Skip to content

Commit 0720fa7

Browse files
erik-krogherik-krogh
authored
Merge pull request github#10286 from erik-krogh/js-followMsg
JS: change alert messages of path queries to use the same template
2 parents cbb64cc + 87fb01d commit 0720fa7

File tree

69 files changed

+800
-802
lines changed

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

69 files changed

+800
-802
lines changed

‎javascript/ql/lib/semmle/javascript/security/dataflow/CodeInjectionCustomizations.qll

+4-3
Original file line numberDiff line numberDiff line change
@@ -19,7 +19,7 @@ module CodeInjection {
1919
/**
2020
* Gets the substitute for `X` in the message `User-provided value flows to X`.
2121
*/
22-
string getMessageSuffix() { result = "here and is interpreted as code" }
22+
string getMessageSuffix() { result = "this location and is interpreted as code" }
2323
}
2424

2525
/**
@@ -126,7 +126,8 @@ module CodeInjection {
126126
}
127127

128128
override string getMessageSuffix() {
129-
result = "here and is interpreted by " + templateType + ", which may evaluate it as code"
129+
result =
130+
"this location and is interpreted by " + templateType + ", which may evaluate it as code"
130131
}
131132
}
132133

@@ -288,7 +289,7 @@ module CodeInjection {
288289
/** A sink for code injection via template injection. */
289290
abstract private class TemplateSink extends Sink {
290291
override string getMessageSuffix() {
291-
result = "here and is interpreted as a template, which may contain code"
292+
result = "this location and is interpreted as a template, which may contain code"
292293
}
293294
}
294295

‎javascript/ql/lib/semmle/javascript/security/dataflow/HardcodedDataInterpretedAsCodeCustomizations.qll

+2-2
Original file line numberDiff line numberDiff line change
@@ -54,7 +54,7 @@ module HardcodedDataInterpretedAsCode {
5454

5555
override DataFlow::FlowLabel getLabel() { result.isTaint() }
5656

57-
override string getKind() { result = "code" }
57+
override string getKind() { result = "Code" }
5858
}
5959

6060
/**
@@ -65,6 +65,6 @@ module HardcodedDataInterpretedAsCode {
6565

6666
override DataFlow::FlowLabel getLabel() { result.isDataOrTaint() }
6767

68-
override string getKind() { result = "an import path" }
68+
override string getKind() { result = "An import path" }
6969
}
7070
}

‎javascript/ql/lib/semmle/javascript/security/dataflow/RemotePropertyInjectionCustomizations.qll

+2-2
Original file line numberDiff line numberDiff line change
@@ -47,7 +47,7 @@ module RemotePropertyInjection {
4747
exists(DeleteExpr expr | expr.getOperand().(PropAccess).getPropertyNameExpr() = astNode)
4848
}
4949

50-
override string getMessage() { result = " a property name to write to." }
50+
override string getMessage() { result = "A property name to write to" }
5151
}
5252

5353
/**
@@ -65,6 +65,6 @@ module RemotePropertyInjection {
6565
)
6666
}
6767

68-
override string getMessage() { result = " a header name." }
68+
override string getMessage() { result = "A header name" }
6969
}
7070
}

‎javascript/ql/src/Security/CWE-022/TaintedPath.ql

+2-2
Original file line numberDiff line numberDiff line change
@@ -21,5 +21,5 @@ import DataFlow::PathGraph
2121

2222
from Configuration cfg, DataFlow::PathNode source, DataFlow::PathNode sink
2323
where cfg.hasFlowPath(source, sink)
24-
select sink.getNode(), source, sink, "$@ flows to here and is used in a path.", source.getNode(),
25-
"User-provided value"
24+
select sink.getNode(), source, sink, "This path depends on $@.", source.getNode(),
25+
"a user-provided value"

‎javascript/ql/src/Security/CWE-022/ZipSlip.ql

+2-3
Original file line numberDiff line numberDiff line change
@@ -18,6 +18,5 @@ import DataFlow::PathGraph
1818

