Napalys/regexp unknown flags #18089
Draft
Napalys/regexp unknown flags #18089
+747
−25
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
erik-krogh
reviewed
Nov 25, 2024
javascript/ql/src/Security/CWE-178/CaseSensitiveMiddlewarePath.ql
Outdated
Show resolved
Hide resolved
Co-authored-by: Erik Krogh Kristensen <[email protected]>
Napalys
force-pushed
the
napalys/regexp-unknown-flags
branch
from
ef0eb2c
to
d6372ae
Compare
… from RegExpCreationNode and reused RegExp::isGlobal in std
Napalys
force-pushed
the
napalys/regexp-unknown-flags
branch
from
e314fef
to
b39a8fe
Compare
…gExp with global flag
…protytpe pulluting
erik-krogh
reviewed
Nov 26, 2024
Comment on lines
122
to
125
| /** | ||
| * Holds if this is a global replacement, that is, the first argument is a regular expression | ||
| * with the `g` flag, or this is a call to `.replaceAll()`. | ||
| */ |
There was a problem hiding this comment.
This docstring needs to mention that the predicate also holds if the flags are unknown.
Incorporate that into the string naturally in some way.
(Actually, try to copy-paste the above sentence into Copilot as instructions, use o1-mini or o1-preview with the Copilot edit mode: Select the docstring in VSCode, press cmd + i, make sure to select the right model, and paste my above instructions).
Comment on lines
1685
to
1687
| /** Holds if the constructed predicate has the `g` flag. */ | ||
| predicate isGlobal() { RegExp::isGlobal(this.getFlags()) } | ||
|
|
There was a problem hiding this comment.
Don't outright delete predicates like this. Instead keep the implementation but add a deprecated annotation, and add an explanation into the docstring as to why a predicate is deprecated.
Deprecated predicates gets deleted after a little over a year.
Napalys
force-pushed
the
napalys/regexp-unknown-flags
branch
from
8b64f17
to
56cde75
Compare
…pr Object, instead of literal
Napalys
force-pushed
the
napalys/regexp-unknown-flags
branch
from
70a1645
to
f320ce5
Compare
… longer flagged as bad sanitization to reduce false positives.
Napalys
force-pushed
the
napalys/regexp-unknown-flags
branch
from
f320ce5
to
2f7df2d
Compare
Napalys
force-pushed
the
napalys/regexp-unknown-flags
branch
from
143f1b8
to
0c937cd
Compare
Napalys
force-pushed
the
napalys/regexp-unknown-flags
branch
2 times, most recently
from
c003a81
to
b6ffc46
Compare
Napalys
force-pushed
the
napalys/regexp-unknown-flags
branch
from
6e16778
to
57d542f
Compare
…gives wrong results
…erals but not objects
…assword Clear text storage of sensitive information
…arEscapeSanitizer
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
This pull request fixes an issue where queries were only handling regular expressions with known flags, overlooking unknown flags. Now, it correctly deals with unknown flags in regular expressions.
Additionally, some queries in the
JavaScriptcode were only working with literal regular expressions. Now, they work with both literals and RegExp objects. Notable updates include:javascript/ql/lib/semmle/javascript/security/IncompleteBlacklistSanitizer.qlljavascript/ql/lib/semmle/javascript/security/dataflow/TaintedPathCustomizations.qlljavascript/ql/src/Security/CWE-116/IncompleteSanitization.ql