Merge pull request #19854 from Napalys/js/sinon

Napalys · web-flow · commit 2218a981f6a1 · 2025-06-24T10:24:13.000+02:00
JS: Explicitly Mark `Sinon` Package as Non RegExp
diff --git a/javascript/ql/lib/change-notes/2025-06-20-sinon.md b/javascript/ql/lib/change-notes/2025-06-20-sinon.md
@@ -0,0 +1,4 @@
+---
+category: minorAnalysis
+---
+* Calls to `sinon.match()` are no longer incorrectly identified as regular expression operations.
diff --git a/javascript/ql/lib/semmle/javascript/Regexp.qll b/javascript/ql/lib/semmle/javascript/Regexp.qll
@@ -998,6 +998,8 @@ private predicate isUsedAsNonMatchObject(DataFlow::MethodCallNode call) {
     or
     // Result is obviously unused
     call.asExpr() = any(ExprStmt stmt).getExpr()
+    or
+    call = API::moduleImport("sinon").getMember("match").getACall()
   )
 }
 
diff --git a/javascript/ql/test/query-tests/Security/CWE-020/IncompleteHostnameRegExp/tst-IncompleteHostnameRegExp.js b/javascript/ql/test/query-tests/Security/CWE-020/IncompleteHostnameRegExp/tst-IncompleteHostnameRegExp.js
@@ -60,4 +60,8 @@
 	/^(foo.example\.com|whatever)$/; // $ Alert (but kinda OK - one disjunction doesn't even look like a hostname)
 
 	if (s.matchAll("^http://test.example.com")) {} // $ Alert
+
+	const sinon = require('sinon');
+	const megacliteUrl = "https://a.b.com";
+	sinon.assert.calledWith(postStub.firstCall, sinon.match(megacliteUrl));
 });
diff --git a/javascript/ql/test/query-tests/Security/CWE-020/MissingRegExpAnchor/tst.js b/javascript/ql/test/query-tests/Security/CWE-020/MissingRegExpAnchor/tst.js
@@ -0,0 +1,6 @@
+const sinon = require('sinon');
+
+function testFunction() {
+  const megacliteUrl = "https://a.b.com";
+	sinon.assert.calledWith(postStub.firstCall, sinon.match(megacliteUrl));
+}

-Original file line number
+Diff line change
@@ @@ -0,0 +1,4 @@ @@
 +---
 +category: minorAnalysis
 +---
 +* Calls to `sinon.match()` are no longer incorrectly identified as regular expression operations.
Original file line number	Diff line number	Diff line change
`@@ -998,6 +998,8 @@ private predicate isUsedAsNonMatchObject(DataFlow::MethodCallNode call) {`
`998`	`998`	`or`
`999`	`999`	`// Result is obviously unused`
`1000`	`1000`	`call.asExpr() = any(ExprStmt stmt).getExpr()`
	`1001`	`+ or`
	`1002`	`+ call = API::moduleImport("sinon").getMember("match").getACall()`
`1001`	`1003`	`)`
`1002`	`1004`	`}`
`1003`	`1005`