1919
from Configuration cfg, DataFlow::PathNode source, DataFlow::PathNode sink
2020
where cfg.hasFlowPath(source, sink)
21-
select source.getNode(), source, sink,
22-
"Unsanitized archive entry, which may contain '..', is used in a $@.", sink.getNode(),
23-
"file system operation"
21+
select source.getNode(), source, sink, "$@ depends on $@ which may contain '..'", sink.getNode(),
22+
"File system operation", source.getNode(), "unsanitized archive entry"

‎javascript/ql/src/Security/CWE-073/TemplateObjectInjection.ql

+2-2
Original file line numberDiff line numberDiff line change
@@ -17,5 +17,5 @@ import semmle.javascript.security.dataflow.TemplateObjectInjectionQuery
1717

1818
from DataFlow::Configuration cfg, DataFlow::PathNode source, DataFlow::PathNode sink
1919
where cfg.hasFlowPath(source, sink)
20-
select sink.getNode(), source, sink, "Template object injection due to $@.", source.getNode(),
21-
"user-provided value"
20+
select sink.getNode(), source, sink, "Template object depends on $@.", source.getNode(),
21+
"a user-provided value"

‎javascript/ql/src/Security/CWE-078/CommandInjection.ql

+2-2
Original file line numberDiff line numberDiff line change
@@ -28,5 +28,5 @@ where
2828
else highlight = sink.getNode()
2929
) and
3030
sourceNode = source.getNode()
31-
select highlight, source, sink, "$@ flows to here and is used in a command.", source.getNode(),
32-
sourceNode.getSourceType()
31+
select highlight, source, sink, "Command line depends on $@.", source.getNode(),
32+
"a user-provided value"

‎javascript/ql/src/Security/CWE-078/UnsafeShellCommandConstruction.ql

+2-2
Original file line numberDiff line numberDiff line change
@@ -19,6 +19,6 @@ import DataFlow::PathGraph
1919

2020
from Configuration cfg, DataFlow::PathNode source, DataFlow::PathNode sink, Sink sinkNode
2121
where cfg.hasFlowPath(source, sink) and sinkNode = sink.getNode()
22-
select sinkNode.getAlertLocation(), source, sink, "$@ based on $@ is later used in $@.",
22+
select sinkNode.getAlertLocation(), source, sink, "$@ which depends on $@ is later used in $@.",
2323
sinkNode.getAlertLocation(), sinkNode.getSinkType(), source.getNode(), "library input",
24-
sinkNode.getCommandExecution(), "shell command"
24+
sinkNode.getCommandExecution(), "a shell command"

‎javascript/ql/src/Security/CWE-079/UnsafeHtmlConstruction.ql

+1-1
Original file line numberDiff line numberDiff line change
@@ -18,6 +18,6 @@ import semmle.javascript.security.dataflow.UnsafeHtmlConstructionQuery
1818

1919
from DataFlow::Configuration cfg, DataFlow::PathNode source, DataFlow::PathNode sink, Sink sinkNode
2020
where cfg.hasFlowPath(source, sink) and sink.getNode() = sinkNode
21-
select sinkNode, source, sink, "$@ based on $@ might later cause $@.", sinkNode,
21+
select sinkNode, source, sink, "$@ which depends on $@ might later allow $@.", sinkNode,
2222
sinkNode.describe(), source.getNode(), "library input", sinkNode.getSink(),
2323
sinkNode.getVulnerabilityKind().toLowerCase()

‎javascript/ql/src/Security/CWE-094/ImproperCodeSanitization.ql

+2-2
Original file line numberDiff line numberDiff line change
@@ -68,5 +68,5 @@ where
6868
sink.getNode().(StringOps::ConcatenationLeaf).getRoot() = endsInCodeInjectionSink() and
6969
remoteFlow() = source.getNode().(DataFlow::InvokeNode).getAnArgument()
7070
)
71-
select sink.getNode(), source, sink, "$@ flows to here and is used to construct code.",
72-
source.getNode(), "Improperly sanitized value"
71+
select sink.getNode(), source, sink, "Code construction depends on $@.", source.getNode(),
72+
"an improperly sanitized value"

