-
Notifications
You must be signed in to change notification settings - Fork 1.8k
JS: Recognize lazy-cache and property enumeration through libraries #2768
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Conversation
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Looks good.
I think we should have a test case or two for the lazy-cache
+require
combo.
We also need to update the change notes with all the libraries we end up modelling something for in this PR.
result = moduleImport("for-own") or | ||
result = moduleImport("for-in") or | ||
result = moduleMember("ramda", "forEachObjIndexed") or | ||
result = LodashUnderscore::member("forEach") or |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
If the evaluation turns out fine, we should consider adding jQuery's forEach..
This particular predicate can probably be extended with a thousand more cases though...
} | ||
|
||
/** | ||
* Property enumeration through the `for-own` or `for-in` package. |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
This docstring needs to be more general now that propertyEnumerator
includes many more cases than just for-own
and for-in
The evaluation shows that this PR actually fixes four timeouts that had snuck in due to a bad join ordering from a refactoring in #2731. I'll run a quick evaluation against a commit that specifically fixes the join ordering, to see if this PR introduces any overhead of its own, possibly hidden behind the unrelated speed-up. |
Smoke-test evaluation against the commit that just fixes the join-ordering looks fine. Taken together with the original evaluation I'd say both this PR and the join order fix look safe. I'll put up a separate PR for the join order fix in case a cherry-picked and/or revert is needed. |
b21ae68
to
91a5385
Compare
Rebased on top of the fix commit. Should be ready to merge after the PR checks. Edit: never mind, there are still outstanding review comments |
As a general improvement, we now recognise imports through
lazy-cache
:The prototype pollution utility query has been improved to recognize property enumeration through a few NPM packages, such as
for-own
andfor-in
, allowing us to flag another CVE.This currently includes more general-purpose enumerators like
_.each
which is possibly a bit risky, as we might pick up on places where it's always enumerating an array, but we'll see from the evaluation how it works.