testable-eu / sast-testability-patterns

Testability Pattern Catalogs for SAST
https://owasp.org/www-project-testability-patterns-for-web-applications/
Apache License 2.0
29 stars 2 forks source link

[Patterns] Test discovery rules for JS #10

Open compaluca opened 1 year ago

compaluca commented 1 year ago

Problem statement

Discovery rules (when avaliable) were tested for JS patterns via the tpframework new functionality:

tpframework checkdiscoveryrules --export test_export.csv -l JS -a --output-dir /tp-framework/out/20230202_check_discovery_rules-JS
Here a summary of the results:   JS - 02022023
counting 134
successful 40
unsuccessful 11
error 83

Here the raw data in a zip comprising:

20230202-JS-discovery_rules.zip

Proposed changes

@SoheilKhodayari, @ManuManu97 : can you please check the patterns you have already reviewed? Is there anyone that needs to be updated?

SoheilKhodayari commented 1 year ago

@compaluca In my case, there are seven patterns that I individually tested and worked back then, but do not work in batch mode (see the list below). Looking at the errors in the log file, there are three types of problems:

CASE 1: Wrong JSON File Name [FIXED] The file name of the JSON file should be /JS/105_this_statement/105_this_statement.json instead of /JS/105_this_statement/1_instance_105_this_statement.json.

CASE 2: Mal-formated file [FIXED]

The error isEither pattern id 104 does not exist, or its file system structure is not valid, or its instances cannot be fetched. Exception raised: Expecting value: line 8 column 5 (char 264). Lists should not end with a comma in the JSON files.

CASE 3: Discovery method None is not supported [FIXED] Not sure what that means, but I suspect this has to do with the query results not returning the specific fields tp-framework expects? If so, should we specify what fields of a node the query must contain?

Update: this error happens when the instance JSON file does not specify the discovery method. Maybe we should set that to Joern by default?

ManuManu97 commented 1 year ago

I tried to work on it today and I solved patterns 55 and 77, the others need more work to be solved.