Thanks to visit codestin.com
Credit goes to github.com

Skip to content

Commit 32022cc

Browse files
asgerfasgerf
committed
JS: Port UnsafeCodeConstruction
1 parent 5af608c commit 32022cc

3 files changed

Lines changed: 43 additions & 121 deletions

File tree

‎javascript/ql/lib/semmle/javascript/security/dataflow/UnsafeCodeConstruction.qll‎

Lines changed: 28 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -19,7 +19,34 @@ module UnsafeCodeConstruction {
1919
/**
2020
* A taint-tracking configuration for reasoning about unsafe code constructed from library input.
2121
*/
22-
class Configuration extends TaintTracking::Configuration {
22+
module UnsafeCodeConstructionConfig implements DataFlow::ConfigSig {
23+
predicate isSource(DataFlow::Node source) { source instanceof Source }
24+
25+
predicate isSink(DataFlow::Node sink) { sink instanceof Sink }
26+
27+
predicate isBarrier(DataFlow::Node node) { node instanceof CodeInjection::Sanitizer }
28+
29+
predicate isAdditionalFlowStep(DataFlow::Node src, DataFlow::Node trg) {
30+
// HTML sanitizers are insufficient protection against code injection
31+
src = trg.(HtmlSanitizerCall).getInput()
32+
or
33+
none()
34+
// TODO: localFieldStep is too expensive with dataflow2
35+
// DataFlow::localFieldStep(pred, succ)
36+
}
37+
38+
DataFlow::FlowFeature getAFeature() { result instanceof DataFlow::FeatureHasSourceCallContext }
39+
}
40+
41+
/**
42+
* Taint-tracking for reasoning about unsafe code constructed from library input.
43+
*/
44+
module UnsafeCodeConstructionFlow = TaintTracking::Global<UnsafeCodeConstructionConfig>;
45+
46+
/**
47+
* DEPRECATED. Use the `UnsafeCodeConstructionFlow` module instead.
48+
*/
49+
deprecated class Configuration extends TaintTracking::Configuration {
2350
Configuration() { this = "UnsafeCodeConstruction" }
2451

2552
override predicate isSource(DataFlow::Node source) { source instanceof Source }

‎javascript/ql/src/Security/CWE-094/UnsafeCodeConstruction.ql‎

Lines changed: 5 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -14,11 +14,13 @@
1414
*/
1515

1616
import javascript
17-
import DataFlow::PathGraph
1817
import semmle.javascript.security.dataflow.UnsafeCodeConstruction::UnsafeCodeConstruction
18+
import UnsafeCodeConstructionFlow::PathGraph
1919

20-
from Configuration cfg, DataFlow::PathNode source, DataFlow::PathNode sink, Sink sinkNode
21-
where cfg.hasFlowPath(source, sink) and sinkNode = sink.getNode()
20+
from
21+
UnsafeCodeConstructionFlow::PathNode source, UnsafeCodeConstructionFlow::PathNode sink,
22+
Sink sinkNode
23+
where UnsafeCodeConstructionFlow::flowPath(source, sink) and sinkNode = sink.getNode()
2224
select sink.getNode(), source, sink,
2325
"This " + sinkNode.getSinkType() + " which depends on $@ is later $@.", source.getNode(),
2426
"library input", sinkNode.getCodeSink(), "interpreted as code"

‎javascript/ql/test/query-tests/Security/CWE-094/CodeInjection/UnsafeCodeConstruction.expected‎

