Thanks to visit codestin.com
Credit goes to github.com

Skip to content

Commit 2dbd762

Browse files
esbenaesbena
committed
JS: reintroduce reverted js/server-crash
This reverts commit 0a8d15c.
1 parent b794fcb commit 2dbd762

5 files changed

Lines changed: 202 additions & 0 deletions

File tree

‎javascript/ql/src/Security/CWE-730/ServerCrash.qhelp‎

Lines changed: 22 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,22 @@
1+
<!DOCTYPE qhelp PUBLIC
2+
"-//Semmle//qhelp//EN"
3+
"qhelp.dtd">
4+
<qhelp>
5+
6+
<overview>
7+
8+
</overview>
9+
10+
<recommendation>
11+
12+
</recommendation>
13+
14+
<example>
15+
16+
</example>
17+
18+
<references>
19+
20+
</references>
21+
22+
</qhelp>

‎javascript/ql/src/Security/CWE-730/ServerCrash.ql‎

Lines changed: 100 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,100 @@
1+
/**
2+
* @name Server crash
3+
* @description A server that can be forced to crash may be vulnerable to denial-of-service
4+
* attacks.
5+
* @kind problem
6+
* @problem.severity error
7+
* @precision high
8+
* @id js/server-crash
9+
* @tags security
10+
* external/cwe/cwe-730
11+
*/
12+
13+
import javascript
14+
15+
/**
16+
* Gets a function that `caller` invokes.
17+
*/
18+
Function getACallee(Function caller) {
19+
exists(DataFlow::InvokeNode invk |
20+
invk.getEnclosingFunction() = caller and result = invk.getACallee()
21+
)
22+
}
23+
24+
/**
25+
* Gets a function that `caller` invokes, excluding calls guarded in `try`-blocks.
26+
*/
27+
Function getAnUnguardedCallee(Function caller) {
28+
exists(DataFlow::InvokeNode invk |
29+
invk.getEnclosingFunction() = caller and
30+
result = invk.getACallee() and
31+
not exists(invk.asExpr().getEnclosingStmt().getEnclosingTryCatchStmt())
32+
)
33+
}
34+
35+
predicate isHeaderValue(HTTP::ExplicitHeaderDefinition def, DataFlow::Node node) {
36+
def.definesExplicitly(_, node.asExpr())
37+
}
38+
39+
class Configuration extends TaintTracking::Configuration {
40+
Configuration() { this = "Configuration" }
41+
42+
override predicate isSource(DataFlow::Node node) { node instanceof RemoteFlowSource }
43+
44+
override predicate isSink(DataFlow::Node node) {
45+
// using control characters in a header value will cause an exception
46+
isHeaderValue(_, node)
47+
}
48+
}
49+
50+
predicate isLikelyToThrow(DataFlow::Node crash) {
51+
exists(Configuration cfg, DataFlow::Node sink | cfg.hasFlow(_, sink) | isHeaderValue(crash, sink))
52+
}
53+
54+
/**
55+
* A call that looks like it is asynchronous.
56+
*/
57+
class AsyncCall extends DataFlow::CallNode {
58+
DataFlow::FunctionNode callback;
59+
60+
AsyncCall() {
61+
callback.flowsTo(getLastArgument()) and
62+
callback.getParameter(0).getName() = ["e", "err", "error"] and
63+
callback.getNumParameter() = 2 and
64+
not exists(callback.getAReturn())
65+
}
66+
67+
DataFlow::FunctionNode getCallback() { result = callback }
68+
}
69+
70+
/**
71+
* Gets a function that is invoked by `asyncCallback` without any try-block wrapping, `asyncCallback` is in turn is called indirectly by `routeHandler`.
72+
*
73+
* If the result throws an excection, the server of `routeHandler` will crash.
74+
*/
75+
Function getAPotentialServerCrasher(
76+
HTTP::RouteHandler routeHandler, DataFlow::FunctionNode asyncCallback
77+
) {
78+
exists(AsyncCall asyncCall |
79+
// the route handler transitively calls an async function
80+
asyncCall.getEnclosingFunction() =
81+
getACallee*(routeHandler.(DataFlow::FunctionNode).getFunction()) and
82+
asyncCallback = asyncCall.getCallback() and
83+
// the async function transitively calls a function that may throw an exception out of the the async function
84+
result = getAnUnguardedCallee*(asyncCallback.getFunction())
85+
)
86+
}
87+
88+
/**
89+
* Gets an AST node that is likely to throw an uncaught exception in `fun`.
90+
*/
91+
ExprOrStmt getALikelyExceptionThrower(Function fun) {
92+
result.getContainer() = fun and
93+
not exists([result.(Expr).getEnclosingStmt(), result.(Stmt)].getEnclosingTryCatchStmt()) and
94+
(isLikelyToThrow(result.(Expr).flow()) or result instanceof ThrowStmt)
95+
}
96+
97+
from HTTP::RouteHandler routeHandler, DataFlow::FunctionNode asyncCallback, ExprOrStmt crasher
98+
where crasher = getALikelyExceptionThrower(getAPotentialServerCrasher(routeHandler, asyncCallback))
99+
select crasher, "When an exception is thrown here and later exits $@, the server of $@ will crash.",
100+
asyncCallback, "this asynchronous callback", routeHandler, "this route handler"

