JS: Add 'case sensitive middleware' query #9718
Conversation
![github-code-scanning[bot]](https://ssr-www.pages.dev/web/20220707125406im_/https://avatars.githubusercontent.com/in/57789?s=60&v=4&kwid=1tfa-bq%2560kjuf-lqd){kind=small}
| <overview> | ||
| <p> | ||
| Using a case-sensitive regular expression path in a middleware route enables an attacker to bypass that middleware | ||
| when accessing an endpoint with a case-insensitive path. |
There was a problem hiding this comment.
I think we need to explain that explicit string routes typically are treated case-insensitively.
|
|
||
| <recommendation> | ||
| <p> | ||
| When using a regular expression as a middlware path, make sure the regular expression is |
There was a problem hiding this comment.
| When using a regular expression as a middlware path, make sure the regular expression is | |
| When using a regular expression as a middleware path, make sure the regular expression is |
| * Converts `s` to upper case, or to lower-case if it was already upper case. | ||
| */ | ||
| bindingset[s] | ||
| string invertCase(string s) { |
There was a problem hiding this comment.
In isolation, I find the naming confusing here. If s is mixed case, it will be upper-cased, that does not sound like an inversion.
There was a problem hiding this comment.
Renamed to toOtherCase
| } | ||
|
|
||
| /** | ||
| * Holds if `term` distinguishes between upper and lower case letters, assuming the `i` flag is not present. |
There was a problem hiding this comment.
I agree that this predicate suits the query: it identifies the typical regexp routes such as /admin\/.*/.
The predicate will however also hold (wrongly) for cases such as /a|A/ or /[abcA-C]/
Could the docstring/predicate name be something like isCaseSensitiveRouteRegExp?
There was a problem hiding this comment.
Renamed to isLikelyCaseSensitiveRegExp
esbena
added
the
ready-for-doc-review
LGTM. Thanks for making this query a reality.
We are ready for the docs review.
Adds a query for detecting middlewares that can be bypassed due to having a case-sensitive regular expression as its path.
Evaluations have been split into a few parts: