Skip to content

Commit 2a4570e

Browse files
erik-krogherik-krogh
committed
add model for the dayjs library
1 parent 05389bb commit 2a4570e

File tree

5 files changed

+28
-0
lines changed

5 files changed

+28
-0
lines changed

‎javascript/change-notes/2021-06-21-dates.md

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,5 @@
1+
lgtm,codescanning
2+
* Improved support for date parsing libraries, resulting in more results in security queries.
3+
Affected packages are
4+
[dayjs](https://npmjs.com/package/dayjs)
5+

‎javascript/ql/src/semmle/javascript/frameworks/DateFunctions.qll

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -58,6 +58,9 @@ private module Moment {
5858
private API::Node moment() {
5959
result = API::moduleImport(["moment", "moment-timezone"])
6060
or
61+
// `dayjs` largely has a similar API to `moment`
62+
result = API::moduleImport("dayjs")
63+
or
6164
result = moment().getReturn()
6265
or
6366
result = moment().getAMember()

‎javascript/ql/test/query-tests/Security/CWE-079/DomBasedXss/Xss.expected

Lines changed: 9 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -126,6 +126,10 @@ nodes
126126
| dates.js:18:31:18:66 | `Time i ... aint)}` |
127127
| dates.js:18:42:18:64 | datefor ... taint) |
128128
| dates.js:18:59:18:63 | taint |
129+
| dates.js:21:31:21:68 | `Time i ... aint)}` |
130+
| dates.js:21:31:21:68 | `Time i ... aint)}` |
131+
| dates.js:21:42:21:66 | dayjs(t ... (taint) |
132+
| dates.js:21:61:21:65 | taint |
129133
| event-handler-receiver.js:2:31:2:83 | '<h2><a ... ></h2>' |
130134
| event-handler-receiver.js:2:31:2:83 | '<h2><a ... ></h2>' |
131135
| event-handler-receiver.js:2:49:2:61 | location.href |
@@ -755,6 +759,7 @@ edges
755759
| dates.js:9:9:9:69 | taint | dates.js:13:59:13:63 | taint |
756760
| dates.js:9:9:9:69 | taint | dates.js:16:62:16:66 | taint |
757761
| dates.js:9:9:9:69 | taint | dates.js:18:59:18:63 | taint |
762+
| dates.js:9:9:9:69 | taint | dates.js:21:61:21:65 | taint |
758763
| dates.js:9:17:9:69 | decodeU ... ing(1)) | dates.js:9:9:9:69 | taint |
759764
| dates.js:9:36:9:55 | window.location.hash | dates.js:9:36:9:68 | window. ... ring(1) |
760765
| dates.js:9:36:9:55 | window.location.hash | dates.js:9:36:9:68 | window. ... ring(1) |
@@ -774,6 +779,9 @@ edges
774779
| dates.js:18:42:18:64 | datefor ... taint) | dates.js:18:31:18:66 | `Time i ... aint)}` |
775780
| dates.js:18:42:18:64 | datefor ... taint) | dates.js:18:31:18:66 | `Time i ... aint)}` |
776781
| dates.js:18:59:18:63 | taint | dates.js:18:42:18:64 | datefor ... taint) |
782+
| dates.js:21:42:21:66 | dayjs(t ... (taint) | dates.js:21:31:21:68 | `Time i ... aint)}` |
783+
| dates.js:21:42:21:66 | dayjs(t ... (taint) | dates.js:21:31:21:68 | `Time i ... aint)}` |
784+
| dates.js:21:61:21:65 | taint | dates.js:21:42:21:66 | dayjs(t ... (taint) |
777785
| event-handler-receiver.js:2:49:2:61 | location.href | event-handler-receiver.js:2:31:2:83 | '<h2><a ... ></h2>' |
778786
| event-handler-receiver.js:2:49:2:61 | location.href | event-handler-receiver.js:2:31:2:83 | '<h2><a ... ></h2>' |
779787
| event-handler-receiver.js:2:49:2:61 | location.href | event-handler-receiver.js:2:31:2:83 | '<h2><a ... ></h2>' |
@@ -1285,6 +1293,7 @@ edges
12851293
| dates.js:13:31:13:72 | `Time i ... time)}` | dates.js:9:36:9:55 | window.location.hash | dates.js:13:31:13:72 | `Time i ... time)}` | Cross-site scripting vulnerability due to $@. | dates.js:9:36:9:55 | window.location.hash | user-provided value |
12861294
| dates.js:16:31:16:69 | `Time i ... aint)}` | dates.js:9:36:9:55 | window.location.hash | dates.js:16:31:16:69 | `Time i ... aint)}` | Cross-site scripting vulnerability due to $@. | dates.js:9:36:9:55 | window.location.hash | user-provided value |
12871295
| dates.js:18:31:18:66 | `Time i ... aint)}` | dates.js:9:36:9:55 | window.location.hash | dates.js:18:31:18:66 | `Time i ... aint)}` | Cross-site scripting vulnerability due to $@. | dates.js:9:36:9:55 | window.location.hash | user-provided value |
1296+
| dates.js:21:31:21:68 | `Time i ... aint)}` | dates.js:9:36:9:55 | window.location.hash | dates.js:21:31:21:68 | `Time i ... aint)}` | Cross-site scripting vulnerability due to $@. | dates.js:9:36:9:55 | window.location.hash | user-provided value |
12881297
| event-handler-receiver.js:2:31:2:83 | '<h2><a ... ></h2>' | event-handler-receiver.js:2:49:2:61 | location.href | event-handler-receiver.js:2:31:2:83 | '<h2><a ... ></h2>' | Cross-site scripting vulnerability due to $@. | event-handler-receiver.js:2:49:2:61 | location.href | user-provided value |
12891298
| express.js:7:15:7:33 | req.param("wobble") | express.js:7:15:7:33 | req.param("wobble") | express.js:7:15:7:33 | req.param("wobble") | Cross-site scripting vulnerability due to $@. | express.js:7:15:7:33 | req.param("wobble") | user-provided value |
12901299
| jquery.js:7:5:7:34 | "<div i ... + "\\">" | jquery.js:2:17:2:40 | documen ... .search | jquery.js:7:5:7:34 | "<div i ... + "\\">" | Cross-site scripting vulnerability due to $@. | jquery.js:2:17:2:40 | documen ... .search | user-provided value |

