Thanks to visit codestin.com
Credit goes to github.com

Skip to content

Commit 45067ee

Browse files
erik-krogherik-krogh
authored
add command parsing model for "arg"
1 parent 821b4be commit 45067ee

3 files changed

Lines changed: 45 additions & 25 deletions

File tree

‎javascript/ql/src/semmle/javascript/security/dataflow/IndirectCommandInjectionCustomizations.qll‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -49,6 +49,9 @@ module IndirectCommandInjection {
4949
or
5050
// `require('optimist').argv` => `{ _: [], a: ... b: ... }`
5151
this = DataFlow::moduleMember("optimist", "argv")
52+
or
53+
// `require("arg")({...spec})` => `{_: [], a: ..., b: ...}`
54+
this = DataFlow::moduleImport("arg").getACall()
5255
}
5356
}
5457

‎javascript/ql/test/query-tests/Security/CWE-078/IndirectCommandInjection.expected‎

Lines changed: 36 additions & 22 deletions
Original file line numberDiff line numberDiff line change
@@ -115,15 +115,15 @@ nodes
115115
| command-line-parameter-command-injection.js:72:10:72:27 | "cmd.sh " + taint4 |
116116
| command-line-parameter-command-injection.js:72:10:72:27 | "cmd.sh " + taint4 |
117117
| command-line-parameter-command-injection.js:72:22:72:27 | taint4 |
118-
| command-line-parameter-command-injection.js:76:8:76:35 | args |
118+
| command-line-parameter-command-injection.js:76:8:76:35 | argv |
119119
| command-line-parameter-command-injection.js:76:15:76:26 | process.argv |
120120
| command-line-parameter-command-injection.js:76:15:76:26 | process.argv |
121121
| command-line-parameter-command-injection.js:76:15:76:35 | process ... lice(2) |
122-
| command-line-parameter-command-injection.js:79:10:79:39 | "cmd.sh ... gs).foo |
123-
| command-line-parameter-command-injection.js:79:10:79:39 | "cmd.sh ... gs).foo |
124-
| command-line-parameter-command-injection.js:79:22:79:35 | minimist(args) |
125-
| command-line-parameter-command-injection.js:79:22:79:39 | minimist(args).foo |
126-
| command-line-parameter-command-injection.js:79:31:79:34 | args |
122+
| command-line-parameter-command-injection.js:79:10:79:39 | "cmd.sh ... gv).foo |
123+
| command-line-parameter-command-injection.js:79:10:79:39 | "cmd.sh ... gv).foo |
124+
| command-line-parameter-command-injection.js:79:22:79:35 | minimist(argv) |
125+
| command-line-parameter-command-injection.js:79:22:79:39 | minimist(argv).foo |
126+
| command-line-parameter-command-injection.js:79:31:79:34 | argv |
127127
| command-line-parameter-command-injection.js:82:10:82:54 | "cmd.sh ... 2)).foo |
128128
| command-line-parameter-command-injection.js:82:10:82:54 | "cmd.sh ... 2)).foo |
129129
| command-line-parameter-command-injection.js:82:22:82:50 | subarg( ... ice(2)) |
@@ -138,14 +138,21 @@ nodes
138138
| command-line-parameter-command-injection.js:85:34:85:45 | process.argv |
139139
| command-line-parameter-command-injection.js:85:34:85:45 | process.argv |
140140
| command-line-parameter-command-injection.js:85:34:85:54 | process ... lice(2) |
141-
| command-line-parameter-command-injection.js:88:8:88:39 | flags |
142-
| command-line-parameter-command-injection.js:88:16:88:39 | args.pa ... s.argv) |
143-
| command-line-parameter-command-injection.js:88:27:88:38 | process.argv |
144-
| command-line-parameter-command-injection.js:88:27:88:38 | process.argv |
141+
| command-line-parameter-command-injection.js:88:6:88:37 | flags |
142+
| command-line-parameter-command-injection.js:88:14:88:37 | args.pa ... s.argv) |
143+
| command-line-parameter-command-injection.js:88:25:88:36 | process.argv |
144+
| command-line-parameter-command-injection.js:88:25:88:36 | process.argv |
145145
| command-line-parameter-command-injection.js:89:10:89:30 | "cmd.sh ... ags.foo |
146146
| command-line-parameter-command-injection.js:89:10:89:30 | "cmd.sh ... ags.foo |
147147
| command-line-parameter-command-injection.js:89:22:89:26 | flags |
148148
| command-line-parameter-command-injection.js:89:22:89:30 | flags.foo |
149+
| command-line-parameter-command-injection.js:91:6:91:38 | flags |
150+
| command-line-parameter-command-injection.js:91:14:91:38 | require ... .spec}) |
151+
| command-line-parameter-command-injection.js:91:14:91:38 | require ... .spec}) |
152+
| command-line-parameter-command-injection.js:92:10:92:30 | "cmd.sh ... ags.foo |
153+
| command-line-parameter-command-injection.js:92:10:92:30 | "cmd.sh ... ags.foo |
154+
| command-line-parameter-command-injection.js:92:22:92:26 | flags |
155+
| command-line-parameter-command-injection.js:92:22:92:30 | flags.foo |
149156
edges
150157
| command-line-parameter-command-injection.js:4:10:4:21 | process.argv | command-line-parameter-command-injection.js:4:10:4:21 | process.argv |
151158
| command-line-parameter-command-injection.js:8:22:8:33 | process.argv | command-line-parameter-command-injection.js:8:22:8:36 | process.argv[2] |
@@ -248,14 +255,14 @@ edges
248255
| command-line-parameter-command-injection.js:71:20:71:40 | require ... ').argv | command-line-parameter-command-injection.js:71:6:71:16 | [...taint4] |
249256
| command-line-parameter-command-injection.js:72:22:72:27 | taint4 | command-line-parameter-command-injection.js:72:10:72:27 | "cmd.sh " + taint4 |
250257
