JS: Port ReflectedXss

asgerf · asgerf · commit 46b90e51fc81 · 2023-10-13T13:15:03.000+02:00
diff --git a/javascript/ql/lib/semmle/javascript/security/dataflow/ReflectedXssQuery.qll b/javascript/ql/lib/semmle/javascript/security/dataflow/ReflectedXssQuery.qll
@@ -5,12 +5,30 @@
 
 import javascript
 import ReflectedXssCustomizations::ReflectedXss
-private import Xss::Shared as Shared
+private import Xss::Shared as SharedXss
 
 /**
- * A taint-tracking configuration for reasoning about XSS.
+ * A taint-tracking configuration for reasoning about reflected XSS.
  */
-class Configuration extends TaintTracking::Configuration {
+module ReflectedXssConfig implements DataFlow::ConfigSig {
+  predicate isSource(DataFlow::Node source) { source instanceof Source }
+
+  predicate isSink(DataFlow::Node sink) { sink instanceof Sink }
+
+  predicate isBarrier(DataFlow::Node node) {
+    node instanceof Sanitizer or node = SharedXss::BarrierGuard::getABarrierNode()
+  }
+}
+
+/**
+ * Taint-tracking for reasoning about reflected XSS.
+ */
+module ReflectedXssFlow = TaintTracking::Global<ReflectedXssConfig>;
+
+/**
+ * DEPRECATED. Use the `ReflectedXssFlow` module instead.
+ */
+deprecated class Configuration extends TaintTracking::Configuration {
   Configuration() { this = "ReflectedXss" }
 
   override predicate isSource(DataFlow::Node source) { source instanceof Source }
@@ -28,11 +46,10 @@ class Configuration extends TaintTracking::Configuration {
   }
 }
 
-private class QuoteGuard extends TaintTracking::SanitizerGuardNode, Shared::QuoteGuard {
+private class QuoteGuard extends SharedXss::QuoteGuard {
   QuoteGuard() { this = this }
 }
 
-private class ContainsHtmlGuard extends TaintTracking::SanitizerGuardNode, Shared::ContainsHtmlGuard
-{
+private class ContainsHtmlGuard extends SharedXss::ContainsHtmlGuard {
   ContainsHtmlGuard() { this = this }
 }
diff --git a/javascript/ql/src/Security/CWE-079/ReflectedXss.ql b/javascript/ql/src/Security/CWE-079/ReflectedXss.ql
@@ -14,9 +14,9 @@
 
 import javascript
 import semmle.javascript.security.dataflow.ReflectedXssQuery
-import DataFlow::PathGraph
+import ReflectedXssFlow::PathGraph
 
-from Configuration cfg, DataFlow::PathNode source, DataFlow::PathNode sink
-where cfg.hasFlowPath(source, sink)
+from ReflectedXssFlow::PathNode source, ReflectedXssFlow::PathNode sink
+where ReflectedXssFlow::flowPath(source, sink)
 select sink.getNode(), source, sink, "Cross-site scripting vulnerability due to a $@.",
   source.getNode(), "user-provided value"
diff --git a/javascript/ql/test/query-tests/Security/CWE-079/ReflectedXss/ReflectedXss.expected b/javascript/ql/test/query-tests/Security/CWE-079/ReflectedXss/ReflectedXss.expected
