Thanks to visit codestin.com
Credit goes to github.com

Skip to content

Commit 2eaa4a4

Browse files
author
Dave Bartolomeo
committed
Merge remote-tracking branch 'upstream/main' into work
2 parents d0b93df + 3587235 commit 2eaa4a4

10 files changed

Lines changed: 258 additions & 3 deletions

File tree

‎change-notes/1.26/analysis-javascript.md‎

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -8,7 +8,9 @@
88
- [@angular/*](https://www.npmjs.com/package/@angular/core)
99
- [AWS Serverless](https://docs.aws.amazon.com/serverless-application-model/latest/developerguide/sam-resource-function.html)
1010
- [Alibaba Serverless](https://www.alibabacloud.com/help/doc-detail/156876.htm)
11+
- [debounce](https://www.npmjs.com/package/debounce)
1112
- [bluebird](https://www.npmjs.com/package/bluebird)
13+
- [call-limit](https://www.npmjs.com/package/call-limit)
1214
- [express](https://www.npmjs.com/package/express)
1315
- [fast-json-stable-stringify](https://www.npmjs.com/package/fast-json-stable-stringify)
1416
- [fast-safe-stringify](https://www.npmjs.com/package/fast-safe-stringify)
@@ -18,11 +20,15 @@
1820
- [json-stable-stringify](https://www.npmjs.com/package/json-stable-stringify)
1921
- [json-stringify-safe](https://www.npmjs.com/package/json-stringify-safe)
2022
- [json3](https://www.npmjs.com/package/json3)
23+
- [jQuery throttle / debounce](https://github.com/cowboy/jquery-throttle-debounce)
2124
- [lodash](https://www.npmjs.com/package/lodash)
25+
- [lodash.debounce](https://www.npmjs.com/package/lodash.debounce)
26+
- [lodash.throttle](https://www.npmjs.com/package/lodash.throttle)
2227
- [needle](https://www.npmjs.com/package/needle)
2328
- [object-inspect](https://www.npmjs.com/package/object-inspect)
2429
- [pretty-format](https://www.npmjs.com/package/pretty-format)
2530
- [stringify-object](https://www.npmjs.com/package/stringify-object)
31+
- [throttle-debounce](https://www.npmjs.com/package/throttle-debounce)
2632
- [underscore](https://www.npmjs.com/package/underscore)
2733

2834
* Analyzing files with the ".cjs" extension is now supported.
@@ -46,6 +52,7 @@
4652
| Unsafe jQuery plugin (`js/unsafe-jquery-plugin`) | More results | This query now detects more unsafe uses of nested option properties. |
4753
| Client-side URL redirect (`js/client-side-unvalidated-url-redirection`) | More results | This query now recognizes some unsafe uses of `importScripts()` inside WebWorkers. |
4854
| Missing CSRF middleware (`js/missing-token-validation`) | More results | This query now recognizes writes to cookie and session variables as potentially vulnerable to CSRF attacks. |
55+
| Missing CSRF middleware (`js/missing-token-validation`) | Fewer results | This query now recognizes more ways of protecting against CSRF attacks. |
4956

5057

5158
## Changes to libraries

‎cpp/ql/src/Likely Bugs/Arithmetic/IntMultToLong.cpp‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -4,3 +4,5 @@ long j = i * i; //Wrong: due to overflow on the multiplication between ints,
44

55
long k = (long) i * i; //Correct: the multiplication is done on longs instead of ints,
66
//and will not overflow
7+
8+
long l = static_cast<long>(i) * i; //Correct: modern C++

‎javascript/ql/src/Security/CWE-352/MissingCsrfMiddleware.ql‎

Lines changed: 66 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -15,7 +15,7 @@ import javascript
1515
/** Gets a property name of `req` which refers to data usually derived from cookie data. */
1616
string cookieProperty() { result = "session" or result = "cookies" or result = "user" }
1717

