JS: add CWE-1333 to the JS ReDoS queries #6129
Merged
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Contributor
|
Historically (as in: this used to be in the Semmle-wiki), we have tried to only make use of the @calumgrant you have recently worked with the CWEs. Do you know what the guidelines are these days for query/CWE combinations? |
Contributor
|
There are no established guidelines yet, but the tooling is still a work in progress. However, it should be fairly safe to just add CWE to an existing query as this will in theory just refine the severity score. In theory you should also rerun the cwe scoring tool as part of the PR but the exact workflow has not been established. |
Contributor
|
Thanks. |
esbena
approved these changes
Jun 22, 2021
erik-krogh
changed the title
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
4 participants
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
CWE-1333 sounds like a perfect fit.
Inspired by Nicks comment here: #6038 (comment)