Thanks to visit codestin.com
Credit goes to github.com

Skip to content

Commit 5ce17be

Browse files
erik-krogherik-krogh
committed
add qhelp for js/bad-code-sanitization
1 parent a0951f7 commit 5ce17be

6 files changed

Lines changed: 110 additions & 28 deletions

File tree

‎javascript/ql/src/Security/CWE-094/ImproperCodeSanitization.qhelp‎

Lines changed: 29 additions & 28 deletions
Original file line numberDiff line numberDiff line change
@@ -3,35 +3,36 @@
33
"qhelp.dtd">
44
<qhelp>
55

6-
<overview>
7-
<p>
8-
Placeholder
9-
</p>
10-
</overview>
6+
<overview>
7+
<p>
8+
Using string concatenation to construct JavaScript code can be error-prone, or in the worst
9+
case enable code-injection if an input is constructed by an attacker.
10+
</p>
11+
</overview>
1112

12-
<recommendation>
13-
<p>
14-
Placeholder
15-
</p>
16-
</recommendation>
13+
<recommendation>
14+
<p>
15+
If using <code>JSON.stringify</code> or a HTML sanitizer to sanitize a string inserted into
16+
JavaScript code, then make sure to perform additional sanitization or remove potentially
17+
dangerous characters.
18+
</p>
19+
</recommendation>
1720

18-
<example>
19-
<p>
20-
Placeholder
21-
</p>
21+
<example>
22+
<p>
23+
The below example constructs a function that assigns the number 42 to the property <code>key</code>
24+
on an object <code>obj</code>. However, if <code>key</code> contains <code>&lt;/script&gt;</code>, then
25+
the generated code will break out of a <code>&lt;script&gt;</code> if the generated code is inserted
26+
into a <code>&lt;script&gt;</code> tag.
27+
</p>
28+
<sample src="examples/ImproperCodeSanitization.js" />
29+
<p>
30+
The issue has been fixed in the below by escaping potentially dangerous characters.
31+
</p>
32+
<sample src="examples/ImproperCodeSanitizationFixed.js" />
33+
</example>
2234

23-
</example>
24-
25-
<references>
26-
<li>
27-
OWASP:
28-
<a href="https://www.owasp.org/index.php/Code_Injection">Code Injection</a>.
29-
</li>
30-
<li>
31-
MDN: <a href="https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Global_Objects#Function_properties">Global functions</a>.
32-
</li>
33-
<li>
34-
MDN: <a href="https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Global_Objects/Function">Function constructor</a>.
35-
</li>
36-
</references>
35+
<references>
36+
<li>OWASP: <a href="https://www.owasp.org/index.php/Code_Injection">Code Injection</a>.</li>
37+
</references>
3738
</qhelp>

‎javascript/ql/src/Security/CWE-094/examples/ImproperCodeSanitization.js‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,4 @@
1+
function createObjectWrite() {
2+
const assignment = `obj[${JSON.stringify(key)}]=42`;
3+
return `(function(){${assignment}})` // NOT OK
4+
}

‎javascript/ql/src/Security/CWE-094/examples/ImproperCodeSanitizationFixed.js‎

Lines changed: 23 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,23 @@
1+
const charMap = {
2+
'<': '\\u003C',
3+
'>' : '\\u003E',
4+
'/': '\\u002F',
5+
'\\': '\\\\',
6+
'\b': '\\b',
7+
'\f': '\\f',
8+
'\n': '\\n',
9+
'\r': '\\r',
10+
'\t': '\\t',
11+
'\0': '\\0',
12+
'\u2028': '\\u2028',
13+
'\u2029': '\\u2029'
14+
};
15+
16+
function escapeUnsafeChars(str) {
17+
return str.replace(/[<>\b\f\n\r\t\0\u2028\u2029]/g, x => charMap[x])
18+
}
19+
20+
function createObjectWrite() {
21+
const assignment = `obj[${escapeUnsafeChars(JSON.stringify(key))}]=42`;
22+
return `(function(){${assignment}})` // OK
23+
}

‎javascript/ql/test/query-tests/Security/CWE-094/CodeInjection/ImproperCodeSanitization.expected‎

