{"action":"created","comment":{"url":"https://api.github.com/repos/Semmle/ql/pulls/comments/237444867","pull_request_review_id":179742168,"id":237444867,"node_id":"MDI0OlB1bGxSZXF1ZXN0UmV2aWV3Q29tbWVudDIzNzQ0NDg2Nw==","diff_hunk":"@@ -2,7 +2,7 @@\n \n ## General improvements\n \n-* Modelling of taint flow through array operations has been improved. This may give additional results for the security queries.\n+* Modelling of taint flow through array and buffer operations has been improved. This may give additional results for the security queries.","path":"change-notes/1.19/analysis-javascript.md","position":5,"original_position":5,"commit_id":"8637eaf100eb8670e674aaffdc2b5178bb91c266","original_commit_id":"8637eaf100eb8670e674aaffdc2b5178bb91c266","user":{"login":"mc-semmle","id":42146119,"node_id":"MDQ6VXNlcjQyMTQ2MTE5","avatar_url":"https://avatars3.githubusercontent.com/u/42146119?v=4","gravatar_id":"","url":"https://api.github.com/users/mc-semmle","html_url":"https://github.com/mc-semmle","followers_url":"https://api.github.com/users/mc-semmle/followers","following_url":"https://api.github.com/users/mc-semmle/following{/other_user}","gists_url":"https://api.github.com/users/mc-semmle/gists{/gist_id}","starred_url":"https://api.github.com/users/mc-semmle/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/mc-semmle/subscriptions","organizations_url":"https://api.github.com/users/mc-semmle/orgs","repos_url":"https://api.github.com/users/mc-semmle/repos","events_url":"https://api.github.com/users/mc-semmle/events{/privacy}","received_events_url":"https://api.github.com/users/mc-semmle/received_events","type":"User","site_admin":false},"body":"I would use \"Modeling\" as I believe it's the most common used form in the US. However, I leave this up to you as this spelling may be used elsewhere","created_at":"2018-11-29T11:15:31Z","updated_at":"2018-11-29T11:16:04Z","html_url":"https://github.com/Semmle/ql/pull/571#discussion_r237444867","pull_request_url":"https://api.github.com/repos/Semmle/ql/pulls/571","author_association":"NONE","_links":{"self":{"href":"https://api.github.com/repos/Semmle/ql/pulls/comments/237444867"},"html":{"href":"https://github.com/Semmle/ql/pull/571#discussion_r237444867"},"pull_request":{"href":"https://api.github.com/repos/Semmle/ql/pulls/571"}}},"pull_request":{"url":"https://api.github.com/repos/Semmle/ql/pulls/571","id":234572227,"node_id":"MDExOlB1bGxSZXF1ZXN0MjM0NTcyMjI3","html_url":"https://github.com/Semmle/ql/pull/571","diff_url":"https://github.com/Semmle/ql/pull/571.diff","patch_url":"https://github.com/Semmle/ql/pull/571.patch","issue_url":"https://api.github.com/repos/Semmle/ql/issues/571","number":571,"state":"open","locked":false,"title":"JavaScript: Add new query `HardcodedDataInterpretedAsCode`.","user":{"login":"xiemaisi","id":501353,"node_id":"MDQ6VXNlcjUwMTM1Mw==","avatar_url":"https://avatars3.githubusercontent.com/u/501353?v=4","gravatar_id":"","url":"https://api.github.com/users/xiemaisi","html_url":"https://github.com/xiemaisi","followers_url":"https://api.github.com/users/xiemaisi/followers","following_url":"https://api.github.com/users/xiemaisi/following{/other_user}","gists_url":"https://api.github.com/users/xiemaisi/gists{/gist_id}","starred_url":"https://api.github.com/users/xiemaisi/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/xiemaisi/subscriptions","organizations_url":"https://api.github.com/users/xiemaisi/orgs","repos_url":"https://api.github.com/users/xiemaisi/repos","events_url":"https://api.github.com/users/xiemaisi/events{/privacy}","received_events_url":"https://api.github.com/users/xiemaisi/received_events","type":"User","site_admin":false},"body":"This adds a query that would have spotted [the event-stream incident](https://blog.npmjs.org/post/180565383195/details-about-the-event-stream-incident). The idea is to look for hard-coded hexadecimal data that is transformed and then interpreted as code or as an import path. There are very few good reasons to do this; the only somewhat acceptable use-case I've seen so far is using `eval` to check whether the runtime supports [bigints](https://github.com/tc39/proposal-bigint). For now, I'm willing to accept the very occasional false positives (in test code) this causes.