18-
/** Gets a data flow node that flows to the base of an access to `cookies`, `session`, or `user`. */
18+
/** Gets a data flow node that flows to the base of a reference to `cookies`, `session`, or `user`. */
1919
private DataFlow::SourceNode nodeLeadingToCookieAccess(DataFlow::TypeBackTracker t) {
2020
t.start() and
2121
exists(DataFlow::PropRef value |
@@ -94,14 +94,78 @@ DataFlow::CallNode csrfMiddlewareCreation() {
9494
exists(result.getOptionArgument(0, "csrf"))
9595
or
9696
callee = DataFlow::moduleMember("lusca", "csrf")
97+
or
98+
callee = DataFlow::moduleMember("express", "csrf")
99+
)
100+
}
101+
102+
/**
103+
* Gets a data flow node that flows to the base of a write to `cookies`, `session`, or `user`,
104+
* where the written property has `csrf` or `xsrf` in its name.
105+
*/
106+
private DataFlow::SourceNode nodeLeadingToCsrfWrite(DataFlow::TypeBackTracker t) {
107+
t.start() and
108+
result
109+
.getAPropertyRead(cookieProperty())
110+
.getAPropertyWrite()
111+
.getPropertyName()
112+
.regexpMatch("(?i).*(csrf|xsrf).*")
113+
or
114+
exists(DataFlow::TypeBackTracker t2 | result = nodeLeadingToCsrfWrite(t2).backtrack(t2, t))
115+
}
116+
117+
/**
118+
* Gets a route handler that sets an CSRF related cookie.
119+
*/
120+
private Express::RouteHandler getAHandlerSettingCsrfCookie() {
121+
exists(HTTP::CookieDefinition setCookie |
122+
setCookie.getNameArgument().getStringValue().regexpMatch("(?i).*(csrf|xsrf).*") and
123+
result = setCookie.getRouteHandler()
124+
)
125+
}
126+
127+
/**
128+
* Holds if `handler` is protecting from CSRF.
129+
* This is indicated either by the request parameter having a CSRF related write to a session variable.
130+
* Or by the response parameter setting a CSRF related cookie.
131+
*/
132+
predicate isCsrfProtectionRouteHandler(Express::RouteHandler handler) {
133+
DataFlow::parameterNode(handler.getRequestParameter()) =
134+
nodeLeadingToCsrfWrite(DataFlow::TypeBackTracker::end())
135+
or
136+
handler = getAHandlerSettingCsrfCookie()
137+
}
138+
139+
/** Gets a data flow node refering to a route handler that is protecting against CSRF. */
140+
private DataFlow::SourceNode getACsrfProtectionRouteHandler(DataFlow::TypeTracker t) {
141+
t.start() and
142+
isCsrfProtectionRouteHandler(result)
143+
or
144+
exists(DataFlow::TypeTracker t2, DataFlow::SourceNode pred |
145+
pred = getACsrfProtectionRouteHandler(t2)
146+
|
147+
result = pred.track(t2, t)
148+
or
149+
t = t2 and
150+
HTTP::routeHandlerStep(pred, result)
97151
)
98152
}
99153

154+
/**
155+
* Gets an express route handler expression that is either a custom CSRF protection middleware,
156+
* or a CSRF protecting library.
157+
*/
158+
Express::RouteHandlerExpr getACsrfMiddleware() {
159+
csrfMiddlewareCreation().flowsToExpr(result)
160+
or
161+
getACsrfProtectionRouteHandler(DataFlow::TypeTracker::end()).flowsToExpr(result)
162+
}
163+
100164
/**
101165
* Holds if the given route handler is protected by CSRF middleware.
102166
*/
103167
predicate hasCsrfMiddleware(Express::RouteHandlerExpr handler) {
104-
csrfMiddlewareCreation().flowsToExpr(handler.getAMatchingAncestor())
168+
getACsrfMiddleware() = handler.getAMatchingAncestor()
105169
}
106170

107171
from

‎javascript/ql/src/semmle/javascript/dataflow/Nodes.qll‎

Lines changed: 40 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1379,6 +1379,46 @@ module PartialInvokeNode {
13791379
}
13801380
}
13811381

1382+
/**
1383+
* A partial call that behaves like a throttle call, like `require("call-limit")(fs, limit)` or `_.memoize`.
1384+
* Seen as a partial invocation that binds no arguments.
1385+
*/
1386+
private class ThrottleLikePartialCall extends PartialInvokeNode::Range, DataFlow::CallNode {
1387+
int callbackIndex;
1388+
1389+
ThrottleLikePartialCall() {
1390+
callbackIndex = 0 and
1391+
(
1392+
this = LodashUnderscore::member(["throttle", "debounce", "once", "memoize"]).getACall()
1393+
or
1394+
this = DataFlow::moduleImport(["call-limit", "debounce"]).getACall()
1395+
)
1396+
or
1397+
callbackIndex = 1 and
1398+
(
1399+
this = LodashUnderscore::member(["after", "before"]).getACall()
1400+
or
1401+
// not jQuery: https://github.com/cowboy/jquery-throttle-debounce
1402+
this = DataFlow::globalVarRef("$").getAMemberCall(["throttle", "debounce"])
1403+
)
1404+
or
1405+
callbackIndex = -1 and
1406+
this = DataFlow::moduleMember("throttle-debounce", ["debounce", "throttle"]).getACall()
1407+
}
1408+
1409+
override DataFlow::SourceNode getBoundFunction(DataFlow::Node callback, int boundArgs) {
1410+
(
1411+
callbackIndex >= 0 and
1412+
callback = getArgument(callbackIndex)
1413+
or
1414+
callbackIndex = -1 and
1415+
callback = getLastArgument()
1416+
) and
1417+
boundArgs = 0 and
1418+
result = this
1419+
}
1420+
}
1421+
13821422
/**
13831423
* A partial call through `ramda.partial`.
13841424
*/

‎javascript/ql/src/semmle/javascript/frameworks/Express.qll‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -718,7 +718,7 @@ module Express {
718718
/**
719719
* An invocation of the `cookie` method on an HTTP response object.
720720
*/
721-
private class SetCookie extends HTTP::CookieDefinition, MethodCallExpr {
721+
class SetCookie extends HTTP::CookieDefinition, MethodCallExpr {
722722
RouteHandler rh;
723723

724724
SetCookie() { calls(rh.getAResponseExpr(), "cookie") }

‎javascript/ql/test/library-tests/InterProceduralFlow/DataFlow.expected‎

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -32,10 +32,18 @@
3232
| partial.js:5:15:5:24 | "tainted1" | partial.js:15:15:15:15 | x |
3333
| partial.js:5:15:5:24 | "tainted1" | partial.js:21:15:21:15 | x |
3434
| partial.js:5:15:5:24 | "tainted1" | partial.js:27:15:27:15 | x |
35+
| partial.js:5:15:5:24 | "tainted1" | partial.js:34:15:34:15 | x |
36+
| partial.js:5:15:5:24 | "tainted1" | partial.js:41:15:41:15 | x |
37+
| partial.js:5:15:5:24 | "tainted1" | partial.js:47:15:47:15 | x |
38+
| partial.js:5:15:5:24 | "tainted1" | partial.js:53:15:53:15 | x |
3539
| partial.js:6:15:6:24 | "tainted2" | partial.js:10:15:10:15 | y |
3640
| partial.js:6:15:6:24 | "tainted2" | partial.js:16:15:16:15 | y |
3741
| partial.js:6:15:6:24 | "tainted2" | partial.js:22:15:22:15 | y |
3842
| partial.js:6:15:6:24 | "tainted2" | partial.js:28:15:28:15 | y |
43+
| partial.js:6:15:6:24 | "tainted2" | partial.js:35:15:35:15 | y |
44+
| partial.js:6:15:6:24 | "tainted2" | partial.js:42:15:42:15 | y |
45+
| partial.js:6:15:6:24 | "tainted2" | partial.js:48:15:48:15 | y |
46+
| partial.js:6:15:6:24 | "tainted2" | partial.js:54:15:54:15 | y |
3947
| promises.js:2:16:2:24 | "tainted" | promises.js:7:16:7:18 | val |
4048
| promises.js:2:16:2:24 | "tainted" | promises.js:38:32:38:32 | v |
4149
| promises.js:11:22:11:31 | "resolved" | promises.js:19:20:19:20 | v |

