Skip to content

Commit ab519d4

Browse files
author
Esben Sparre Andreasen
committed
JS: rename query
"Incomplete URL regular expression" -> "Incomplete regular expression for hostnames".
1 parent 7c6e28d commit ab519d4

File tree

9 files changed

+32
-32
lines changed

9 files changed

+32
-32
lines changed

‎javascript/config/suites/javascript/security‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,6 @@
11
+ semmlecode-javascript-queries/DOM/TargetBlank.ql: /Security/CWE/CWE-200
22
+ semmlecode-javascript-queries/Electron/EnablingNodeIntegration.ql: /Security/CWE/CWE-094
3-
+ semmlecode-javascript-queries/Security/CWE-020/IncompleteUrlRegExp.ql: /Security/CWE/CWE-020
3+
+ semmlecode-javascript-queries/Security/CWE-020/IncompleteHostnameRegExp.ql: /Security/CWE/CWE-020
44
+ semmlecode-javascript-queries/Security/CWE-020/IncompleteUrlSubstringSanitization.ql: /Security/CWE/CWE-020
55
+ semmlecode-javascript-queries/Security/CWE-020/IncorrectSuffixCheck.ql: /Security/CWE/CWE-020
66
+ semmlecode-javascript-queries/Security/CWE-022/TaintedPath.ql: /Security/CWE/CWE-022

javascript/ql/src/Security/CWE-020/IncompleteUrlRegExp.qhelp renamed to javascript/ql/src/Security/CWE-020/IncompleteHostnameRegExp.qhelp

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -46,7 +46,7 @@
4646

4747
</p>
4848

49-
<sample src="examples/IncompleteUrlRegExp.js"/>
49+
<sample src="examples/IncompleteHostnameRegExp.js"/>
5050

5151
<p>
5252

javascript/ql/src/Security/CWE-020/IncompleteUrlRegExp.ql renamed to javascript/ql/src/Security/CWE-020/IncompleteHostnameRegExp.ql

Lines changed: 8 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -1,24 +1,24 @@
11
/**
2-
* @name Incomplete URL regular expression
3-
* @description Using a regular expression that contains an 'any character' may match more URLs than expected.
2+
* @name Incomplete regular expression for hostnames
3+
* @description Matching a URL or hostname against a regular expression that contains an unescaped dot as part of the hostname might match more than expected.
44
* @kind problem
5-
* @problem.severity error
5+
* @problem.severity warning
66
* @precision high
7-
* @id js/incomplete-url-regexp
7+
* @id js/incomplete-hostname-regexp
88
* @tags correctness
99
* security
1010
* external/cwe/cwe-20
1111
*/
1212

1313
import javascript
1414

15-
module IncompleteUrlRegExpTracking {
15+
module IncompleteHostnameRegExpTracking {
1616

1717
/**
18-
* A taint tracking configuration for incomplete URL regular expressions sources.
18+
* A taint tracking configuration for incomplete hostname regular expressions sources.
1919
*/
2020
class Configuration extends TaintTracking::Configuration {
21-
Configuration() { this = "IncompleteUrlRegExpTracking" }
21+
Configuration() { this = "IncompleteHostnameRegExpTracking" }
2222

2323
override
2424
predicate isSource(DataFlow::Node source) {
@@ -53,7 +53,7 @@ from Expr e, string pattern, string hostPart
5353
where
5454
(
5555
e.(RegExpLiteral).getValue() = pattern or
56-
exists (IncompleteUrlRegExpTracking::Configuration cfg |
56+
exists (IncompleteHostnameRegExpTracking::Configuration cfg |
5757
cfg.hasFlow(e.flow(), _) and
5858
e.mayHaveStringValue(pattern)
5959
)

javascript/ql/src/Security/CWE-020/examples/IncompleteUrlRegExp.js renamed to javascript/ql/src/Security/CWE-020/examples/IncompleteHostnameRegExp.js

File renamed without changes.