\r\n\r\nThe first two commits introduce two unrelated library improvements we need to catch the event-stream backdoor: a more lenient definition of what constitutes a `require` call (accounting for cases where our syntactic heuristics fail to identify a Node.js module as such), and a taint propagation step through `Buffer.from`. These two could affect many other queries, so I'm running a full-scale dist-compare to find out. So far, I have not seen any performance regressions, and occasional false-positive fixes due to the improved `require` handling.\r\n\r\nAs discussed with @pavgust and @sjvs, I'm targetting this at 1.19 due to customer interest.","created_at":"2018-11-29T09:54:41Z","updated_at":"2018-11-29T11:16:04Z","closed_at":null,"merged_at":null,"merge_commit_sha":"43186d7205031d28863f5154a325e8e5528f1858","assignee":null,"assignees":[],"requested_reviewers":[],"requested_teams":[],"labels":[{"id":1013903216,"node_id":"MDU6TGFiZWwxMDEzOTAzMjE2","url":"https://api.github.com/repos/Semmle/ql/labels/JS","name":"JS","color":"edcc80","default":false}],"milestone":{"url":"https://api.github.com/repos/Semmle/ql/milestones/2","html_url":"https://github.com/Semmle/ql/milestone/2","labels_url":"https://api.github.com/repos/Semmle/ql/milestones/2/labels","id":3835025,"node_id":"MDk6TWlsZXN0b25lMzgzNTAyNQ==","number":2,"title":"1.19","description":null,"creator":{"login":"geoffw0","id":40627776,"node_id":"MDQ6VXNlcjQwNjI3Nzc2","avatar_url":"https://avatars1.githubusercontent.com/u/40627776?v=4","gravatar_id":"","url":"https://api.github.com/users/geoffw0","html_url":"https://github.com/geoffw0","followers_url":"https://api.github.com/users/geoffw0/followers","following_url":"https://api.github.com/users/geoffw0/following{/other_user}","gists_url":"https://api.github.com/users/geoffw0/gists{/gist_id}","starred_url":"https://api.github.com/users/geoffw0/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/geoffw0/subscriptions","organizations_url":"https://api.github.com/users/geoffw0/orgs","repos_url":"https://api.github.com/users/geoffw0/repos","events_url":"https://api.github.com/users/geoffw0/events{/privacy}","received_events_url":"https://api.github.com/users/geoffw0/received_events","type":"User","site_admin":false},"open_issues":4,"closed_issues":11,"state":"open","created_at":"2018-11-20T16:43:48Z","updated_at":"2018-11-29T10:30:39Z","due_on":null,"closed_at":null},"commits_url":"https://api.github.com/repos/Semmle/ql/pulls/571/commits","review_comments_url":"https://api.github.com/repos/Semmle/ql/pulls/571/comments","review_comment_url":"https://api.github.com/repos/Semmle/ql/pulls/comments{/number}","comments_url":"https://api.github.com/repos/Semmle/ql/issues/571/comments","statuses_url":"https://api.github.com/repos/Semmle/ql/statuses/8637eaf100eb8670e674aaffdc2b5178bb91c266","head":{"label":"xiemaisi:js/numeric-constant-interpreted-as-code","ref":"js/numeric-constant-interpreted-as-code","sha":"8637eaf100eb8670e674aaffdc2b5178bb91c266","user":{"login":"xiemaisi","id":501353,"node_id":"MDQ6VXNlcjUwMTM1Mw==","avatar_url":"https://avatars3.githubusercontent.com/u/501353?v=4","gravatar_id":"","url":"https://api.github.com/users/xiemaisi","html_url":"https://github.com/xiemaisi","followers_url":"https://api.github.com/users/xiemaisi/followers","following_url":"https://api.github.com/users/xiemaisi/following{/other_user}","gists_url":"https://api.github.com/users/xiemaisi/gists{/gist_id}","starred_url":"https://api.github.com/users/xiemaisi/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/xiemaisi/subscriptions","organizations_url":"https://api.github.com/users/xiemaisi/orgs","repos_url":"https://api.github.com/users/xiemaisi/repos","events_url":"https://api.github.com/users/xiemaisi/events{/privacy}","received_events_url":"https://api.github.com/users/xiemaisi/received_events","type":"User","site_admin":false},"repo":{"id":143419908,"node_id":"MDEwOlJlcG9zaXRvcnkxNDM0MTk5MDg=","name":"ql","full_name":"xiemaisi/ql","private":false,"owner":{"login":"xiemaisi","id":501353,"node_id":"MDQ6VXNlcjUwMTM1Mw==","avatar_url":"https://avatars3.githubusercontent.com/u/501353?v=4","gravatar_id":"","url":"https://api.github.com/users/xiemaisi","html_url":"https://github.com/xiemaisi","followers_url":"https://api.github.com/users/xiemaisi/followers","following_url":"https://api.github.com/users/xiemaisi/following{/other_user}","gists_url":"https://api.github.com/users/xiemaisi/gists{/gist_id}","starred_url":"https://api.github.com/users/xiemaisi/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/xiemaisi/subscriptions","organizations_url":"https://api.github.com/users/xiemaisi/orgs","repos_url":"https://api.github.com/users/xiemaisi/repos","events_url":"https://api.github.com/users/xiemaisi/events{/privacy}","received_events_url":"https://api.github.com/users/xiemaisi/received_events","type":"User","site_admin":false},"html_url":"https://github.com/xiemaisi/ql","description":null,"fork":true,"url":"https://api.github.com/repos/xiemaisi/ql","forks_url":"https://api.github.com/repos/xiemaisi/ql/forks","keys_url":"https://api.github.com/repos/xiemaisi/ql/keys{/key_id}","collaborators_url":"https://api.github.com/repos/xiemaisi/ql/collaborators{/collaborator}","teams_url":"https://api.github.com/repos/xiemaisi/ql/teams","hooks_url":"https://api.github.com/repos/xiemaisi/ql/hooks","issue_events_url":"https://api.github.com/repos/xiemaisi/ql/issues/events{/number}","events_url":"https://api.github.com/repos/xiemaisi/ql/events","assignees_url":"https://api.github.com/repos/xiemaisi/ql/assignees{/user}","branches_url":"https://api.github.com/repos/xiemaisi/ql/branches{/branch}","tags_url":"https://api.github.com/repos/xiemaisi/ql/tags","blobs_url":"https://api.github.com/repos/xiemaisi/ql/git/blobs{/sha}","git_tags_url":"https://api.github.com/repos/xiemaisi/ql/git/tags{/sha}","git_refs_url":"https://api.github.com/repos/xiemaisi/ql/git/refs{/sha}","trees_url":"https://api.github.com/repos/xiemaisi/ql/git/trees{/sha}","statuses_url":"https://api.github.com/repos/xiemaisi/ql/statuses/{sha}","languages_url":"https://api.github.com/repos/xiemaisi/ql/languages","stargazers_url":"https://api.github.com/repos/xiemaisi/ql/stargazers","contributors_url":"https://api.github.com/repos/xiemaisi/ql/contributors","subscribers_url":"https://api.github.com/repos/xiemaisi/ql/subscribers","subscription_url":"https://api.github.com/repos/xiemaisi/ql/subscription","commits_url":"https://api.github.com/repos/xiemaisi/ql/commits{/sha}","git_commits_url":"https://api.github.com/repos/xiemaisi/ql/git/commits{/sha}","comments_url":"https://api.github.com/repos/xiemaisi/ql/comments{/number}","issue_comment_url":"https://api.github.com/repos/xiemaisi/ql/issues/comments{/number}","contents_url":"https://api.github.com/repos/xiemaisi/ql/contents/{+path}","compare_url":"https://api.github.com/repos/xiemaisi/ql/compare/{base}...