JS: Migrate all queries to proper flow states and deprecate FlowLabel #18265
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Needed for migrating the XSS query
asgerf
force-pushed
the
jss/flow-labels2
branch
from
cba929d to
fffb15b
Compare
asgerf
force-pushed
the
jss/flow-labels2
branch
2 times, most recently
from
4d33ddb to
60738e8
Compare
asgerf
force-pushed
the
jss/flow-labels2
branch
from
6ed08f5 to
205f486
Compare
asgerf
changed the title
asgerf
changed the title
There was a problem hiding this comment.
Copilot reviewed 55 out of 75 changed files in this pull request and generated no comments.
Files not reviewed (20)
- docs/codeql/codeql-language-guides/analyzing-data-flow-in-javascript-and-typescript.rst: Language not supported
- javascript/ql/examples/queries/dataflow/BackendIdor/BackendIdor.ql: Language not supported
- javascript/ql/examples/queries/dataflow/InformationDisclosure/InformationDisclosure.ql: Language not supported
- javascript/ql/lib/semmle/javascript/dataflow/AdditionalFlowSteps.qll: Language not supported
- javascript/ql/lib/semmle/javascript/dataflow/Configuration.qll: Language not supported
- javascript/ql/lib/semmle/javascript/dataflow/internal/BarrierGuards.qll: Language not supported
- javascript/ql/lib/semmle/javascript/dataflow/internal/FlowSteps.qll: Language not supported
- javascript/ql/lib/semmle/javascript/security/CommonFlowState.qll: Language not supported
- javascript/ql/lib/semmle/javascript/security/TaintedObject.qll: Language not supported
- javascript/ql/lib/semmle/javascript/security/TaintedObjectCustomizations.qll: Language not supported
- javascript/ql/lib/semmle/javascript/security/TaintedUrlSuffix.qll: Language not supported
- javascript/ql/lib/semmle/javascript/security/TaintedUrlSuffixCustomizations.qll: Language not supported
- javascript/ql/lib/semmle/javascript/security/dataflow/BuildArtifactLeakCustomizations.qll: Language not supported
- javascript/ql/lib/semmle/javascript/security/dataflow/BuildArtifactLeakQuery.qll: Language not supported
- javascript/ql/lib/semmle/javascript/security/dataflow/CleartextLoggingQuery.qll: Language not supported
- javascript/ql/lib/semmle/javascript/security/dataflow/ClientSideRequestForgeryQuery.qll: Language not supported
- javascript/ql/lib/semmle/javascript/security/dataflow/ClientSideUrlRedirectCustomizations.qll: Language not supported
- javascript/ql/lib/semmle/javascript/security/dataflow/ClientSideUrlRedirectQuery.qll: Language not supported
- javascript/ql/lib/semmle/javascript/security/dataflow/ConditionalBypassQuery.qll: Language not supported
- javascript/ql/lib/semmle/javascript/security/dataflow/DeepObjectResourceExhaustionCustomizations.qll: Language not supported
Tip: Turn on automatic Copilot reviews for this repository to get quick feedback on every pull request. Learn more
|
Taking back into draft as there are a bunch of new CI failures that popped up when I took it out of draft. |
Having the same name as a standard query is just confusing
This was previously called from isBarrier(node, state) but without restricting the state. The call was therefore moved to isBarrier(node), but this caused some optimisation changes resulting in a bad join.
asgerf
force-pushed
the
jss/flow-labels2
branch
from
bc85328 to
e5ae7e0
Compare
erik-krogh
approved these changes
Dec 17, 2024
|
Right, I left |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Previously, our queries used flow state simply by doing
class FlowState = DataFlow::FlowLabel;. This meant we could reuse some existing flow label-specified infrastructure, this is no longer needed.This PR migrates all queries to
newtype-basedFlowStateclasses and deprecates theFlowLabelclass.I've introduced a file
CommonFlowStateto declare all flow states that are shared between queries, or are in use by a query that depends on another common flow state. This could technically be split intoTaintedUrlSuffix-based queries andTaintedObject-based queries, but it seems simpler to just have one flow state for all cases where they need to be shared.Finally, also applies a mass rename to the
node1,state1,node2,state2naming convention in our flow step predicates. We previously had an inconsistent naming convention, ranging betweenpred -> succ,src -> dst,src -> trg, and likewise for labels, but with the additional variantinlbl -> outlbl. Now it's much more consistent.Evaluation looks quiet, again with hints of a minor speedup (1% on average).