Thanks to visit codestin.com
Credit goes to github.com

Skip to content

Commit 25962a9

Browse files
asgerfasgerf
committed
JS: Port TemplateObjectInjection
1 parent 51624c0 commit 25962a9

3 files changed

Lines changed: 81 additions & 83 deletions

File tree

‎javascript/ql/lib/semmle/javascript/security/dataflow/TemplateObjectInjectionQuery.qll‎

Lines changed: 40 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -14,7 +14,46 @@ private import semmle.javascript.security.TaintedObject
1414
/**
1515
* A taint tracking configuration for reasoning about template object injection vulnerabilities.
1616
*/
17-
class TemplateObjInjectionConfig extends TaintTracking::Configuration {
17+
module TemplateObjectInjectionConfig implements DataFlow::StateConfigSig {
18+
class FlowState = DataFlow::FlowLabel;
19+
20+
predicate isSource(DataFlow::Node source, DataFlow::FlowLabel label) {
21+
source.(Source).getAFlowLabel() = label
22+
}
23+
24+
predicate isSink(DataFlow::Node sink, DataFlow::FlowLabel label) {
25+
sink instanceof Sink and label = TaintedObject::label()
26+
}
27+
28+
predicate isBarrier(DataFlow::Node node) { node instanceof Sanitizer }
29+
30+
predicate isBarrier(DataFlow::Node node, DataFlow::FlowLabel label) {
31+
TaintTracking::defaultSanitizer(node) and
32+
label.isTaint()
33+
or
34+
node = TaintedObject::SanitizerGuard::getABarrierNode(label)
35+
}
36+
37+
predicate isAdditionalFlowStep(
38+
DataFlow::Node src, DataFlow::FlowLabel inlbl, DataFlow::Node trg, DataFlow::FlowLabel outlbl
39+
) {
40+
TaintedObject::step(src, trg, inlbl, outlbl)
41+
or
42+
inlbl.isTaint() and
43+
TaintTracking::defaultTaintStep(src, trg) and
44+
inlbl = outlbl
45+
}
46+
}
47+
48+
/**
49+
* Taint tracking for reasoning about template object injection vulnerabilities.
50+
*/
51+
module TemplateObjectInjectionFlow = DataFlow::GlobalWithState<TemplateObjectInjectionConfig>;
52+
53+
/**
54+
* DEPRECATED. Use the `TemplateObjectInjectionFlow` module instead.
55+
*/
56+
deprecated class TemplateObjInjectionConfig extends TaintTracking::Configuration {
1857
TemplateObjInjectionConfig() { this = "TemplateObjInjectionConfig" }
1958

2059
override predicate isSource(DataFlow::Node source, DataFlow::FlowLabel label) {

‎javascript/ql/src/Security/CWE-073/TemplateObjectInjection.ql‎

Lines changed: 4 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -12,10 +12,11 @@
1212
*/
1313

1414
import javascript
15-
import DataFlow::PathGraph
1615
import semmle.javascript.security.dataflow.TemplateObjectInjectionQuery
16+
import DataFlow::DeduplicatePathGraph<TemplateObjectInjectionFlow::PathNode, TemplateObjectInjectionFlow::PathGraph>
1717

18-
from DataFlow::Configuration cfg, DataFlow::PathNode source, DataFlow::PathNode sink
19-
where cfg.hasFlowPath(source, sink)
18+
from PathNode source, PathNode sink
19+
where
20+
TemplateObjectInjectionFlow::flowPath(source.getAnOriginalPathNode(), sink.getAnOriginalPathNode())
2021
select sink.getNode(), source, sink, "Template object depends on a $@.", source.getNode(),
2122
"user-provided value"

‎javascript/ql/test/query-tests/Security/CWE-073/TemplateObjectInjection.expected‎

