Thanks to visit codestin.com
Credit goes to github.com

Skip to content

Commit 5375604

Browse files
erik-krogherik-krogh
committed
calling pop or shift on a SplitPath returns a PosixPath
1 parent 3855268 commit 5375604

3 files changed

Lines changed: 47 additions & 2 deletions

File tree

‎javascript/ql/src/semmle/javascript/security/dataflow/TaintedPath.qll‎

Lines changed: 6 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -114,7 +114,12 @@ module TaintedPath {
114114
or
115115
(
116116
name = "pop" or
117-
name = "shift" or
117+
name = "shift"
118+
) and
119+
srclabel instanceof Label::SplitPath and
120+
dstlabel.(Label::PosixPath).canContainDotDotSlash()
121+
or
122+
(
118123
name = "slice" or
119124
name = "splice" or
120125
name = "concat"

‎javascript/ql/test/query-tests/Security/CWE-022/TaintedPath/TaintedPath.expected‎

Lines changed: 38 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1106,6 +1106,23 @@ nodes
11061106
| TaintedPath.js:143:19:143:38 | concatted2.join("/") |
11071107
| TaintedPath.js:143:19:143:38 | concatted2.join("/") |
11081108
| TaintedPath.js:143:19:143:38 | concatted2.join("/") |
1109+
| TaintedPath.js:145:19:145:23 | split |
1110+
| TaintedPath.js:145:19:145:23 | split |
1111+
| TaintedPath.js:145:19:145:23 | split |
1112+
| TaintedPath.js:145:19:145:23 | split |
1113+
| TaintedPath.js:145:19:145:29 | split.pop() |
1114+
| TaintedPath.js:145:19:145:29 | split.pop() |
1115+
| TaintedPath.js:145:19:145:29 | split.pop() |
1116+
| TaintedPath.js:145:19:145:29 | split.pop() |
1117+
| TaintedPath.js:145:19:145:29 | split.pop() |
1118+
| TaintedPath.js:145:19:145:29 | split.pop() |
1119+
| TaintedPath.js:145:19:145:29 | split.pop() |
1120+
| TaintedPath.js:145:19:145:29 | split.pop() |
1121+
| TaintedPath.js:145:19:145:29 | split.pop() |
1122+
| TaintedPath.js:145:19:145:29 | split.pop() |
1123+
| TaintedPath.js:145:19:145:29 | split.pop() |
1124+
| TaintedPath.js:145:19:145:29 | split.pop() |
1125+
| TaintedPath.js:145:19:145:29 | split.pop() |
11091126
| normalizedPaths.js:11:7:11:27 | path |
11101127
| normalizedPaths.js:11:7:11:27 | path |
11111128
| normalizedPaths.js:11:7:11:27 | path |
@@ -3615,6 +3632,10 @@ edges
36153632
| TaintedPath.js:130:7:130:29 | split | TaintedPath.js:142:20:142:24 | split |
36163633
| TaintedPath.js:130:7:130:29 | split | TaintedPath.js:142:20:142:24 | split |
36173634
| TaintedPath.js:130:7:130:29 | split | TaintedPath.js:142:20:142:24 | split |
3635+
| TaintedPath.js:130:7:130:29 | split | TaintedPath.js:145:19:145:23 | split |
3636+
| TaintedPath.js:130:7:130:29 | split | TaintedPath.js:145:19:145:23 | split |
3637+
| TaintedPath.js:130:7:130:29 | split | TaintedPath.js:145:19:145:23 | split |
3638+
| TaintedPath.js:130:7:130:29 | split | TaintedPath.js:145:19:145:23 | split |
36183639
| TaintedPath.js:130:15:130:18 | path | TaintedPath.js:130:15:130:29 | path.split("/") |
36193640
| TaintedPath.js:130:15:130:18 | path | TaintedPath.js:130:15:130:29 | path.split("/") |
36203641
| TaintedPath.js:130:15:130:18 | path | TaintedPath.js:130:15:130:29 | path.split("/") |
@@ -3755,6 +3776,22 @@ edges
37553776
| TaintedPath.js:143:19:143:28 | concatted2 | TaintedPath.js:143:19:143:38 | concatted2.join("/") |
37563777
| TaintedPath.js:143:19:143:28 | concatted2 | TaintedPath.js:143:19:143:38 | concatted2.join("/") |
37573778
| TaintedPath.js:143:19:143:28 | concatted2 | TaintedPath.js:143:19:143:38 | concatted2.join("/") |
3779+
| TaintedPath.js:145:19:145:23 | split | TaintedPath.js:145:19:145:29 | split.pop() |
3780+
| TaintedPath.js:145:19:145:23 | split | TaintedPath.js:145:19:145:29 | split.pop() |
3781+
| TaintedPath.js:145:19:145:23 | split | TaintedPath.js:145:19:145:29 | split.pop() |
3782+
