Skip to content

Commit e8d5b09

Browse files
jeongsoolee09jeongsoolee09
authored
Merge pull request #170 from advanced-security/jeongsoolee09/bump-javascript-dataflow-lib
Bump `codeql/javascript-all` and fix breaking changes
2 parents 3b7585e + 75579eb commit e8d5b09

File tree

61 files changed

+423
-731
lines changed

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

61 files changed

+423
-731
lines changed

‎.github/workflows/run-codeql-unit-tests-javascript.yml

Lines changed: 4 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -81,7 +81,8 @@ jobs:
8181
run: |
8282
if ! command -v cds &> /dev/null
8383
then
84-
npm install -g @sap/cds-dk
84+
## Workaround for https://github.tools.sap/cap/issues/issues/17840
85+
npm install -g @sap/[email protected]
8586
fi
8687
8788
# Compile .cds files to .cds.json files.
@@ -97,8 +98,8 @@ jobs:
9798
echo "I am compiling $cds_file"
9899
cds compile $cds_file \
99100
-2 json \
100-
-o "$cds_file.json" \
101-
--locations
101+
--locations \
102+
> "$cds_file.json" 2> "$cds_file.err"
102103
done
103104
popd
104105
done

‎extractors/cds/tools/index-files.sh

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -36,7 +36,7 @@ then
3636
# directory.
3737
#
3838
# We also ensure we skip node_modules, as we can end up in a recursive loop
39-
find . -type d -name node_modules -prune -false -o -type f \( -iname 'package.json' \) -exec grep -ql '@sap/cds' {} \; -execdir bash -c "grep -q \"^\$(pwd)\(/\|$\)\" \"$response_file\"" \; -execdir bash -c "echo \"Installing @sap/cds-dk into \$(pwd) to enable CDS compilation.\"" \; -execdir npm install --silent @sap/cds-dk \; -execdir npm install --silent \;
39+
find . -type d -name node_modules -prune -false -o -type f \( -iname 'package.json' \) -exec grep -ql '@sap/cds' {} \; -execdir bash -c "grep -q \"^\$(pwd)\(/\|$\)\" \"$response_file\"" \; -execdir bash -c "echo \"Installing @sap/cds-dk into \$(pwd) to enable CDS compilation.\"" \; -execdir npm install --silent @sap/cds-dk@8.6.1 \; -execdir npm install --silent \;
4040

4141
# Use the npx command to dynamically install the cds development kit (@sap/cds-dk) package if necessary,
4242
# which then provides the cds command line tool in directories which are not covered by the package.json
@@ -52,7 +52,7 @@ echo "Processing CDS files to JSON"
5252
# the same name
5353
while IFS= read -r cds_file; do
5454
echo "Processing CDS file $cds_file to:"
55-
if ! $cds_command compile "$cds_file" -2 json -o "$cds_file.json" --locations 2> "$cds_file.err"; then
55+
if ! $cds_command compile "$cds_file" -2 json --locations > "$cds_file.json" 2> "$cds_file.err"; then
5656
stderr_truncated=`grep "^\[ERROR\]" "$cds_file.err" | tail -n 4`
5757
error_message=$'Could not compile the file '"$cds_file"$'.\nReported error(s):\n```\n'"$stderr_truncated"$'\n```'
5858
echo "$error_message"

‎javascript/frameworks/cap/ext/qlpack.yml

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,6 @@
11
---
22
library: true
33
name: advanced-security/javascript-sap-cap-models
4-
version: 0.3.0
4+
version: 0.4.0
55
extensionTargets:
6-
codeql/javascript-all: "^2.0.0"
6+
codeql/javascript-all: "^2.4.0"

