JS: add simple query for detecting sensitive files downloaded over insecure connection

[erik-krogh]

CVE-2017-16003: TP/TN

A very closely related issue to look for http urls in 'package.jsonfiles, or<script />tags withhttp` urls, but that is not a path-problem, so it feels weird mashing that into the same query.
Maybe we should get back to that later?

It was suggested at one point that I could add an integrity-check as a sanitizer, but I don't know what that would look like?

The query only supports the http and ftp protocols for now. Suggestions for additional protocols are very welcome.

Performance evaluation waits until after this PR has been merged into the sprint branch.

[intrigus-lgtm]

What about .jar and .war files?

[erik-krogh]

Good point, those after often used as executeables.

[asgerf]

LGTM

@mchammer01 another doc review for you 😄

[mchammer01]

@erik-krogh - this LGTM ✨
Happy for this to be merged once you had a look at my suggestions and comments (there are a few typos, but apart from that, it's looking really good).
Hope it helps!

[intrigus-lgtm]

I'm not sure how relevant this is in practice:
When I looked at a similar query for java, I found instances where the download link looked like this:
http://foo.foo/latestVersion (Notice: No extension). This would then be saved to a version.exe file.

So it may be useful to also to track such cases. Or maybe not 🤷‍♂️

[erik-krogh]

I'm not sure how relevant this is in practice:
When I looked at a similar query for java, I found instances where the download link looked like this:
http://foo.foo/latestVersion (Notice: No extension). This would then be saved to a version.exe file.

So it may be useful to also to track such cases. Or maybe not

I think it is useful to track such cases.

And you got a good point, thanks 👍
But it is a big change that is better suited for a later PR.

[erik-krogh]

Happy for this to be merged once you had a look at my suggestions and comments (there are a few typos, but apart from that, it's looking really good).
Hope it helps!

It did, I agree with all your suggested changes 👍

[mchammer01]

LGTM