Lines changed: 12 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -34,6 +34,12 @@ nodes
3434
| bad-code-sanitization.js:58:29:58:49 | JSON.st ... (taint) |
3535
| bad-code-sanitization.js:58:29:58:49 | JSON.st ... (taint) |
3636
| bad-code-sanitization.js:58:29:58:49 | JSON.st ... (taint) |
37+
| bad-code-sanitization.js:63:11:63:55 | assignment |
38+
| bad-code-sanitization.js:63:24:63:55 | `obj[${ ... )}]=42` |
39+
| bad-code-sanitization.js:63:31:63:49 | JSON.stringify(key) |
40+
| bad-code-sanitization.js:63:31:63:49 | JSON.stringify(key) |
41+
| bad-code-sanitization.js:64:27:64:36 | assignment |
42+
| bad-code-sanitization.js:64:27:64:36 | assignment |
3743
edges
3844
| bad-code-sanitization.js:2:12:2:90 | /^[_$a- ... key)}]` | bad-code-sanitization.js:7:31:7:43 | safeProp(key) |
3945
| bad-code-sanitization.js:2:65:2:90 | `[${JSO ... key)}]` | bad-code-sanitization.js:2:12:2:90 | /^[_$a- ... key)}]` |
@@ -53,6 +59,11 @@ edges
5359
| bad-code-sanitization.js:52:28:52:62 | JSON.st ... bble")) | bad-code-sanitization.js:52:28:52:62 | JSON.st ... bble")) |
5460
| bad-code-sanitization.js:54:29:54:63 | JSON.st ... bble")) | bad-code-sanitization.js:54:29:54:63 | JSON.st ... bble")) |
5561
| bad-code-sanitization.js:58:29:58:49 | JSON.st ... (taint) | bad-code-sanitization.js:58:29:58:49 | JSON.st ... (taint) |
62+
| bad-code-sanitization.js:63:11:63:55 | assignment | bad-code-sanitization.js:64:27:64:36 | assignment |
63+
| bad-code-sanitization.js:63:11:63:55 | assignment | bad-code-sanitization.js:64:27:64:36 | assignment |
64+
| bad-code-sanitization.js:63:24:63:55 | `obj[${ ... )}]=42` | bad-code-sanitization.js:63:11:63:55 | assignment |
65+
| bad-code-sanitization.js:63:31:63:49 | JSON.stringify(key) | bad-code-sanitization.js:63:24:63:55 | `obj[${ ... )}]=42` |
66+
| bad-code-sanitization.js:63:31:63:49 | JSON.stringify(key) | bad-code-sanitization.js:63:24:63:55 | `obj[${ ... )}]=42` |
5667
#select
5768
| bad-code-sanitization.js:8:27:8:46 | statements.join(';') | bad-code-sanitization.js:2:69:2:87 | JSON.stringify(key) | bad-code-sanitization.js:8:27:8:46 | statements.join(';') | $@ flows to here and is used to construct code. | bad-code-sanitization.js:2:69:2:87 | JSON.stringify(key) | Improperly sanitized value |
5869
| bad-code-sanitization.js:15:44:15:63 | htmlescape(pathname) | bad-code-sanitization.js:15:44:15:63 | htmlescape(pathname) | bad-code-sanitization.js:15:44:15:63 | htmlescape(pathname) | $@ flows to here and is used to construct code. | bad-code-sanitization.js:15:44:15:63 | htmlescape(pathname) | Improperly sanitized value |
@@ -61,3 +72,4 @@ edges
6172
| bad-code-sanitization.js:40:23:40:43 | JSON.st ... (input) | bad-code-sanitization.js:40:23:40:43 | JSON.st ... (input) | bad-code-sanitization.js:40:23:40:43 | JSON.st ... (input) | $@ flows to here and is used to construct code. | bad-code-sanitization.js:40:23:40:43 | JSON.st ... (input) | Improperly sanitized value |
6273
| bad-code-sanitization.js:44:22:44:42 | JSON.st ... (input) | bad-code-sanitization.js:44:22:44:42 | JSON.st ... (input) | bad-code-sanitization.js:44:22:44:42 | JSON.st ... (input) | $@ flows to here and is used to construct code. | bad-code-sanitization.js:44:22:44:42 | JSON.st ... (input) | Improperly sanitized value |
6374
| bad-code-sanitization.js:52:28:52:62 | JSON.st ... bble")) | bad-code-sanitization.js:52:28:52:62 | JSON.st ... bble")) | bad-code-sanitization.js:52:28:52:62 | JSON.st ... bble")) | $@ flows to here and is used to construct code. | bad-code-sanitization.js:52:28:52:62 | JSON.st ... bble")) | Improperly sanitized value |
75+
| bad-code-sanitization.js:64:27:64:36 | assignment | bad-code-sanitization.js:63:31:63:49 | JSON.stringify(key) | bad-code-sanitization.js:64:27:64:36 | assignment | $@ flows to here and is used to construct code. | bad-code-sanitization.js:63:31:63:49 | JSON.stringify(key) | Improperly sanitized value |

‎javascript/ql/test/query-tests/Security/CWE-094/CodeInjection/bad-code-sanitization.js‎

Lines changed: 33 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -57,3 +57,36 @@ app.get('/some/path', function(req, res) {
5757

5858
setTimeout(`(function(){${JSON.stringify(taint)}))`); // OK - the source is remote-flow, and the sink is code-injection.
5959
});
60+
61+
// Bad documentation example:
62+
function createObjectWrite() {
63+
const assignment = `obj[${JSON.stringify(key)}]=42`;
64+
return `(function(){${assignment}})` // NOT OK
65+
}
66+
67+
// Good documentation example:
68+
function good() {
69+
const charMap = {
70+
'<': '\\u003C',
71+
'>' : '\\u003E',
72+
'/': '\\u002F',
73+
'\\': '\\\\',
74+
'\b': '\\b',
75+
'\f': '\\f',
76+
'\n': '\\n',
77+
'\r': '\\r',
78+
'\t': '\\t',
79+
'\0': '\\0',
80+
'\u2028': '\\u2028',
81+
'\u2029': '\\u2029'
82+
};
83+
84+
function escapeUnsafeChars(str) {
85+
return str.replace(/[<>\b\f\n\r\t\0\u2028\u2029]/g, x => charMap[x])
86+
}
87+
88+
function createObjectWrite() {
89+
const assignment = `obj[${escapeUnsafeChars(JSON.stringify(key))}]=42`;
90+
return `(function(){${assignment}})` // OK
91+
}
92+
}

‎javascript/ql/test/query-tests/Security/CWE-094/tmp.html‎

Lines changed: 9 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,9 @@
1+
<html>
2+
3+
<body>
4+
<script>
5+
var foo ="bla</script onload=\"\">";
6+
</script>
7+
</body>
8+
9+
</html>

0 commit comments

Comments
 (0)