{head}","merges_url":"https://api.github.com/repos/xiemaisi/ql/merges","archive_url":"https://api.github.com/repos/xiemaisi/ql/{archive_format}{/ref}","downloads_url":"https://api.github.com/repos/xiemaisi/ql/downloads","issues_url":"https://api.github.com/repos/xiemaisi/ql/issues{/number}","pulls_url":"https://api.github.com/repos/xiemaisi/ql/pulls{/number}","milestones_url":"https://api.github.com/repos/xiemaisi/ql/milestones{/number}","notifications_url":"https://api.github.com/repos/xiemaisi/ql/notifications{?since,all,participating}","labels_url":"https://api.github.com/repos/xiemaisi/ql/labels{/name}","releases_url":"https://api.github.com/repos/xiemaisi/ql/releases{/id}","deployments_url":"https://api.github.com/repos/xiemaisi/ql/deployments","created_at":"2018-08-03T11:36:23Z","updated_at":"2018-11-26T16:17:53Z","pushed_at":"2018-11-29T10:48:49Z","git_url":"git://github.com/xiemaisi/ql.git","ssh_url":"git@github.com:xiemaisi/ql.git","clone_url":"https://github.com/xiemaisi/ql.git","svn_url":"https://github.com/xiemaisi/ql","homepage":null,"size":12503,"stargazers_count":0,"watchers_count":0,"language":"JavaScript","has_issues":false,"has_projects":true,"has_downloads":true,"has_wiki":true,"has_pages":false,"forks_count":0,"mirror_url":null,"archived":false,"open_issues_count":0,"license":{"key":"other","name":"Other","spdx_id":"NOASSERTION","url":null,"node_id":"MDc6TGljZW5zZTA="},"forks":0,"open_issues":0,"watchers":0,"default_branch":"master"}},"base":{"label":"Semmle:rc/1.19","ref":"rc/1.19","sha":"595e6fcbf8014b5cb58ce6a931af0fc36a897906","user":{"login":"Semmle","id":1101495,"node_id":"MDEyOk9yZ2FuaXphdGlvbjExMDE0OTU=","avatar_url":"https://avatars0.githubusercontent.com/u/1101495?v=4","gravatar_id":"","url":"https://api.github.com/users/Semmle","html_url":"https://github.com/Semmle","followers_url":"https://api.github.com/users/Semmle/followers","following_url":"https://api.github.com/users/Semmle/following{/other_user}","gists_url":"https://api.github.com/users/Semmle/gists{/gist_id}","starred_url":"https://api.github.com/users/Semmle/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/Semmle/subscriptions","organizations_url":"https://api.github.com/users/Semmle/orgs","repos_url":"https://api.github.com/users/Semmle/repos","events_url":"https://api.github.com/users/Semmle/events{/privacy}","received_events_url":"https://api.github.com/users/Semmle/received_events","type":"Organization","site_admin":false},"repo":{"id":143040428,"node_id":"MDEwOlJlcG9zaXRvcnkxNDMwNDA0Mjg=","name":"ql","full_name":"Semmle/ql","private":false,"owner":{"login":"Semmle","id":1101495,"node_id":"MDEyOk9yZ2FuaXphdGlvbjExMDE0OTU=","avatar_url":"https://avatars0.githubusercontent.com/u/1101495?v=4","gravatar_id":"","url":"https://api.github.com/users/Semmle","html_url":"https://github.com/Semmle","followers_url":"https://api.github.com/users/Semmle/followers","following_url":"https://api.github.com/users/Semmle/following{/other_user}","gists_url":"https://api.github.com/users/Semmle/gists{/gist_id}","starred_url":"https://api.github.com/users/Semmle/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/Semmle/subscriptions","organizations_url":"https://api.github.com/users/Semmle/orgs","repos_url":"https://api.github.com/users/Semmle/repos","events_url":"https://api.github.com/users/Semmle/events{/privacy}","received_events_url":"https://api.github.com/users/Semmle/received_events","type":"Organization","site_admin":false},"html_url":"https://github.com/Semmle/ql","description":"The standard QL libraries and queries that power LGTM.com and other Semmle