‎javascript/ql/test/query-tests/Security/CWE-730/ServerCrash.expected‎

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,6 @@
1+
| server-crash.js:7:5:7:14 | throw err; | When an exception is thrown here and later exits $@, the server of $@ will crash. | server-crash.js:6:28:8:3 | (err, x ... OK\\n } | this asynchronous callback | server-crash.js:31:25:73:1 | (req, r ... });\\n} | this route handler |
2+
| server-crash.js:11:3:11:11 | throw 42; | When an exception is thrown here and later exits $@, the server of $@ will crash. | server-crash.js:50:28:52:3 | (err, x ... ();\\n } | this asynchronous callback | server-crash.js:31:25:73:1 | (req, r ... });\\n} | this route handler |
3+
| server-crash.js:16:7:16:16 | throw err; | When an exception is thrown here and later exits $@, the server of $@ will crash. | server-crash.js:15:30:17:5 | (err, x ... K\\n } | this asynchronous callback | server-crash.js:31:25:73:1 | (req, r ... });\\n} | this route handler |
4+
| server-crash.js:28:5:28:14 | throw err; | When an exception is thrown here and later exits $@, the server of $@ will crash. | server-crash.js:27:28:29:3 | (err, x ... OK\\n } | this asynchronous callback | server-crash.js:31:25:73:1 | (req, r ... });\\n} | this route handler |
5+
| server-crash.js:33:5:33:14 | throw err; | When an exception is thrown here and later exits $@, the server of $@ will crash. | server-crash.js:32:28:34:3 | (err, x ... OK\\n } | this asynchronous callback | server-crash.js:31:25:73:1 | (req, r ... });\\n} | this route handler |
6+
| server-crash.js:41:5:41:48 | res.set ... header) | When an exception is thrown here and later exits $@, the server of $@ will crash. | server-crash.js:40:28:42:3 | (err, x ... OK\\n } | this asynchronous callback | server-crash.js:31:25:73:1 | (req, r ... });\\n} | this route handler |

‎javascript/ql/test/query-tests/Security/CWE-730/ServerCrash.qlref‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1 @@
1+
Security/CWE-730/ServerCrash.ql

‎javascript/ql/test/query-tests/Security/CWE-730/server-crash.js‎

Lines changed: 73 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,73 @@
1+
const express = require("express");
2+
const app = express();
3+
const fs = require("fs");
4+
5+
function indirection1() {
6+
fs.readFile("/WHATEVER", (err, x) => {
7+
throw err; // NOT OK
8+
});
9+
}
10+
function indirection2() {
11+
throw 42; // NOT OK
12+
}
13+
function indirection3() {
14+
try {
15+
fs.readFile("/WHATEVER", (err, x) => {
16+
throw err; // NOT OK
17+
});
18+
} catch (e) {}
19+
}
20+
function indirection4() {
21+
throw 42; // OK: guarded caller
22+
}
23+
function indirection5() {
24+
indirection6();
25+
}
26+
function indirection6() {
27+
fs.readFile("/WHATEVER", (err, x) => {
28+
throw err; // NOT OK
29+
});
30+
}
31+
app.get("/async-throw", (req, res) => {
32+
fs.readFile("/WHATEVER", (err, x) => {
33+
throw err; // NOT OK
34+
});
35+
fs.readFile("/WHATEVER", (err, x) => {
36+
try {
37+
throw err; // OK: guarded throw
38+
} catch (e) {}
39+
});
40+
fs.readFile("/WHATEVER", (err, x) => {
41+
res.setHeader("reflected", req.query.header); // NOT OK
42+
});
43+
fs.readFile("/WHATEVER", (err, x) => {
44+
try {
45+
res.setHeader("reflected", req.query.header); // OK: guarded call
46+
} catch (e) {}
47+
});
48+
49+
indirection1();
50+
fs.readFile("/WHATEVER", (err, x) => {
51+
indirection2();
52+
});
53+
54+
indirection3();
55+
try {
56+
indirection4();
57+
} catch (e) {}
58+
indirection5();
59+
60+
fs.readFile("/WHATEVER", (err, x) => {
61+
req.query.foo; // OK
62+
});
63+
fs.readFile("/WHATEVER", (err, x) => {
64+
req.query.foo.toString(); // OK
65+
});
66+
67+
fs.readFile("/WHATEVER", (err, x) => {
68+
req.query.foo.bar; // NOT OK [INCONSISTENCY]: need to add property reads as sinks
69+
});
70+
fs.readFile("/WHATEVER", (err, x) => {
71+
res.setHeader("reflected", unknown); // OK
72+
});
73+
});

0 commit comments

Comments
 (0)