‎javascript/frameworks/cap/lib/codeql-pack.lock.yml

Lines changed: 12 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -2,23 +2,25 @@
22
lockVersion: 1.0.0
33
dependencies:
44
codeql/dataflow:
5-
version: 1.1.2
6-
codeql/javascript-all:
75
version: 2.0.0
6+
codeql/javascript-all:
7+
version: 2.4.0
88
codeql/mad:
9-
version: 1.0.8
9+
version: 1.0.16
1010
codeql/regex:
11-
version: 1.0.8
11+
version: 1.0.16
1212
codeql/ssa:
13-
version: 1.0.8
13+
version: 1.0.16
14+
codeql/threat-models:
15+
version: 1.0.16
1416
codeql/tutorial:
15-
version: 1.0.8
17+
version: 1.0.16
1618
codeql/typetracking:
17-
version: 1.0.8
19+
version: 2.0.0
1820
codeql/util:
19-
version: 1.0.8
21+
version: 2.0.3
2022
codeql/xml:
21-
version: 1.0.8
23+
version: 1.0.16
2224
codeql/yaml:
23-
version: 1.0.8
25+
version: 1.0.16
2426
compiled: false

‎javascript/frameworks/cap/lib/qlpack.yml

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -1,9 +1,9 @@
11
---
22
library: true
33
name: advanced-security/javascript-sap-cap-all
4-
version: 0.3.0
4+
version: 0.4.0
55
suites: codeql-suites
66
extractor: javascript
77
dependencies:
8-
codeql/javascript-all: "^2.0.0"
9-
advanced-security/javascript-sap-cap-models: "^0.3.0"
8+
codeql/javascript-all: "^2.4.0"
9+
advanced-security/javascript-sap-cap-models: "^0.4.0"

‎javascript/frameworks/cap/src/codeql-pack.lock.yml

Lines changed: 12 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -2,23 +2,25 @@
22
lockVersion: 1.0.0
33
dependencies:
44
codeql/dataflow:
5-
version: 1.1.2
6-
codeql/javascript-all:
75
version: 2.0.0
6+
codeql/javascript-all:
7+
version: 2.4.0
88
codeql/mad:
9-
version: 1.0.8
9+
version: 1.0.16
1010
codeql/regex:
11-
version: 1.0.8
11+
version: 1.0.16
1212
codeql/ssa:
13-
version: 1.0.8
13+
version: 1.0.16
14+
codeql/threat-models:
15+
version: 1.0.16
1416
codeql/tutorial:
15-
version: 1.0.8
17+
version: 1.0.16
1618
codeql/typetracking:
17-
version: 1.0.8
19+
version: 2.0.0
1820
codeql/util:
19-
version: 1.0.8
21+
version: 2.0.3
2022
codeql/xml:
21-
version: 1.0.8
23+
version: 1.0.16
2224
codeql/yaml:
23-
version: 1.0.8
25+
version: 1.0.16
2426
compiled: false

‎javascript/frameworks/cap/src/qlpack.yml

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -1,11 +1,11 @@
11
---
22
library: false
33
name: advanced-security/javascript-sap-cap-queries
4-
version: 0.3.0
4+
version: 0.4.0
55
suites: codeql-suites
66
extractor: javascript
77
dependencies:
8-
codeql/javascript-all: "^2.0.0"
9-
advanced-security/javascript-sap-cap-models: "^0.3.0"
10-
advanced-security/javascript-sap-cap-all: "^0.3.0"
8+
codeql/javascript-all: "^2.4.0"
9+
advanced-security/javascript-sap-cap-models: "^0.4.0"
10+
advanced-security/javascript-sap-cap-all: "^0.4.0"
1111
default-suite-file: codeql-suites/javascript-code-scanning.qls

‎javascript/frameworks/cap/test/codeql-pack.lock.yml

Lines changed: 12 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -2,23 +2,25 @@
22
lockVersion: 1.0.0
33
dependencies:
44
codeql/dataflow:
5-
version: 1.1.2
6-
codeql/javascript-all:
75
version: 2.0.0
6+
codeql/javascript-all:
7+
version: 2.4.0
88
codeql/mad:
9-
version: 1.0.8
9+
version: 1.0.16
1010
codeql/regex:
11-
version: 1.0.8
11+
version: 1.0.16
1212
codeql/ssa:
13-
version: 1.0.8
13+
version: 1.0.16
14+
codeql/threat-models:
15+
version: 1.0.16
1416
codeql/tutorial:
15-
version: 1.0.8
17+
version: 1.0.16
1618
codeql/typetracking:
17-
version: 1.0.8
19+
version: 2.0.0
1820
codeql/util:
19-
version: 1.0.8
21+
version: 2.0.3
2022
codeql/xml:
21-
version: 1.0.8
23+
version: 1.0.16
2224
codeql/yaml:
23-
version: 1.0.8
25+
version: 1.0.16
2426
compiled: false

