Thanks to visit codestin.com
Credit goes to github.com

Skip to content

Commit 2062afc

Browse files
erik-krogherik-krogh
committed
add calls to parseDN as sinks for ldap-injection
1 parent d4de5e3 commit 2062afc

3 files changed

Lines changed: 12 additions & 0 deletions

File tree

‎javascript/ql/lib/semmle/javascript/security/dataflow/SqlInjectionCustomizations.qll‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -52,6 +52,9 @@ module SqlInjection {
5252
or
5353
// A search options object, which contains a filter and a baseDN.
5454
this = any(LDAPjs::SearchOptions opt).getARhs()
55+
or
56+
// A call to "parseDN", which parses a DN from a string.
57+
this = LDAPjs::ldapjs().getMember("parseDN").getACall().getArgument(0)
5558
}
5659
}
5760

‎javascript/ql/test/query-tests/Security/CWE-089/untyped/SqlInjection.expected‎

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -94,6 +94,9 @@ nodes
9494
| ldap.js:66:30:66:53 | { filte ... ilter } |
9595
| ldap.js:66:30:66:53 | { filte ... ilter } |
9696
| ldap.js:66:40:66:51 | parsedFilter |
97+
| ldap.js:68:27:68:42 | `cn=${username}` |
98+
| ldap.js:68:27:68:42 | `cn=${username}` |
99+
| ldap.js:68:33:68:40 | username |
97100
| marsdb-flow-to.js:10:9:10:18 | query |
98101
| marsdb-flow-to.js:10:17:10:18 | {} |
99102
| marsdb-flow-to.js:11:17:11:24 | req.body |
@@ -480,6 +483,7 @@ edges
480483
| ldap.js:22:7:22:33 | username | ldap.js:32:48:32:55 | username |
481484
| ldap.js:22:7:22:33 | username | ldap.js:64:16:64:23 | username |
482485
| ldap.js:22:7:22:33 | username | ldap.js:64:38:64:45 | username |
486+
| ldap.js:22:7:22:33 | username | ldap.js:68:33:68:40 | username |
483487
| ldap.js:22:18:22:18 | q | ldap.js:22:18:22:24 | q.query |
484488
| ldap.js:22:18:22:24 | q.query | ldap.js:22:18:22:33 | q.query.username |
485489
| ldap.js:22:18:22:33 | q.query.username | ldap.js:22:7:22:33 | username |
@@ -498,6 +502,8 @@ edges
498502
| ldap.js:64:38:64:45 | username | ldap.js:64:5:64:49 | `(\|(nam ... ame}))` |
499503
| ldap.js:66:40:66:51 | parsedFilter | ldap.js:66:30:66:53 | { filte ... ilter } |
500504
| ldap.js:66:40:66:51 | parsedFilter | ldap.js:66:30:66:53 | { filte ... ilter } |
505+
| ldap.js:68:33:68:40 | username | ldap.js:68:27:68:42 | `cn=${username}` |
506+
| ldap.js:68:33:68:40 | username | ldap.js:68:27:68:42 | `cn=${username}` |
501507
| marsdb-flow-to.js:10:9:10:18 | query | marsdb-flow-to.js:14:17:14:21 | query |
502508
| marsdb-flow-to.js:10:9:10:18 | query | marsdb-flow-to.js:14:17:14:21 | query |
503509
| marsdb-flow-to.js:10:17:10:18 | {} | marsdb-flow-to.js:10:9:10:18 | query |
@@ -909,6 +915,7 @@ edges
909915
| ldap.js:28:30:28:34 | opts1 | ldap.js:20:21:20:27 | req.url | ldap.js:28:30:28:34 | opts1 | This query depends on $@. | ldap.js:20:21:20:27 | req.url | a user-provided value |
910916
| ldap.js:32:5:32:61 | { filte ... e}))` } | ldap.js:20:21:20:27 | req.url | ldap.js:32:5:32:61 | { filte ... e}))` } | This query depends on $@. | ldap.js:20:21:20:27 | req.url | a user-provided value |
911917
| ldap.js:66:30:66:53 | { filte ... ilter } | ldap.js:20:21:20:27 | req.url | ldap.js:66:30:66:53 | { filte ... ilter } | This query depends on $@. | ldap.js:20:21:20:27 | req.url | a user-provided value |
918+
| ldap.js:68:27:68:42 | `cn=${username}` | ldap.js:20:21:20:27 | req.url | ldap.js:68:27:68:42 | `cn=${username}` | This query depends on $@. | ldap.js:20:21:20:27 | req.url | a user-provided value |
912919
| marsdb-flow-to.js:14:17:14:21 | query | marsdb-flow-to.js:11:17:11:24 | req.body | marsdb-flow-to.js:14:17:14:21 | query | This query depends on $@. | marsdb-flow-to.js:11:17:11:24 | req.body | a user-provided value |
913920
| marsdb.js:16:12:16:16 | query | marsdb.js:13:17:13:24 | req.body | marsdb.js:16:12:16:16 | query | This query depends on $@. | marsdb.js:13:17:13:24 | req.body | a user-provided value |
914921
| minimongo.js:18:12:18:16 | query | minimongo.js:15:17:15:24 | req.body | minimongo.js:18:12:18:16 | query | This query depends on $@. | minimongo.js:15:17:15:24 | req.body | a user-provided value |

‎javascript/ql/test/query-tests/Security/CWE-089/untyped/ldap.js‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -64,6 +64,8 @@ const server = http.createServer((req, res) => {
6464
`(|(name=${username})(username=${username}))`
6565
);
6666
client.search("o=example", { filter: parsedFilter }, function (err, res) {}); // NOT OK
67+
68+
const dn = ldap.parseDN(`cn=${username}`, function (err, dn) {}); // NOT OK
6769
});
6870

6971
server.listen(389, () => {});

0 commit comments

Comments
 (0)