Thanks to visit codestin.com
Credit goes to github.com

Skip to content

Commit 060c19a

Browse files
codeql-cicodeql-ci
authored
Merge pull request #4352 from erik-krogh/destructing-redirect
Approved by esbena
2 parents 8a76195 + 664342d commit 060c19a

3 files changed

Lines changed: 23 additions & 6 deletions

File tree

‎javascript/ql/src/semmle/javascript/frameworks/Express.qll‎

Lines changed: 6 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -195,7 +195,7 @@ module Express {
195195

196196
PassportRouteHandler() { this = any(PassportRouteSetup setup).getARouteHandler() }
197197

198-
override SimpleParameter getRouteHandlerParameter(string kind) {
198+
override Parameter getRouteHandlerParameter(string kind) {
199199
kind = "request" and
200200
result = astNode.getParameter(0)
201201
}
@@ -329,17 +329,17 @@ module Express {
329329
*
330330
* `kind` is one of: "error", "request", "response", "next", or "parameter".
331331
*/
332-
abstract SimpleParameter getRouteHandlerParameter(string kind);
332+
abstract Parameter getRouteHandlerParameter(string kind);
333333

334334
/**
335335
* Gets the parameter of the route handler that contains the request object.
336336
*/
337-
SimpleParameter getRequestParameter() { result = getRouteHandlerParameter("request") }
337+
Parameter getRequestParameter() { result = getRouteHandlerParameter("request") }
338338

339339
/**
340340
* Gets the parameter of the route handler that contains the response object.
341341
*/
342-
SimpleParameter getResponseParameter() { result = getRouteHandlerParameter("response") }
342+
Parameter getResponseParameter() { result = getRouteHandlerParameter("response") }
343343

344344
/**
345345
* Gets a request body access of this handler.
@@ -357,7 +357,7 @@ module Express {
357357

358358
StandardRouteHandler() { this = routeSetup.getARouteHandler() }
359359

360-
override SimpleParameter getRouteHandlerParameter(string kind) {
360+
override Parameter getRouteHandlerParameter(string kind) {
361361
if routeSetup.isParameterHandler()
362362
then result = getRouteParameterHandlerParameter(astNode, kind)
363363
else result = getRouteHandlerParameter(astNode, kind)
@@ -890,7 +890,7 @@ module Express {
890890

891891
TrackedRouteHandlerCandidateWithSetup() { this = routeSetup.getARouteHandler() }
892892

893-
override SimpleParameter getRouteHandlerParameter(string kind) {
893+
override Parameter getRouteHandlerParameter(string kind) {
894894
if routeSetup.isParameterHandler()
895895
then result = getRouteParameterHandlerParameter(astNode, kind)
896896
else result = getRouteHandlerParameter(astNode, kind)

‎javascript/ql/test/query-tests/Security/CWE-601/ServerSideUrlRedirect/ServerSideUrlRedirect.expected‎

Lines changed: 10 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -44,6 +44,12 @@ nodes
4444
| express.js:136:16:136:36 | 'u' + r ... ms.user |
4545
| express.js:136:22:136:36 | req.params.user |
4646
| express.js:136:22:136:36 | req.params.user |
47+
| express.js:143:16:143:28 | req.query.foo |
48+
| express.js:143:16:143:28 | req.query.foo |
49+
| express.js:143:16:143:28 | req.query.foo |
50+
| express.js:146:16:146:24 | query.foo |
51+
| express.js:146:16:146:24 | query.foo |
52+
| express.js:146:16:146:24 | query.foo |
4753
| koa.js:6:6:6:27 | url |
4854
| koa.js:6:12:6:27 | ctx.query.target |
4955
| koa.js:6:12:6:27 | ctx.query.target |
@@ -128,6 +134,8 @@ edges
128134
| express.js:136:22:136:36 | req.params.user | express.js:136:16:136:36 | 'u' + r ... ms.user |
129135
| express.js:136:22:136:36 | req.params.user | express.js:136:16:136:36 | 'u' + r ... ms.user |
130136
| express.js:136:22:136:36 | req.params.user | express.js:136:16:136:36 | 'u' + r ... ms.user |
137+
| express.js:143:16:143:28 | req.query.foo | express.js:143:16:143:28 | req.query.foo |
138+
| express.js:146:16:146:24 | query.foo | express.js:146:16:146:24 | query.foo |
131139
| koa.js:6:6:6:27 | url | koa.js:7:15:7:17 | url |
132140
| koa.js:6:6:6:27 | url | koa.js:7:15:7:17 | url |
133141
| koa.js:6:6:6:27 | url | koa.js:8:18:8:20 | url |
@@ -181,6 +189,8 @@ edges
181189
| express.js:134:16:134:36 | '/' + r ... ms.user | express.js:134:22:134:36 | req.params.user | express.js:134:16:134:36 | '/' + r ... ms.user | Untrusted URL redirection due to $@. | express.js:134:22:134:36 | req.params.user | user-provided value |
182190
| express.js:135:16:135:37 | '//' + ... ms.user | express.js:135:23:135:37 | req.params.user | express.js:135:16:135:37 | '//' + ... ms.user | Untrusted URL redirection due to $@. | express.js:135:23:135:37 | req.params.user | user-provided value |
183191
| express.js:136:16:136:36 | 'u' + r ... ms.user | express.js:136:22:136:36 | req.params.user | express.js:136:16:136:36 | 'u' + r ... ms.user | Untrusted URL redirection due to $@. | express.js:136:22:136:36 | req.params.user | user-provided value |
192+
| express.js:143:16:143:28 | req.query.foo | express.js:143:16:143:28 | req.query.foo | express.js:143:16:143:28 | req.query.foo | Untrusted URL redirection due to $@. | express.js:143:16:143:28 | req.query.foo | user-provided value |
193+
| express.js:146:16:146:24 | query.foo | express.js:146:16:146:24 | query.foo | express.js:146:16:146:24 | query.foo | Untrusted URL redirection due to $@. | express.js:146:16:146:24 | query.foo | user-provided value |
184194
| koa.js:7:15:7:17 | url | koa.js:6:12:6:27 | ctx.query.target | koa.js:7:15:7:17 | url | Untrusted URL redirection due to $@. | koa.js:6:12:6:27 | ctx.query.target | user-provided value |
185195
| koa.js:8:15:8:26 | `${url}${x}` | koa.js:6:12:6:27 | ctx.query.target | koa.js:8:15:8:26 | `${url}${x}` | Untrusted URL redirection due to $@. | koa.js:6:12:6:27 | ctx.query.target | user-provided value |
186196
| koa.js:14:16:14:18 | url | koa.js:6:12:6:27 | ctx.query.target | koa.js:14:16:14:18 | url | Untrusted URL redirection due to $@. | koa.js:6:12:6:27 | ctx.query.target | user-provided value |

‎javascript/ql/test/query-tests/Security/CWE-601/ServerSideUrlRedirect/express.js‎

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -138,3 +138,10 @@ app.get('/redirect/:user', function(req, res) {
138138
res.redirect('/' + ('/u' + req.params.user)); // BAD - could go to //u.evil.com, but not flagged [INCONSISTENCY]
139139
res.redirect('/u' + req.params.user); // GOOD
140140
});
141+
142+
app.get("foo", (req, res) => {
143+
res.redirect(req.query.foo); // NOT OK
144+
});
145+
app.get("bar", ({query}, res) => {
146+
res.redirect(query.foo); // NOT OK
147+
})

0 commit comments

Comments
 (0)