Thanks to visit codestin.com
Credit goes to github.com

Skip to content

Commit 2e05937

Browse files
esbenaesbena
committed
JS: add query js/disabling-certificate-validation
1 parent 8b3dd6d commit 2e05937

5 files changed

Lines changed: 142 additions & 0 deletions

File tree

‎javascript/ql/src/Security/CWE-295/DisablingCertificateValidation.qhelp‎

Lines changed: 22 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,22 @@
1+
<!DOCTYPE qhelp PUBLIC
2+
"-//Semmle//qhelp//EN"
3+
"qhelp.dtd">
4+
<qhelp>
5+
6+
<overview>
7+
8+
</overview>
9+
10+
<recommendation>
11+
12+
</recommendation>
13+
14+
<example>
15+
16+
</example>
17+
18+
<references>
19+
20+
</references>
21+
22+
</qhelp>

‎javascript/ql/src/Security/CWE-295/DisablingCertificateValidation.ql‎

Lines changed: 40 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,40 @@
1+
/**
2+
* @name Disabling certificate validation
3+
* @description Disabling cryptographic certificate validation can cause security vulnerabilities.
4+
* @kind problem
5+
* @problem.severity error
6+
* @precision very-high
7+
* @id js/disabling-certificate-validation
8+
* @tags security
9+
* external/cwe-295
10+
*/
11+
12+
import javascript
13+
14+
from DataFlow::PropWrite disable
15+
where
16+
exists(DataFlow::SourceNode env |
17+
env = NodeJSLib::process().getAPropertyRead("env") and
18+
disable = env.getAPropertyWrite("NODE_TLS_REJECT_UNAUTHORIZED") and
19+
disable.getRhs().mayHaveStringValue("0")
20+
)
21+
or
22+
exists(DataFlow::ObjectLiteralNode options, DataFlow::InvokeNode invk |
23+
options.flowsTo(invk.getAnArgument()) and
24+
disable = options.getAPropertyWrite("rejectUnauthorized") and
25+
disable.getRhs().(AnalyzedNode).getTheBooleanValue() = false
26+
|
27+
invk instanceof NodeJSLib::NodeJSClientRequest
28+
or
29+
invk = DataFlow::moduleMember("https", "Agent").getAnInstantiation()
30+
or
31+
exists(DataFlow::NewNode new |
32+
new = DataFlow::moduleMember("tls", "TLSSocket").getAnInstantiation()
33+
|
34+
invk = new or
35+
invk = new.getAMethodCall("renegotiate")
36+
)
37+
or
38+
invk = DataFlow::moduleMember("tls", ["connect", "createServer"]).getACall()
39+
)
40+
select disable, "Disabling certificate validation is strongly discouraged."

‎javascript/ql/test/query-tests/Security/CWE-295/DisablingCertificateValidation.expected‎

Lines changed: 9 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,9 @@
1+
| tst.js:15:3:15:27 | rejectU ... : false | Disabling certificate validation is strongly discouraged. |
2+
| tst.js:18:1:18:40 | process ... HORIZED | Disabling certificate validation is strongly discouraged. |
3+
| tst.js:21:3:21:27 | rejectU ... : false | Disabling certificate validation is strongly discouraged. |
4+
| tst.js:25:3:25:27 | rejectU ... : false | Disabling certificate validation is strongly discouraged. |
5+
| tst.js:29:3:29:27 | rejectU ... : false | Disabling certificate validation is strongly discouraged. |
6+
| tst.js:34:3:34:27 | rejectU ... : false | Disabling certificate validation is strongly discouraged. |
7+
| tst.js:39:2:39:29 | rejectU ... ndirect | Disabling certificate validation is strongly discouraged. |
8+
| tst.js:45:2:45:28 | rejectU ... !!false | Disabling certificate validation is strongly discouraged. |
9+
| tst.js:48:2:48:26 | rejectU ... : !true | Disabling certificate validation is strongly discouraged. |

‎javascript/ql/test/query-tests/Security/CWE-295/DisablingCertificateValidation.qlref‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1 @@
1+
Security/CWE-295/DisablingCertificateValidation.ql

‎javascript/ql/test/query-tests/Security/CWE-295/tst.js‎

Lines changed: 70 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,70 @@
1+
let https = require("https"),
2+
tls = require("tls");
3+
4+
new https.Agent(); // OK
5+
6+
new https.Agent({
7+
rejectUnauthorized: true // OK
8+
});
9+
10+
unknownCall({
11+
rejectUnauthorized: false // OK (but probably unsafe after all)
12+
});
13+
14+
new https.Agent({
15+
rejectUnauthorized: false // NOT OK
16+
});
17+
18+
process.env.NODE_TLS_REJECT_UNAUTHORIZED = "0"; // NOT OK
19+
20+
https.get({
21+
rejectUnauthorized: false // NOT OK
22+
});
23+
24+
new tls.TLSSocket(socket, {
25+
rejectUnauthorized: false // NOT OK
26+
});
27+
28+
tls.connect({
29+
rejectUnauthorized: false // NOT OK
30+
});
31+
32+
let socket = new tls.TLSSocket();
33+
socket.renegotiate({
34+
rejectUnauthorized: false // NOT OK
35+
});
36+
37+
let indirect = false;
38+
new https.Agent({
39+
rejectUnauthorized: indirect // NOT OK
40+
});
41+
new https.Agent({
42+
rejectUnauthorized: !false // OK
43+
});
44+
new https.Agent({
45+
rejectUnauthorized: !!false // NOT OK
46+
});
47+
new https.Agent({
48+
rejectUnauthorized: !true // NOT OK
49+
});
50+
new https.Agent({
51+
rejectUnauthorized: !!true // OK
52+
});
53+
new https.Agent({
54+
rejectUnauthorized: unknown() // OK
55+
});
56+
new https.Agent({
57+
rejectUnauthorized: !getOptions().selfSignedSSL // OK
58+
});
59+
new https.Agent({
60+
rejectUnauthorized: getOptions().rejectUnauthorized // OK
61+
});
62+
new https.Agent({
63+
rejectUnauthorized: !!getOptions().rejectUnauthorized // OK
64+
});
65+
new https.Agent({
66+
rejectUnauthorized: getOptions() == null ? true : getOptions().verifySsl // OK
67+
});
68+
new https.Agent({
69+
rejectUnauthorized: typeof getOptions().rejectUnauthorized === 'boolean' ? getOptions().rejectUnauthorized : undefined // OK
70+
});

0 commit comments

Comments
 (0)