Skip to content

Commit 358b6c3

Browse files
author
Esben Sparre Andreasen
committed
JS: change "remote request" to "network request"
1 parent e93545d commit 358b6c3

File tree

6 files changed

+23
-23
lines changed

6 files changed

+23
-23
lines changed

‎change-notes/1.19/analysis-javascript.md‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -16,7 +16,7 @@
1616
| **Query** | **Tags** | **Purpose** |
1717
|-----------------------------------------------|------------------------------------------------------|-----------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
1818
| Enabling Node.js integration for Electron web content renderers (`js/enabling-electron-renderer-node-integration`) | security, frameworks/electron, external/cwe/cwe-094 | Highlights Electron web content renderer preferences with Node.js integration enabled, indicating a violation of [CWE-94](https://cwe.mitre.org/data/definitions/94.html). Results are not shown on LGTM by default. |
19-
| File data in outbound remote request | security, external/cwe/cwe-200 | Highlights locations where file data is sent in a remote request. Results are not shown on LGTM by default. |
19+
| File data in outbound network request | security, external/cwe/cwe-200 | Highlights locations where file data is sent in a network request. Results are not shown on LGTM by default. |
2020
| Host header poisoning in email generation | security, external/cwe/cwe-640 | Highlights code that generates emails with links that can be hijacked by HTTP host header poisoning, indicating a violation of [CWE-640](https://cwe.mitre.org/data/definitions/640.html). Results shown on LGTM by default. |
2121
| Replacement of a substring with itself (`js/identity-replacement`) | correctness, security, external/cwe/cwe-116 | Highlights string replacements that replace a string with itself, which usually indicates a mistake. Results shown on LGTM by default. |
2222
| Stored cross-site scripting (`js/stored-xss`) | security, external/cwe/cwe-079, external/cwe/cwe-116 | Highlights uncontrolled stored values flowing into HTML content, indicating a violation of [CWE-079](https://cwe.mitre.org/data/definitions/79.html). Results shown on LGTM by default. |

‎javascript/ql/src/Security/CWE-200/FileAccessToHttp.ql‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,6 @@
11
/**
2-
* @name File data in outbound remote request
3-
* @description Directly sending file data in an outbound remote request can indicate unauthorized information disclosure.
2+
* @name File data in outbound network request
3+
* @description Directly sending file data in an outbound network request can indicate unauthorized information disclosure.
44
* @kind problem
55
* @problem.severity warning
66
* @id js/file-access-to-http
@@ -13,4 +13,4 @@ import semmle.javascript.security.dataflow.FileAccessToHttp
1313

1414
from FileAccessToHttp::Configuration config, DataFlow::Node src, DataFlow::Node sink
1515
where config.hasFlow (src, sink)
16-
select sink, "$@ flows directly to outbound remote request", src, "File data"
16+
select sink, "$@ flows directly to outbound network request", src, "File data"

‎javascript/ql/src/Security/CWE-918/RequestForgery.qhelp‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -25,8 +25,8 @@
2525
<p>
2626

2727
To guard against request forgery, it is advisable to avoid
28-
putting user input directly into a remote request. If a flexible
29-
remote request mechanism is required, it is recommended to maintain a
28+
putting user input directly into a network request. If a flexible
29+
network request mechanism is required, it is recommended to maintain a
3030
list of authorized request targets and choose from that list based on
3131
the user input provided.
3232

‎javascript/ql/src/Security/CWE-918/RequestForgery.ql‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,6 @@
11
/**
2-
* @name Uncontrolled data used in remote request
3-
* @description Sending remote requests with user-controlled data allows for request forgery attacks.
2+
* @name Uncontrolled data used in network request
3+
* @description Sending network requests with user-controlled data allows for request forgery attacks.
44
* @kind problem
55
* @problem.severity error
66
* @precision medium

‎javascript/ql/src/semmle/javascript/security/dataflow/FileAccessToHttp.qll‎

Lines changed: 7 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -1,28 +1,28 @@
11
/**
2-
* Provides a taint tracking configuration for reasoning about file data in outbound remote requests.
2+
* Provides a taint tracking configuration for reasoning about file data in outbound network requests.
33
*/
44
import javascript
55
import semmle.javascript.security.dataflow.RemoteFlowSources
66

77
module FileAccessToHttp {
88

99
/**
10-
* A data flow source for file data in outbound remote requests.
10+
* A data flow source for file data in outbound network requests.
1111
*/
1212
abstract class Source extends DataFlow::Node { }
1313

