Skip to content

docs: improve warnings markdown docs #167

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
merged 1 commit into from
Nov 29, 2023
Merged
Show file tree
Hide file tree
Changes from all commits
Commits
File filter

Filter by extension

Filter by extension

Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
4 changes: 2 additions & 2 deletions docs/encoded-literal.md
Original file line number Diff line number Diff line change
Expand Up @@ -6,12 +6,12 @@

## Introduction

The SAST scanner assert all Literals in the tree and search for encoded values. JS-X-Ray currently supports three types of detection:
JS-X-Ray assert all Literals in the tree and search for **encoded values**. It currently supports `three` types of detection:
- Hexadecimal sequence: `'\x72\x4b\x58\x6e\x75\x65\x38\x3d'`
- Unicode sequence: `\u03B1`
- Base64 encryption: `z0PgB0O=`

Hexadecimal and Unicode sequence are tested directly on the raw Literal provided by meriyah. For base64 detection we use the npm package [is-base64](https://github.com/miguelmota/is-base64).
Hexadecimal and Unicode sequence are tested directly on the **raw Literal** provided by meriyah. For base64 detection we use the npm package [is-base64](https://github.com/miguelmota/is-base64).

Example of a JavaScript implementation:
```js
Expand Down
7 changes: 5 additions & 2 deletions docs/obfuscated-code.md
Original file line number Diff line number Diff line change
Expand Up @@ -6,7 +6,9 @@

## Introduction

An **experimental** warning capable of detecting obfuscation and sometimes the tool used. The scanner is capable to detect:
An **experimental** warning capable of detecting obfuscation and sometimes the tool used.

JS-X-Ray is capable to detect the following internet tools:

- [freejsobfuscator](http://www.freejsobfuscator.com/)
- [jjencode](https://utf-8.jp/public/jjencode.html)
Expand All @@ -22,7 +24,8 @@ A complete G.Drive document has been written to describe the patterns of obfusca

- [JSXRay - Patterns of obfuscated JavaScript code](https://docs.google.com/document/d/11ZrfW0bDQ-kd7Gr_Ixqyk8p3TGvxckmhFH3Z8dFoPhY/edit?usp=sharing)

> **Note** There is no frozen implementation and this is an early implementation
> [!CAUTION]
> This is an early (beta) implementation

## Example

Expand Down
5 changes: 3 additions & 2 deletions docs/parsing-error.md
Original file line number Diff line number Diff line change
Expand Up @@ -6,9 +6,10 @@

## Introduction

Parsing Error is throw when the library [meriyah](https://github.com/meriyah/meriyah) fail to parse the javascript source code into an AST. But it can also happen when the AST analysis fails because we don't manage a case properly.
<kbd>parsing-error</kbd> warning is throw when the library [meriyah](https://github.com/meriyah/meriyah) **fail to parse** the javascript source code into an AST. But it can also happen when the AST analysis fails because we don't manage a case properly.

> **Note** If you are in the second case, please open an issue [here](https://github.com/NodeSecure/js-x-ray/issues)
> [!IMPORTANT]
> If you are in the second case, please open an issue [here](https://github.com/NodeSecure/js-x-ray/issues)

## Example

Expand Down
5 changes: 3 additions & 2 deletions docs/shady-link.md
Original file line number Diff line number Diff line change
Expand Up @@ -5,9 +5,10 @@

## Introduction

Identify when a Literal (string) contains an URL to a domain with a suspicious extension.
Identify when a Literal (string) contains an URL to a domain with a **suspicious extension**.

> **Note** credit goes to the [guarddog](https://github.dev/DataDog/guarddog) team.
> [!IMPORTANT]
> Credit goes to the [guarddog](https://github.dev/DataDog/guarddog) team.

## Example

Expand Down
4 changes: 3 additions & 1 deletion docs/short-identifiers.md
Original file line number Diff line number Diff line change
Expand Up @@ -6,8 +6,10 @@

## Introduction

The SAST store in memory all Identifiers id so we are able later to sum the length of all ids. We are looking at several ESTree Node in the tree:
JS-X-Ray store in memory all Identifiers so we are able later to sum the length of all of them. We are looking at several ESTree Node in the tree:
- VariableDeclarator: `var boo;`
- ClassDeclaration: `class boo {}`
- MethodDefinition
- AssignmentExpression: `(boo = 5)`
- FunctionDeclaration: `function boo() {}`
- Property of ObjectExpression: `{ boo: 5 }`
Expand Down
14 changes: 10 additions & 4 deletions docs/suspicious-literal.md
Original file line number Diff line number Diff line change
Expand Up @@ -41,15 +41,21 @@ function stringSuspicionScore(str) {
}

const includeSpace = str.includes(" ");
const includeSpaceAtStart = includeSpace ? str.slice(0, kMaxSafeStringLen).includes(" ") : false;
const includeSpaceAtStart = includeSpace ?
str.slice(0, kMaxSafeStringLen).includes(" ") :
false;

let suspectScore = includeSpaceAtStart ? 0 : 1;
if (strLen > kMinUnsafeStringLenThreshold) {
suspectScore += Math.ceil(strLen / kScoreStringLengthThreshold);
suspectScore += Math.ceil(
strLen / kScoreStringLengthThreshold
);
}

return stringCharDiversity(str) >= kMaxSafeStringCharDiversity ? suspectScore + 2 : suspectScore;
return stringCharDiversity(str) >= kMaxSafeStringCharDiversity ?
suspectScore + 2 : suspectScore;
}
```