Lines changed: 10 additions & 117 deletions
Original file line numberDiff line numberDiff line change
@@ -1,127 +1,20 @@
1-
nodes
2-
| lib/index.js:1:35:1:38 | data |
3-
| lib/index.js:1:35:1:38 | data |
4-
| lib/index.js:2:21:2:24 | data |
5-
| lib/index.js:2:21:2:24 | data |
6-
| lib/index.js:5:35:5:38 | name |
7-
| lib/index.js:5:35:5:38 | name |
8-
| lib/index.js:6:26:6:29 | name |
9-
| lib/index.js:6:26:6:29 | name |
10-
| lib/index.js:13:38:13:41 | data |
11-
| lib/index.js:13:38:13:41 | data |
12-
| lib/index.js:14:21:14:24 | data |
13-
| lib/index.js:14:21:14:24 | data |
14-
| lib/index.js:19:26:19:29 | data |
15-
| lib/index.js:19:26:19:29 | data |
16-
| lib/index.js:22:7:22:10 | data |
17-
| lib/index.js:22:7:22:10 | data |
18-
| lib/index.js:41:32:41:35 | opts |
19-
| lib/index.js:41:32:41:35 | opts |
20-
| lib/index.js:42:3:42:19 | opts |
21-
| lib/index.js:42:10:42:13 | opts |
22-
| lib/index.js:42:10:42:19 | opts \|\| {} |
23-
| lib/index.js:44:21:44:24 | opts |
24-
| lib/index.js:44:21:44:32 | opts.varName |
25-
| lib/index.js:51:21:51:32 | opts.varName |
26-
| lib/index.js:51:21:51:32 | opts.varName |
27-
| lib/index.js:51:21:51:32 | opts.varName |
28-
| lib/index.js:86:15:86:19 | taint |
29-
| lib/index.js:86:15:86:19 | taint |
30-
| lib/index.js:87:18:87:22 | taint |
31-
| lib/index.js:89:36:89:40 | taint |
32-
| lib/index.js:93:32:93:36 | taint |
33-
| lib/index.js:98:30:98:34 | taint |
34-
| lib/index.js:103:21:103:47 | this.op ... dOption |
35-
| lib/index.js:103:21:103:47 | this.op ... dOption |
36-
| lib/index.js:104:21:104:47 | this.op ... dOption |
37-
| lib/index.js:104:21:104:47 | this.op ... dOption |
38-
| lib/index.js:105:21:105:47 | this.op ... dOption |
39-
| lib/index.js:105:21:105:47 | this.op ... dOption |
40-
| lib/index.js:106:21:106:30 | this.taint |
41-
| lib/index.js:106:21:106:30 | this.taint |
42-
| lib/index.js:112:17:112:21 | taint |
43-
| lib/index.js:112:17:112:21 | taint |
44-
| lib/index.js:113:20:113:24 | taint |
45-
| lib/index.js:115:38:115:42 | taint |
46-
| lib/index.js:121:34:121:38 | taint |
47-
| lib/index.js:129:32:129:36 | taint |
48-
| lib/index.js:135:23:135:49 | this.op ... dOption |
49-
| lib/index.js:135:23:135:49 | this.op ... dOption |
50-
| lib/index.js:136:23:136:49 | this.op ... dOption |
51-
| lib/index.js:136:23:136:49 | this.op ... dOption |
52-
| lib/index.js:137:23:137:49 | this.op ... dOption |
53-
| lib/index.js:137:23:137:49 | this.op ... dOption |
54-
| lib/index.js:138:23:138:32 | this.taint |
55-
| lib/index.js:138:23:138:32 | this.taint |
561
edges
572
| lib/index.js:1:35:1:38 | data | lib/index.js:2:21:2:24 | data |
58-
| lib/index.js:1:35:1:38 | data | lib/index.js:2:21:2:24 | data |
59-
| lib/index.js:1:35:1:38 | data | lib/index.js:2:21:2:24 | data |
60-
| lib/index.js:1:35:1:38 | data | lib/index.js:2:21:2:24 | data |
61-
| lib/index.js:5:35:5:38 | name | lib/index.js:6:26:6:29 | name |
62-
| lib/index.js:5:35:5:38 | name | lib/index.js:6:26:6:29 | name |
63-
| lib/index.js:5:35:5:38 | name | lib/index.js:6:26:6:29 | name |
643
| lib/index.js:5:35:5:38 | name | lib/index.js:6:26:6:29 | name |
654
| lib/index.js:13:38:13:41 | data | lib/index.js:14:21:14:24 | data |
66-
| lib/index.js:13:38:13:41 | data | lib/index.js:14:21:14:24 | data |
67-
| lib/index.js:13:38:13:41 | data | lib/index.js:14:21:14:24 | data |
68-
| lib/index.js:13:38:13:41 | data | lib/index.js:14:21:14:24 | data |
69-
| lib/index.js:19:26:19:29 | data | lib/index.js:22:7:22:10 | data |
705
| lib/index.js:19:26:19:29 | data | lib/index.js:22:7:22:10 | data |
71-
| lib/index.js:19:26:19:29 | data | lib/index.js:22:7:22:10 | data |
72-
| lib/index.js:19:26:19:29 | data | lib/index.js:22:7:22:10 | data |
73-
| lib/index.js:41:32:41:35 | opts | lib/index.js:42:10:42:13 | opts |
74-
| lib/index.js:41:32:41:35 | opts | lib/index.js:42:10:42:13 | opts |
75-
| lib/index.js:42:3:42:19 | opts | lib/index.js:44:21:44:24 | opts |
