|
4 | 4 |
|
5 | 5 | * TypeScript 3.8 is now supported. |
6 | 6 |
|
7 | | -* Alert suppression can now be done with single-line block comments (`/* ... */`) as well as line comments (`// ...`). |
| 7 | +* You can now suppress alerts using either single-line block comments (`/* ... */`) or line comments (`// ...`). |
8 | 8 |
|
9 | 9 | * Resolution of imports has improved, leading to more results from the security queries: |
10 | | - - Imports with the `.js` extension can now be resolved to a TypeScript file, |
11 | | - when the import refers to a file generated by TypeScript. |
12 | | - - Imports that rely on path-mappings from a `tsconfig.json` file can now be resolved. |
13 | | - - Export declarations of the form `export * as ns from "x"` are now analyzed more precisely. |
| 10 | + - Imports with the `.js` extension can now be resolved to a TypeScript file, |
| 11 | + when the import refers to a file generated by TypeScript. |
| 12 | + - Imports that rely on path-mappings from a `tsconfig.json` file can now be resolved. |
| 13 | + - Export declarations of the form `export * as ns from "x"` are now analyzed more precisely. |
14 | 14 |
|
15 | 15 | * The analysis of sanitizers has improved, leading to more accurate results from the security queries. |
16 | 16 | In particular: |
17 | | - - Sanitizer guards now act across function boundaries in more cases. |
18 | | - - Sanitizers can now better distinguish between a tainted value and an object _containing_ a tainted value. |
| 17 | + - Sanitizer guards now act across function boundaries in more cases. |
| 18 | + - Sanitizers can now better distinguish between a tainted value and an object _containing_ a tainted value. |
19 | 19 |
|
20 | 20 | * Call graph construction has been improved, leading to more results from the security queries: |
21 | | - - Calls can now be resolved to indirectly-defined class members in more cases. |
22 | | - - Calls through partial invocations such as `.bind` can now be resolved in more cases. |
| 21 | + - Calls can now be resolved to indirectly-defined class members in more cases. |
| 22 | + - Calls through partial invocations such as `.bind` can now be resolved in more cases. |
23 | 23 |
|
24 | 24 | * Support for flow summaries has been more clearly marked as being experimental and moved to the new `experimental` folder. |
25 | 25 |
|
26 | 26 | * Support for the following frameworks and libraries has been improved: |
27 | | - - [Electron](https://electronjs.org/) |
28 | | - - [fstream](https://www.npmjs.com/package/fstream) |
29 | | - - [Handlebars](https://www.npmjs.com/package/handlebars) |
30 | | - - [jsonfile](https://www.npmjs.com/package/jsonfile) |
31 | | - - [Koa](https://www.npmjs.com/package/koa) |
32 | | - - [Node.js](https://nodejs.org/) |
33 | | - - [Socket.IO](https://socket.io/) |
34 | | - - [WebSocket](https://developer.mozilla.org/en-US/docs/Web/API/WebSockets_API) |
35 | | - - [chrome-remote-interface](https://www.npmjs.com/package/chrome-remote-interface) |
36 | | - - [for-in](https://www.npmjs.com/package/for-in) |
37 | | - - [for-own](https://www.npmjs.com/package/for-own) |
38 | | - - [http2](https://nodejs.org/api/http2.html) |
39 | | - - [jQuery](https://jquery.com/) |
40 | | - - [lazy-cache](https://www.npmjs.com/package/lazy-cache) |
41 | | - - [mongodb](https://www.npmjs.com/package/mongodb) |
42 | | - - [ncp](https://www.npmjs.com/package/ncp) |
43 | | - - [node-dir](https://www.npmjs.com/package/node-dir) |
44 | | - - [path-exists](https://www.npmjs.com/package/path-exists) |
45 | | - - [pg](https://www.npmjs.com/package/pg) |
46 | | - - [react](https://www.npmjs.com/package/react) |
47 | | - - [recursive-readdir](https://www.npmjs.com/package/recursive-readdir) |
48 | | - - [request](https://www.npmjs.com/package/request) |
49 | | - - [rimraf](https://www.npmjs.com/package/rimraf) |
50 | | - - [send](https://www.npmjs.com/package/send) |