‎javascript/ql/test/library-tests/InterProceduralFlow/GermanFlow.expected‎

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -33,10 +33,18 @@
3333
| partial.js:5:15:5:24 | "tainted1" | partial.js:15:15:15:15 | x |
3434
| partial.js:5:15:5:24 | "tainted1" | partial.js:21:15:21:15 | x |
3535
| partial.js:5:15:5:24 | "tainted1" | partial.js:27:15:27:15 | x |
36+
| partial.js:5:15:5:24 | "tainted1" | partial.js:34:15:34:15 | x |
37+
| partial.js:5:15:5:24 | "tainted1" | partial.js:41:15:41:15 | x |
38+
| partial.js:5:15:5:24 | "tainted1" | partial.js:47:15:47:15 | x |
39+
| partial.js:5:15:5:24 | "tainted1" | partial.js:53:15:53:15 | x |
3640
| partial.js:6:15:6:24 | "tainted2" | partial.js:10:15:10:15 | y |
3741
| partial.js:6:15:6:24 | "tainted2" | partial.js:16:15:16:15 | y |
3842
| partial.js:6:15:6:24 | "tainted2" | partial.js:22:15:22:15 | y |
3943
| partial.js:6:15:6:24 | "tainted2" | partial.js:28:15:28:15 | y |
44+
| partial.js:6:15:6:24 | "tainted2" | partial.js:35:15:35:15 | y |
45+
| partial.js:6:15:6:24 | "tainted2" | partial.js:42:15:42:15 | y |
46+
| partial.js:6:15:6:24 | "tainted2" | partial.js:48:15:48:15 | y |
47+
| partial.js:6:15:6:24 | "tainted2" | partial.js:54:15:54:15 | y |
4048
| promises.js:2:16:2:24 | "tainted" | promises.js:7:16:7:18 | val |
4149
| promises.js:2:16:2:24 | "tainted" | promises.js:38:32:38:32 | v |
4250
| promises.js:11:22:11:31 | "resolved" | promises.js:19:20:19:20 | v |

‎javascript/ql/test/library-tests/InterProceduralFlow/TaintTracking.expected‎

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -38,10 +38,18 @@
3838
| partial.js:5:15:5:24 | "tainted1" | partial.js:15:15:15:15 | x |
3939
| partial.js:5:15:5:24 | "tainted1" | partial.js:21:15:21:15 | x |
4040
| partial.js:5:15:5:24 | "tainted1" | partial.js:27:15:27:15 | x |
41+
| partial.js:5:15:5:24 | "tainted1" | partial.js:34:15:34:15 | x |
42+
| partial.js:5:15:5:24 | "tainted1" | partial.js:41:15:41:15 | x |
43+
| partial.js:5:15:5:24 | "tainted1" | partial.js:47:15:47:15 | x |
44+
| partial.js:5:15:5:24 | "tainted1" | partial.js:53:15:53:15 | x |
4145
| partial.js:6:15:6:24 | "tainted2" | partial.js:10:15:10:15 | y |
4246
| partial.js:6:15:6:24 | "tainted2" | partial.js:16:15:16:15 | y |
4347
| partial.js:6:15:6:24 | "tainted2" | partial.js:22:15:22:15 | y |
4448
| partial.js:6:15:6:24 | "tainted2" | partial.js:28:15:28:15 | y |
49+
| partial.js:6:15:6:24 | "tainted2" | partial.js:35:15:35:15 | y |
50+
| partial.js:6:15:6:24 | "tainted2" | partial.js:42:15:42:15 | y |
51+
| partial.js:6:15:6:24 | "tainted2" | partial.js:48:15:48:15 | y |
52+
| partial.js:6:15:6:24 | "tainted2" | partial.js:54:15:54:15 | y |
4553
| promises.js:2:16:2:24 | "tainted" | promises.js:7:16:7:18 | val |
4654
| promises.js:2:16:2:24 | "tainted" | promises.js:38:32:38:32 | v |
4755
| promises.js:11:22:11:31 | "resolved" | promises.js:19:20:19:20 | v |

