Skip to content

Commit aeba0f5

Browse files
d10cd10c
committed
JS: patch-generated stubs
1 parent 6c32f26 commit aeba0f5

File tree

6 files changed

+48
-2
lines changed

6 files changed

+48
-2
lines changed

‎javascript/ql/lib/semmle/javascript/security/dataflow/IndirectCommandInjectionQuery.qll

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -29,11 +29,16 @@ module IndirectCommandInjectionConfig implements DataFlow::ConfigSig {
2929

3030
predicate observeDiffInformedIncrementalMode() { any() }
3131

32+
Location getASelectedSourceLocation(DataFlow::Node source) {
33+
none() // TODO: Make sure that this source location matches the query's select clause: Column 1 does not select a source or sink originating from the flow call on line 25 (/Users/d10c/src/semmle-code/ql/javascript/ql/src/Security/CWE-078/IndirectCommandInjection.ql@29:8:29:16)
34+
}
35+
3236
Location getASelectedSinkLocation(DataFlow::Node sink) {
3337
exists(DataFlow::Node node |
3438
isSinkWithHighlight(sink, node) and
3539
result = node.getLocation()
3640
)
41+
// TODO: Make sure that this sink location matches the query's select clause: Column 1 does not select a source or sink originating from the flow call on line 25 (/Users/d10c/src/semmle-code/ql/javascript/ql/src/Security/CWE-078/IndirectCommandInjection.ql@29:8:29:16)
3742
}
3843
}
3944

‎javascript/ql/lib/semmle/javascript/security/dataflow/NosqlInjectionQuery.qll

Lines changed: 11 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -52,7 +52,17 @@ module NosqlInjectionConfig implements DataFlow::StateConfigSig {
5252
state2 = state1
5353
}
5454

55-
predicate observeDiffInformedIncrementalMode() { any() }
55+
predicate observeDiffInformedIncrementalMode() {
56+
any() // TODO: Make sure that the location overrides match the query's select clause: Column 1 does not select a source or sink originating from the flow call on line 32 (/Users/d10c/src/semmle-code/ql/javascript/ql/src/Security/CWE-089/SqlInjection.ql@35:8:35:21), Column 1 does not select a source or sink originating from the flow call on line 34 (/Users/d10c/src/semmle-code/ql/javascript/ql/src/experimental/heuristics/ql/src/Security/CWE-089/SqlInjection.ql@37:8:37:21), Column 5 does not select a source or sink originating from the flow call on line 32 (/Users/d10c/src/semmle-code/ql/javascript/ql/src/Security/CWE-089/SqlInjection.ql@35:82:35:97), Column 5 does not select a source or sink originating from the flow call on line 34 (/Users/d10c/src/semmle-code/ql/javascript/ql/src/experimental/heuristics/ql/src/Security/CWE-089/SqlInjection.ql@37:82:37:97)
57+
}
58+
59+
Location getASelectedSourceLocation(DataFlow::Node source) {
60+
none() // TODO: Make sure that this source location matches the query's select clause: Column 1 does not select a source or sink originating from the flow call on line 32 (/Users/d10c/src/semmle-code/ql/javascript/ql/src/Security/CWE-089/SqlInjection.ql@35:8:35:21), Column 1 does not select a source or sink originating from the flow call on line 34 (/Users/d10c/src/semmle-code/ql/javascript/ql/src/experimental/heuristics/ql/src/Security/CWE-089/SqlInjection.ql@37:8:37:21), Column 5 does not select a source or sink originating from the flow call on line 32 (/Users/d10c/src/semmle-code/ql/javascript/ql/src/Security/CWE-089/SqlInjection.ql@35:82:35:97), Column 5 does not select a source or sink originating from the flow call on line 34 (/Users/d10c/src/semmle-code/ql/javascript/ql/src/experimental/heuristics/ql/src/Security/CWE-089/SqlInjection.ql@37:82:37:97)
61+
}
62+
63+
Location getASelectedSinkLocation(DataFlow::Node sink) {
64+
none() // TODO: Make sure that this sink location matches the query's select clause: Column 1 does not select a source or sink originating from the flow call on line 32 (/Users/d10c/src/semmle-code/ql/javascript/ql/src/Security/CWE-089/SqlInjection.ql@35:8:35:21), Column 1 does not select a source or sink originating from the flow call on line 34 (/Users/d10c/src/semmle-code/ql/javascript/ql/src/experimental/heuristics/ql/src/Security/CWE-089/SqlInjection.ql@37:8:37:21), Column 5 does not select a source or sink originating from the flow call on line 32 (/Users/d10c/src/semmle-code/ql/javascript/ql/src/Security/CWE-089/SqlInjection.ql@35:82:35:97), Column 5 does not select a source or sink originating from the flow call on line 34 (/Users/d10c/src/semmle-code/ql/javascript/ql/src/experimental/heuristics/ql/src/Security/CWE-089/SqlInjection.ql@37:82:37:97)
65+
}
5666
}
5767