51 | | - - [SockJS](https://www.npmjs.com/package/sockjs) |
52 | | - - [SockJS-client](https://www.npmjs.com/package/sockjs-client) |
53 | | - - [typeahead.js](https://www.npmjs.com/package/typeahead.js) |
54 | | - - [vinyl-fs](https://www.npmjs.com/package/vinyl-fs) |
55 | | - - [write-file-atomic](https://www.npmjs.com/package/write-file-atomic) |
56 | | - - [ws](https://github.com/websockets/ws) |
| 27 | + - [chrome-remote-interface](https://www.npmjs.com/package/chrome-remote-interface) |
| 28 | + - [Electron](https://electronjs.org/) |
| 29 | + - [for-in](https://www.npmjs.com/package/for-in) |
| 30 | + - [for-own](https://www.npmjs.com/package/for-own) |
| 31 | + - [fstream](https://www.npmjs.com/package/fstream) |
| 32 | + - [Handlebars](https://www.npmjs.com/package/handlebars) |
| 33 | + - [http2](https://nodejs.org/api/http2.html) |
| 34 | + - [jQuery](https://jquery.com/) |
| 35 | + - [jsonfile](https://www.npmjs.com/package/jsonfile) |
| 36 | + - [Koa](https://www.npmjs.com/package/koa) |
| 37 | + - [lazy-cache](https://www.npmjs.com/package/lazy-cache) |
| 38 | + - [mongodb](https://www.npmjs.com/package/mongodb) |
| 39 | + - [ncp](https://www.npmjs.com/package/ncp) |
| 40 | + - [Node.js](https://nodejs.org/) |
| 41 | + - [node-dir](https://www.npmjs.com/package/node-dir) |
| 42 | + - [path-exists](https://www.npmjs.com/package/path-exists) |
| 43 | + - [pg](https://www.npmjs.com/package/pg) |
| 44 | + - [react](https://www.npmjs.com/package/react) |
| 45 | + - [recursive-readdir](https://www.npmjs.com/package/recursive-readdir) |
| 46 | + - [request](https://www.npmjs.com/package/request) |
| 47 | + - [rimraf](https://www.npmjs.com/package/rimraf) |
| 48 | + - [send](https://www.npmjs.com/package/send) |
| 49 | + - [Socket.IO](https://socket.io/) |
| 50 | + - [SockJS](https://www.npmjs.com/package/sockjs) |
| 51 | + - [SockJS-client](https://www.npmjs.com/package/sockjs-client) |
| 52 | + - [typeahead.js](https://www.npmjs.com/package/typeahead.js) |
| 53 | + - [vinyl-fs](https://www.npmjs.com/package/vinyl-fs) |
| 54 | + - [WebSocket](https://developer.mozilla.org/en-US/docs/Web/API/WebSockets_API) |
| 55 | + - [write-file-atomic](https://www.npmjs.com/package/write-file-atomic) |
| 56 | + - [ws](https://github.com/websockets/ws) |
| 57 | + |
57 | 58 |
|
58 | 59 | ## New queries |
59 | 60 |
|
60 | 61 | | **Query** | **Tags** | **Purpose** | |
61 | 62 | |---------------------------------------------------------------------------------|-------------------------------------------------------------------|----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------| |
62 | 63 | | Cross-site scripting through exception (`js/xss-through-exception`) | security, external/cwe/cwe-079, external/cwe/cwe-116 | Highlights potential XSS vulnerabilities where an exception is written to the DOM. Results are not shown on LGTM by default. | |
63 | | -| Regular expression always matches (`js/regex/always-matches`) | correctness, regular-expressions | Highlights regular expression checks that trivially succeed by matching an empty substring. Results are shown on LGTM by default. | |
64 | 64 | | Missing await (`js/missing-await`) | correctness | Highlights expressions that operate directly on a promise object in a nonsensical way, instead of awaiting its result. Results are shown on LGTM by default. | |
65 | 65 | | Polynomial regular expression used on uncontrolled data (`js/polynomial-redos`) | security, external/cwe/cwe-730, external/cwe/cwe-400 | Highlights expensive regular expressions that may be used on malicious input. Results are shown on LGTM by default. | |
66 | 66 | | Prototype pollution in utility function (`js/prototype-pollution-utility`) | security, external/cwe/cwe-400, external/cwe/cwe-471 | Highlights recursive assignment operations that are susceptible to prototype pollution. Results are shown on LGTM by default. | |