76-
| lib/index.js:42:10:42:13 | opts | lib/index.js:42:10:42:19 | opts \|\| {} |
77-
| lib/index.js:42:10:42:19 | opts \|\| {} | lib/index.js:42:3:42:19 | opts |
78-
| lib/index.js:44:21:44:24 | opts | lib/index.js:44:21:44:32 | opts.varName |
79-
| lib/index.js:44:21:44:32 | opts.varName | lib/index.js:51:21:51:32 | opts.varName |
80-
| lib/index.js:44:21:44:32 | opts.varName | lib/index.js:51:21:51:32 | opts.varName |
81-
| lib/index.js:44:21:44:32 | opts.varName | lib/index.js:51:21:51:32 | opts.varName |
82-
| lib/index.js:86:15:86:19 | taint | lib/index.js:87:18:87:22 | taint |
83-
| lib/index.js:86:15:86:19 | taint | lib/index.js:87:18:87:22 | taint |
84-
| lib/index.js:86:15:86:19 | taint | lib/index.js:89:36:89:40 | taint |
85-
| lib/index.js:86:15:86:19 | taint | lib/index.js:89:36:89:40 | taint |
86-
| lib/index.js:86:15:86:19 | taint | lib/index.js:93:32:93:36 | taint |
87-
| lib/index.js:86:15:86:19 | taint | lib/index.js:93:32:93:36 | taint |
88-
| lib/index.js:86:15:86:19 | taint | lib/index.js:98:30:98:34 | taint |
89-
| lib/index.js:86:15:86:19 | taint | lib/index.js:98:30:98:34 | taint |
90-
| lib/index.js:87:18:87:22 | taint | lib/index.js:106:21:106:30 | this.taint |
91-
| lib/index.js:87:18:87:22 | taint | lib/index.js:106:21:106:30 | this.taint |
92-
| lib/index.js:89:36:89:40 | taint | lib/index.js:103:21:103:47 | this.op ... dOption |
93-
| lib/index.js:89:36:89:40 | taint | lib/index.js:103:21:103:47 | this.op ... dOption |
94-
| lib/index.js:93:32:93:36 | taint | lib/index.js:104:21:104:47 | this.op ... dOption |
95-
| lib/index.js:93:32:93:36 | taint | lib/index.js:104:21:104:47 | this.op ... dOption |
96-
| lib/index.js:98:30:98:34 | taint | lib/index.js:105:21:105:47 | this.op ... dOption |
97-
| lib/index.js:98:30:98:34 | taint | lib/index.js:105:21:105:47 | this.op ... dOption |
98-
| lib/index.js:112:17:112:21 | taint | lib/index.js:113:20:113:24 | taint |
99-
| lib/index.js:112:17:112:21 | taint | lib/index.js:113:20:113:24 | taint |
100-
| lib/index.js:112:17:112:21 | taint | lib/index.js:115:38:115:42 | taint |
101-
| lib/index.js:112:17:112:21 | taint | lib/index.js:115:38:115:42 | taint |
102-
| lib/index.js:112:17:112:21 | taint | lib/index.js:121:34:121:38 | taint |
103-
| lib/index.js:112:17:112:21 | taint | lib/index.js:121:34:121:38 | taint |
104-
| lib/index.js:112:17:112:21 | taint | lib/index.js:129:32:129:36 | taint |
105-
| lib/index.js:112:17:112:21 | taint | lib/index.js:129:32:129:36 | taint |
106-
| lib/index.js:113:20:113:24 | taint | lib/index.js:138:23:138:32 | this.taint |
107-
| lib/index.js:113:20:113:24 | taint | lib/index.js:138:23:138:32 | this.taint |
108-
| lib/index.js:115:38:115:42 | taint | lib/index.js:135:23:135:49 | this.op ... dOption |
109-
| lib/index.js:115:38:115:42 | taint | lib/index.js:135:23:135:49 | this.op ... dOption |
110-
| lib/index.js:121:34:121:38 | taint | lib/index.js:136:23:136:49 | this.op ... dOption |
111-
| lib/index.js:121:34:121:38 | taint | lib/index.js:136:23:136:49 | this.op ... dOption |
112-
| lib/index.js:129:32:129:36 | taint | lib/index.js:137:23:137:49 | this.op ... dOption |
113-
| lib/index.js:129:32:129:36 | taint | lib/index.js:137:23:137:49 | this.op ... dOption |
6+
nodes
7+
| lib/index.js:1:35:1:38 | data | semmle.label | data |
8+
| lib/index.js:2:21:2:24 | data | semmle.label | data |
9+
| lib/index.js:5:35:5:38 | name | semmle.label | name |
10+
| lib/index.js:6:26:6:29 | name | semmle.label | name |
11+
| lib/index.js:13:38:13:41 | data | semmle.label | data |
12+
| lib/index.js:14:21:14:24 | data | semmle.label | data |
13+
| lib/index.js:19:26:19:29 | data | semmle.label | data |
14+
| lib/index.js:22:7:22:10 | data | semmle.label | data |
15+
subpaths
11416
#select
11517