| TaintedPath.js:145:19:145:23 | split | TaintedPath.js:145:19:145:29 | split.pop() |
3783+
| TaintedPath.js:145:19:145:23 | split | TaintedPath.js:145:19:145:29 | split.pop() |
3784+
| TaintedPath.js:145:19:145:23 | split | TaintedPath.js:145:19:145:29 | split.pop() |
3785+
| TaintedPath.js:145:19:145:23 | split | TaintedPath.js:145:19:145:29 | split.pop() |
3786+
| TaintedPath.js:145:19:145:23 | split | TaintedPath.js:145:19:145:29 | split.pop() |
3787+
| TaintedPath.js:145:19:145:23 | split | TaintedPath.js:145:19:145:29 | split.pop() |
3788+
| TaintedPath.js:145:19:145:23 | split | TaintedPath.js:145:19:145:29 | split.pop() |
3789+
| TaintedPath.js:145:19:145:23 | split | TaintedPath.js:145:19:145:29 | split.pop() |
3790+
| TaintedPath.js:145:19:145:23 | split | TaintedPath.js:145:19:145:29 | split.pop() |
3791+
| TaintedPath.js:145:19:145:23 | split | TaintedPath.js:145:19:145:29 | split.pop() |
3792+
| TaintedPath.js:145:19:145:23 | split | TaintedPath.js:145:19:145:29 | split.pop() |
3793+
| TaintedPath.js:145:19:145:23 | split | TaintedPath.js:145:19:145:29 | split.pop() |
3794+
| TaintedPath.js:145:19:145:23 | split | TaintedPath.js:145:19:145:29 | split.pop() |
37583795
| normalizedPaths.js:11:7:11:27 | path | normalizedPaths.js:13:19:13:22 | path |
37593796
| normalizedPaths.js:11:7:11:27 | path | normalizedPaths.js:13:19:13:22 | path |
37603797
| normalizedPaths.js:11:7:11:27 | path | normalizedPaths.js:13:19:13:22 | path |
@@ -5017,6 +5054,7 @@ edges
50175054
| TaintedPath.js:137:19:137:35 | prefix + split[x] | TaintedPath.js:126:24:126:30 | req.url | TaintedPath.js:137:19:137:35 | prefix + split[x] | This path depends on $@. | TaintedPath.js:126:24:126:30 | req.url | a user-provided value |
50185055
| TaintedPath.js:140:19:140:37 | concatted.join("/") | TaintedPath.js:126:24:126:30 | req.url | TaintedPath.js:140:19:140:37 | concatted.join("/") | This path depends on $@. | TaintedPath.js:126:24:126:30 | req.url | a user-provided value |
50195056
| TaintedPath.js:143:19:143:38 | concatted2.join("/") | TaintedPath.js:126:24:126:30 | req.url | TaintedPath.js:143:19:143:38 | concatted2.join("/") | This path depends on $@. | TaintedPath.js:126:24:126:30 | req.url | a user-provided value |
5057+
| TaintedPath.js:145:19:145:29 | split.pop() | TaintedPath.js:126:24:126:30 | req.url | TaintedPath.js:145:19:145:29 | split.pop() | This path depends on $@. | TaintedPath.js:126:24:126:30 | req.url | a user-provided value |
50205058
| normalizedPaths.js:13:19:13:22 | path | normalizedPaths.js:11:14:11:27 | req.query.path | normalizedPaths.js:13:19:13:22 | path | This path depends on $@. | normalizedPaths.js:11:14:11:27 | req.query.path | a user-provided value |
50215059
| normalizedPaths.js:14:19:14:29 | './' + path | normalizedPaths.js:11:14:11:27 | req.query.path | normalizedPaths.js:14:19:14:29 | './' + path | This path depends on $@. | normalizedPaths.js:11:14:11:27 | req.query.path | a user-provided value |
50225060
| normalizedPaths.js:15:19:15:38 | path + '/index.html' | normalizedPaths.js:11:14:11:27 | req.query.path | normalizedPaths.js:15:19:15:38 | path + '/index.html' | This path depends on $@. | normalizedPaths.js:11:14:11:27 | req.query.path | a user-provided value |

‎javascript/ql/test/query-tests/Security/CWE-022/TaintedPath/TaintedPath.js‎

Lines changed: 3 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -140,6 +140,8 @@ var server = http.createServer(function(req, res) {
140140
fs.readFileSync(concatted.join("/")); // NOT OK
141141

142142
var concatted2 = split.concat(prefix);
143-
fs.readFileSync(concatted2.join("/")); // NOT OK
143+
fs.readFileSync(concatted2.join("/")); // NOT OK
144+
145+
fs.readFileSync(split.pop()); // NOT OK
144146

145147
});

0 commit comments

Comments
 (0)