JS: Migrate CodeQL tests for ML-powered queries

Author: henrymercer

javascript/ql/experimental/adaptivethreatmodeling/test/endpoint_large_scale/EndpointFeatures.expected

@@ -0,0 +1,34 @@
+/**
+ * EndpointFeatures.ql
+ *
+ * This tests generic token-based featurization of all endpoint candidates for all of the security
+ * queries we support. This is in comparison to the `ExtractEndpointData.qlref` test, which tests
+ * just the endpoints we extract in the training data.
+ */
+
+import javascript
+import experimental.adaptivethreatmodeling.NosqlInjectionATM as NosqlInjectionATM
+import experimental.adaptivethreatmodeling.SqlInjectionATM as SqlInjectionATM
+import experimental.adaptivethreatmodeling.TaintedPathATM as TaintedPathATM
+import experimental.adaptivethreatmodeling.XssATM as XssATM
+import experimental.adaptivethreatmodeling.EndpointFeatures as EndpointFeatures
+import experimental.adaptivethreatmodeling.StandardEndpointFilters as StandardEndpointFilters
+import extraction.NoFeaturizationRestrictionsConfig
+
+query predicate tokenFeatures(DataFlow::Node endpoint, string featureName, string featureValue) {
+  (
+    not exists(NosqlInjectionATM::SinkEndpointFilter::getAReasonSinkExcluded(endpoint)) or
+    not exists(SqlInjectionATM::SinkEndpointFilter::getAReasonSinkExcluded(endpoint)) or
+    not exists(TaintedPathATM::SinkEndpointFilter::getAReasonSinkExcluded(endpoint)) or
+    not exists(XssATM::SinkEndpointFilter::getAReasonSinkExcluded(endpoint)) or
+    StandardEndpointFilters::isArgumentToModeledFunction(endpoint)
+  ) and
+  EndpointFeatures::tokenFeatures(endpoint, featureName, featureValue)
+}
+
+query predicate invalidTokenFeatures(
+  DataFlow::Node endpoint, string featureName, string featureValue
+) {
+  strictcount(string value | EndpointFeatures::tokenFeatures(endpoint, featureName, value)) > 1 and
+  EndpointFeatures::tokenFeatures(endpoint, featureName, featureValue)
+}

javascript/ql/experimental/adaptivethreatmodeling/test/endpoint_large_scale/EndpointFeatures.ql

@@ -0,0 +1 @@
+extraction/ExtractEndpointData.ql

javascript/ql/experimental/adaptivethreatmodeling/test/endpoint_large_scale/ExtractEndpointData.expected

@@ -0,0 +1 @@
+extraction/ExtractEndpointDataEvaluation.ql

javascript/ql/experimental/adaptivethreatmodeling/test/endpoint_large_scale/ExtractEndpointData.qlref

@@ -0,0 +1 @@
+extraction/ExtractEndpointDataTraining.ql

javascript/ql/experimental/adaptivethreatmodeling/test/endpoint_large_scale/ExtractEndpointDataEvaluation.expected

