Thanks to visit codestin.com
Credit goes to github.com

Skip to content

Commit 51624c0

Browse files
asgerfasgerf
committed
JS: Port TaintedFormatString
1 parent 63343b1 commit 51624c0

3 files changed

Lines changed: 42 additions & 85 deletions

File tree

‎javascript/ql/lib/semmle/javascript/security/dataflow/TaintedFormatStringQuery.qll‎

Lines changed: 17 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -13,7 +13,23 @@ private import TaintedFormatStringCustomizations::TaintedFormatString
1313
/**
1414
* A taint-tracking configuration for format injections.
1515
*/
16-
class Configuration extends TaintTracking::Configuration {
16+
module TaintedFormatStringConfig implements DataFlow::ConfigSig {
17+
predicate isSource(DataFlow::Node source) { source instanceof Source }
18+
19+
predicate isSink(DataFlow::Node sink) { sink instanceof Sink }
20+
21+
predicate isBarrier(DataFlow::Node node) { node instanceof Sanitizer }
22+
}
23+
24+
/**
25+
* Taint-tracking for format injections.
26+
*/
27+
module TaintedFormatStringFlow = TaintTracking::Global<TaintedFormatStringConfig>;
28+
29+
/**
30+
* DEPRECATED. Use the `TaintedFormatStringFlow` module instead.
31+
*/
32+
deprecated class Configuration extends TaintTracking::Configuration {
1733
Configuration() { this = "TaintedFormatString" }
1834

1935
override predicate isSource(DataFlow::Node source) { source instanceof Source }

‎javascript/ql/src/Security/CWE-134/TaintedFormatString.ql‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -12,9 +12,9 @@
1212

1313
import javascript
1414
import semmle.javascript.security.dataflow.TaintedFormatStringQuery
15-
import DataFlow::PathGraph
15+
import TaintedFormatStringFlow::PathGraph
1616

17-
from Configuration cfg, DataFlow::PathNode source, DataFlow::PathNode sink
18-
where cfg.hasFlowPath(source, sink)
17+
from TaintedFormatStringFlow::PathNode source, TaintedFormatStringFlow::PathNode sink
18+
where TaintedFormatStringFlow::flowPath(source, sink)
1919
select sink.getNode(), source, sink, "Format string depends on a $@.", source.getNode(),
2020
"user-provided value"