‎javascript/ql/src/Security/CWE-094/UnsafeCodeConstruction.ql

+1-1
Original file line numberDiff line numberDiff line change
@@ -19,5 +19,5 @@ import semmle.javascript.security.dataflow.UnsafeCodeConstruction::UnsafeCodeCon
1919

2020
from Configuration cfg, DataFlow::PathNode source, DataFlow::PathNode sink
2121
where cfg.hasFlowPath(source, sink)
22-
select sink.getNode(), source, sink, "$@ flows to here and is later $@.", source.getNode(),
22+
select sink.getNode(), source, sink, "$@ flows to this location and is later $@.", source.getNode(),
2323
"Library input", sink.getNode().(Sink).getCodeSink(), "interpreted as code"

‎javascript/ql/src/Security/CWE-094/UnsafeDynamicMethodAccess.ql

+2-2
Original file line numberDiff line numberDiff line change
@@ -17,5 +17,5 @@ import DataFlow::PathGraph
1717
from Configuration cfg, DataFlow::PathNode source, DataFlow::PathNode sink
1818
where cfg.hasFlowPath(source, sink)
1919
select sink, source, sink,
20-
"Invocation of method derived from $@ may lead to remote code execution.", source.getNode(),
21-
"user-controlled value"
20+
"This method is invoked using $@, which may allow remote code execution.", source.getNode(),
21+
"a user-controlled value"

‎javascript/ql/src/Security/CWE-117/LogInjection.ql

+2-2
Original file line numberDiff line numberDiff line change
@@ -17,5 +17,5 @@ import semmle.javascript.security.dataflow.LogInjectionQuery
1717

1818
from LogInjectionConfiguration config, DataFlow::PathNode source, DataFlow::PathNode sink
1919
where config.hasFlowPath(source, sink)
20-
select sink.getNode(), source, sink, "$@ flows to log entry.", source.getNode(),
21-
"User-provided value"
20+
select sink.getNode(), source, sink, "Log entry depends on $@.", source.getNode(),
21+
"a user-provided value"

‎javascript/ql/src/Security/CWE-134/TaintedFormatString.ql

+2-2
Original file line numberDiff line numberDiff line change
@@ -16,5 +16,5 @@ import DataFlow::PathGraph
1616

1717
from Configuration cfg, DataFlow::PathNode source, DataFlow::PathNode sink
1818
where cfg.hasFlowPath(source, sink)
19-
select sink.getNode(), source, sink, "$@ flows to here and is used in a format string.",
20-
source.getNode(), "User-provided value"
19+
select sink.getNode(), source, sink, "Format string depends on $@.", source.getNode(),
20+
"a user-provided value"

‎javascript/ql/src/Security/CWE-200/FileAccessToHttp.ql

+2-2
Original file line numberDiff line numberDiff line change
@@ -16,5 +16,5 @@ import DataFlow::PathGraph
1616

1717
from Configuration cfg, DataFlow::PathNode source, DataFlow::PathNode sink
1818
where cfg.hasFlowPath(source, sink)
19-
select sink.getNode(), source, sink, "$@ flows directly to outbound network request",
20-
source.getNode(), "File data"
19+
select sink.getNode(), source, sink, "Outbound network request depends on $@", source.getNode(),
20+
"file data"

‎javascript/ql/src/Security/CWE-201/PostMessageStar.ql

+2-3
Original file line numberDiff line numberDiff line change
@@ -19,6 +19,5 @@ import DataFlow::PathGraph
1919

2020
from Configuration cfg, DataFlow::PathNode source, DataFlow::PathNode sink
2121
where cfg.hasFlowPath(source, sink)
22-
select sink.getNode(), source, sink,
23-
"Sensitive data returned from $@ is sent to another window without origin restriction.",
24-
source.getNode(), "here"
22+
select sink.getNode(), source, sink, "$@ is sent to another window without origin restriction.",
23+
source.getNode(), "Sensitive data"

