Deep Learning Adds New Code Scanning Detections for JS/TS
GitHub has opened a public beta for an experimental, machine learning–powered analysis capability in code scanning. It targets JavaScript and TypeScript repositories on GitHub.com and is designed to surface additional alerts for four vulnerability classes: cross-site scripting (XSS), path injection, NoSQL injection, and SQL injection. Those categories account for a substantial share of recent CVEs in the JavaScript/TypeScript ecosystem, so catching them earlier in the development cycle is a priority.
Code scanning itself is built on the CodeQL engine. Developers enable it by running queries against a codebase. The open source queries are maintain curated by GitHub security researchers and community contributors, and each is designed for broad coverage of a particular vulnerability type, including support for common CWE entries. These queries are constantly updated to include newly popular libraries and frameworks, which helps accurately trace flows of untrusted user data that typically lead to vulnerabilities.
The open source ecosystem, however, has a long tail of less widely used libraries. GitHub trained deep learning models using detection results from the hand-written CodeQL queries. These models now recognize that long tail, along with closed-source, internally developed libraries. The trained system lets CodeQL identify additional flows of untrusted user data and, by extension, more potential vulnerabilities.
Enabling the Experimental Analysis
The experimental JS/TS analysis is already available to any user running code scanning’s security-extended or security-and-quality analysis suites. Repositories already configured with either suite will automatically use the new ML analysis on their next scan. Teams on a different suite can switch by editing the code scanning workflow configuration:
[...]
- uses: github/codeql-action/init@v1
with:
queries: +security-extended
[...]
For repositories not yet set up with code scanning, the standard setup process includes the option to select either the security-extended or security-and-quality suite.
Where Alerts Show Up
Results produced by the experimental analysis appear alongside usual code scanning alerts in the repository’s Security tab and in pull requests. Alerts from the new model carry an "Experimental" label so they are easy to distinguish.
One caveat: because the analysis is based on machine learning models that are still being tested and refined, it may produce a higher rate of false positives than standard CodeQL analysis. GitHub expects the results to improve over time and solicits feedback from users to drive further iteration on the models.