1414
/**
15-
* A data flow sink for file data in outbound remote requests.
15+
* A data flow sink for file data in outbound network requests.
1616
*/
1717
abstract class Sink extends DataFlow::Node { }
1818

1919
/**
20-
* A sanitizer for file data in outbound remote requests.
20+
* A sanitizer for file data in outbound network requests.
2121
*/
2222
abstract class Sanitizer extends DataFlow::Node { }
2323

2424
/**
25-
* A taint tracking configuration for file data in outbound remote requests.
25+
* A taint tracking configuration for file data in outbound network requests.
2626
*/
2727
class Configuration extends TaintTracking::Configuration {
2828
Configuration() {
@@ -52,7 +52,7 @@ module FileAccessToHttp {
5252
}
5353

5454
/**
55-
* A file access parameter, considered as a flow source for file data in outbound remote requests.
55+
* A file access parameter, considered as a flow source for file data in outbound network requests.
5656
*/
5757
private class FileAccessArgumentAsSource extends Source {
5858
FileAccessArgumentAsSource() {
@@ -63,7 +63,7 @@ module FileAccessToHttp {
6363
}
6464

6565
/**
66-
* The URL or data of a client request, considered as a flow source for file data in outbound remote requests.
66+
* The URL or data of a client request, considered as a flow source for file data in outbound network requests.
6767
*/
6868
private class ClientRequestUrlOrDataAsSink extends Sink {
6969
ClientRequestUrlOrDataAsSink () {

‎javascript/ql/test/query-tests/Security/CWE-200/FileAccessToHttp.expected‎

Lines changed: 8 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -1,8 +1,8 @@
1-
| bufferRead.js:33:21:33:28 | postData | $@ flows directly to outbound remote request | bufferRead.js:12:22:12:43 | new Buf ... s.size) | File data |
2-
| googlecompiler.js:38:18:38:26 | post_data | $@ flows directly to outbound remote request | googlecompiler.js:44:54:44:57 | data | File data |
3-
| readFileSync.js:26:18:26:18 | s | $@ flows directly to outbound remote request | readFileSync.js:5:12:5:39 | fs.read ... t.txt") | File data |
4-
| readStreamRead.js:30:19:30:23 | chunk | $@ flows directly to outbound remote request | readStreamRead.js:13:21:13:35 | readable.read() | File data |
5-
| request.js:8:11:8:20 | {jsonData} | $@ flows directly to outbound remote request | request.js:28:52:28:55 | data | File data |
6-
| request.js:16:11:23:3 | {\\n u ... ody\\n } | $@ flows directly to outbound remote request | request.js:43:51:43:54 | data | File data |
7-
| sentAsHeaders.js:14:20:19:9 | {\\n ... } | $@ flows directly to outbound remote request | sentAsHeaders.js:10:79:10:84 | buffer | File data |
8-
| sentAsHeaders.js:20:20:25:9 | {\\n ... } | $@ flows directly to outbound remote request | sentAsHeaders.js:10:79:10:84 | buffer | File data |
1+
| bufferRead.js:33:21:33:28 | postData | $@ flows directly to outbound network request | bufferRead.js:12:22:12:43 | new Buf ... s.size) | File data |
2+
| googlecompiler.js:38:18:38:26 | post_data | $@ flows directly to outbound network request | googlecompiler.js:44:54:44:57 | data | File data |
3+
| readFileSync.js:26:18:26:18 | s | $@ flows directly to outbound network request | readFileSync.js:5:12:5:39 | fs.read ... t.txt") | File data |
4+
| readStreamRead.js:30:19:30:23 | chunk | $@ flows directly to outbound network request | readStreamRead.js:13:21:13:35 | readable.read() | File data |
5+
| request.js:8:11:8:20 | {jsonData} | $@ flows directly to outbound network request | request.js:28:52:28:55 | data | File data |
6+
| request.js:16:11:23:3 | {\\n u ... ody\\n } | $@ flows directly to outbound network request | request.js:43:51:43:54 | data | File data |
7+
| sentAsHeaders.js:14:20:19:9 | {\\n ... } | $@ flows directly to outbound network request | sentAsHeaders.js:10:79:10:84 | buffer | File data |
8+
| sentAsHeaders.js:20:20:25:9 | {\\n ... } | $@ flows directly to outbound network request | sentAsHeaders.js:10:79:10:84 | buffer | File data |

0 commit comments

Comments
 (0)