‎javascript/frameworks/cap/test/qlpack.yml

Lines changed: 5 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -1,9 +1,9 @@
11
---
22
name: advanced-security/javascript-sap-cap-queries-tests
3-
version: 0.3.0
3+
version: 0.4.0
44
extractor: javascript
55
dependencies:
6-
codeql/javascript-all: "^2.0.0"
7-
advanced-security/javascript-sap-cap-queries: "^0.3.0"
8-
advanced-security/javascript-sap-cap-models: "^0.3.0"
9-
advanced-security/javascript-sap-cap-all: "^0.3.0"
6+
codeql/javascript-all: "^2.4.0"
7+
advanced-security/javascript-sap-cap-queries: "^0.4.0"
8+
advanced-security/javascript-sap-cap-models: "^0.4.0"
9+
advanced-security/javascript-sap-cap-all: "^0.4.0"

‎javascript/frameworks/cap/test/queries/cqlinjection/cqlinjection.expected

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,3 +1,7 @@
1+
WARNING: module 'PathGraph' has been deprecated and may be removed in future (CqlInjection.ql:14,8-27)
2+
WARNING: type 'Configuration' has been deprecated and may be removed in future (CqlInjection.ql:19,33-61)
3+
WARNING: type 'PathNode' has been deprecated and may be removed in future (CqlInjection.ql:46,29-47)
4+
WARNING: type 'PathNode' has been deprecated and may be removed in future (CqlInjection.ql:46,56-74)
15
nodes
26
| cqlinjection.js:7:34:7:36 | req |
37
| cqlinjection.js:7:34:7:36 | req |

‎javascript/frameworks/cap/test/queries/loginjection/log-injection-not-depending-on-request/log-injection-not-depending-on-request.expected

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,3 +1,6 @@
1+
WARNING: module 'PathGraph' has been deprecated and may be removed in future (LogInjection.ql:14,8-27)
2+
WARNING: type 'PathNode' has been deprecated and may be removed in future (LogInjection.ql:18,43-61)
3+
WARNING: type 'PathNode' has been deprecated and may be removed in future (LogInjection.ql:18,70-88)
14
nodes
25
edges
36
#select

‎javascript/frameworks/cap/test/queries/loginjection/log-injection-type-sanitized/log-injection-type-sanitized.expected

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,3 +1,6 @@
1+
WARNING: module 'PathGraph' has been deprecated and may be removed in future (LogInjection.ql:14,8-27)
2+
WARNING: type 'PathNode' has been deprecated and may be removed in future (LogInjection.ql:18,43-61)
3+
WARNING: type 'PathNode' has been deprecated and may be removed in future (LogInjection.ql:18,70-88)
14
nodes
25
edges
36
#select

‎javascript/frameworks/cap/test/queries/loginjection/log-injection-with-complete-protocol-none/log-injection-with-complete-protocol-none.expected

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,3 +1,6 @@
1+
WARNING: module 'PathGraph' has been deprecated and may be removed in future (LogInjection.ql:14,8-27)
2+
WARNING: type 'PathNode' has been deprecated and may be removed in future (LogInjection.ql:18,43-61)
3+
WARNING: type 'PathNode' has been deprecated and may be removed in future (LogInjection.ql:18,70-88)
14
nodes
25
edges
36
#select

‎javascript/frameworks/cap/test/queries/loginjection/log-injection-with-service1-protocol-none/log-injection-with-service1-protocol-none.expected

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,3 +1,6 @@
1+
WARNING: module 'PathGraph' has been deprecated and may be removed in future (LogInjection.ql:14,8-27)
2+
WARNING: type 'PathNode' has been deprecated and may be removed in future (LogInjection.ql:18,43-61)
3+
WARNING: type 'PathNode' has been deprecated and may be removed in future (LogInjection.ql:18,70-88)
14
nodes
25
| srv/service2.js:6:29:6:31 | msg |
36
| srv/service2.js:6:29:6:31 | msg |

‎javascript/frameworks/cap/test/queries/loginjection/log-injection-with-service2-protocol-none/log-injection-with-service2-protocol-none.expected