‎javascript/ql/src/Security/CWE-209/StackTraceExposure.ql

+2-2
Original file line numberDiff line numberDiff line change
@@ -20,5 +20,5 @@ import DataFlow::PathGraph
2020
from Configuration cfg, DataFlow::PathNode source, DataFlow::PathNode sink
2121
where cfg.hasFlowPath(source, sink)
2222
select sink.getNode(), source, sink,
23-
"Stack trace information from $@ may be exposed to an external user here.", source.getNode(),
24-
"here"
23+
"$@ flows to this location and may be exposed to an external user.", source.getNode(),
24+
"Stack trace information"

‎javascript/ql/src/Security/CWE-312/BuildArtifactLeak.ql

+2-2
Original file line numberDiff line numberDiff line change
@@ -20,5 +20,5 @@ import DataFlow::PathGraph
2020
from Configuration cfg, DataFlow::PathNode source, DataFlow::PathNode sink
2121
where cfg.hasFlowPath(source, sink)
2222
select sink.getNode(), source, sink,
23-
"Sensitive data returned by $@ is stored in a build artifact here.", source.getNode(),
24-
source.getNode().(CleartextLogging::Source).describe()
23+
"Sensitive data returned by $@ flows to this location and is stored in a build artifact.",
24+
source.getNode(), source.getNode().(CleartextLogging::Source).describe()

‎javascript/ql/src/Security/CWE-312/CleartextLogging.ql

+2-2
Original file line numberDiff line numberDiff line change
@@ -38,5 +38,5 @@ where
3838
cfg.hasFlowPath(source, sink) and
3939
// ignore logging to the browser console (even though it is not a good practice)
4040
not inBrowserEnvironment(sink.getNode().asExpr().getTopLevel())
41-
select sink.getNode(), source, sink, "Sensitive data returned by $@ is logged here.",
42-
source.getNode(), source.getNode().(Source).describe()
41+
select sink.getNode(), source, sink, "$@ is logged here.", source.getNode(),
42+
"Sensitive data returned by " + source.getNode().(Source).describe()

‎javascript/ql/src/Security/CWE-312/CleartextStorage.ql

+2-2
Original file line numberDiff line numberDiff line change
@@ -19,5 +19,5 @@ import DataFlow::PathGraph
1919

2020
from Configuration cfg, DataFlow::PathNode source, DataFlow::PathNode sink
2121
where cfg.hasFlowPath(source, sink)
22-
select sink.getNode(), source, sink, "Sensitive data returned by $@ is stored here.",
23-
source.getNode(), source.getNode().(Source).describe()
22+
select sink.getNode(), source, sink, "$@ is stored here.", source.getNode(),
23+
"Sensitive data returned by " + source.getNode().(Source).describe()

‎javascript/ql/src/Security/CWE-327/BrokenCryptoAlgorithm.ql

+2-3
Original file line numberDiff line numberDiff line change
@@ -20,6 +20,5 @@ from Configuration cfg, DataFlow::PathNode source, DataFlow::PathNode sink
2020
where
2121
cfg.hasFlowPath(source, sink) and
2222
not source.getNode() instanceof CleartextPasswordExpr // flagged by js/insufficient-password-hash
23-
select sink.getNode(), source, sink,
24-
"Sensitive data from $@ is used in a broken or weak cryptographic algorithm.", source.getNode(),
25-
source.getNode().(Source).describe()
23+
select sink.getNode(), source, sink, "A broken or weak cryptographic algorithm depends on $@.",
24+
source.getNode(), "sensitive data from" + source.getNode().(Source).describe()

‎javascript/ql/src/Security/CWE-338/InsecureRandomness.ql

+1-1
Original file line numberDiff line numberDiff line change
@@ -19,5 +19,5 @@ import DataFlow::PathGraph
1919
from Configuration cfg, DataFlow::PathNode source, DataFlow::PathNode sink
2020
where cfg.hasFlowPath(source, sink)
2121
select sink.getNode(), source, sink,
22-
"Cryptographically insecure random number is generated at $@ and used here in a security context.",
22+
"This security context depends on a cryptographically insecure random number at $@.",
2323
source.getNode(), source.getNode().toString()