‎javascript/ql/test/query-tests/Security/CWE-134/TaintedFormatString.expected‎

Lines changed: 22 additions & 81 deletions
Original file line numberDiff line numberDiff line change
@@ -1,85 +1,26 @@
1-
nodes
2-
| tst.js:5:15:5:30 | req.query.format |
3-
| tst.js:5:15:5:30 | req.query.format |
4-
| tst.js:5:15:5:30 | req.query.format |
5-
| tst.js:6:26:6:41 | req.query.format |
6-
| tst.js:6:26:6:41 | req.query.format |
7-
| tst.js:6:26:6:41 | req.query.format |
8-
| tst.js:7:15:7:30 | req.query.format |
9-
| tst.js:7:15:7:30 | req.query.format |
10-
| tst.js:7:15:7:30 | req.query.format |
11-
| tst.js:8:17:8:32 | req.query.format |
12-
| tst.js:8:17:8:32 | req.query.format |
13-
| tst.js:8:17:8:32 | req.query.format |
14-
| tst.js:9:16:9:31 | req.query.format |
15-
| tst.js:9:16:9:31 | req.query.format |
16-
| tst.js:9:16:9:31 | req.query.format |
17-
| tst.js:10:12:10:27 | req.query.format |
18-
| tst.js:10:12:10:27 | req.query.format |
19-
| tst.js:10:12:10:27 | req.query.format |
20-
| tst.js:11:32:11:47 | req.query.format |
21-
| tst.js:11:32:11:47 | req.query.format |
22-
| tst.js:11:32:11:47 | req.query.format |
23-
| tst.js:12:21:12:36 | req.query.format |
24-
| tst.js:12:21:12:36 | req.query.format |
25-
| tst.js:12:21:12:36 | req.query.format |
26-
| tst.js:13:35:13:50 | req.query.format |
27-
| tst.js:13:35:13:50 | req.query.format |
28-
| tst.js:13:35:13:50 | req.query.format |
29-
| tst.js:14:29:14:44 | req.query.format |
30-
| tst.js:14:29:14:44 | req.query.format |
31-
| tst.js:14:29:14:44 | req.query.format |
32-
| tst.js:15:30:15:45 | req.query.format |
33-
| tst.js:15:30:15:45 | req.query.format |
34-
| tst.js:15:30:15:45 | req.query.format |
35-
| tst.js:16:26:16:41 | req.query.format |
36-
| tst.js:16:26:16:41 | req.query.format |
37-
| tst.js:16:26:16:41 | req.query.format |
38-
| tst.js:17:30:17:45 | req.query.format |
39-
| tst.js:17:30:17:45 | req.query.format |
40-
| tst.js:17:30:17:45 | req.query.format |
41-
| tst.js:18:38:18:53 | req.query.format |
42-
| tst.js:18:38:18:53 | req.query.format |
43-
| tst.js:18:38:18:53 | req.query.format |
44-
| tst.js:20:17:20:32 | req.query.format |
45-
| tst.js:20:17:20:32 | req.query.format |
46-
| tst.js:20:17:20:32 | req.query.format |
47-
| tst.js:21:16:21:31 | req.query.format |
48-
| tst.js:21:16:21:31 | req.query.format |
49-
| tst.js:21:16:21:31 | req.query.format |
50-
| tst.js:22:17:22:32 | req.query.format |
51-
| tst.js:22:17:22:32 | req.query.format |
52-
| tst.js:22:17:22:32 | req.query.format |
53-
| tst.js:24:25:24:40 | req.query.format |
54-
| tst.js:24:25:24:40 | req.query.format |
55-
| tst.js:24:25:24:40 | req.query.format |
56-
| tst.js:25:33:25:48 | req.query.format |
57-
| tst.js:25:33:25:48 | req.query.format |
58-
| tst.js:25:33:25:48 | req.query.format |
59-
| tst.js:26:34:26:49 | req.query.format |
60-
| tst.js:26:34:26:49 | req.query.format |
61-
| tst.js:26:34:26:49 | req.query.format |
621
edges
63-
| tst.js:5:15:5:30 | req.query.format | tst.js:5:15:5:30 | req.query.format |
64-
| tst.js:6:26:6:41 | req.query.format | tst.js:6:26:6:41 | req.query.format |
65-
| tst.js:7:15:7:30 | req.query.format | tst.js:7:15:7:30 | req.query.format |
66-
| tst.js:8:17:8:32 | req.query.format | tst.js:8:17:8:32 | req.query.format |
67-
| tst.js:9:16:9:31 | req.query.format | tst.js:9:16:9:31 | req.query.format |
68-
| tst.js:10:12:10:27 | req.query.format | tst.js:10:12:10:27 | req.query.format |
69-
| tst.js:11:32:11:47 | req.query.format | tst.js:11:32:11:47 | req.query.format |
70-
| tst.js:12:21:12:36 | req.query.format | tst.js:12:21:12:36 | req.query.format |
71-
| tst.js:13:35:13:50 | req.query.format | tst.js:13:35:13:50 | req.query.format |
72-
| tst.js:14:29:14:44 | req.query.format | tst.js:14:29:14:44 | req.query.format |
73-
| tst.js:15:30:15:45 | req.query.format | tst.js:15:30:15:45 | req.query.format |
74-
| tst.js:16:26:16:41 | req.query.format | tst.js:16:26:16:41 | req.query.format |
75-
| tst.js:17:30:17:45 | req.query.format | tst.js:17:30:17:45 | req.query.format |
76-
| tst.js:18:38:18:53 | req.query.format | tst.js:18:38:18:53 | req.query.format |
77-
| tst.js:20:17:20:32 | req.query.format | tst.js:20:17:20:32 | req.query.format |
78-
| tst.js:21:16:21:31 | req.query.format | tst.js:21:16:21:31 | req.query.format |
79-
| tst.js:22:17:22:32 | req.query.format | tst.js:22:17:22:32 | req.query.format |
80-
| tst.js:24:25:24:40 | req.query.format | tst.js:24:25:24:40 | req.query.format |
81-
| tst.js:25:33:25:48 | req.query.format | tst.js:25:33:25:48 | req.query.format |
82-
| tst.js:26:34:26:49 | req.query.format | tst.js:26:34:26:49 | req.query.format |
2+
nodes
3+
| tst.js:5:15:5:30 | req.query.format | semmle.label | req.query.format |
4+
| tst.js:6:26:6:41 | req.query.format | semmle.label | req.query.format |
5+
| tst.js:7:15:7:30 | req.query.format | semmle.label | req.query.format |
6+
| tst.js:8:17:8:32 | req.query.format | semmle.label | req.query.format |
7+
| tst.js:9:16:9:31 | req.query.format | semmle.label | req.query.format |
8+
| tst.js:10:12:10:27 | req.query.format | semmle.label | req.query.format |
9+
| tst.js:11:32:11:47 | req.query.format | semmle.label | req.query.format |
10+
| tst.js:12:21:12:36 | req.query.format | semmle.label | req.query.format |
11+
| tst.js:13:35:13:50 | req.query.format | semmle.label | req.query.format |
12+
| tst.js:14:29:14:44 | req.query.format | semmle.label | req.query.format |
13+
| tst.js:15:30:15:45 | req.query.format | semmle.label | req.query.format |
14+
| tst.js:16:26:16:41 | req.query.format | semmle.label | req.query.format |
15+
| tst.js:17:30:17:45 | req.query.format | semmle.label | req.query.format |
16+
| tst.js:18:38:18:53 | req.query.format | semmle.label | req.query.format |
17+
| tst.js:20:17:20:32 | req.query.format | semmle.label | req.query.format |
18+
| tst.js:21:16:21:31 | req.query.format | semmle.label | req.query.format |
19+
| tst.js:22:17:22:32 | req.query.format | semmle.label | req.query.format |
20+
| tst.js:24:25:24:40 | req.query.format | semmle.label | req.query.format |
21+
| tst.js:25:33:25:48 | req.query.format | semmle.label | req.query.format |
22+
| tst.js:26:34:26:49 | req.query.format | semmle.label | req.query.format |
23+
subpaths
8324
#select
8425
| tst.js:5:15:5:30 | req.query.format | tst.js:5:15:5:30 | req.query.format | tst.js:5:15:5:30 | req.query.format | Format string depends on a $@. | tst.js:5:15:5:30 | req.query.format | user-provided value |
8526
| tst.js:6:26:6:41 | req.query.format | tst.js:6:26:6:41 | req.query.format | tst.js:6:26:6:41 | req.query.format | Format string depends on a $@. | tst.js:6:26:6:41 | req.query.format | user-provided value |

0 commit comments

Comments
 (0)