‎javascript/ql/test/library-tests/InterProceduralFlow/partial.js‎

Lines changed: 26 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -28,3 +28,29 @@ function f4(x, y) {
2828
let sink2 = y;
2929
}
3030
R.partial(f4, [source1])(source2);
31+
32+
const limit = require('call-limit')
33+
function f5(x, y) {
34+
let sink1 = x;
35+
let sink2 = y;
36+
}
37+
const limited = limit(f5, 5)
38+
limited(source1, source2);
39+
40+
function f6(x, y) {
41+
let sink1 = x;
42+
let sink2 = y;
43+
}
44+
_.throttle(f6, 100)(source1, source2);
45+
46+
function f7(x, y) {
47+
let sink1 = x;
48+
let sink2 = y;
49+
}
50+
_.after(3, f7)(source1, source2);
51+
52+
function f8(x, y) {
53+
let sink1 = x;
54+
let sink2 = y;
55+
}
56+
require("throttle-debounce").debounce(1000, false, f8)(source1, source2);

‎javascript/ql/test/query-tests/Security/CWE-352/MissingCsrfMiddlewareGood2.js‎

Lines changed: 92 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,92 @@
1+
var express = require('express');
2+
var cookieParser = require('cookie-parser');
3+
var passport = require('passport');
4+
5+
(function () {
6+
7+
var app = express()
8+
9+
app.use(cookieParser())
10+
app.use(passport.authorize({ session: true }))
11+
12+
function getCsrfToken(request) {
13+
return request.headers['x-xsrf-token'];
14+
}
15+
16+
function setCsrfToken(request, response, next) {
17+
response.cookie('XSRF-TOKEN', request.csrfToken());
18+
next();
19+
}
20+
21+
const csrf = {
22+
getCsrfToken: getCsrfToken,
23+
setCsrfToken: setCsrfToken
24+
};
25+
26+
app.use(express.csrf({ value: csrf.getCsrfToken }));
27+
app.use(csrf.setCsrfToken);
28+
29+
app.post('/changeEmail', function (req, res) {
30+
let newEmail = req.cookies["newEmail"];
31+
})
32+
});
33+
34+
35+
36+
(function () {
37+
var app = express()
38+
39+
app.use(cookieParser())
40+
app.use(passport.authorize({ session: true }))
41+
42+
var crypto = require('crypto');
43+
44+
var generateToken = function (len) {
45+
return crypto.randomBytes(Math.ceil(len * 3 / 4))
46+
.toString('base64')
47+
.slice(0, len);
48+
};
49+
function defaultValue(req) {
50+
return (req.body && req.body._csrf)
51+
|| (req.query && req.query._csrf)
52+
|| (req.headers['x-csrf-token']);
53+
}
54+
var checkToken = function (req, res, next) {
55+
var token = req.session._csrf || (req.session._csrf = generateToken(24));
56+
if ('GET' == req.method || 'HEAD' == req.method || 'OPTIONS' == req.method) return next();
57+
var val = defaultValue(req);
58+
if (val != token) return next(function () {
59+
res.send({ auth: false });
60+
});
61+
next();
62+
}
63+
const csrf = {
64+
check: checkToken
65+
};
66+
67+
app.use(express.cookieParser());
68+
app.use(express.session({ secret: 'thomasdavislovessalmon' }));
69+
app.use(express.bodyParser());
70+
app.use(csrf.check);
71+
72+
app.post('/changeEmail', function (req, res) {
73+
let newEmail = req.cookies["newEmail"];
74+
})
75+
});
76+
77+
(function () {
78+
79+
var app = express()
80+
81+
app.use(cookieParser())
82+
app.use(passport.authorize({ session: true }))
83+
84+
// Assume token is being set somewhere
85+
app.use(express.csrf({ value: function (request) {
86+
return request.headers['x-xsrf-token'];
87+
}}));
88+
89+
app.post('/changeEmail', function (req, res) {
90+
let newEmail = req.cookies["newEmail"];
91+
})
92+
});

0 commit comments

Comments
 (0)