| lib/index.js:2:21:2:24 | data | lib/index.js:1:35:1:38 | data | lib/index.js:2:21:2:24 | data | This string concatenation which depends on $@ is later $@. | lib/index.js:1:35:1:38 | data | library input | lib/index.js:2:15:2:30 | "(" + data + ")" | interpreted as code |
11618
| lib/index.js:6:26:6:29 | name | lib/index.js:5:35:5:38 | name | lib/index.js:6:26:6:29 | name | This string concatenation which depends on $@ is later $@. | lib/index.js:5:35:5:38 | name | library input | lib/index.js:6:17:6:29 | "obj." + name | interpreted as code |
11719
| lib/index.js:14:21:14:24 | data | lib/index.js:13:38:13:41 | data | lib/index.js:14:21:14:24 | data | This string concatenation which depends on $@ is later $@. | lib/index.js:13:38:13:41 | data | library input | lib/index.js:14:15:14:30 | "(" + data + ")" | interpreted as code |
11820
| lib/index.js:22:7:22:10 | data | lib/index.js:19:26:19:29 | data | lib/index.js:22:7:22:10 | data | This string concatenation which depends on $@ is later $@. | lib/index.js:19:26:19:29 | data | library input | lib/index.js:25:24:25:26 | str | interpreted as code |
119-
| lib/index.js:51:21:51:32 | opts.varName | lib/index.js:41:32:41:35 | opts | lib/index.js:51:21:51:32 | opts.varName | This string concatenation which depends on $@ is later $@. | lib/index.js:41:32:41:35 | opts | library input | lib/index.js:51:10:51:52 | " var ... ing();" | interpreted as code |
120-
| lib/index.js:103:21:103:47 | this.op ... dOption | lib/index.js:86:15:86:19 | taint | lib/index.js:103:21:103:47 | this.op ... dOption | This string concatenation which depends on $@ is later $@. | lib/index.js:86:15:86:19 | taint | library input | lib/index.js:103:10:103:67 | " var ... ing();" | interpreted as code |
121-
| lib/index.js:104:21:104:47 | this.op ... dOption | lib/index.js:86:15:86:19 | taint | lib/index.js:104:21:104:47 | this.op ... dOption | This string concatenation which depends on $@ is later $@. | lib/index.js:86:15:86:19 | taint | library input | lib/index.js:104:10:104:67 | " var ... ing();" | interpreted as code |
122-
| lib/index.js:105:21:105:47 | this.op ... dOption | lib/index.js:86:15:86:19 | taint | lib/index.js:105:21:105:47 | this.op ... dOption | This string concatenation which depends on $@ is later $@. | lib/index.js:86:15:86:19 | taint | library input | lib/index.js:105:10:105:67 | " var ... ing();" | interpreted as code |
123-
| lib/index.js:106:21:106:30 | this.taint | lib/index.js:86:15:86:19 | taint | lib/index.js:106:21:106:30 | this.taint | This string concatenation which depends on $@ is later $@. | lib/index.js:86:15:86:19 | taint | library input | lib/index.js:106:10:106:50 | " var ... ing();" | interpreted as code |
124-
| lib/index.js:135:23:135:49 | this.op ... dOption | lib/index.js:112:17:112:21 | taint | lib/index.js:135:23:135:49 | this.op ... dOption | This string concatenation which depends on $@ is later $@. | lib/index.js:112:17:112:21 | taint | library input | lib/index.js:135:12:135:69 | " var ... ing();" | interpreted as code |
125-
| lib/index.js:136:23:136:49 | this.op ... dOption | lib/index.js:112:17:112:21 | taint | lib/index.js:136:23:136:49 | this.op ... dOption | This string concatenation which depends on $@ is later $@. | lib/index.js:112:17:112:21 | taint | library input | lib/index.js:136:12:136:69 | " var ... ing();" | interpreted as code |
126-
| lib/index.js:137:23:137:49 | this.op ... dOption | lib/index.js:112:17:112:21 | taint | lib/index.js:137:23:137:49 | this.op ... dOption | This string concatenation which depends on $@ is later $@. | lib/index.js:112:17:112:21 | taint | library input | lib/index.js:137:12:137:69 | " var ... ing();" | interpreted as code |
127-
| lib/index.js:138:23:138:32 | this.taint | lib/index.js:112:17:112:21 | taint | lib/index.js:138:23:138:32 | this.taint | This string concatenation which depends on $@ is later $@. | lib/index.js:112:17:112:21 | taint | library input | lib/index.js:138:12:138:52 | " var ... ing();" | interpreted as code |

0 commit comments

Comments
 (0)