| command-line-parameter-command-injection.js:72:22:72:27 | taint4 | command-line-parameter-command-injection.js:72:10:72:27 | "cmd.sh " + taint4 |
251-
| command-line-parameter-command-injection.js:76:8:76:35 | args | command-line-parameter-command-injection.js:79:31:79:34 | args |
258+
| command-line-parameter-command-injection.js:76:8:76:35 | argv | command-line-parameter-command-injection.js:79:31:79:34 | argv |
252259
| command-line-parameter-command-injection.js:76:15:76:26 | process.argv | command-line-parameter-command-injection.js:76:15:76:35 | process ... lice(2) |
253260
| command-line-parameter-command-injection.js:76:15:76:26 | process.argv | command-line-parameter-command-injection.js:76:15:76:35 | process ... lice(2) |
254-
| command-line-parameter-command-injection.js:76:15:76:35 | process ... lice(2) | command-line-parameter-command-injection.js:76:8:76:35 | args |
255-
| command-line-parameter-command-injection.js:79:22:79:35 | minimist(args) | command-line-parameter-command-injection.js:79:22:79:39 | minimist(args).foo |
256-
| command-line-parameter-command-injection.js:79:22:79:39 | minimist(args).foo | command-line-parameter-command-injection.js:79:10:79:39 | "cmd.sh ... gs).foo |
257-
| command-line-parameter-command-injection.js:79:22:79:39 | minimist(args).foo | command-line-parameter-command-injection.js:79:10:79:39 | "cmd.sh ... gs).foo |
258-
| command-line-parameter-command-injection.js:79:31:79:34 | args | command-line-parameter-command-injection.js:79:22:79:35 | minimist(args) |
261+
| command-line-parameter-command-injection.js:76:15:76:35 | process ... lice(2) | command-line-parameter-command-injection.js:76:8:76:35 | argv |
262+
| command-line-parameter-command-injection.js:79:22:79:35 | minimist(argv) | command-line-parameter-command-injection.js:79:22:79:39 | minimist(argv).foo |
263+
| command-line-parameter-command-injection.js:79:22:79:39 | minimist(argv).foo | command-line-parameter-command-injection.js:79:10:79:39 | "cmd.sh ... gv).foo |
264+
| command-line-parameter-command-injection.js:79:22:79:39 | minimist(argv).foo | command-line-parameter-command-injection.js:79:10:79:39 | "cmd.sh ... gv).foo |
265+
| command-line-parameter-command-injection.js:79:31:79:34 | argv | command-line-parameter-command-injection.js:79:22:79:35 | minimist(argv) |
259266
| command-line-parameter-command-injection.js:82:22:82:50 | subarg( ... ice(2)) | command-line-parameter-command-injection.js:82:22:82:54 | subarg( ... 2)).foo |
260267
| command-line-parameter-command-injection.js:82:22:82:54 | subarg( ... 2)).foo | command-line-parameter-command-injection.js:82:10:82:54 | "cmd.sh ... 2)).foo |
261268
| command-line-parameter-command-injection.js:82:22:82:54 | subarg( ... 2)).foo | command-line-parameter-command-injection.js:82:10:82:54 | "cmd.sh ... 2)).foo |
@@ -268,13 +275,19 @@ edges
268275
| command-line-parameter-command-injection.js:85:34:85:45 | process.argv | command-line-parameter-command-injection.js:85:34:85:54 | process ... lice(2) |
269276
| command-line-parameter-command-injection.js:85:34:85:45 | process.argv | command-line-parameter-command-injection.js:85:34:85:54 | process ... lice(2) |
270277
| command-line-parameter-command-injection.js:85:34:85:54 | process ... lice(2) | command-line-parameter-command-injection.js:85:22:85:55 | yargsPa ... ice(2)) |
271-
| command-line-parameter-command-injection.js:88:8:88:39 | flags | command-line-parameter-command-injection.js:89:22:89:26 | flags |
272-
| command-line-parameter-command-injection.js:88:16:88:39 | args.pa ... s.argv) | command-line-parameter-command-injection.js:88:8:88:39 | flags |
273-
| command-line-parameter-command-injection.js:88:27:88:38 | process.argv | command-line-parameter-command-injection.js:88:16:88:39 | args.pa ... s.argv) |
274-
| command-line-parameter-command-injection.js:88:27:88:38 | process.argv | command-line-parameter-command-injection.js:88:16:88:39 | args.pa ... s.argv) |
278+
| command-line-parameter-command-injection.js:88:6:88:37 | flags | command-line-parameter-command-injection.js:89:22:89:26 | flags |
279+
| command-line-parameter-command-injection.js:88:14:88:37 | args.pa ... s.argv) | command-line-parameter-command-injection.js:88:6:88:37 | flags |
280+
| command-line-parameter-command-injection.js:88:25:88:36 | process.argv | command-line-parameter-command-injection.js:88:14:88:37 | args.pa ... s.argv) |
281+
| command-line-parameter-command-injection.js:88:25:88:36 | process.argv | command-line-parameter-command-injection.js:88:14:88:37 | args.pa ... s.argv) |
275282
| command-line-parameter-command-injection.js:89:22:89:26 | flags | command-line-parameter-command-injection.js:89:22:89:30 | flags.foo |
276283
| command-line-parameter-command-injection.js:89:22:89:30 | flags.foo | command-line-parameter-command-injection.js:89:10:89:30 | "cmd.sh ... ags.foo |
277284
| command-line-parameter-command-injection.js:89:22:89:30 | flags.foo | command-line-parameter-command-injection.js:89:10:89:30 | "cmd.sh ... ags.foo |
285+
| command-line-parameter-command-injection.js:91:6:91:38 | flags | command-line-parameter-command-injection.js:92:22:92:26 | flags |
286+
| command-line-parameter-command-injection.js:91:14:91:38 | require ... .spec}) | command-line-parameter-command-injection.js:91:6:91:38 | flags |
287+