‎javascript/ql/src/Security/CWE-400/DeepObjectResourceExhaustion.ql

+2-2
Original file line numberDiff line numberDiff line change
@@ -20,5 +20,5 @@ from
2020
where
2121
cfg.hasFlowPath(source, sink) and
2222
sink.getNode().(Sink).hasReason(link, reason)
23-
select sink, source, sink, "Denial of service caused by processing user input from $@ with $@.",
24-
source.getNode(), "here", link, reason
23+
select sink, source, sink, "Denial of service caused by processing $@ with $@.", source.getNode(),
24+
"user input", link, reason

‎javascript/ql/src/Security/CWE-400/RemotePropertyInjection.ql

+2-2
Original file line numberDiff line numberDiff line change
@@ -18,5 +18,5 @@ import DataFlow::PathGraph
1818

1919
from Configuration cfg, DataFlow::PathNode source, DataFlow::PathNode sink
2020
where cfg.hasFlowPath(source, sink)
21-
select sink.getNode(), source, sink, "A $@ is used as" + sink.getNode().(Sink).getMessage(),
22-
source.getNode(), "user-provided value"
21+
select sink.getNode(), source, sink, sink.getNode().(Sink).getMessage() + " depends on $@.",
22+
source.getNode(), "a user-provided value"

‎javascript/ql/src/Security/CWE-502/UnsafeDeserialization.ql

+2-1
Original file line numberDiff line numberDiff line change
@@ -17,4 +17,5 @@ import DataFlow::PathGraph
1717

1818
from Configuration cfg, DataFlow::PathNode source, DataFlow::PathNode sink
1919
where cfg.hasFlowPath(source, sink)
20-
select sink.getNode(), source, sink, "Unsafe deserialization of $@.", source.getNode(), "user input"
20+
select sink.getNode(), source, sink, "Unsafe deserialization that depends on $@.", source.getNode(),
21+
"a user-provided value"

‎javascript/ql/src/Security/CWE-506/HardcodedDataInterpretedAsCode.ql

+2-2
Original file line numberDiff line numberDiff line change
@@ -19,5 +19,5 @@ import DataFlow::PathGraph
1919
from Configuration cfg, DataFlow::PathNode source, DataFlow::PathNode sink
2020
where cfg.hasFlowPath(source, sink)
2121
select sink.getNode(), source, sink,
22-
"Hard-coded data from $@ is interpreted as " + sink.getNode().(Sink).getKind() + ".",
23-
source.getNode(), "here"
22+
"$@ is interpreted as " + sink.getNode().(Sink).getKind() + ".", source.getNode(),
23+
"Hard-coded data"

‎javascript/ql/src/Security/CWE-601/ClientSideUrlRedirect.ql

+2-2
Original file line numberDiff line numberDiff line change
@@ -19,5 +19,5 @@ import DataFlow::PathGraph
1919

2020
from Configuration cfg, DataFlow::PathNode source, DataFlow::PathNode sink
2121
where cfg.hasFlowPath(source, sink)
22-
select sink.getNode(), source, sink, "Untrusted URL redirection due to $@.", source.getNode(),
23-
"user-provided value"
22+
select sink.getNode(), source, sink, "Untrusted URL redirection depends on $@.", source.getNode(),
23+
"a user-provided value"

‎javascript/ql/src/Security/CWE-601/ServerSideUrlRedirect.ql

+2-2
Original file line numberDiff line numberDiff line change
@@ -17,5 +17,5 @@ import DataFlow::PathGraph
1717

1818
from Configuration cfg, DataFlow::PathNode source, DataFlow::PathNode sink
1919
where cfg.hasFlowPath(source, sink)
20-
select sink.getNode(), source, sink, "Untrusted URL redirection due to $@.", source.getNode(),
21-
"user-provided value"
20+
select sink.getNode(), source, sink, "Untrusted URL redirection depends on $@.", source.getNode(),
21+
"a user-provided value"

‎javascript/ql/src/Security/CWE-611/Xxe.ql

+2-2
Original file line numberDiff line numberDiff line change
@@ -19,5 +19,5 @@ import DataFlow::PathGraph
1919
from Configuration cfg, DataFlow::PathNode source, DataFlow::PathNode sink
2020
where cfg.hasFlowPath(source, sink)
2121
select sink.getNode(), source, sink,
22-
"A $@ is parsed as XML without guarding against external entity expansion.", source.getNode(),
23-
"user-provided value"
22+
"XML parsing depends on $@ without guarding against external entity expansion.", source.getNode(),
23+
"a user-provided value"