Lines changed: 37 additions & 79 deletions
Original file line numberDiff line numberDiff line change
@@ -1,112 +1,70 @@
11
nodes
2-
| routes.js:2:23:2:30 | req.body |
3-
| routes.js:2:23:2:30 | req.body |
4-
| routes.js:2:23:2:30 | req.body |
5-
| tst2.js:6:9:6:46 | bodyParameter |
6-
| tst2.js:6:25:6:32 | req.body |
7-
| tst2.js:6:25:6:32 | req.body |
8-
| tst2.js:6:25:6:46 | req.bod ... rameter |
9-
| tst2.js:7:28:7:40 | bodyParameter |
10-
| tst2.js:7:28:7:40 | bodyParameter |
11-
| tst2.js:26:9:26:46 | bodyParameter |
12-
| tst2.js:26:25:26:32 | req.body |
13-
| tst2.js:26:25:26:32 | req.body |
14-
| tst2.js:26:25:26:46 | req.bod ... rameter |
15-
| tst2.js:27:28:27:40 | bodyParameter |
16-
| tst2.js:27:28:27:40 | bodyParameter |
17-
| tst2.js:34:9:34:46 | bodyParameter |
18-
| tst2.js:34:25:34:32 | req.body |
19-
| tst2.js:34:25:34:32 | req.body |
20-
| tst2.js:34:25:34:46 | req.bod ... rameter |
21-
| tst2.js:35:28:35:40 | bodyParameter |
22-
| tst2.js:35:28:35:40 | bodyParameter |
23-
| tst2.js:42:9:42:46 | bodyParameter |
24-
| tst2.js:42:25:42:32 | req.body |
25-
| tst2.js:42:25:42:32 | req.body |
26-
| tst2.js:42:25:42:46 | req.bod ... rameter |
27-
| tst2.js:43:28:43:40 | bodyParameter |
28-
| tst2.js:43:28:43:40 | bodyParameter |
29-
| tst2.js:51:9:51:46 | bodyParameter |
30-
| tst2.js:51:25:51:32 | req.body |
31-
| tst2.js:51:25:51:32 | req.body |
32-
| tst2.js:51:25:51:46 | req.bod ... rameter |
33-
| tst2.js:52:28:52:40 | bodyParameter |
34-
| tst2.js:52:28:52:40 | bodyParameter |
35-
| tst.js:7:9:7:46 | bodyParameter |
36-
| tst.js:7:25:7:32 | req.body |
37-
| tst.js:7:25:7:32 | req.body |
38-
| tst.js:7:25:7:46 | req.bod ... rameter |
39-
| tst.js:8:9:8:49 | queryParameter |
40-
| tst.js:8:9:8:49 | queryParameter |
41-
| tst.js:8:26:8:49 | req.que ... rameter |
42-
| tst.js:8:26:8:49 | req.que ... rameter |
43-
| tst.js:8:26:8:49 | req.que ... rameter |
44-
| tst.js:10:28:10:40 | bodyParameter |
45-
| tst.js:10:28:10:40 | bodyParameter |
46-
| tst.js:11:28:11:41 | queryParameter |
47-
| tst.js:11:28:11:41 | queryParameter |
48-
| tst.js:20:19:20:32 | queryParameter |
49-
| tst.js:20:19:20:32 | queryParameter |
50-
| tst.js:23:24:23:26 | obj |
51-
| tst.js:23:24:23:26 | obj |
52-
| tst.js:24:28:24:30 | obj |
53-
| tst.js:24:28:24:30 | obj |
54-
| tst.js:26:11:26:24 | str |
55-
| tst.js:26:17:26:19 | obj |
56-
| tst.js:26:17:26:24 | obj + "" |
57-
| tst.js:29:28:29:42 | JSON.parse(str) |
58-
| tst.js:29:28:29:42 | JSON.parse(str) |
59-
| tst.js:29:39:29:41 | str |
2+
| routes.js:2:23:2:30 | req.body | semmle.label | req.body |
3+
| tst2.js:6:9:6:46 | bodyParameter | semmle.label | bodyParameter |
4+
| tst2.js:6:25:6:32 | req.body | semmle.label | req.body |
5+
| tst2.js:6:25:6:46 | req.bod ... rameter | semmle.label | req.bod ... rameter |
6+
| tst2.js:7:28:7:40 | bodyParameter | semmle.label | bodyParameter |
7+
| tst2.js:26:9:26:46 | bodyParameter | semmle.label | bodyParameter |
8+
| tst2.js:26:25:26:32 | req.body | semmle.label | req.body |
9+
| tst2.js:26:25:26:46 | req.bod ... rameter | semmle.label | req.bod ... rameter |
10+