| command-line-parameter-command-injection.js:91:14:91:38 | require ... .spec}) | command-line-parameter-command-injection.js:91:6:91:38 | flags |
288+
| command-line-parameter-command-injection.js:92:22:92:26 | flags | command-line-parameter-command-injection.js:92:22:92:30 | flags.foo |
289+
| command-line-parameter-command-injection.js:92:22:92:30 | flags.foo | command-line-parameter-command-injection.js:92:10:92:30 | "cmd.sh ... ags.foo |
290+
| command-line-parameter-command-injection.js:92:22:92:30 | flags.foo | command-line-parameter-command-injection.js:92:10:92:30 | "cmd.sh ... ags.foo |
278291
#select
279292
| command-line-parameter-command-injection.js:4:10:4:21 | process.argv | command-line-parameter-command-injection.js:4:10:4:21 | process.argv | command-line-parameter-command-injection.js:4:10:4:21 | process.argv | This command depends on an unsanitized $@. | command-line-parameter-command-injection.js:4:10:4:21 | process.argv | command-line argument |
280293
| command-line-parameter-command-injection.js:8:10:8:36 | "cmd.sh ... argv[2] | command-line-parameter-command-injection.js:8:22:8:33 | process.argv | command-line-parameter-command-injection.js:8:10:8:36 | "cmd.sh ... argv[2] | This command depends on an unsanitized $@. | command-line-parameter-command-injection.js:8:22:8:33 | process.argv | command-line argument |
@@ -296,7 +309,8 @@ edges
296309
| command-line-parameter-command-injection.js:66:10:66:31 | "cmd.sh ... nt2rest | command-line-parameter-command-injection.js:58:17:58:40 | require ... parse() | command-line-parameter-command-injection.js:66:10:66:31 | "cmd.sh ... nt2rest | This command depends on an unsanitized $@. | command-line-parameter-command-injection.js:58:17:58:40 | require ... parse() | command-line argument |
297310
| command-line-parameter-command-injection.js:69:10:69:27 | "cmd.sh " + taint3 | command-line-parameter-command-injection.js:68:20:68:40 | require ... ').argv | command-line-parameter-command-injection.js:69:10:69:27 | "cmd.sh " + taint3 | This command depends on an unsanitized $@. | command-line-parameter-command-injection.js:68:20:68:40 | require ... ').argv | command-line argument |
298311
| command-line-parameter-command-injection.js:72:10:72:27 | "cmd.sh " + taint4 | command-line-parameter-command-injection.js:71:20:71:40 | require ... ').argv | command-line-parameter-command-injection.js:72:10:72:27 | "cmd.sh " + taint4 | This command depends on an unsanitized $@. | command-line-parameter-command-injection.js:71:20:71:40 | require ... ').argv | command-line argument |
299-
| command-line-parameter-command-injection.js:79:10:79:39 | "cmd.sh ... gs).foo | command-line-parameter-command-injection.js:76:15:76:26 | process.argv | command-line-parameter-command-injection.js:79:10:79:39 | "cmd.sh ... gs).foo | This command depends on an unsanitized $@. | command-line-parameter-command-injection.js:76:15:76:26 | process.argv | command-line argument |
312+
| command-line-parameter-command-injection.js:79:10:79:39 | "cmd.sh ... gv).foo | command-line-parameter-command-injection.js:76:15:76:26 | process.argv | command-line-parameter-command-injection.js:79:10:79:39 | "cmd.sh ... gv).foo | This command depends on an unsanitized $@. | command-line-parameter-command-injection.js:76:15:76:26 | process.argv | command-line argument |
300313
| command-line-parameter-command-injection.js:82:10:82:54 | "cmd.sh ... 2)).foo | command-line-parameter-command-injection.js:82:29:82:40 | process.argv | command-line-parameter-command-injection.js:82:10:82:54 | "cmd.sh ... 2)).foo | This command depends on an unsanitized $@. | command-line-parameter-command-injection.js:82:29:82:40 | process.argv | command-line argument |
301314
| command-line-parameter-command-injection.js:85:10:85:59 | "cmd.sh ... 2)).foo | command-line-parameter-command-injection.js:85:34:85:45 | process.argv | command-line-parameter-command-injection.js:85:10:85:59 | "cmd.sh ... 2)).foo | This command depends on an unsanitized $@. | command-line-parameter-command-injection.js:85:34:85:45 | process.argv | command-line argument |
302-
| command-line-parameter-command-injection.js:89:10:89:30 | "cmd.sh ... ags.foo | command-line-parameter-command-injection.js:88:27:88:38 | process.argv | command-line-parameter-command-injection.js:89:10:89:30 | "cmd.sh ... ags.foo | This command depends on an unsanitized $@. | command-line-parameter-command-injection.js:88:27:88:38 | process.argv | command-line argument |
315+
| command-line-parameter-command-injection.js:89:10:89:30 | "cmd.sh ... ags.foo | command-line-parameter-command-injection.js:88:25:88:36 | process.argv | command-line-parameter-command-injection.js:89:10:89:30 | "cmd.sh ... ags.foo | This command depends on an unsanitized $@. | command-line-parameter-command-injection.js:88:25:88:36 | process.argv | command-line argument |
316+
| command-line-parameter-command-injection.js:92:10:92:30 | "cmd.sh ... ags.foo | command-line-parameter-command-injection.js:91:14:91:38 | require ... .spec}) | command-line-parameter-command-injection.js:92:10:92:30 | "cmd.sh ... ags.foo | This command depends on an unsanitized $@. | command-line-parameter-command-injection.js:91:14:91:38 | require ... .spec}) | command-line argument |

