JS: Move js/log-injection into non-experimental.

[erik-krogh]

I added API-graphs to Logging.qll such that the manual property-tracking implemented in LogInjection.qll was no longer needed.

[asgerf]

Could you run an evaluation? I believe this is the first use of API::EntryPoint to be merged into main so it's worth checking.

[erik-krogh]

An evaluation on nightly for a few default queries looks fine.

And profilling just LogInjection.ql shows that performance is not completely terrible for the LogInjection query itself.

[erik-krogh]

@asgerf Can I get an approve?

[erik-krogh]

@mchammer01 can I get a doc review?
Mostly of the qhelp file that was moved out of experimental.

[mchammer01]

@erik-krogh - will try to look at this later today (I have urgent things to do for the GHES 30 docs ship first).

[mchammer01]

@erik-krogh - this LGTM 🙂 , I have a few comments on the qhelp file but because the file has been moved without any changes, I couldn't comment on the diff, so please find my comments below. As usual, feel free to ignore if you think some aren't relevant.

1. "If unsanitized user input is written to a log entry, a malicious user may be able to forge new log entries." seems a bit like a repetition of the query name that appears just above. I'd perhaps suggest removing it?

2. "If the log entries are plain text then line breaks should be removed from user input, using String.prototype.replace or similar. Care should also be taken that user input is clearly marked in log entries" - remove the "and that a malicious user cannot cause confusion in other ways.", I think it's implied, and it doesn't add anything new.

3. "If the log entries are plain text " -> "If the log entries are written in plain text" or "If the log entries are in plain text"

4. "For log entries that will be displayed in HTML, user input should be HTML-encoded before being logged, to prevent forgery and other forms of HTML injection." - add an hyphen between HTML and encoded.

5. "In the second case, the username is used to build an error", add a comma between "case" and "the username".

Hope this helps!

[erik-krogh]

Thanks for the review.
I've applied all the suggested changes except for 1..

Can I get a final approve @mchammer01 and @asgerf?

[mchammer01]

Thank you for the updates @erik-krogh ✨
LGTM from my point of view 👍🏻