| tst2.js:27:28:27:40 | bodyParameter | semmle.label | bodyParameter |
11+
| tst2.js:34:9:34:46 | bodyParameter | semmle.label | bodyParameter |
12+
| tst2.js:34:25:34:32 | req.body | semmle.label | req.body |
13+
| tst2.js:34:25:34:46 | req.bod ... rameter | semmle.label | req.bod ... rameter |
14+
| tst2.js:35:28:35:40 | bodyParameter | semmle.label | bodyParameter |
15+
| tst2.js:42:9:42:46 | bodyParameter | semmle.label | bodyParameter |
16+
| tst2.js:42:25:42:32 | req.body | semmle.label | req.body |
17+
| tst2.js:42:25:42:46 | req.bod ... rameter | semmle.label | req.bod ... rameter |
18+
| tst2.js:43:28:43:40 | bodyParameter | semmle.label | bodyParameter |
19+
| tst2.js:51:9:51:46 | bodyParameter | semmle.label | bodyParameter |
20+
| tst2.js:51:25:51:32 | req.body | semmle.label | req.body |
21+
| tst2.js:51:25:51:46 | req.bod ... rameter | semmle.label | req.bod ... rameter |
22+
| tst2.js:52:28:52:40 | bodyParameter | semmle.label | bodyParameter |
23+
| tst.js:7:9:7:46 | bodyParameter | semmle.label | bodyParameter |
24+
| tst.js:7:25:7:32 | req.body | semmle.label | req.body |
25+
| tst.js:7:25:7:46 | req.bod ... rameter | semmle.label | req.bod ... rameter |
26+
| tst.js:8:9:8:49 | queryParameter | semmle.label | queryParameter |
27+
| tst.js:8:26:8:49 | req.que ... rameter | semmle.label | req.que ... rameter |
28+
| tst.js:10:28:10:40 | bodyParameter | semmle.label | bodyParameter |
29+
| tst.js:11:28:11:41 | queryParameter | semmle.label | queryParameter |
30+
| tst.js:20:19:20:32 | queryParameter | semmle.label | queryParameter |
31+
| tst.js:23:24:23:26 | obj | semmle.label | obj |
32+
| tst.js:24:28:24:30 | obj | semmle.label | obj |
33+
| tst.js:26:11:26:24 | str | semmle.label | str |
34+
| tst.js:26:17:26:19 | obj | semmle.label | obj |
35+
| tst.js:26:17:26:24 | obj + "" | semmle.label | obj + "" |
36+
| tst.js:29:28:29:42 | JSON.parse(str) | semmle.label | JSON.parse(str) |
37+
| tst.js:29:39:29:41 | str | semmle.label | str |
6038
edges
61-
| routes.js:2:23:2:30 | req.body | routes.js:2:23:2:30 | req.body |
6239
| tst2.js:6:9:6:46 | bodyParameter | tst2.js:7:28:7:40 | bodyParameter |
63-
| tst2.js:6:9:6:46 | bodyParameter | tst2.js:7:28:7:40 | bodyParameter |
64-
| tst2.js:6:25:6:32 | req.body | tst2.js:6:25:6:46 | req.bod ... rameter |
6540
| tst2.js:6:25:6:32 | req.body | tst2.js:6:25:6:46 | req.bod ... rameter |
6641
| tst2.js:6:25:6:46 | req.bod ... rameter | tst2.js:6:9:6:46 | bodyParameter |
6742
| tst2.js:26:9:26:46 | bodyParameter | tst2.js:27:28:27:40 | bodyParameter |
68-
| tst2.js:26:9:26:46 | bodyParameter | tst2.js:27:28:27:40 | bodyParameter |
69-
| tst2.js:26:25:26:32 | req.body | tst2.js:26:25:26:46 | req.bod ... rameter |
7043
| tst2.js:26:25:26:32 | req.body | tst2.js:26:25:26:46 | req.bod ... rameter |
7144
| tst2.js:26:25:26:46 | req.bod ... rameter | tst2.js:26:9:26:46 | bodyParameter |
7245
| tst2.js:34:9:34:46 | bodyParameter | tst2.js:35:28:35:40 | bodyParameter |
73-
| tst2.js:34:9:34:46 | bodyParameter | tst2.js:35:28:35:40 | bodyParameter |
74-
| tst2.js:34:25:34:32 | req.body | tst2.js:34:25:34:46 | req.bod ... rameter |
7546
