Skip to content

Commit 03c5ad0

Browse files
oetroetr
committed
feat(code-injection): add stack suppressions
Let users disable or ignore expected canary access and invocation findings using the shown-stack suppression rules.
1 parent 9a4e67c commit 03c5ad0

8 files changed

Lines changed: 378 additions & 12 deletions

File tree

‎packages/bug-detectors/internal/code-injection.ts‎

Lines changed: 128 additions & 12 deletions
Original file line numberDiff line numberDiff line change
@@ -25,13 +25,91 @@ import {
2525
} from "@jazzer.js/core";
2626
import { registerBeforeHook } from "@jazzer.js/hooking";
2727

28+
import { bugDetectorConfigurations } from "../configuration";
2829
import { ensureCanary } from "../shared/code-injection-canary";
30+
import {
31+
buildGenericSuppressionSnippet,
32+
captureStack,
33+
getUserFacingStackLines,
34+
IgnoreList,
35+
type IgnoreRule,
36+
} from "../shared/finding-suppression";
37+
38+
export type { IgnoreRule } from "../shared/finding-suppression";
2939

3040
type PendingAccess = {
3141
canaryName: string;
42+
stack: string;
3243
invoked: boolean;
3344
};
3445

46+
/**
47+
* Configuration for the Code Injection bug detector.
48+
* Controls the reporting and suppression of dynamic code evaluation findings.
49+
*/
50+
export interface CodeInjectionConfig {
51+
/**
52+
* Disables Stage 1 (Access) reporting entirely.
53+
* The detector will no longer report when the canary is merely read.
54+
*/
55+
disableAccessReporting(): this;
56+
/**
57+
* Disables Stage 2 (Invocation) reporting entirely.
58+
* The detector will no longer report when the canary is actually executed.
59+
*/
60+
disableInvocationReporting(): this;
61+
/**
62+
* Suppresses Stage 1 (Access) findings that match the provided rule.
63+
* Use this to silence safe heuristic reads such as template lookups.
64+
*/
65+
ignoreAccess(rule: IgnoreRule): this;
66+
/**
67+
* Suppresses Stage 2 (Invocation) findings that match the provided rule.
68+
* Use this only for known-safe execution sinks in test environments.
69+
*/
70+
ignoreInvocation(rule: IgnoreRule): this;
71+
}
72+
73+
class CodeInjectionConfigImpl implements CodeInjectionConfig {
74+
private _reportAccess = true;
75+
private _reportInvocation = true;
76+
private readonly _ignoredAccessRules = new IgnoreList();
77+
private readonly _ignoredInvocationRules = new IgnoreList();
78+
79+
disableAccessReporting(): this {
80+
this._reportAccess = false;
81+
return this;
82+
}
83+
84+
disableInvocationReporting(): this {
85+
this._reportInvocation = false;
86+
return this;
87+
}
88+
89+
ignoreAccess(rule: IgnoreRule): this {
90+
this._ignoredAccessRules.add(rule);
91+
return this;
92+
}
93+
94+
ignoreInvocation(rule: IgnoreRule): this {
95+
this._ignoredInvocationRules.add(rule);
96+
return this;
97+
}
98+
99+
shouldReportAccess(stack: string): boolean {
100+
return this._reportAccess && !this._ignoredAccessRules.matches(stack);
101+
}
102+
103+
shouldReportInvocation(stack: string): boolean {
104+
return (
105+
this._reportInvocation && !this._ignoredInvocationRules.matches(stack)
106+
);
107+
}
108+
}
109+
110+
const config = new CodeInjectionConfigImpl();
111+
bugDetectorConfigurations.set("code-injection", config);
112+
35113
const canaryCache = new WeakMap<object, string>();
36114
const pendingAccesses: PendingAccess[] = [];
37115

@@ -103,18 +181,35 @@ function ensureActiveCanary(): string {
103181
function createCanaryDescriptor(canaryName: string): PropertyDescriptor {
104182
return {
105183
get() {
106-
const pendingAccess = { canaryName, invoked: false };
107-
pendingAccesses.push(pendingAccess);
184+
const accessStack = captureStack();
185+
const pendingAccess = config.shouldReportAccess(accessStack)
186+
? {
187+
canaryName,
188+
stack: accessStack,
189+
invoked: false,
190+
}
191+
: undefined;
192+
if (pendingAccess) {
193+
pendingAccesses.push(pendingAccess);
194+
}
108195