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,3 +1,6 @@
1+
WARNING: module 'PathGraph' has been deprecated and may be removed in future (LogInjection.ql:14,8-27)
2+
WARNING: type 'PathNode' has been deprecated and may be removed in future (LogInjection.ql:18,43-61)
3+
WARNING: type 'PathNode' has been deprecated and may be removed in future (LogInjection.ql:18,70-88)
14
nodes
25
| srv/service1.js:6:33:6:35 | req |
36
| srv/service1.js:6:33:6:35 | req |

‎javascript/frameworks/cap/test/queries/loginjection/log-injection-without-protocol-none/log-injection-without-protocol-none.expected

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,3 +1,6 @@
1+
WARNING: module 'PathGraph' has been deprecated and may be removed in future (LogInjection.ql:14,8-27)
2+
WARNING: type 'PathNode' has been deprecated and may be removed in future (LogInjection.ql:18,43-61)
3+
WARNING: type 'PathNode' has been deprecated and may be removed in future (LogInjection.ql:18,70-88)
14
nodes
25
| srv/service1.js:6:33:6:35 | req |
36
| srv/service1.js:6:33:6:35 | req |

‎javascript/frameworks/cap/test/queries/sensitive-exposure/sensitive-exposure.expected

Lines changed: 5 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,8 +1,12 @@
1+
WARNING: module 'PathGraph' has been deprecated and may be removed in future (SensitiveExposure.ql:17,8-27)
2+
WARNING: type 'Configuration' has been deprecated and may be removed in future (SensitiveExposure.ql:50,42-70)
3+
WARNING: type 'PathNode' has been deprecated and may be removed in future (SensitiveExposure.ql:60,41-59)
4+
WARNING: type 'PathNode' has been deprecated and may be removed in future (SensitiveExposure.ql:60,68-86)
15
nodes
26
| sensitive-exposure.js:9:32:9:42 | Sample.name |
37
| sensitive-exposure.js:9:32:9:42 | Sample.name |
48
| sensitive-exposure.js:9:32:9:42 | Sample.name |
59
edges
610
| sensitive-exposure.js:9:32:9:42 | Sample.name | sensitive-exposure.js:9:32:9:42 | Sample.name |
711
#select
8-
| sensitive-exposure.js:9:32:9:42 | Sample.name | sensitive-exposure.js:9:32:9:42 | Sample.name | sensitive-exposure.js:9:32:9:42 | Sample.name | Log entry depends on the $@ field which is annotated as potentially sensitive. | sensitive-exposure.cds:4:5:4:8 | {\\n ... } | name |
12+
| sensitive-exposure.js:9:32:9:42 | Sample.name | sensitive-exposure.js:9:32:9:42 | Sample.name | sensitive-exposure.js:9:32:9:42 | Sample.name | Log entry depends on the $@ field which is annotated as potentially sensitive. | sensitive-exposure.cds:4:5:4:8 | {\\n ... } | name |

‎javascript/frameworks/ui5/ext/qlpack.yml

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,8 +1,8 @@
11
---
22
library: true
33
name: advanced-security/javascript-sap-ui5-models
4-
version: 0.6.0
4+
version: 0.7.0
55
extensionTargets:
6-
codeql/javascript-all: "^2.0.0"
6+
codeql/javascript-all: "^2.4.0"
77
dataExtensions:
88
- "*.model.yml"

‎javascript/frameworks/ui5/lib/advanced_security/javascript/frameworks/ui5/RemoteFlowSources.qll

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -83,8 +83,8 @@ class ODataServiceModel extends UI5ExternalModel {
8383
this instanceof NewNode and
8484
(
8585
exists(RequiredObject oDataModel |
86-
oDataModel.flowsTo(this.getCalleeNode()) and
87-
oDataModel.getDependencyType() = "sap/ui/model/odata/v2/ODataModel"
86+
oDataModel.asSourceNode().flowsTo(this.getCalleeNode()) and
87+
oDataModel.getDependency() = "sap/ui/model/odata/v2/ODataModel"
8888
)
8989
or
9090
this.getCalleeName() = "ODataModel"

0 commit comments

Comments
 (0)