5868
/**

‎javascript/ql/lib/semmle/javascript/security/dataflow/ShellCommandInjectionFromEnvironmentQuery.qll

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -30,11 +30,16 @@ module ShellCommandInjectionFromEnvironmentConfig implements DataFlow::ConfigSig
3030

3131
predicate observeDiffInformedIncrementalMode() { any() }
3232

33+
Location getASelectedSourceLocation(DataFlow::Node source) {
34+
none() // TODO: Make sure that this source location matches the query's select clause: Column 1 does not select a source or sink originating from the flow call on line 26 (/Users/d10c/src/semmle-code/ql/javascript/ql/src/Security/CWE-078/ShellCommandInjectionFromEnvironment.ql@30:8:30:16)
35+
}
36+
3337
Location getASelectedSinkLocation(DataFlow::Node sink) {
3438
exists(DataFlow::Node node |
3539
isSinkWithHighlight(sink, node) and
3640
result = node.getLocation()
3741
)
42+
// TODO: Make sure that this sink location matches the query's select clause: Column 1 does not select a source or sink originating from the flow call on line 26 (/Users/d10c/src/semmle-code/ql/javascript/ql/src/Security/CWE-078/ShellCommandInjectionFromEnvironment.ql@30:8:30:16)
3843
}
3944
}
4045

‎javascript/ql/lib/semmle/javascript/security/dataflow/SqlInjectionQuery.qll

Lines changed: 11 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -32,7 +32,17 @@ module SqlInjectionConfig implements DataFlow::ConfigSig {
3232
)
3333
}
3434

35-
predicate observeDiffInformedIncrementalMode() { any() }
35+
predicate observeDiffInformedIncrementalMode() {
36+
any() // TODO: Make sure that the location overrides match the query's select clause: Column 1 does not select a source or sink originating from the flow call on line 28 (/Users/d10c/src/semmle-code/ql/javascript/ql/src/Security/CWE-089/SqlInjection.ql@35:8:35:21), Column 1 does not select a source or sink originating from the flow call on line 30 (/Users/d10c/src/semmle-code/ql/javascript/ql/src/experimental/heuristics/ql/src/Security/CWE-089/SqlInjection.ql@37:8:37:21), Column 5 does not select a source or sink originating from the flow call on line 28 (/Users/d10c/src/semmle-code/ql/javascript/ql/src/Security/CWE-089/SqlInjection.ql@35:82:35:97), Column 5 does not select a source or sink originating from the flow call on line 30 (/Users/d10c/src/semmle-code/ql/javascript/ql/src/experimental/heuristics/ql/src/Security/CWE-089/SqlInjection.ql@37:82:37:97)
37+
}
38+
39+
Location getASelectedSourceLocation(DataFlow::Node source) {
40+
none() // TODO: Make sure that this source location matches the query's select clause: Column 1 does not select a source or sink originating from the flow call on line 28 (/Users/d10c/src/semmle-code/ql/javascript/ql/src/Security/CWE-089/SqlInjection.ql@35:8:35:21), Column 1 does not select a source or sink originating from the flow call on line 30 (/Users/d10c/src/semmle-code/ql/javascript/ql/src/experimental/heuristics/ql/src/Security/CWE-089/SqlInjection.ql@37:8:37:21), Column 5 does not select a source or sink originating from the flow call on line 28 (/Users/d10c/src/semmle-code/ql/javascript/ql/src/Security/CWE-089/SqlInjection.ql@35:82:35:97), Column 5 does not select a source or sink originating from the flow call on line 30 (/Users/d10c/src/semmle-code/ql/javascript/ql/src/experimental/heuristics/ql/src/Security/CWE-089/SqlInjection.ql@37:82:37:97)
41+
}
42+
43+
Location getASelectedSinkLocation(DataFlow::Node sink) {
44+
none() // TODO: Make sure that this sink location matches the query's select clause: Column 1 does not select a source or sink originating from the flow call on line 28 (/Users/d10c/src/semmle-code/ql/javascript/ql/src/Security/CWE-089/SqlInjection.ql@35:8:35:21), Column 1 does not select a source or sink originating from the flow call on line 30 (/Users/d10c/src/semmle-code/ql/javascript/ql/src/experimental/heuristics/ql/src/Security/CWE-089/SqlInjection.ql@37:8:37:21), Column 5 does not select a source or sink originating from the flow call on line 28 (/Users/d10c/src/semmle-code/ql/javascript/ql/src/Security/CWE-089/SqlInjection.ql@35:82:35:97), Column 5 does not select a source or sink originating from the flow call on line 30 (/Users/d10c/src/semmle-code/ql/javascript/ql/src/experimental/heuristics/ql/src/Security/CWE-089/SqlInjection.ql@37:82:37:97)
45+
}
3646
}
3747

