Detecting sanitizers or guard types for all vulnerabilities

[Naman-ntc]

I am trying to study the kinds of sanitizers used in different languages (and implemented in CodeQL). Is there a way to list down all the sanitizer/barrier/sanitizer-guard/barrier-guard classes that are used for a vulnerability in an automated manner? We can discount the general sanitizers that are implemented in global files and only consider the specific ones implemented in customizations.
I can imagine something along the lines of doing regex matches in customization files but is there any other way someone can think of?

[RasmusWL]

Hi @Naman-ntc, sorry for the late reply, it seems this question got overlooked 😳

If I understand you correctly, you want an automated way to know that for example the Python query for SQL injection has a sanitizer guard for comparison with string constants?

Would be interesting to hear what you want to use that data for 😊

There are potential ways to extend the CodeQL query runs so that it can dump the QL class name of the available DataFlow::BarrierGuard for the available configurations, but that has the built-in limitation that there is a barrier-guard for a code-pattern that is not present in the DB, it will not be listed... so I would not recommend going down that route.

So besides manually looking through configuration specification, I would probably also have gone for some regexes 😅

[Naman-ntc]

Hi, thanks for responding. Yes, that is exactly what I want. We are studying javascript code security and felt enumerating different types of sanitizers for different vulnerabilities would be a good experiment.
I agree that dumping the sanitizers in the database is probably not the optimal way. For the regex approach - this can also lead to a few corner cases since some customizations/configurations (at least in javascript) further import sanitizers in other files as well.
But I guess, we can't do better than manually handling such cases?

[RasmusWL]

We have not designed our setup to support automatic discovery of what sanitizers are applied, so I think the only reliable way to this things is by manual inspection.