‎javascript/ql/src/Security/CWE-640/HostHeaderPoisoningInEmailGeneration.ql

+2-3
Original file line numberDiff line numberDiff line change
@@ -17,6 +17,5 @@ import DataFlow::PathGraph
1717

1818
from Configuration cfg, DataFlow::PathNode source, DataFlow::PathNode sink
1919
where cfg.hasFlowPath(source, sink)
20-
select sink.getNode(), source, sink,
21-
"Links in this email can be hijacked by poisoning the HTTP host header $@.", source.getNode(),
22-
"here"
20+
select sink.getNode(), source, sink, "Links in this email can be hijacked by poisoning the $@.",
21+
source.getNode(), "HTTP host header"

‎javascript/ql/src/Security/CWE-643/XpathInjection.ql

+2-2
Original file line numberDiff line numberDiff line change
@@ -17,5 +17,5 @@ import DataFlow::PathGraph
1717

1818
from Configuration cfg, DataFlow::PathNode source, DataFlow::PathNode sink
1919
where cfg.hasFlowPath(source, sink)
20-
select sink.getNode(), source, sink, "$@ flows to here and is used in an XPath expression.",
21-
source.getNode(), "User-provided value"
20+
select sink.getNode(), source, sink, "XPath expression depends on $@.", source.getNode(),
21+
"a user-provided value"

‎javascript/ql/src/Security/CWE-730/RegExpInjection.ql

+2-2
Original file line numberDiff line numberDiff line change
@@ -19,5 +19,5 @@ import DataFlow::PathGraph
1919

2020
from Configuration cfg, DataFlow::PathNode source, DataFlow::PathNode sink
2121
where cfg.hasFlowPath(source, sink)
22-
select sink.getNode(), source, sink, "This regular expression is constructed from a $@.",
23-
source.getNode(), "user-provided value"
22+
select sink.getNode(), source, sink, "This regular expression depends on $@.", source.getNode(),
23+
"a user-provided value"

‎javascript/ql/src/Security/CWE-776/XmlBomb.ql

+2-2
Original file line numberDiff line numberDiff line change
@@ -19,5 +19,5 @@ import DataFlow::PathGraph
1919
from Configuration cfg, DataFlow::PathNode source, DataFlow::PathNode sink
2020
where cfg.hasFlowPath(source, sink)
2121
select sink.getNode(), source, sink,
22-
"A $@ is parsed as XML without guarding against uncontrolled entity expansion.", source.getNode(),
23-
"user-provided value"
22+
"XML parsing depends on $@ without guarding against uncontrolled entity expansion.",
23+
source.getNode(), "a user-provided value"

‎javascript/ql/src/Security/CWE-834/LoopBoundInjection.ql

+2-2
Original file line numberDiff line numberDiff line change
@@ -19,5 +19,5 @@ import DataFlow::PathGraph
1919
from Configuration dataflow, DataFlow::PathNode source, DataFlow::PathNode sink
2020
where dataflow.hasFlowPath(source, sink)
2121
select sink, source, sink,
22-
"Iterating over user-controlled object with a potentially unbounded .length property from $@.",
23-
source, "here"
22+
"Iteration over a user-controlled object with a potentially unbounded .length property from $@.",
23+
source, "a user-provided value"

‎javascript/ql/src/Security/CWE-912/HttpToFileAccess.ql

+1-1
Original file line numberDiff line numberDiff line change
@@ -17,4 +17,4 @@ import DataFlow::PathGraph
1717

1818
from Configuration cfg, DataFlow::PathNode source, DataFlow::PathNode sink
1919
where cfg.hasFlowPath(source, sink)
20-
select sink.getNode(), source, sink, "$@ flows to file system", source.getNode(), "Untrusted data"
20+
select sink.getNode(), source, sink, "$@ flows to file system.", source.getNode(), "Untrusted data"

0 commit comments

Comments
 (0)