> **Note** The warning is generated only if the sum of all scores exceeds **three**.
> [!IMPORTANT]
> The warning is generated only if the sum of all scores exceeds **three**.
7 changes: 4 additions & 3 deletions docs/unsafe-import.md
Original file line number Diff line number Diff line change
Expand Up @@ -6,9 +6,10 @@

## Introduction

On JS-X-Ray we intensively track the use of `require` CallExpression and also ESM Import declarations. Knowing the dependencies used is really important for our analysis and that why when the SAST fail to follow an important it will throw an `unsafe-import` warning.
JS-X-Ray intensively track the use of `require` CallExpression and also ESM Import declarations. Knowing the dependencies used is really important for our analysis and that why when the SAST fail to follow an important it will throw an `unsafe-import` warning.

> **Note** Sometimes we trigger this warning on purpose because we have detected a malicious import
> [!CAUTION]
> Sometimes we trigger this warning on purpose because we have detected a malicious import

### CJS Note
We analyze and trace several ways to require in Node.js (with CJS):
Expand All @@ -19,7 +20,7 @@ We analyze and trace several ways to require in Node.js (with CJS):

## Example

The code below try to require Node.js core dependency `http`. JS-X-Ray sucessfully detect it and throw an `unsafe-import` warning.
The code below try to require Node.js core dependency `http`. JS-X-Ray sucessfully detect it and throw an <kbd>unsafe-import</kbd> warning.

```js
function unhex(r) {
Expand Down
3 changes: 2 additions & 1 deletion docs/unsafe-regex.md
Original file line number Diff line number Diff line change
Expand Up @@ -15,7 +15,8 @@ Learn more:
- [Why Aren’t Regexes a Lingua Franca?](https://davisjam.medium.com/why-arent-regexes-a-lingua-franca-esecfse19-a36348df3a2)
- [Comparing regex matching algorithms](https://swtch.com/~rsc/regexp/regexp1.html)

> **Note** credit goes to the `safe-regex` package author for the last three resources.
> [!NOTE]
> Credit goes to the `safe-regex` package author for the last three resources.

### Technical implementation

Expand Down
2 changes: 1 addition & 1 deletion docs/unsafe-stmt.md
Original file line number Diff line number Diff line change
Expand Up @@ -6,7 +6,7 @@

## Introduction

Warning to notify of the usage of `eval()` or `Function()` in the source code. Their use is not recommended and can be used to execute insecure code (for example to retrieve the `globalThis` / `window` object).
Warning about the usage of <kbd>eval()</kbd> or <kbd>Function()</kdb> in the source code. Their use is not recommended and can be used to execute insecure code (for example to retrieve the **globalThis** / **window** object).

- [MDN - Never use eval()!](https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Global_Objects/eval#never_use_eval!)

Expand Down
2 changes: 1 addition & 1 deletion docs/weak-crypto.md
Original file line number Diff line number Diff line change
Expand Up @@ -6,7 +6,7 @@

## Introduction

Detect usage of weak crypto algorithm with the Node.js core `Crypto` dependency. Algorithm considered to be weak are:
Detect usage of **weak crypto** algorithm with the Node.js core `Crypto` dependency. Algorithm considered to be weak are:

- md5
- md4
Expand Down