‎javascript/ql/test/query-tests/Security/CWE-079/DomBasedXss/XssWithAdditionalSources.expected

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -126,6 +126,10 @@ nodes
126126
| dates.js:18:31:18:66 | `Time i ... aint)}` |
127127
| dates.js:18:42:18:64 | datefor ... taint) |
128128
| dates.js:18:59:18:63 | taint |
129+
| dates.js:21:31:21:68 | `Time i ... aint)}` |
130+
| dates.js:21:31:21:68 | `Time i ... aint)}` |
131+
| dates.js:21:42:21:66 | dayjs(t ... (taint) |
132+
| dates.js:21:61:21:65 | taint |
129133
| event-handler-receiver.js:2:31:2:83 | '<h2><a ... ></h2>' |
130134
| event-handler-receiver.js:2:31:2:83 | '<h2><a ... ></h2>' |
131135
| event-handler-receiver.js:2:49:2:61 | location.href |
@@ -773,6 +777,7 @@ edges
773777
| dates.js:9:9:9:69 | taint | dates.js:13:59:13:63 | taint |
774778
| dates.js:9:9:9:69 | taint | dates.js:16:62:16:66 | taint |
775779
| dates.js:9:9:9:69 | taint | dates.js:18:59:18:63 | taint |
780+
| dates.js:9:9:9:69 | taint | dates.js:21:61:21:65 | taint |
776781
| dates.js:9:17:9:69 | decodeU ... ing(1)) | dates.js:9:9:9:69 | taint |
777782
| dates.js:9:36:9:55 | window.location.hash | dates.js:9:36:9:68 | window. ... ring(1) |
778783
| dates.js:9:36:9:55 | window.location.hash | dates.js:9:36:9:68 | window. ... ring(1) |
@@ -792,6 +797,9 @@ edges
792797
| dates.js:18:42:18:64 | datefor ... taint) | dates.js:18:31:18:66 | `Time i ... aint)}` |
793798
| dates.js:18:42:18:64 | datefor ... taint) | dates.js:18:31:18:66 | `Time i ... aint)}` |
794799
| dates.js:18:59:18:63 | taint | dates.js:18:42:18:64 | datefor ... taint) |
800+
| dates.js:21:42:21:66 | dayjs(t ... (taint) | dates.js:21:31:21:68 | `Time i ... aint)}` |
801+
| dates.js:21:42:21:66 | dayjs(t ... (taint) | dates.js:21:31:21:68 | `Time i ... aint)}` |
802+
| dates.js:21:61:21:65 | taint | dates.js:21:42:21:66 | dayjs(t ... (taint) |
795803
| event-handler-receiver.js:2:49:2:61 | location.href | event-handler-receiver.js:2:31:2:83 | '<h2><a ... ></h2>' |
796804
| event-handler-receiver.js:2:49:2:61 | location.href | event-handler-receiver.js:2:31:2:83 | '<h2><a ... ></h2>' |
797805
| event-handler-receiver.js:2:49:2:61 | location.href | event-handler-receiver.js:2:31:2:83 | '<h2><a ... ></h2>' |

‎javascript/ql/test/query-tests/Security/CWE-079/DomBasedXss/dates.js

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -16,4 +16,7 @@ function main() {
1616
document.body.innerHTML = `Time is ${moment(time).format(taint)}`; // NOT OK
1717
document.body.innerHTML = `Time is ${moment(taint).format()}`; // OK
1818
document.body.innerHTML = `Time is ${dateformat(time, taint)}`; // NOT OK
19+
20+
import dayjs from 'dayjs';
21+
document.body.innerHTML = `Time is ${dayjs(time).format(taint)}`; // NOT OK
1922
}

0 commit comments

Comments
 (0)