3848
/**

‎javascript/ql/src/experimental/Security/CWE-099/EnvValueAndKeyInjection.ql

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -33,6 +33,14 @@ module EnvValueAndKeyInjectionConfig implements DataFlow::ConfigSig {
3333
)
3434
)
3535
}
36+
37+
predicate observeDiffInformedIncrementalMode() {
38+
any() // TODO: Make sure that the location overrides match the query's select clause: Column 1 does not select a source or sink originating from the flow call on line 66 (/Users/d10c/src/semmle-code/ql/javascript/ql/src/experimental/Security/CWE-099/EnvValueAndKeyInjection.ql@69:8:69:23)
39+
}
40+
41+
Location getASelectedSinkLocation(DataFlow::Node sink) {
42+
none() // TODO: Make sure that this sink location matches the query's select clause: Column 1 does not select a source or sink originating from the flow call on line 66 (/Users/d10c/src/semmle-code/ql/javascript/ql/src/experimental/Security/CWE-099/EnvValueAndKeyInjection.ql@69:8:69:23)
43+
}
3644
}
3745

3846
module EnvValueAndKeyInjectionFlow = TaintTracking::Global<EnvValueAndKeyInjectionConfig>;

‎javascript/ql/src/experimental/Security/CWE-347/decodeJwtWithoutVerification.ql

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -27,6 +27,14 @@ module VerifiedDecodeConfig implements DataFlow::ConfigSig {
2727
predicate isSource(DataFlow::Node source) { source instanceof ActiveThreatModelSource }
2828

2929
predicate isSink(DataFlow::Node sink) { sink = verifiedDecode() }
30+
31+
predicate observeDiffInformedIncrementalMode() {
32+
any() // TODO: Make sure that the location overrides match the query's select clause: Column 5 does not select a source or sink originating from the flow call on line 39 (/Users/d10c/src/semmle-code/ql/javascript/ql/src/experimental/Security/CWE-347/decodeJwtWithoutVerification.ql@40:60:40:73)
33+
}
34+
35+
Location getASelectedSinkLocation(DataFlow::Node sink) {
36+
none() // TODO: Make sure that this sink location matches the query's select clause: Column 5 does not select a source or sink originating from the flow call on line 39 (/Users/d10c/src/semmle-code/ql/javascript/ql/src/experimental/Security/CWE-347/decodeJwtWithoutVerification.ql@40:60:40:73)
37+
}
3038
}
3139

3240
module VerifiedDecodeFlow = TaintTracking::Global<VerifiedDecodeConfig>;

0 commit comments

Comments
 (0)