Skip to content

JS: Modeling of underscore.string package #19049

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
Napalys merged 24 commits into from
Mar 20, 2025
Merged

JS: Modeling of underscore.string package #19049

Show file tree
Hide file tree
Changes from 1 commit
Commits
Show all changes
24 commits
Select commit Hold shift + click to select a range
e8b233f
Added test cases `underscore.string` string to string.
Napalys Mar 17, 2025
9bca863
Added modeling of `underscore.string` string to string functions.
Napalys Mar 17, 2025
c256b9c
Added `underscore.string` test cases for str to array.
Napalys Mar 17, 2025
30623cd
Added modeling of `underscore.string` for str to array.
Napalys Mar 17, 2025
cd40b6f
Added test cases `underscore.string` array to string.
Napalys Mar 17, 2025
6b105b2
Added modeling `underscore.string` array to string functions.
Napalys Mar 17, 2025
77e1e17
Added test cases `underscore.string` with multiple sources.
Napalys Mar 17, 2025
b59b9c8
Added modeling `underscore.string` of function which contain multiple…
Napalys Mar 17, 2025
25c6fb5
Added chaining tests for `underscore.string` package.
Napalys Mar 17, 2025
ca9ae8a
Added chaining modeling for `underscore.string` package.
Napalys Mar 17, 2025
cccd863
Added test for extra chaining function for `underscore.string`.
Napalys Mar 17, 2025
3a83c8d
Added modeling for extra chaining function from `underscore.string`.
Napalys Mar 17, 2025
dcc1e88
Added test cases for aliases.
Napalys Mar 17, 2025
fc6b779
Added modeling for aliases.
Napalys Mar 17, 2025
eb18c3c
Added test case for `tap`.
Napalys Mar 17, 2025
d8e6d76
Added modeling for `tap` function.
Napalys Mar 17, 2025
2c7562d
Removed `value` from modeling its return value as Wrapper class, sinc…
Napalys Mar 17, 2025
8b431dc
Added change note.
Napalys Mar 17, 2025
922a07d
Added `underscore.string` `clearsContent`.
Napalys Mar 18, 2025
752f02f
Fixed `map` modeling and added test cases.
Napalys Mar 20, 2025
f4ca2dc
Restricted taint to array elements.
Napalys Mar 20, 2025
221cc19
Merge branch 'main' into js/underscore-string
Napalys Mar 20, 2025
ca53e97
Adressed comments.
Napalys Mar 20, 2025
9e78755
Fixed typo in the test cases.
Napalys Mar 20, 2025
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
1 change: 1 addition & 0 deletions javascript/ql/lib/ext/underscore.string.model.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -4,3 +4,4 @@ extensions:
extensible: summaryModel
data:
- ["'underscore.string'", "Member[slugify,capitalize,decapitalize,clean,cleanDiacritics,swapCase,escapeHTML,unescapeHTML,wrap,dedent,reverse,pred,succ,titleize,camelize,classify,underscored,dasherize,humanize,trim,ltrim,rtrim,truncate,sprintf,strRight,strRightBack,strLeft,strLeftBack,stripTags,unquote,map]", "Argument[0]", "ReturnValue", "taint"]
Comment thread
Napalys marked this conversation as resolved.
Outdated
- ["'underscore.string'", "Member[chop,chars,words,lines]", "Argument[0]", "ReturnValue", "taint"]
Copy link
Copy Markdown
Contributor

@asgerf asgerf Mar 20, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Suggested change
- ["'underscore.string'", "Member[chop,chars,words,lines]", "Argument[0]", "ReturnValue", "taint"]
- ["'underscore.string'", "Member[chop,chars,words,lines]", "Argument[0]", "ReturnValue.ArrayElement", "taint"]

This is a bit more precise.

If the whole return value is tainted, the analysis thinks all its properties are tainted too, including .length. You could try adding the test:

sink(s.chop(source("s1"), 3).length);

Copy link
Copy Markdown
Contributor Author

@Napalys Napalys Mar 20, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

It looks like there is still something off with ArrayElement f4ca2dc?

Copy link
Copy Markdown
Contributor

@asgerf asgerf Mar 20, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Some of the tests have a typo, they should access the [0] on the returned array, not on the source string:

sink(s.chars(source("s2")[0])) -> sink(s.chars(source("s2"))[0])

I know why the last test is failing but it's complicated. Would you mind leaving it as MISSING: for now?

8 changes: 4 additions & 4 deletions javascript/ql/test/library-tests/TripleDot/underscore.string.js
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -35,8 +35,8 @@ function strToStr() {
}

function strToArray() {
sink(s.chop(source("s1"), 3)[0]); // $ MISSING: hasTaintFlow=s1
sink(s.chars(source("s2")[0])); // $ MISSING: hasTaintFlow=s2
sink(s.words(source("s3")[0])); // $ MISSING: hasTaintFlow=s3
sink(s.lines(source("s7")[0])); // $ MISSING: hasTaintFlow=s7
sink(s.chop(source("s1"), 3)[0]); // $ hasTaintFlow=s1
sink(s.chars(source("s2")[0])); // $ hasTaintFlow=s2
sink(s.words(source("s3")[0])); // $ hasTaintFlow=s3
sink(s.lines(source("s7")[0])); // $ hasTaintFlow=s7
}