Thanks to visit codestin.com
Credit goes to github.com

Skip to content

Commit 5e87d5c

Browse files
asger-semmleasger-semmle
committed
JS: Update syntactic heuristics
1 parent f173e30 commit 5e87d5c

3 files changed

Lines changed: 23 additions & 33 deletions

File tree

‎javascript/ql/src/semmle/javascript/heuristics/AdditionalSinks.qll‎

Lines changed: 9 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -34,11 +34,11 @@ private class HeuristicCodeInjectionSink extends HeuristicSink, CodeInjection::S
3434
srcPattern = "(?s).*function\\s*\\(.*\\).*" or
3535
srcPattern = "(?s).*(\\(.*\\)|[A-Za-z_]+)\\s?=>.*"
3636
|
37-
isContatenatedWithString(this, srcPattern)
37+
isConcatenatedWithString(this, srcPattern)
3838
)
3939
or
4040
// dynamic property name
41-
isContatenatedWithStrings("(?is)[a-z]+\\[", this, "(?s)\\].*")
41+
isConcatenatedWithStrings("(?is)[a-z]+\\[", this, "(?s)\\].*")
4242
}
4343
}
4444

@@ -53,25 +53,25 @@ private class HeuristicDomBasedXssSink extends HeuristicSink, DomBasedXss::DomBa
5353
HeuristicDomBasedXssSink() {
5454
isAssignedToOrConcatenatedWith(this, "(?i)(html|innerhtml)") or
5555
isArgTo(this, "(?i)(html|render)") or
56-
isContatenatedWithString(this, "(?is).*<.*>.*") or
57-
isContatenatedWithStrings("(?is).*<[a-z ]+.*", this, "(?s).*>.*")
56+
this instanceof StringOps::HtmlConcatenationLeaf or
57+
isConcatenatedWithStrings("(?is).*<[a-z ]+.*", this, "(?s).*>.*")
5858
}
5959
}
6060

6161
private class HeuristicReflectedXssSink extends HeuristicSink, ReflectedXss::ReflectedXss::Sink {
6262
HeuristicReflectedXssSink() {
6363
isAssignedToOrConcatenatedWith(this, "(?i)(html|innerhtml)") or
6464
isArgTo(this, "(?i)(html|render)") or
65-
isContatenatedWithString(this, "(?is).*<.*>.*") or
66-
isContatenatedWithStrings("(?is).*<[a-z ]+.*", this, "(?s).*>.*")
65+
this instanceof StringOps::HtmlConcatenationLeaf or
66+
isConcatenatedWithStrings("(?is).*<[a-z ]+.*", this, "(?s).*>.*")
6767
}
6868
}
6969

7070
private class HeuristicSqlInjectionSink extends HeuristicSink, SqlInjection::Sink {
7171
HeuristicSqlInjectionSink() {
7272
isAssignedToOrConcatenatedWith(this, "(?i)(sql|query)") or
7373
isArgTo(this, "(?i)(query)") or
74-
isContatenatedWithString(this,
74+
isConcatenatedWithString(this,
7575
"(?s).*(ALTER|COUNT|CREATE|DATABASE|DELETE|DISTINCT|DROP|FROM|GROUP|INSERT|INTO|LIMIT|ORDER|SELECT|TABLE|UPDATE|WHERE).*")
7676
}
7777
}
@@ -94,10 +94,10 @@ private class HeuristicTaintedPathSink extends HeuristicSink, TaintedPath::Sink
9494
pathPattern = "(?i)([a-z0-9_.-]+/){2,}" or
9595
pathPattern = "(?i)(/[a-z0-9_.-]+){2,}"
9696
|
97-
isContatenatedWithString(this, pathPattern)
97+
isConcatenatedWithString(this, pathPattern)
9898
)
9999
or
100-
isContatenatedWithStrings(".*/", this, "/.*")
100+
isConcatenatedWithStrings(".*/", this, "/.*")
101101
}
102102
}
103103