‎javascript/ql/test/query-tests/Security/CWE-078/command-line-parameter-command-injection.js‎

Lines changed: 6 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -73,10 +73,10 @@ cp.exec("cmd.sh " + require("optimist").argv.foo); // NOT OK
7373
});
7474

7575
(function () {
76-
const args = process.argv.slice(2);
76+
const argv = process.argv.slice(2);
7777

7878
var minimist = require("minimist");
79-
cp.exec("cmd.sh " + minimist(args).foo); // NOT OK
79+
cp.exec("cmd.sh " + minimist(argv).foo); // NOT OK
8080

8181
var subarg = require('subarg');
8282
cp.exec("cmd.sh " + subarg(process.argv.slice(2)).foo); // NOT OK
@@ -85,6 +85,9 @@ cp.exec("cmd.sh " + require("optimist").argv.foo); // NOT OK
8585
cp.exec("cmd.sh " + yargsParser(process.argv.slice(2)).foo); // NOT OK
8686

8787
import args from 'args'
88-
const flags = args.parse(process.argv);
88+
var flags = args.parse(process.argv);
89+
cp.exec("cmd.sh " + flags.foo); // NOT OK
90+
91+
var flags = require('arg')({...spec});
8992
cp.exec("cmd.sh " + flags.foo); // NOT OK
9093
})

0 commit comments

Comments
 (0)