Skip to content

Conversation

@mdtro
Copy link
Contributor

@mdtro mdtro commented Nov 14, 2023

This expands CodeQL to cover more potentially vulnerable code paths.

In addition to the current detections, this will add detections for:

> github/codeql/java/ql/src/Security/CWE/CWE-079/AndroidWebViewSettingsEnabledJavaScript.ql
> github/codeql/java/ql/src/Security/CWE/CWE-079/AndroidWebViewAddJavascriptInterface.ql
> github/codeql/javascript/ql/src/Security/CWE-117/LogInjection.ql
> github/codeql/javascript/ql/src/Security/CWE-384/SessionFixation.ql
> github/codeql/javascript/ql/src/Security/CWE-400/RemotePropertyInjection.ql
> github/codeql/javascript/ql/src/Security/CWE-078/IndirectCommandInjection.ql
> github/codeql/javascript/ql/src/Security/CWE-020/MissingRegExpAnchor.ql
> github/codeql/javascript/ql/src/Security/CWE-020/MissingOriginCheck.ql
> github/codeql/javascript/ql/src/Security/CWE-313/PasswordInConfigurationFile.ql
> github/codeql/javascript/ql/src/Security/CWE-912/HttpToFileAccess.ql
> github/codeql/javascript/ql/src/Security/CWE-200/FileAccessToHttp.ql
> github/codeql/javascript/ql/src/Security/CWE-807/ConditionalBypass.ql
> github/codeql/javascript/ql/src/Security/CWE-094/UnsafeCodeConstruction.ql
> github/codeql/javascript/ql/src/Security/CWE-1275/SameSiteNoneCookie.ql
> github/codeql/javascript/ql/src/Security/CWE-918/ClientSideRequestForgery.ql
> github/codeql/javascript/ql/src/Security/CWE-377/InsecureTemporaryFile.ql
> github/codeql/javascript/ql/src/Security/CWE-862/EmptyPasswordInConfigurationFile.ql
> github/codeql/javascript/ql/src/Security/CWE-506/HardcodedDataInterpretedAsCode.ql
> github/codeql/javascript/ql/src/Security/CWE-367/FileSystemRace.ql

The query logic can be found here: https://github.com/github/codeql/tree/codeql-cli/v2.15.2/javascript/ql/src/Security

@mdtro mdtro force-pushed the mdtro/codeql-extended branch from b6a571e to 04a41ee Compare November 14, 2023 17:19
@mdtro mdtro enabled auto-merge November 14, 2023 17:21
@mdtro mdtro merged commit ad4f2d1 into develop Nov 14, 2023
@mdtro mdtro deleted the mdtro/codeql-extended branch November 14, 2023 21:03
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

4 participants