From c6448548a3d6f260b4bf6301a073b2749d03c912 Mon Sep 17 00:00:00 2001 From: Scott Talbot Date: Wed, 22 Jul 2026 17:42:39 +1000 Subject: [PATCH] JS: Recognize @fastify/rate-limit as a rate limiter --- .../javascript/security/dataflow/MissingRateLimiting.qll | 4 +++- .../ql/src/change-notes/2026-07-22-fastify-rate-limit.md | 4 ++++ .../CWE-770/MissingRateLimit/MissingRateLimiting.expected | 3 ++- .../query-tests/Security/CWE-770/MissingRateLimit/tst.js | 8 +++++++- 4 files changed, 16 insertions(+), 3 deletions(-) create mode 100644 javascript/ql/src/change-notes/2026-07-22-fastify-rate-limit.md diff --git a/javascript/ql/lib/semmle/javascript/security/dataflow/MissingRateLimiting.qll b/javascript/ql/lib/semmle/javascript/security/dataflow/MissingRateLimiting.qll index 8dd9c4831446..5cac49d6dd66 100644 --- a/javascript/ql/lib/semmle/javascript/security/dataflow/MissingRateLimiting.qll +++ b/javascript/ql/lib/semmle/javascript/security/dataflow/MissingRateLimiting.qll @@ -189,7 +189,9 @@ class RouteHandlerLimitedByRateLimiterFlexible extends RateLimitingMiddleware in { } private class FastifyRateLimiter extends RateLimitingMiddleware { - FastifyRateLimiter() { this = DataFlow::moduleImport("fastify-rate-limit") } + FastifyRateLimiter() { + this = DataFlow::moduleImport(["fastify-rate-limit", "@fastify/rate-limit"]) + } } /** diff --git a/javascript/ql/src/change-notes/2026-07-22-fastify-rate-limit.md b/javascript/ql/src/change-notes/2026-07-22-fastify-rate-limit.md new file mode 100644 index 000000000000..55e23b9dc111 --- /dev/null +++ b/javascript/ql/src/change-notes/2026-07-22-fastify-rate-limit.md @@ -0,0 +1,4 @@ +--- +category: minorAnalysis +--- +* The `js/missing-rate-limiting` query now recognizes the `@fastify/rate-limit` package as a rate limiter. diff --git a/javascript/ql/test/query-tests/Security/CWE-770/MissingRateLimit/MissingRateLimiting.expected b/javascript/ql/test/query-tests/Security/CWE-770/MissingRateLimit/MissingRateLimiting.expected index 8d197d6e37f6..5e2265f64b49 100644 --- a/javascript/ql/test/query-tests/Security/CWE-770/MissingRateLimit/MissingRateLimiting.expected +++ b/javascript/ql/test/query-tests/Security/CWE-770/MissingRateLimit/MissingRateLimiting.expected @@ -9,4 +9,5 @@ | tst.js:64:25:64:63 | functio ... req); } | This route handler performs $@, but is not rate-limited. | tst.js:64:46:64:60 | verifyUser(req) | authorization | | tst.js:76:25:76:53 | catchAs ... ndler1) | This route handler performs $@, but is not rate-limited. | tst.js:14:40:14:46 | login() | authorization | | tst.js:88:24:88:40 | expensiveHandler1 | This route handler performs $@, but is not rate-limited. | tst.js:14:40:14:46 | login() | authorization | -| tst.js:112:28:112:44 | expensiveHandler1 | This route handler performs $@, but is not rate-limited. | tst.js:14:40:14:46 | login() | authorization | +| tst.js:111:28:111:44 | expensiveHandler1 | This route handler performs $@, but is not rate-limited. | tst.js:14:40:14:46 | login() | authorization | +| tst.js:116:39:116:55 | expensiveHandler1 | This route handler performs $@, but is not rate-limited. | tst.js:14:40:14:46 | login() | authorization | diff --git a/javascript/ql/test/query-tests/Security/CWE-770/MissingRateLimit/tst.js b/javascript/ql/test/query-tests/Security/CWE-770/MissingRateLimit/tst.js index 5b4312bbbe0e..7ff0c067fb51 100644 --- a/javascript/ql/test/query-tests/Security/CWE-770/MissingRateLimit/tst.js +++ b/javascript/ql/test/query-tests/Security/CWE-770/MissingRateLimit/tst.js @@ -91,7 +91,6 @@ fastifyApp.get('/bar', expensiveHandler1); // Fastify per-route rate limiting via config.rateLimit const fastifyApp2 = require('fastify')(); -fastifyApp2.register(require('@fastify/rate-limit')); fastifyApp2.post('/login', { config: { @@ -110,3 +109,10 @@ fastifyApp2.post('/signup', { }, expensiveHandler1); // OK - has per-route rateLimit directly in options fastifyApp2.post('/other', expensiveHandler1); // $ Alert - no rate limiting + +// rate limiting using the scoped package name +const fastifyApp3 = require('fastify')(); + +fastifyApp3.get('/before-rate-limit', expensiveHandler1); // $ Alert +fastifyApp3.register(require('@fastify/rate-limit')); +fastifyApp3.get('/after-rate-limit', expensiveHandler1);