‎javascript/ql/test/query-tests/Security/CWE-020/IncompleteHostnameRegExp.expected‎

Lines changed: 21 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,21 @@
1+
| tst-IncompleteHostnameRegExp.js:3:2:3:28 | /http:\\ ... le.com/ | This regular expression has an unescaped '.' before 'example.com', so it might match more hosts than expected. |
2+
| tst-IncompleteHostnameRegExp.js:5:2:5:28 | /http:\\ ... le.net/ | This regular expression has an unescaped '.' before 'example.net', so it might match more hosts than expected. |
3+
| tst-IncompleteHostnameRegExp.js:6:2:6:42 | /http:\\ ... b).com/ | This regular expression has an unescaped '.' before '(example-a\|example-b).com', so it might match more hosts than expected. |
4+
| tst-IncompleteHostnameRegExp.js:11:13:11:37 | "http:/ ... le.com" | This regular expression has an unescaped '.' before 'example.com', so it might match more hosts than expected. |
5+
| tst-IncompleteHostnameRegExp.js:12:10:12:34 | "http:/ ... le.com" | This regular expression has an unescaped '.' before 'example.com', so it might match more hosts than expected. |
6+
| tst-IncompleteHostnameRegExp.js:15:22:15:46 | "http:/ ... le.com" | This regular expression has an unescaped '.' before 'example.com', so it might match more hosts than expected. |
7+
| tst-IncompleteHostnameRegExp.js:17:13:17:31 | `test.example.com$` | This regular expression has an unescaped '.' before 'example.com', so it might match more hosts than expected. |
8+
| tst-IncompleteHostnameRegExp.js:17:14:17:30 | test.example.com$ | This regular expression has an unescaped '.' before 'example.com', so it might match more hosts than expected. |
9+
| tst-IncompleteHostnameRegExp.js:19:17:19:34 | 'test.example.com' | This regular expression has an unescaped '.' before 'example.com', so it might match more hosts than expected. |
10+
| tst-IncompleteHostnameRegExp.js:22:27:22:44 | 'test.example.com' | This regular expression has an unescaped '.' before 'example.com', so it might match more hosts than expected. |
11+
| tst-IncompleteHostnameRegExp.js:28:22:28:39 | 'test.example.com' | This regular expression has an unescaped '.' before 'example.com', so it might match more hosts than expected. |
12+
| tst-IncompleteHostnameRegExp.js:37:2:37:54 | /^(http ... =$\|\\/)/ | This regular expression has an unescaped '.' before ')?example.com', so it might match more hosts than expected. |
13+
| tst-IncompleteHostnameRegExp.js:38:2:38:44 | /^(http ... p\\/f\\// | This regular expression has an unescaped '.' before 'example.com', so it might match more hosts than expected. |
14+
| tst-IncompleteHostnameRegExp.js:39:2:39:34 | /\\(http ... m\\/\\)/g | This regular expression has an unescaped '.' before 'example.com', so it might match more hosts than expected. |
15+
| tst-IncompleteHostnameRegExp.js:40:2:40:29 | /https? ... le.com/ | This regular expression has an unescaped '.' before 'example.com', so it might match more hosts than expected. |
16+
| tst-IncompleteHostnameRegExp.js:41:13:41:68 | '^http: ... e\\.com' | This regular expression has an unescaped '.' before 'example.com', so it might match more hosts than expected. |
17+
| tst-IncompleteHostnameRegExp.js:41:41:41:68 | '^https ... e\\.com' | This regular expression has an unescaped '.' before 'example.com', so it might match more hosts than expected. |
18+
| tst-IncompleteHostnameRegExp.js:42:13:42:61 | 'http[s ... \\/(.+)' | This regular expression has an unescaped '.' before 'example.com', so it might match more hosts than expected. |
19+
| tst-IncompleteHostnameRegExp.js:43:2:43:33 | /^https ... e.com$/ | This regular expression has an unescaped '.' before 'example.com', so it might match more hosts than expected. |
20+
| tst-IncompleteHostnameRegExp.js:44:9:44:100 | 'protos ... ernal)' | This regular expression has an unescaped '.' before 'example-b.com', so it might match more hosts than expected. |
21+
| tst-IncompleteHostnameRegExp.js:46:2:46:26 | /exampl ... le.com/ | This regular expression has an unescaped '.' before 'dev\|example.com', so it might match more hosts than expected. |

‎javascript/ql/test/query-tests/Security/CWE-020/IncompleteHostnameRegExp.qlref‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1 @@
1+
Security/CWE-020/IncompleteHostnameRegExp.ql

‎javascript/ql/test/query-tests/Security/CWE-020/IncompleteUrlRegExp.expected‎

Lines changed: 0 additions & 21 deletions
This file was deleted.

‎javascript/ql/test/query-tests/Security/CWE-020/IncompleteUrlRegExp.qlref‎

Lines changed: 0 additions & 1 deletion
This file was deleted.

javascript/ql/test/query-tests/Security/CWE-020/tst-IncompleteUrlRegExp.js renamed to javascript/ql/test/query-tests/Security/CWE-020/tst-IncompleteHostnameRegExp.js

File renamed without changes.

0 commit comments

Comments
 (0)