JS: RegExp unknown flags support and enhanced compatibility with RegExp objects #18089
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
erik-krogh
reviewed
Nov 25, 2024
javascript/ql/src/Security/CWE-178/CaseSensitiveMiddlewarePath.ql
Outdated
Show resolved
Hide resolved
Co-authored-by: Erik Krogh Kristensen <[email protected]>
Napalys
force-pushed
the
napalys/regexp-unknown-flags
branch
2 times, most recently
from
e314fef
to
b39a8fe
Compare
erik-krogh
reviewed
Nov 26, 2024
Comment on lines
122
to
123
| /** | ||
| * Holds if this is a global replacement, that is, the first argument is a regular expression | ||
| * with the `g` flag, or this is a call to `.replaceAll()`. | ||
| */ |
There was a problem hiding this comment.
This docstring needs to mention that the predicate also holds if the flags are unknown.
Incorporate that into the string naturally in some way.
(Actually, try to copy-paste the above sentence into Copilot as instructions, use o1-mini or o1-preview with the Copilot edit mode: Select the docstring in VSCode, press cmd + i, make sure to select the right model, and paste my above instructions).
Comment on lines
1685
to
1687
| /** Holds if the constructed predicate has the `g` flag. */ | ||
| predicate isGlobal() { RegExp::isGlobal(this.getFlags()) } | ||
|
|
There was a problem hiding this comment.
Don't outright delete predicates like this. Instead keep the implementation but add a deprecated annotation, and add an explanation into the docstring as to why a predicate is deprecated.
Deprecated predicates gets deleted after a little over a year.
Napalys
force-pushed
the
napalys/regexp-unknown-flags
branch
8 times, most recently
from
59c78b0
to
7d2b6c9
Compare
Napalys
changed the title
…gExp with global flag
…protytpe pulluting
…ks only with literals
…gives wrong results
…erals but not objects
…assword Clear text storage of sensitive information
…arEscapeSanitizer
Napalys
force-pushed
the
napalys/regexp-unknown-flags
branch
from
2970aad
to
98a459f
Compare
Napalys
force-pushed
the
napalys/regexp-unknown-flags
branch
from
98a459f
to
fd77360
Compare
erik-krogh
reviewed
Nov 28, 2024
.../ql/test/query-tests/Security/CWE-116/IncompleteSanitization/IncompleteSanitization.expected
Outdated
Show resolved
Hide resolved
javascript/ql/lib/semmle/javascript/security/dataflow/CleartextLoggingCustomizations.qll
Outdated
Show resolved
Hide resolved
| --- | ||
| category: majorAnalysis | ||
| --- | ||
| * Queries such as `IncompleteSanitization`, `TaintedPathCustomizations`, and `IncompleteBlacklistSanitizer` are now compatible with both `RegExpLiteral` and `RegExpObject`. |
There was a problem hiding this comment.
Maybe focus more on the change that users will actually see.
The change they'll see is that the queries now flag new RegExp objects, and not just regex literals.
Same with the below.
Co-authored-by: erik-krogh <[email protected]>
Napalys
force-pushed
the
napalys/regexp-unknown-flags
branch
from
051ff39
to
9ca0fe4
Compare
erik-krogh
reviewed
Nov 28, 2024
javascript/ql/lib/change-notes/2024-11-28-regexp-unknown-flags.md
Outdated
Show resolved
Hide resolved
Co-authored-by: Erik Krogh Kristensen <[email protected]>
asgerf
reviewed
Nov 29, 2024
.../ql/test/query-tests/Security/CWE-116/IncompleteSanitization/IncompleteSanitization.expected
Outdated
Show resolved
Hide resolved
![github-advanced-security[bot]](https://avatars.githubusercontent.com/in/57789?s=60&v=4){kind=small}
…for new RegExp objects
Napalys
force-pushed
the
napalys/regexp-unknown-flags
branch
from
26c625e
to
3171f38
Compare
asgerf
reviewed
Nov 29, 2024
Co-authored-by: asgerf <[email protected]>
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
This pull request fixes an issue where queries were only handling regular expressions with known flags, overlooking unknown flags. Now, it correctly deals with unknown flags in regular expressions.
Additionally, some queries in the
JavaScriptcode were only working with literal regular expressions. Now, they work with both literals and RegExp objects. Notable updates include:javascript/ql/lib/semmle/javascript/security/IncompleteBlacklistSanitizer.qlljavascript/ql/lib/semmle/javascript/security/dataflow/TaintedPathCustomizations.qlljavascript/ql/src/Security/CWE-116/IncompleteSanitization.ql