| tst2.js:34:25:34:32 | req.body | tst2.js:34:25:34:46 | req.bod ... rameter |
7647
| tst2.js:34:25:34:46 | req.bod ... rameter | tst2.js:34:9:34:46 | bodyParameter |
7748
| tst2.js:42:9:42:46 | bodyParameter | tst2.js:43:28:43:40 | bodyParameter |
78-
| tst2.js:42:9:42:46 | bodyParameter | tst2.js:43:28:43:40 | bodyParameter |
79-
| tst2.js:42:25:42:32 | req.body | tst2.js:42:25:42:46 | req.bod ... rameter |
8049
| tst2.js:42:25:42:32 | req.body | tst2.js:42:25:42:46 | req.bod ... rameter |
8150
| tst2.js:42:25:42:46 | req.bod ... rameter | tst2.js:42:9:42:46 | bodyParameter |
8251
| tst2.js:51:9:51:46 | bodyParameter | tst2.js:52:28:52:40 | bodyParameter |
83-
| tst2.js:51:9:51:46 | bodyParameter | tst2.js:52:28:52:40 | bodyParameter |
84-
| tst2.js:51:25:51:32 | req.body | tst2.js:51:25:51:46 | req.bod ... rameter |
8552
| tst2.js:51:25:51:32 | req.body | tst2.js:51:25:51:46 | req.bod ... rameter |
8653
| tst2.js:51:25:51:46 | req.bod ... rameter | tst2.js:51:9:51:46 | bodyParameter |
8754
| tst.js:7:9:7:46 | bodyParameter | tst.js:10:28:10:40 | bodyParameter |
88-
| tst.js:7:9:7:46 | bodyParameter | tst.js:10:28:10:40 | bodyParameter |
89-
| tst.js:7:25:7:32 | req.body | tst.js:7:25:7:46 | req.bod ... rameter |
9055
| tst.js:7:25:7:32 | req.body | tst.js:7:25:7:46 | req.bod ... rameter |
9156
| tst.js:7:25:7:46 | req.bod ... rameter | tst.js:7:9:7:46 | bodyParameter |
9257
| tst.js:8:9:8:49 | queryParameter | tst.js:11:28:11:41 | queryParameter |
93-
| tst.js:8:9:8:49 | queryParameter | tst.js:11:28:11:41 | queryParameter |
9458
| tst.js:8:9:8:49 | queryParameter | tst.js:20:19:20:32 | queryParameter |
95-
| tst.js:8:9:8:49 | queryParameter | tst.js:20:19:20:32 | queryParameter |
96-
| tst.js:8:26:8:49 | req.que ... rameter | tst.js:8:9:8:49 | queryParameter |
9759
| tst.js:8:26:8:49 | req.que ... rameter | tst.js:8:9:8:49 | queryParameter |
98-
| tst.js:8:26:8:49 | req.que ... rameter | tst.js:8:9:8:49 | queryParameter |
99-
| tst.js:8:26:8:49 | req.que ... rameter | tst.js:8:9:8:49 | queryParameter |
100-
| tst.js:20:19:20:32 | queryParameter | tst.js:23:24:23:26 | obj |
10160
| tst.js:20:19:20:32 | queryParameter | tst.js:23:24:23:26 | obj |
10261
| tst.js:23:24:23:26 | obj | tst.js:24:28:24:30 | obj |
103-
| tst.js:23:24:23:26 | obj | tst.js:24:28:24:30 | obj |
10462
| tst.js:23:24:23:26 | obj | tst.js:26:17:26:19 | obj |
10563
| tst.js:26:11:26:24 | str | tst.js:29:39:29:41 | str |
10664
| tst.js:26:17:26:19 | obj | tst.js:26:17:26:24 | obj + "" |
10765
| tst.js:26:17:26:24 | obj + "" | tst.js:26:11:26:24 | str |
10866
| tst.js:29:39:29:41 | str | tst.js:29:28:29:42 | JSON.parse(str) |
109-
| tst.js:29:39:29:41 | str | tst.js:29:28:29:42 | JSON.parse(str) |
67+
subpaths
11068
#select
11169
| routes.js:2:23:2:30 | req.body | routes.js:2:23:2:30 | req.body | routes.js:2:23:2:30 | req.body | Template object depends on a $@. | routes.js:2:23:2:30 | req.body | user-provided value |
11270
| tst2.js:7:28:7:40 | bodyParameter | tst2.js:6:25:6:32 | req.body | tst2.js:7:28:7:40 | bodyParameter | Template object depends on a $@. | tst2.js:6:25:6:32 | req.body | user-provided value |

0 commit comments

Comments
 (0)