109196
return function canaryCall() {
110-
pendingAccess.invoked = true;
111-
reportAndThrowFinding(
112-
buildFindingMessage(
113-
"Confirmed Code Injection (Canary Invoked)",
114-
`invoked canary: ${canaryName}`,
115-
),
116-
false,
117-
);
197+
const invocationStack = captureStack();
198+
if (config.shouldReportInvocation(invocationStack)) {
199+
if (pendingAccess) {
200+
pendingAccess.invoked = true;
201+
}
202+
reportAndThrowFinding(
203+
buildFindingMessage(
204+
"Confirmed Code Injection (Canary Invoked)",
205+
`invoked canary: ${canaryName}`,
206+
invocationStack,
207+
"ignoreInvocation",
208+
"If this execution sink is expected in your test environment, suppress it:",
209+
),
210+
false,
211+
);
212+
}
118213
};
119214
},
120215
enumerable: false,
@@ -131,12 +226,33 @@ function flushPendingAccesses(): void {
131226
buildFindingMessage(
132227
"Potential Code Injection (Canary Accessed)",
133228
`accessed canary: ${pendingAccess.canaryName}`,
229+
pendingAccess.stack,
230+
"ignoreAccess",
231+
"If this is a safe heuristic read, suppress it to continue fuzzing for code execution. Add this to your custom hooks:",
134232
),
135233
false,
136234
);
137235
}
138236
}
139237

140-
function buildFindingMessage(title: string, action: string): string {
141-
return `${title} -- ${action}`;
238+
function buildFindingMessage(
239+
title: string,
240+
action: string,
241+
stack: string,
242+
suppressionMethod: "ignoreAccess" | "ignoreInvocation",
243+
hint: string,
244+
): string {
245+
const relevantStackLines = getUserFacingStackLines(stack);
246+
const message = [`${title} -- ${action}`];
247+
if (relevantStackLines.length > 0) {
248+
message.push(...relevantStackLines);
249+
}
250+
message.push(
251+
"",
252+
`[!] ${hint}`,
253+
" Example only: copy/paste it and adapt `stackPattern` to your needs.",
254+
"",
255+
buildGenericSuppressionSnippet("code-injection", suppressionMethod),
256+
);
257+
return message.join("\n");
142258
}

‎tests/bug-detectors/code-injection.test.js‎

Lines changed: 114 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -93,6 +93,93 @@ describe("CLI", () => {
9393
});
9494
}
9595

