Due to some urgent travel I was not able to update the Week_8 report, this report summarize what I did in both week.
Any latest code will be found in this repository : GitHub - akshajrawat/plugins-test · GitHub
What I did :
Firstly, I focused on running the codeql rule test on all of the 30 plugins listed in Joplin Plugins website. The tests was done etirely locally so that I can dedicate all of my empty cpu cores to run the codeql rules which reduce the scanning time up to 60%.
27 out of 30 plugins passed with 0 findings. Following are the plugins that gave few findings :
The rules were updated respectively so that these plugins also do not give any result. With this the current set of rules if ran on the top 30 plugins will generate no noise.
Then I focused on the pr related to plugin-repo-cli and generator-joplin, updated the code tested them using a dedicated published test package which is a clone of updated plugin-repo-cli and raised 2 prs :
I will be updating the GitHub - joplin/plugins-test · GitHub repository with all of the code shortly since some changes are underway right now, after doing the necessary changes and make sure everything works, I'll update the repository.
The rules were updated respectively so that these plugins also do not give any result. With this the current set of rules if ran on the top 30 plugins will generate no noise.
Please provide a link to the rules that were added along with the tests.
Also there should have been a report on 31 July but there wasn't?
My college started last week so the only thing I did was the pr work, there was not much to add so I though I'll add 2 week report together, Im currently reviewing all the Ts and yaml code in : GitHub - joplin/plugins-test · GitHub, I'll give a report for both week tommorow.
For the update done for the rest of the 10 plugins, no test were updated, only few rules were made tighter and some built in rules were excluded :
Rule 07b – Hardcoded command execution : Previously, any hardcoded string passed to a command-execution sink could be reported. It now ignores: Command-line flags and Common utilities such as git, cp, mv, tar, zip, rsync, pandoc, and ffmpeg.
Rule 18 – Mass data destruction : It now suppresses the finding when the same function contains an explicit Joplin confirmation dialog using joplin.views.dialogs.open().
Rule 19 – Keylogging and surveillance : Generic UI message handlers are no longer treated as keylogging sources, like onMessage
note : Rule 18 & Rule 19 still need little more update to make them more precise on what it should flag, I'll be updating them next
The test were done locally so I added all 30 plugin in the regression test once and ran them : test: top 30 plugins · joplin/plugins-test@5ace573 · GitHub
Everything passed. The one error which is there is due to joplin-plugin-toggle-sidebars being inside the joplin/ repository, which would need a little extra peice of code to run it, though since all of the 20 plugin in the regression test is individually built I did not add that code there.
Though this commit is outdated now, I updated rules and tests and tightened and fixed them a little more in the last 2 weeks, these are the lastest commits where I did those changes :
