Merge pull request #20148 from Napalys/js/reg-exp-env-variable-threat-model

JS: Exclude environment variables from `js/regex-injection` query by default

Author: Napalys

javascript/ql/lib/semmle/javascript/security/dataflow/RegExpInjectionCustomizations.qll

@@ -5,6 +5,7 @@
  */
 
 import javascript
+private import codeql.threatmodels.ThreatModels
 
 module RegExpInjection {
   /**
@@ -32,19 +33,32 @@ module RegExpInjection {
 
   /**
    * An active threat-model source, considered as a flow source.
+   * Excludes environment variables by default - they require the "environment" threat model.
    */
   private class ActiveThreatModelSourceAsSource extends Source instanceof ActiveThreatModelSource {
-    ActiveThreatModelSourceAsSource() { not this.isClientSideSource() }
+    ActiveThreatModelSourceAsSource() {
+      not this.isClientSideSource() and
+      not this.(ThreatModelSource).getThreatModel() = "environment"
+    }
   }
 
-  private import IndirectCommandInjectionCustomizations
+  /**
+   * Environment variables as a source when the "environment" threat model is active.
+   */
+  private class EnvironmentVariableAsSource extends Source instanceof ThreatModelSource {
+    EnvironmentVariableAsSource() {
+      this.getThreatModel() = "environment" and
+      currentThreatModel("environment")
+    }
+
+    override string describe() { result = "environment variable" }
+  }
 
   /**
-   * A read of `process.env`, `process.argv`, and similar, considered as a flow source for regular
-   * expression injection.
+   * Command line arguments as a source for regular expression injection.
    */
-  class ArgvAsSource extends Source instanceof IndirectCommandInjection::Source {
-    override string describe() { result = IndirectCommandInjection::Source.super.describe() }
+  private class CommandLineArgumentAsSource extends Source instanceof CommandLineArguments {
+    override string describe() { result = "command-line argument" }
   }
 
   /**

javascript/ql/src/change-notes/2025-07-31-regexp-injection-threat-model.md

@@ -0,0 +1,4 @@
+---
+category: minorAnalysis
+---
+* The `js/regex-injection` query no longer considers environment variables as sources by default. Environment variables can be re-enabled as sources by setting the threat model to include the "environment" category.

javascript/ql/test/query-tests/Security/CWE-730/RegExpInjection.expected renamed to javascript/ql/test/query-tests/Security/CWE-730/Threat-models-disabled/RegExpInjection.expected

@@ -14,7 +14,6 @@
 | RegExpInjection.js:49:14:49:52 | key.spl ... in("-") | RegExpInjection.js:5:13:5:28 | req.param("key") | RegExpInjection.js:49:14:49:52 | key.spl ... in("-") | This regular expression is constructed from a $@. | RegExpInjection.js:5:13:5:28 | req.param("key") | user-provided value |
 | RegExpInjection.js:59:14:59:18 | input | RegExpInjection.js:55:39:55:56 | req.param("input") | RegExpInjection.js:59:14:59:18 | input | This regular expression is constructed from a $@. | RegExpInjection.js:55:39:55:56 | req.param("input") | user-provided value |
 | RegExpInjection.js:82:14:82:55 | "^.*\\.( ...  + ")$" | RegExpInjection.js:77:15:77:32 | req.param("input") | RegExpInjection.js:82:14:82:55 | "^.*\\.( ...  + ")$" | This regular expression is constructed from a $@. | RegExpInjection.js:77:15:77:32 | req.param("input") | user-provided value |
-| RegExpInjection.js:86:16:86:50 | `^${pro ... r.app$` | RegExpInjection.js:86:20:86:30 | process.env | RegExpInjection.js:86:16:86:50 | `^${pro ... r.app$` | This regular expression is constructed from a $@. | RegExpInjection.js:86:20:86:30 | process.env | environment variable |
 | RegExpInjection.js:88:16:88:49 | `^${pro ... r.app$` | RegExpInjection.js:88:20:88:31 | process.argv | RegExpInjection.js:88:16:88:49 | `^${pro ... r.app$` | This regular expression is constructed from a $@. | RegExpInjection.js:88:20:88:31 | process.argv | command-line argument |
 | RegExpInjection.js:95:14:95:22 | sanitized | RegExpInjection.js:92:15:92:32 | req.param("input") | RegExpInjection.js:95:14:95:22 | sanitized | This regular expression is constructed from a $@. | RegExpInjection.js:92:15:92:32 | req.param("input") | user-provided value |
 | tst.js:6:16:6:35 | "^"+ data.name + "$" | tst.js:5:16:5:29 | req.query.data | tst.js:6:16:6:35 | "^"+ data.name + "$" | This regular expression is constructed from a $@. | tst.js:5:16:5:29 | req.query.data | user-provided value |
@@ -57,7 +56,6 @@ edges
 | RegExpInjection.js:77:15:77:32 | req.param("input") | RegExpInjection.js:77:7:77:32 | input | provenance |  |
 | RegExpInjection.js:82:25:82:29 | input | RegExpInjection.js:82:25:82:48 | input.r ... g, "\|") | provenance |  |
 | RegExpInjection.js:82:25:82:48 | input.r ... g, "\|") | RegExpInjection.js:82:14:82:55 | "^.*\\.( ...  + ")$" | provenance |  |
-| RegExpInjection.js:86:20:86:30 | process.env | RegExpInjection.js:86:16:86:50 | `^${pro ... r.app$` | provenance |  |
 | RegExpInjection.js:88:20:88:31 | process.argv | RegExpInjection.js:88:16:88:49 | `^${pro ... r.app$` | provenance |  |
 | RegExpInjection.js:92:7:92:32 | input | RegExpInjection.js:94:19:94:23 | input | provenance |  |
 | RegExpInjection.js:92:15:92:32 | req.param("input") | RegExpInjection.js:92:7:92:32 | input | provenance |  |
@@ -109,8 +107,6 @@ nodes
 | RegExpInjection.js:82:14:82:55 | "^.*\\.( ...  + ")$" | semmle.label | "^.*\\.( ...  + ")$" |
 | RegExpInjection.js:82:25:82:29 | input | semmle.label | input |
 | RegExpInjection.js:82:25:82:48 | input.r ... g, "\|") | semmle.label | input.r ... g, "\|") |
-| RegExpInjection.js:86:16:86:50 | `^${pro ... r.app$` | semmle.label | `^${pro ... r.app$` |
-| RegExpInjection.js:86:20:86:30 | process.env | semmle.label | process.env |
 | RegExpInjection.js:88:16:88:49 | `^${pro ... r.app$` | semmle.label | `^${pro ... r.app$` |
 | RegExpInjection.js:88:20:88:31 | process.argv | semmle.label | process.argv |
 | RegExpInjection.js:92:7:92:32 | input | semmle.label | input |

javascript/ql/test/query-tests/Security/CWE-730/RegExpInjection.js renamed to javascript/ql/test/query-tests/Security/CWE-730/Threat-models-disabled/RegExpInjection.js

@@ -83,7 +83,7 @@ app.get('/has-sanitizer', function(req, res) {
 });
 
 app.get("argv", function(req, res) {
-    new RegExp(`^${process.env.HOME}/Foo/bar.app$`); // $ Alert[js/regex-injection]
+    new RegExp(`^${process.env.HOME}/Foo/bar.app$`); // environment variable, should be detected only with threat model enabled.
 
     new RegExp(`^${process.argv[1]}/Foo/bar.app$`); // $ Alert[js/regex-injection]
 });