JS: Functionality from untrusted sources query (CWE-830)

[kaeluka]

This adds a query that finds HTML <script src="http://somepage.com/foo.js"></script> elements where the src is only a http URL (not https) and there's no integrity checking. It also finds <iframe>s where the src is a http URL.

[esbena]

(For completeness: even the use of HTTPS is problematic without an integrity check. A compromised JavaScript CDN that is accessed through HTTPS can easily respond with malicious content.)

[kaeluka]

(For completeness: even the use of HTTPS is problematic without an integrity check. A compromised JavaScript CDN that is accessed through HTTPS can easily respond with malicious content.)

Yes, that is true; but in practice, the integrity check is almost never used — it would create a lot of noise to demand that.

[esbena]

Hmm. Is there a significant difference in the result quality from the two queries that prevents us from having a single unified query?

[kaeluka]

No, but the queries are completely different — one is a taint tracking query, and the other is working on the level of HTML elements. That was the reason I built two independent queries.

[kaeluka]

I have now:

• refactored the taint tracking query to use type tracking
• merged the two resulting queries and updated the change log file and the tests
• removed flagging of // urls
• made the integrity attribute mandatory for <script/> elements that load from CDNs which recommend using the attribute — eg, by including the attribute in their code snippets.
• removed flagging of the ternaries (added a test for that, too)
• polished the qlhelp documentation some more

Is anything missing, @esbena and @asgerf?

[asgerf]

Just a few comments from me.

Another point is that it would be nice to be consistent in how we format the words http, https and url.

My suggestion would be:

• http: and https:. In the alert message, surround with single quotes, in qhelp surround with <code>.
• URL. No other formatting.

[kaeluka]

I went through the experiment results with @esbena — they look good (except some failures that seem to be caused by DCA or github actions).

[erik-krogh]

I like the general structure of the query, I think this can be a good query.

I got a lot of minor comments, mostly about the documentation.

[kaeluka]

Thank you, @erik-krogh, for the thorough review! I went through your comments and hope to have fixed them all. Are you happy with the fixes?

[erik-krogh]

A few more comments before I call it a day.
Your changes look good 👍

There are still two comments from my previous round that you haven't addressed.

Also, the autoformatter is failing.

[erik-krogh]

Looks good, lets get a doc review on this.

[hubwriter]

Looks good. Just a few editorial comments.

[kaeluka]

Thank you, @hubwriter! I've added a new commit.