67 | | -| Unsafe jQuery plugin (`js/unsafe-jquery-plugin`) | Highlights potential XSS vulnerabilities in unsafely designed jQuery plugins. Results are shown on LGTM by default. | |
| 67 | +| Regular expression always matches (`js/regex/always-matches`) | correctness, regular-expressions | Highlights regular expression checks that trivially succeed by matching an empty substring. Results are shown on LGTM by default. | |
| 68 | +| Unsafe jQuery plugin (`js/unsafe-jquery-plugin`) | | Highlights potential XSS vulnerabilities in unsafely designed jQuery plugins. Results are shown on LGTM by default. | |
68 | 69 | | Unnecessary use of `cat` process (`js/unnecessary-use-of-cat`) | correctness, security, maintainability | Highlights command executions of `cat` where the fs API should be used instead. Results are shown on LGTM by default. | |
69 | 70 |
|
70 | 71 |
|
|
73 | 74 | | **Query** | **Expected impact** | **Change** | |
74 | 75 | |--------------------------------|------------------------------|---------------------------------------------------------------------------| |
75 | 76 | | Clear-text logging of sensitive information (`js/clear-text-logging`) | More results | More results involving `process.env` and indirect calls to logging methods are recognized. | |
76 | | -| Duplicate parameter names (`js/duplicate-parameter-name`) | Fewer results | This query now recognizes additional parameters that reasonably can have duplicated names. | |
77 | | -| Incomplete string escaping or encoding (`js/incomplete-sanitization`) | Fewer false positive results | This query now recognizes additional cases where a single replacement is likely to be intentional. | |
78 | | -| Unbound event handler receiver (`js/unbound-event-handler-receiver`) | Fewer false positive results | This query now recognizes additional ways event handler receivers can be bound. | |
| 77 | +| Duplicate parameter names (`js/duplicate-parameter-name`) | Fewer results | This query now ignores additional parameters that reasonably can have duplicated names. | |
79 | 78 | | Expression has no effect (`js/useless-expression`) | Fewer false positive results | The query now recognizes block-level flow type annotations and ignores the first statement of a try block. | |
80 | | -| Use of call stack introspection in strict mode (`js/strict-mode-call-stack-introspection`) | Fewer false positive results | The query no longer flags expression statements. | |
| 79 | +| Identical operands (`js/redundant-operation`) | Fewer results | This query now excludes cases where the operands change a value using ++/-- expressions. | |
| 80 | +| Incomplete string escaping or encoding (`js/incomplete-sanitization`) | Fewer false positive results | This query now recognizes and excludes additional cases where a single replacement is likely to be intentional. | |
| 81 | +| Incomplete URL scheme check (`js/incomplete-url-scheme-check`) | More results | This query now recognizes additional variations of URL scheme checks. | |
81 | 82 | | Missing CSRF middleware (`js/missing-token-validation`) | Fewer false positive results | The query reports fewer duplicates and only flags handlers that explicitly access cookie data. | |
82 | | -| Uncontrolled data used in path expression (`js/path-injection`) | More results | This query now recognizes additional ways dangerous paths can be constructed and used. | |
83 | | -| Uncontrolled command line (`js/command-line-injection`) | More results | This query now recognizes additional ways of constructing arguments to `cmd.exe` and `/bin/sh`. | |
| 83 | +| Superfluous trailing arguments (`js/superfluous-trailing-arguments`) | Fewer results | This query now excludes cases where a function uses the `Function.arguments` value to process a variable number of parameters. | |
84 | 84 | | Syntax error (`js/syntax-error`) | Lower severity | This results of this query are now displayed with lower severity. | |