96+
it("prints a generic access suppression example", () => {
97+
const fuzzTest = fuzzTestBuilder
98+
.fuzzEntryPoint("heuristicReadAccessesCanary")
99+
.build();
100+
expect(() => {
101+
fuzzTest.execute();
102+
}).toThrow(FuzzingExitCode);
103+
expect(fuzzTest.stderr).toContain(
104+
'getBugDetectorConfiguration("code-injection")',
105+
);
106+
expect(fuzzTest.stderr).toContain(
107+
"Example only: copy/paste it and adapt `stackPattern` to your needs.",
108+
);
109+
expect(fuzzTest.stderr).toContain(
110+
"// Example only: adapt `stackPattern` to the shown stack above.",
111+
);
112+
expect(fuzzTest.stderr).toContain("?.ignoreAccess({");
113+
expect(fuzzTest.stderr).toContain('stackPattern: "test.js:10"');
114+
});
115+
116+
it("reports confirmed invocation when access reporting is disabled", () => {
117+
const fuzzTest = fuzzTestBuilder
118+
.fuzzEntryPoint("evalAccessesCanary")
119+
.customHooks(["disable-access.config.js"])
120+
.build();
121+
expect(() => {
122+
fuzzTest.execute();
123+
}).toThrow(FuzzingExitCode);
124+
expect(fuzzTest.stderr).toContain(invocationFindingMessage);
125+
expect(fuzzTest.stderr).toContain("?.ignoreInvocation({");
126+
});
127+
128+
it("falls back to potential access when invocation reporting is disabled", () => {
129+
const fuzzTest = fuzzTestBuilder
130+
.fuzzEntryPoint("evalAccessesCanary")
131+
.customHooks(["disable-invocation.config.js"])
132+
.build();
133+
expect(() => {
134+
fuzzTest.execute();
135+
}).toThrow(FuzzingExitCode);
136+
expect(fuzzTest.stderr).toContain(accessFindingMessage);
137+
expect(fuzzTest.stderr).not.toContain(invocationFindingMessage);
138+
});
139+
140+
it("suppresses heuristic access when a stack pattern matches", () => {
141+
const fuzzTest = fuzzTestBuilder
142+
.fuzzEntryPoint("heuristicReadAccessesCanary")
143+
.customHooks(["ignore-heuristic-access.config.js"])
144+
.build()
145+
.execute();
146+
expect(fuzzTest.stdout).toContain(okMessage);
147+
expect(fuzzTest.stderr).not.toContain(accessFindingMessage);
148+
});
149+
150+
it("reaches invocation reporting when access is ignored by stack pattern", () => {
151+
const fuzzTest = fuzzTestBuilder
152+
.fuzzEntryPoint("evalAccessesCanary")
153+
.customHooks(["ignore-access-by-stack.config.js"])
154+
.build();
155+
expect(() => {
156+
fuzzTest.execute();
157+
}).toThrow(FuzzingExitCode);
158+
expect(fuzzTest.stderr).toContain(invocationFindingMessage);
159+
});
160+
161+
it("falls back to potential access when invocation is ignored", () => {
162+
const fuzzTest = fuzzTestBuilder
163+
.fuzzEntryPoint("evalAccessesCanary")
164+
.customHooks(["ignore-invocation-only.config.js"])
165+
.build();
166+
expect(() => {
167+
fuzzTest.execute();
168+
}).toThrow(FuzzingExitCode);
169+
expect(fuzzTest.stderr).toContain(accessFindingMessage);
170+
expect(fuzzTest.stderr).not.toContain(invocationFindingMessage);
171+
});
172+
173+
it("suppresses invocation when the invocation rule matches", () => {
174+
const fuzzTest = fuzzTestBuilder
175+
.fuzzEntryPoint("evalAccessesCanary")
176+
.customHooks(["ignore-invocation.config.js"])
177+
.build();
178+
fuzzTest.execute();
179+
expect(fuzzTest.stderr).not.toContain(accessFindingMessage);
180+
expect(fuzzTest.stderr).not.toContain(invocationFindingMessage);
181+
});
182+
96183
it("Function.prototype should still exist", () => {
97184
const fuzzTest = fuzzTestBuilder
98185
.dryRun(false)
@@ -159,6 +246,33 @@ describe("Jest", () => {
159246
expect(fuzzTest.stderr).not.toContain(accessFindingMessage);
160247
});
161248

249+
it("reports confirmed invocation when access reporting is disabled", () => {
250+
const fuzzTest = fuzzTestBuilder
251+
.dryRun(false)
252+
.jestTestFile("tests.fuzz.js")
253+
.jestTestName("eval Accesses canary$")
254+
.customHooks(["disable-access.config.js"])
255+
.build();
256+
expect(() => {
257+
fuzzTest.execute();
258+
}).toThrow(JestRegressionExitCode);
259+
expect(fuzzTest.stderr).toContain(invocationFindingMessage);
260+
});
261+
262+
it("falls back to potential access when invocation reporting is disabled", () => {
263+
const fuzzTest = fuzzTestBuilder
264+
.dryRun(false)
265+
.jestTestFile("tests.fuzz.js")
266+
.jestTestName("eval Accesses canary$")
267+
.customHooks(["disable-invocation.config.js"])
268+
.build();
269+
expect(() => {
270+
fuzzTest.execute();
271+
}).toThrow(JestRegressionExitCode);
272+
expect(fuzzTest.stderr).toContain(accessFindingMessage);
273+
expect(fuzzTest.stderr).not.toContain(invocationFindingMessage);
274+
});
275+
162276
it("safe code stays quiet", () => {
163277
const fuzzTest = fuzzTestBuilder
164278
.dryRun(false)

