JS: Port CommandInjection

asgerf · asgerf · commit 17233a67493f · 2023-10-13T13:15:03.000+02:00
diff --git a/javascript/ql/lib/semmle/javascript/security/dataflow/CommandInjectionQuery.qll b/javascript/ql/lib/semmle/javascript/security/dataflow/CommandInjectionQuery.qll
@@ -11,25 +11,41 @@ import javascript
 import CommandInjectionCustomizations::CommandInjection
 import IndirectCommandArgument
 
+/**
+ * Holds if `sink` is a data flow sink for command-injection vulnerabilities, and
+ * the alert should be placed at the node `highlight`.
+ */
+predicate isSinkWithHighlight(DataFlow::Node sink, DataFlow::Node highlight) {
+  sink instanceof Sink and highlight = sink
+  or
+  isIndirectCommandArgument(sink, highlight)
+}
+
 /**
  * A taint-tracking configuration for reasoning about command-injection vulnerabilities.
  */
-class Configuration extends TaintTracking::Configuration {
-  Configuration() { this = "CommandInjection" }
+module CommandInjectionConfig implements DataFlow::ConfigSig {
+  predicate isSource(DataFlow::Node source) { source instanceof Source }
+
+  predicate isSink(DataFlow::Node sink) { isSinkWithHighlight(sink, _) }
+
+  predicate isBarrier(DataFlow::Node node) { node instanceof Sanitizer }
+}
+
+/**
+ * Taint-tracking for reasoning about command-injection vulnerabilities.
+ */
+module CommandInjectionFlow = TaintTracking::Global<CommandInjectionConfig>;
 
-  override predicate isSource(DataFlow::Node source) { source instanceof Source }
+/**
+ * DEPRECATED. Use the `CommandInjectionFlow` module instead.
+ */
+deprecated class Configuration extends TaintTracking::Configuration {
+  Configuration() { this = "CommandInjection" }
 
-  /**
-   * Holds if `sink` is a data flow sink for command-injection vulnerabilities, and
-   * the alert should be placed at the node `highlight`.
-   */
-  predicate isSinkWithHighlight(DataFlow::Node sink, DataFlow::Node highlight) {
-    sink instanceof Sink and highlight = sink
-    or
-    isIndirectCommandArgument(sink, highlight)
-  }
+  override predicate isSource(DataFlow::Node source) { CommandInjectionConfig::isSource(source) }
 
-  override predicate isSink(DataFlow::Node sink) { this.isSinkWithHighlight(sink, _) }
+  override predicate isSink(DataFlow::Node sink) { CommandInjectionConfig::isSink(sink) }
 
-  override predicate isSanitizer(DataFlow::Node node) { node instanceof Sanitizer }
+  override predicate isSanitizer(DataFlow::Node node) { CommandInjectionConfig::isBarrier(node) }
 }
diff --git a/javascript/ql/src/Security/CWE-078/CommandInjection.ql b/javascript/ql/src/Security/CWE-078/CommandInjection.ql
@@ -15,16 +15,16 @@
 
 import javascript
 import semmle.javascript.security.dataflow.CommandInjectionQuery
-import DataFlow::PathGraph
+import CommandInjectionFlow::PathGraph
 
 from
-  Configuration cfg, DataFlow::PathNode source, DataFlow::PathNode sink, DataFlow::Node highlight,
-  Source sourceNode
+  CommandInjectionFlow::PathNode source, CommandInjectionFlow::PathNode sink,
+  DataFlow::Node highlight, Source sourceNode
 where
-  cfg.hasFlowPath(source, sink) and
+  CommandInjectionFlow::flowPath(source, sink) and
   (
-    if cfg.isSinkWithHighlight(sink.getNode(), _)
-    then cfg.isSinkWithHighlight(sink.getNode(), highlight)
+    if isSinkWithHighlight(sink.getNode(), _)
+    then isSinkWithHighlight(sink.getNode(), highlight)
     else highlight = sink.getNode()
   ) and
   sourceNode = source.getNode()
diff --git a/javascript/ql/test/query-tests/Security/CWE-078/CommandInjection/CommandInjection.expected b/javascript/ql/test/query-tests/Security/CWE-078/CommandInjection/CommandInjection.expected
