JS: improvement to URL-gotcha queries #1178
Closed
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
added 4 commits
March 28, 2019 22:06
The controversial bit of this is the change from `source.getStringValue()` to `source.asExpr().(SimpleConstantString).getSimpleStringValue()`.
- use taint tracking - restrict string sources to SimpleConstantString - turn into a path problem
ghost
self-requested a review
as a 
xiemaisi
suggested changes
Mar 29, 2019
xiemaisi
left a comment
xiemaisi
left a comment
There was a problem hiding this comment.
One minor comment. As discussed it would be nice to have a clearer performance evaluation, and it might be worth to experiment with type back-tracking as an alternative to hardcoding (reasonable but essentially arbitrary) length bounds.
|
|
||
| <references> | ||
| <li>OWASP: <a href="https://www.owasp.org/index.php/Server_Side_Request_Forgery">SSRF</a></li> | ||
| <li>MDN: <a href="https://developer.mozilla.org/en-US/docs/Web/JavaScript/Guide/Regular_Expressions">Regular Expressions</a></li> <li>OWASP: <a href="https://www.owasp.org/index.php/Server_Side_Request_Forgery">SSRF</a></li> |
There was a problem hiding this comment.
Missing linebreak between the two <li>s.
Author
|
Replaced by #1211 and another upcoming PR. |
ghost
closed this
This pull request was closed.
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
This PR is a bit of everything for two queries, and can be summarized as doing the following:
js/incomplete-hostname-regexpjs/incomplete-url-substring-sanitizationTaken together, this results in a decrease of overall relative anslysis time to 0.88. But this is negligible in the context of the security suite.
Backing data (note that another new
ConfigurationqueryUnanchoredUrlRegExp.qlcontribute to these numbers):I have also sanity checked this on our set of performance-problematic slugs. The picture seems to be the same as above.