116.html). Results are shown on LGTM by default. |
1919
| Incomplete regular expression for hostnames (`js/incomplete-hostname-regexp`) | correctness, security, external/cwe/cwe-020 | Highlights hostname sanitizers that are likely to be incomplete, indicating a violation of [CWE-020](https://cwe.mitre.org/data/definitions/20.html). Results are shown on LGTM by default.|
2020
| Incomplete URL substring sanitization | correctness, security, external/cwe/cwe-020 | Highlights URL sanitizers that are likely to be incomplete, indicating a violation of [CWE-020](https://cwe.mitre.org/data/definitions/20.html). Results shown on LGTM by default. |

‎javascript/config/suites/javascript/security‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -14,6 +14,7 @@
1414
+ semmlecode-javascript-queries/Security/CWE-116/IncompleteSanitization.ql: /Security/CWE/CWE-116
1515
+ semmlecode-javascript-queries/Security/CWE-116/DoubleEscaping.ql: /Security/CWE/CWE-116
1616
+ semmlecode-javascript-queries/Security/CWE-134/TaintedFormatString.ql: /Security/CWE/CWE-134
17+
+ semmlecode-javascript-queries/Security/CWE-201/PostMessageStar.ql: /Security/CWE/CWE-201
1718
+ semmlecode-javascript-queries/Security/CWE-209/StackTraceExposure.ql: /Security/CWE/CWE-209
1819
+ semmlecode-javascript-queries/Security/CWE-312/CleartextStorage.ql: /Security/CWE/CWE-312
1920
+ semmlecode-javascript-queries/Security/CWE-312/CleartextLogging.ql: /Security/CWE/CWE-312
@@ -22,7 +23,6 @@
2223
+ semmlecode-javascript-queries/Security/CWE-338/InsecureRandomness.ql: /Security/CWE/CWE-338
2324
+ semmlecode-javascript-queries/Security/CWE-346/CorsMisconfigurationForCredentials.ql: /Security/CWE/CWE-346
2425
+ semmlecode-javascript-queries/Security/CWE-352/MissingCsrfMiddleware.ql: /Security/CWE/CWE-352
25-
+ semmlecode-javascript-queries/Security/CWE-359/PostMessageStar.ql: /Security/CWE/CWE-359
2626
+ semmlecode-javascript-queries/Security/CWE-400/RemotePropertyInjection.ql: /Security/CWE/CWE-400
2727
+ semmlecode-javascript-queries/Security/CWE-502/UnsafeDeserialization.ql: /Security/CWE/CWE-502
2828
+ semmlecode-javascript-queries/Security/CWE-506/HardcodedDataInterpretedAsCode.ql: /Security/CWE/CWE-506

javascript/ql/src/Security/CWE-359/PostMessageStar.qhelp renamed to javascript/ql/src/Security/CWE-201/PostMessageStar.qhelp

File renamed without changes.

javascript/ql/src/Security/CWE-359/PostMessageStar.ql renamed to javascript/ql/src/Security/CWE-201/PostMessageStar.ql

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -8,6 +8,7 @@
88
* @precision high
99
* @id js/cross-window-information-leak
1010
* @tags security
11+
* external/cwe/cwe-201
1112
* external/cwe/cwe-359
1213
*/
1314

javascript/ql/src/Security/CWE-359/examples/PostMessageStar.js renamed to javascript/ql/src/Security/CWE-201/examples/PostMessageStar.js

File renamed without changes.

javascript/ql/src/Security/CWE-359/examples/PostMessageStarGood.js renamed to javascript/ql/src/Security/CWE-201/examples/PostMessageStarGood.js

File renamed without changes.

javascript/ql/test/query-tests/Security/CWE-359/PostMessageStar.expected renamed to javascript/ql/test/query-tests/Security/CWE-201/PostMessageStar.expected

File renamed without changes.

javascript/ql/test/query-tests/Security/CWE-359/PostMessageStar.js renamed to javascript/ql/test/query-tests/Security/CWE-201/PostMessageStar.js

File renamed without changes.

‎javascript/ql/test/query-tests/Security/CWE-201/PostMessageStar.qlref‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1 @@
1+
Security/CWE-201/PostMessageStar.ql

javascript/ql/test/query-tests/Security/CWE-359/PostMessageStar2.js renamed to javascript/ql/test/query-tests/Security/CWE-201/PostMessageStar2.js

File renamed without changes.

0 commit comments

Comments
 (0)