Products","fork":false,"url":"https://api.github.com/repos/Semmle/ql","forks_url":"https://api.github.com/repos/Semmle/ql/forks","keys_url":"https://api.github.com/repos/Semmle/ql/keys{/key_id}","collaborators_url":"https://api.github.com/repos/Semmle/ql/collaborators{/collaborator}","teams_url":"https://api.github.com/repos/Semmle/ql/teams","hooks_url":"https://api.github.com/repos/Semmle/ql/hooks","issue_events_url":"https://api.github.com/repos/Semmle/ql/issues/events{/number}","events_url":"https://api.github.com/repos/Semmle/ql/events","assignees_url":"https://api.github.com/repos/Semmle/ql/assignees{/user}","branches_url":"https://api.github.com/repos/Semmle/ql/branches{/branch}","tags_url":"https://api.github.com/repos/Semmle/ql/tags","blobs_url":"https://api.github.com/repos/Semmle/ql/git/blobs{/sha}","git_tags_url":"https://api.github.com/repos/Semmle/ql/git/tags{/sha}","git_refs_url":"https://api.github.com/repos/Semmle/ql/git/refs{/sha}","trees_url":"https://api.github.com/repos/Semmle/ql/git/trees{/sha}","statuses_url":"https://api.github.com/repos/Semmle/ql/statuses/{sha}","languages_url":"https://api.github.com/repos/Semmle/ql/languages","stargazers_url":"https://api.github.com/repos/Semmle/ql/stargazers","contributors_url":"https://api.github.com/repos/Semmle/ql/contributors","subscribers_url":"https://api.github.com/repos/Semmle/ql/subscribers","subscription_url":"https://api.github.com/repos/Semmle/ql/subscription","commits_url":"https://api.github.com/repos/Semmle/ql/commits{/sha}","git_commits_url":"https://api.github.com/repos/Semmle/ql/git/commits{/sha}","comments_url":"https://api.github.com/repos/Semmle/ql/comments{/number}","issue_comment_url":"https://api.github.com/repos/Semmle/ql/issues/comments{/number}","contents_url":"https://api.github.com/repos/Semmle/ql/contents/{+path}","compare_url":"https://api.github.com/repos/Semmle/ql/compare/{base}...{head}","merges_url":"https://api.github.com/repos/Semmle/ql/merges","archive_url":"https://api.github.com/repos/Semmle/ql/{archive_format}{/ref}","downloads_url":"https://api.github.com/repos/Semmle/ql/downloads","issues_url":"https://api.github.com/repos/Semmle/ql/issues{/number}","pulls_url":"https://api.github.com/repos/Semmle/ql/pulls{/number}","milestones_url":"https://api.github.com/repos/Semmle/ql/milestones{/number}","notifications_url":"https://api.github.com/repos/Semmle/ql/notifications{?since,all,participating}","labels_url":"https://api.github.com/repos/Semmle/ql/labels{/name}","releases_url":"https://api.github.com/repos/Semmle/ql/releases{/id}","deployments_url":"https://api.github.com/repos/Semmle/ql/deployments","created_at":"2018-07-31T16:35:51Z","updated_at":"2018-11-29T09:49:27Z","pushed_at":"2018-11-29T10:48:50Z","git_url":"git://github.com/Semmle/ql.git","ssh_url":"git@github.com:Semmle/ql.git","clone_url":"https://github.com/Semmle/ql.git","svn_url":"https://github.com/Semmle/ql","homepage":"https://semmle.com/ql","size":12417,"stargazers_count":69,"watchers_count":69,"language":"JavaScript","has_issues":true,"has_projects":true,"has_downloads":true,"has_wiki":true,"has_pages":false,"forks_count":44,"mirror_url":null,"archived":false,"open_issues_count":37,"license":{"key":"other","name":"Other","spdx_id":"NOASSERTION","url":null,"node_id":"MDc6TGljZW5zZTA="},"forks":44,"open_issues":37,"watchers":69,"default_branch":"master"}},"_links":{"self":{"href":"https://api.github.com/repos/Semmle/ql/pulls/571"},"html":{"href":"https://github.com/Semmle/ql/pull/571"},"issue":{"href":"https://api.github.com/repos/Semmle/ql/issues/571"},"comments":{"href":"https://api.github.com/repos/Semmle/ql/issues/571/comments"},"review_comments":{"href":"https://api.github.com/repos/Semmle/ql/pulls/571/comments"},"review_comment":{"href":"https://api.github.com/repos/Semmle/ql/pulls/comments{/number}"},"commits":{"href":"https://api.github.com/repos/Semmle/ql/pulls/571/commits"},"statuses":{"href":"https://api.github.com/repos/Semmle/ql/statuses/8637eaf100eb8670e674aaffdc2b5178bb91c266"}},"author_association":"MEMBER"}}
{"actor":{"display_login":"mc-semmle"}}