@@ -0,0 +1,16 @@
+nosqlFilteredTruePositives
+| autogenerated/NosqlAndSqlInjection/untyped/mongoose.js:111:14:111:18 | query | not a direct argument to a likely external library call or a heuristic sink |
+sqlFilteredTruePositives
+| autogenerated/NosqlAndSqlInjection/untyped/tst2.js:7:13:7:45 | select  ... e id =  | not an argument to a likely external library call or a heuristic sink |
+| autogenerated/NosqlAndSqlInjection/untyped/tst2.js:7:48:7:60 | req.params.id | not an argument to a likely external library call or a heuristic sink |
+taintedPathFilteredTruePositives
+| autogenerated/TaintedPath/TaintedPath.js:66:26:66:31 | "SAFE" | not a direct argument to a likely external library call or a heuristic sink |
+| autogenerated/TaintedPath/TaintedPath.js:71:26:71:45 | Cookie.get("unsafe") | not a direct argument to a likely external library call or a heuristic sink |
+xssFilteredTruePositives
+| autogenerated/Xss/DomBasedXss/d3.js:12:20:12:29 | getTaint() | not a direct argument to a likely external library call or a heuristic sink |
+| autogenerated/Xss/DomBasedXss/d3.js:14:20:14:29 | getTaint() | not a direct argument to a likely external library call or a heuristic sink |
+| autogenerated/Xss/DomBasedXss/express.js:7:15:7:33 | req.param("wobble") | not a direct argument to a likely external library call or a heuristic sink |
+| autogenerated/Xss/DomBasedXss/jwt-server.js:11:19:11:29 | decoded.foo | not a direct argument to a likely external library call or a heuristic sink |
+| autogenerated/Xss/DomBasedXss/tst.js:316:35:316:42 | location | not a direct argument to a likely external library call or a heuristic sink |
+| autogenerated/Xss/DomBasedXss/typeahead.js:10:16:10:18 | loc | not a direct argument to a likely external library call or a heuristic sink |
+| autogenerated/Xss/DomBasedXss/typeahead.js:25:18:25:20 | val | not a direct argument to a likely external library call or a heuristic sink |

javascript/ql/experimental/adaptivethreatmodeling/test/endpoint_large_scale/ExtractEndpointDataEvaluation.qlref

@@ -0,0 +1,47 @@
+/*
+ * FilteredTruePositives.ql
+ *
+ * This test checks several components of the endpoint filters for each query to see whether they
+ * filter out any known sinks. It explicitly does not check the endpoint filtering step that's based
+ * on whether the endpoint is an argument to a modelled function, since this necessarily filters out
+ * all known sinks. However, we can test all the other filtering steps against the set of known
+ * sinks.
+ *
+ * Ideally, the sink endpoint filters would have perfect recall and therefore each of the predicates
+ * in this test would have zero results. However, in some cases we have chosen to sacrifice recall
+ * when we perceive the improved precision of the results to be worth the drop in recall.
+ */
+
+import semmle.javascript.security.dataflow.NosqlInjectionCustomizations
+import semmle.javascript.security.dataflow.SqlInjectionCustomizations
+import semmle.javascript.security.dataflow.TaintedPathCustomizations
+import semmle.javascript.security.dataflow.DomBasedXssCustomizations
+import experimental.adaptivethreatmodeling.StandardEndpointFilters as StandardEndpointFilters
+import experimental.adaptivethreatmodeling.NosqlInjectionATM as NosqlInjectionATM
+import experimental.adaptivethreatmodeling.SqlInjectionATM as SqlInjectionATM
+import experimental.adaptivethreatmodeling.TaintedPathATM as TaintedPathATM
+import experimental.adaptivethreatmodeling.XssATM as XssATM
+
+query predicate nosqlFilteredTruePositives(DataFlow::Node endpoint, string reason) {
+  endpoint instanceof NosqlInjection::Sink and
+  reason = NosqlInjectionATM::SinkEndpointFilter::getAReasonSinkExcluded(endpoint) and
+  not reason = ["argument to modeled function", "modeled sink", "modeled database access"]
+}
+
+query predicate sqlFilteredTruePositives(DataFlow::Node endpoint, string reason) {
+  endpoint instanceof SqlInjection::Sink and
+  reason = SqlInjectionATM::SinkEndpointFilter::getAReasonSinkExcluded(endpoint) and
+  reason != "argument to modeled function"
+}
+
+query predicate taintedPathFilteredTruePositives(DataFlow::Node endpoint, string reason) {
+  endpoint instanceof TaintedPath::Sink and
+  reason = TaintedPathATM::SinkEndpointFilter::getAReasonSinkExcluded(endpoint) and
+  reason != "argument to modeled function"
+}
+
+query predicate xssFilteredTruePositives(DataFlow::Node endpoint, string reason) {
+  endpoint instanceof DomBasedXss::Sink and
+  reason = XssATM::SinkEndpointFilter::getAReasonSinkExcluded(endpoint) and
+  reason != "argument to modeled function"
+}