85 | | -| Use of password hash with insufficient computational effort (`js/insufficient-password-hash`) | Fewer false positive results | This query now recognizes additional cases that do not require secure hashing. | |
86 | | -| Useless regular-expression character escape (`js/useless-regexp-character-escape`) | Fewer false positive results | This query now distinguishes escapes in strings and regular expression literals. | |
87 | | -| Identical operands (`js/redundant-operation`) | Fewer results | This query now recognizes cases where the operands change a value using ++/-- expressions. | |
88 | | -| Superfluous trailing arguments (`js/superfluous-trailing-arguments`) | Fewer results | This query now recognizes cases where a function uses the `Function.arguments` value to process a variable number of parameters. | |
89 | | -| Incomplete URL scheme check (`js/incomplete-url-scheme-check`) | More results | This query now recognizes more variations of URL scheme checks. | |
| 85 | +| Unbound event handler receiver (`js/unbound-event-handler-receiver`) | Fewer false positive results | This query now recognizes additional ways event handler receivers can be bound. | |
| 86 | +| Uncontrolled command line (`js/command-line-injection`) | More results | This query now recognizes additional ways of constructing arguments to `cmd.exe` and `/bin/sh`. | |
| 87 | +| Uncontrolled data used in path expression (`js/path-injection`) | More results | This query now recognizes additional ways dangerous paths can be constructed and used. | |
| 88 | +| Use of call stack introspection in strict mode (`js/strict-mode-call-stack-introspection`) | Fewer false positive results | The query no longer flags expression statements. | |
| 89 | +| Use of password hash with insufficient computational effort (`js/insufficient-password-hash`) | Fewer false positive results | This query now recognizes and excludes additional cases that do not require secure hashing. | |
| 90 | +| Useless regular-expression character escape (`js/useless-regexp-character-escape`) | Fewer false positive results | This query now distinguishes between escapes in strings and regular expression literals. | |
90 | 91 |
|
91 | 92 | ## Changes to libraries |
92 | 93 |
|
93 | 94 | * The predicates `RegExpTerm.getSuccessor` and `RegExpTerm.getPredecessor` have been changed to reflect textual, not operational, matching order. This only makes a difference in lookbehind assertions, which are operationally matched backwards. Previously, `getSuccessor` would mimick this, so in an assertion `(?<=ab)` the term `b` would be considered the predecessor, not the successor, of `a`. Textually, however, `a` is still matched before `b`, and this is the order we now follow. |
94 | 95 | * An extensible model of the `EventEmitter` pattern has been implemented. |
95 | 96 | * Taint-tracking configurations now interact differently with the `data` flow label, which may affect queries |
96 | 97 | that combine taint-tracking and flow labels. |
97 | | - - Sources added by the 1-argument `isSource` predicate are associated with the `taint` label now, instead of the `data` label. |
98 | | - - Sanitizers now only block the `taint` label. As a result, sanitizers no longer block the flow of tainted values wrapped inside a property of an object. |
99 | | - To retain the old behavior, instead use a barrier, or block the `data` flow label using a labeled sanitizer. |
| 98 | + - Sources added by the 1-argument `isSource` predicate are associated with the `taint` label now, instead of the `data` label. |
| 99 | + - Sanitizers now only block the `taint` label. As a result, sanitizers no longer block the flow of tainted values wrapped inside a property of an object. |
| 100 | + To retain the old behavior, instead use a barrier, or block the `data` flow label using a labeled sanitizer. |
0 commit comments