‎tests/bug-detectors/code-injection/disable-access.config.js‎

Lines changed: 21 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,21 @@
1+
/*
2+
* Copyright 2026 Code Intelligence GmbH
3+
*
4+
* Licensed under the Apache License, Version 2.0 (the "License");
5+
* you may not use this file except in compliance with the License.
6+
* You may obtain a copy of the License at
7+
*
8+
* http://www.apache.org/licenses/LICENSE-2.0
9+
*
10+
* Unless required by applicable law or agreed to in writing, software
11+
* distributed under the License is distributed on an "AS IS" BASIS,
12+
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
13+
* See the License for the specific language governing permissions and
14+
* limitations under the License.
15+
*/
16+
17+
const {
18+
getBugDetectorConfiguration,
19+
} = require("../../../packages/bug-detectors");
20+
21+
getBugDetectorConfiguration("code-injection")?.disableAccessReporting();

‎tests/bug-detectors/code-injection/disable-invocation.config.js‎

Lines changed: 21 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,21 @@
1+
/*
2+
* Copyright 2026 Code Intelligence GmbH
3+
*
4+
* Licensed under the Apache License, Version 2.0 (the "License");
5+
* you may not use this file except in compliance with the License.
6+
* You may obtain a copy of the License at
7+
*
8+
* http://www.apache.org/licenses/LICENSE-2.0
9+
*
10+
* Unless required by applicable law or agreed to in writing, software
11+
* distributed under the License is distributed on an "AS IS" BASIS,
12+
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
13+
* See the License for the specific language governing permissions and
14+
* limitations under the License.
15+
*/
16+
17+
const {
18+
getBugDetectorConfiguration,
19+
} = require("../../../packages/bug-detectors");
20+
21+
getBugDetectorConfiguration("code-injection")?.disableInvocationReporting();

‎tests/bug-detectors/code-injection/ignore-access-by-stack.config.js‎

Lines changed: 23 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,23 @@
1+
/*
2+
* Copyright 2026 Code Intelligence GmbH
3+
*
4+
* Licensed under the Apache License, Version 2.0 (the "License");
5+
* you may not use this file except in compliance with the License.
6+
* You may obtain a copy of the License at
7+
*
8+
* http://www.apache.org/licenses/LICENSE-2.0
9+
*
10+
* Unless required by applicable law or agreed to in writing, software
11+
* distributed under the License is distributed on an "AS IS" BASIS,
12+
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
13+
* See the License for the specific language governing permissions and
14+
* limitations under the License.
15+
*/
16+
17+
const {
18+
getBugDetectorConfiguration,
19+
} = require("../../../packages/bug-detectors");
20+
21+
getBugDetectorConfiguration("code-injection")?.ignoreAccess({
22+
stackPattern: "evalAccessesCanary",
23+
});

‎tests/bug-detectors/code-injection/ignore-heuristic-access.config.js‎

Lines changed: 23 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,23 @@
1+
/*
2+
* Copyright 2026 Code Intelligence GmbH
3+
*
4+
* Licensed under the Apache License, Version 2.0 (the "License");
5+
* you may not use this file except in compliance with the License.
6+
* You may obtain a copy of the License at
7+
*
8+
* http://www.apache.org/licenses/LICENSE-2.0
9+
*
10+
* Unless required by applicable law or agreed to in writing, software
11+
* distributed under the License is distributed on an "AS IS" BASIS,
12+
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
13+
* See the License for the specific language governing permissions and
14+
* limitations under the License.
15+
*/
16+
17+
const {
18+
getBugDetectorConfiguration,
19+
} = require("../../../packages/bug-detectors");
20+
21+
getBugDetectorConfiguration("code-injection")?.ignoreAccess({
22+
stackPattern: "heuristicReadAccessesCanary",
23+
});

0 commit comments

Comments
 (0)