Thanks to visit codestin.com
Credit goes to github.com

Skip to content

Commit 3f67e90

Browse files
esbenaesbena
committed
JS: rename query, support timeouts, add documentation, add to suite
1 parent d9d8eb4 commit 3f67e90

25 files changed

Lines changed: 759 additions & 404 deletions

‎change-notes/1.25/analysis-javascript.md‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -37,6 +37,7 @@
3737
| Unsafe expansion of self-closing HTML tag (`js/unsafe-html-expansion`) | security, external/cwe/cwe-079, external/cwe/cwe-116 | Highlights potential XSS vulnerabilities caused by unsafe expansion of self-closing HTML tags. |
3838
| Unsafe shell command constructed from library input (`js/shell-command-constructed-from-input`) | correctness, security, external/cwe/cwe-078, external/cwe/cwe-088 | Highlights potential command injections due to a shell command being constructed from library inputs. Results are shown on LGTM by default. |
3939
| Improper code sanitization (`js/bad-code-sanitization`) | security, external/cwe/cwe-094, external/cwe/cwe-079, external/cwe/cwe-116 | Highlights string concatenation where code is constructed without proper sanitization. Results are shown on LGTM by default. |
40+
| Resource exhaustion (`js/resource-exhaustion`) | security, external/cwe/cwe-770 | Highlights operations that may cause the resources of the application to be exhausted. Results are shown on LGTM by default. |
4041

4142
## Changes to existing queries
4243

‎javascript/config/suites/javascript/security‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -44,6 +44,7 @@
4444
+ semmlecode-javascript-queries/Security/CWE-730/RegExpInjection.ql: /Security/CWE/CWE-730
4545
+ semmlecode-javascript-queries/Security/CWE-754/UnvalidatedDynamicMethodCall.ql: /Security/CWE/CWE-754
4646
+ semmlecode-javascript-queries/Security/CWE-770/MissingRateLimiting.ql: /Security/CWE/CWE-770
47+
+ semmlecode-javascript-queries/Security/CWE-770/ResourceExhaustion.ql: /Security/CWE/CWE-770
4748
+ semmlecode-javascript-queries/Security/CWE-776/XmlBomb.ql: /Security/CWE/CWE-776
4849
+ semmlecode-javascript-queries/Security/CWE-798/HardcodedCredentials.ql: /Security/CWE/CWE-798
4950
+ semmlecode-javascript-queries/Security/CWE-807/ConditionalBypass.ql: /Security/CWE/CWE-807

‎javascript/ql/src/Security/CWE-770/MemoryExhaustion.qhelp‎

Lines changed: 0 additions & 22 deletions
This file was deleted.

‎javascript/ql/src/Security/CWE-770/MemoryExhaustion.ql‎

Lines changed: 0 additions & 225 deletions
This file was deleted.

‎javascript/ql/src/Security/CWE-770/ResourceExhaustion.qhelp‎

Lines changed: 82 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,82 @@
1+
<!DOCTYPE qhelp PUBLIC
2+
"-//Semmle//qhelp//EN"
3+
"qhelp.dtd">
4+
<qhelp>
5+
6+
<overview>
7+
8+
Applications are constrained by how many resources they can make use
9+
of, failing to respect these constraints may cause the application to
10+
be unresponsive or crash. It is therefore be problematic if attackers
11+
can control the sizes or lifetimes of allocated objects.
12+
13+
</overview>
14+
15+
<recommendation>
16+
17+
Ensure that attackers can not control object sizes and their
18+
lifetimes. If object sizes and lifetimes must be controlled by
19+
external parties, ensure to restrict the object sizes and lifetimes to
20+
be within accptable ranges.
21+
22+
</recommendation>
23+
24+
<example>
25+
26+
The following example allocates a buffer with a user-controlled
27+
size.
28+
29+
<sample src="examples/ResourceExhaustion_buffer.js" />
30+
31+
This is problematic since an attacker can choose a size
32+
that makes the application run out of memory. Even worse, in older
33+
versions of Node.js, this could leak confidential memory.
34+
35+
To prevent such attacks, limit the buffer size:
36+
37+
<sample src="examples/ResourceExhaustion_buffer_fixed.js" />
38+
39+
</example>
40+
41+
<example>
42+
43+
As another example, consider an application that allocates an
44+
array with a user-controlled size, and then fills it with values:
45+
46+
<sample src="examples/ResourceExhaustion_array.js" />
47+
48+
The allocation of the array itself is not problematic since arrays are
49+
allocated sparsely, but the subsequent filling of the array will take
50+
a long time, causing the application to be unresponsive, or even run
51+
out of memory.
52+
53+
Again, a limit on the size will prevent the attack:
54+
55+
<sample src="examples/ResourceExhaustion_array_fixed.js" />
56+
57+
</example>
58+
59+
<example>
60+
61+
Finally, the following example lets a user choose delay after
62+
which a function is executed:
63+
64+
<sample src="examples/ResourceExhaustion_timeout.js" />
65+
66+
This is problematic because a large delay essentially makes the
67+
application wait indefinitely before executing the function. Repeated
68+
registrations of such delays will therefore use up all of the memory
69+
in the application.
70+
71+
Again, a limit on the delay will prevent the attack:
72+
73+
<sample src="examples/ResourceExhaustion_timeout_fixed.js" />
74+
75+
76+
</example>
77+
78+
<references>
79+
80+
</references>
81+
82+
</qhelp>

‎javascript/ql/src/Security/CWE-770/ResourceExhaustion.ql‎

Lines changed: 20 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,20 @@
1+
/**
2+
* @name Resource exhaustion
3+
* @description Allocating objects or timers with user-controlled
4+
* sizes or durations can cause resource exhaustion.
5+
* @kind path-problem
6+
* @problem.severity warning
7+
* @id js/resource-exhaustion
8+
* @precision high
9+
* @tags security
10+
* external/cwe/cwe-770
11+
*/
12+
13+
import javascript
14+
import DataFlow::PathGraph
15+
import semmle.javascript.security.dataflow.ResourceExhaustion::ResourceExhaustion
16+
17+
from Configuration dataflow, DataFlow::PathNode source, DataFlow::PathNode sink
18+
where dataflow.hasFlowPath(source, sink)
19+
select sink, source, sink, sink.getNode().(Sink).getProblemDescription() + " from $@.", source,
20+
"here"

‎javascript/ql/src/Security/CWE-770/examples/ResourceExhaustion_array.js‎

Lines changed: 10 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,10 @@
1+
var http = require("http"),
2+
url = require("url");
3+
4+
var server = http.createServer(function(req, res) {
5+
var size = parseInt(url.parse(req.url, true).query.size);
6+
7+
let dogs = new Array(size).fill(x => "dog"); // BAD
8+
9+
// ... use the dogs
10+
});

‎javascript/ql/src/Security/CWE-770/examples/ResourceExhaustion_array_fixed.js‎

Lines changed: 16 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,16 @@
1+
var http = require("http"),
2+
url = require("url");
3+
4+
var server = http.createServer(function(req, res) {
5+
var size = parseInt(url.parse(req.url, true).query.size);
6+
7+
if (size > 1024) {
8+
res.statusCode = 400;
9+
res.end("Bad request.");
10+
return;
11+
}
12+
13+
let dogs = new Array(size).fill(x => "dog"); // GOOD
14+
15+
// ... use the dogs
16+
});

0 commit comments

Comments
 (0)