‎javascript/ql/src/semmle/javascript/heuristics/SyntacticHeuristics.qll‎

Lines changed: 9 additions & 23 deletions
Original file line numberDiff line numberDiff line change
@@ -66,42 +66,28 @@ predicate isArgTo(DataFlow::Node arg, string regexp) {
6666
}
6767

6868
/**
69-
* Holds if `n` is concatenated with something with a name that matches `regexp`.
69+
* Holds if `n` is concatenation containing something with a name that matches `regexp`.
7070
*/
7171
bindingset[regexp]
72-
predicate isConcatenatedWith(DataFlow::Node n, string regexp) {
73-
exists(Expr other |
74-
other = n.asExpr().(AddExpr).getAnOperand() or
75-
other = n.asExpr().(AssignAddExpr).getRhs()
76-
|
77-
isReadFrom(DataFlow::valueNode(other), regexp)
78-
)
72+
predicate isConcatenatedWith(StringOps::Concatenation n, string regexp) {
73+
isReadFrom(n.getAnOperand(), regexp)
7974
}
8075

8176
/**
82-
* Holds if `n` is concatenated with a string constant that matches `regexp`.
77+
* Holds if `n` is a concatenation containing something with a name that matches `regexp`.
8378
*/
8479
bindingset[regexp]
85-
predicate isContatenatedWithString(DataFlow::Node n, string regexp) {
86-
exists(Expr other |
87-
other = n.asExpr().(AddExpr).getAnOperand() or
88-
other = n.asExpr().(AssignAddExpr).getRhs()
89-
|
90-
other.getStringValue().regexpMatch(regexp)
91-
)
80+
predicate isConcatenatedWithString(StringOps::Concatenation n, string regexp) {
81+
n.getAnOperand().getStringValue().regexpMatch(regexp)
9282
}
9383

9484
/**
9585
* Holds if `n` is concatenated between two string constants that match `lRegexp` and `rRegexp` respectively.
9686
*/
9787
bindingset[lRegexp, rRegexp]
98-
predicate isContatenatedWithStrings(string lRegexp, DataFlow::Node n, string rRegexp) {
99-
exists(AddExpr concat1, AddExpr concat2 |
100-
concat1.getLeftOperand().getStringValue().regexpMatch(lRegexp) and
101-
concat1.getRightOperand() = n.asExpr() and
102-
concat2.getLeftOperand() = concat1 and
103-
concat2.getRightOperand().getStringValue().regexpMatch(rRegexp)
104-
)
88+
predicate isConcatenatedWithStrings(string lRegexp, StringOps::ConcatenationLeaf n, string rRegexp) {
89+
n.getPreviousLeaf().getStringValue().regexpMatch(lRegexp) and
90+
n.getNextLeaf().getStringValue().regexpMatch(rRegexp)
10591
}
10692

10793
/**

‎javascript/ql/test/library-tests/Security/heuristics/HeuristicSink.expected‎

Lines changed: 5 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -3,6 +3,7 @@
33
| sinks.js:4:9:4:12 | sink |
44
| sinks.js:6:16:6:19 | sink |
55
| sinks.js:7:5:7:22 | getScript() + sink |
6+
| sinks.js:8:5:8:18 | script += sink |
67
| sinks.js:8:15:8:18 | sink |
78
| sinks.js:9:5:9:18 | sink += script |
89
| sinks.js:10:11:10:14 | sink |
@@ -25,8 +26,11 @@
2526
| sinks.js:41:5:41:26 | sink + ... ion(){" |
2627
| sinks.js:42:5:42:18 | "x => " + sink |
2728
| sinks.js:43:14:43:17 | sink |
28-
| sinks.js:45:5:45:18 | "<div>" + sink |
29+
| sinks.js:45:5:45:11 | "<div>" |
30+
| sinks.js:45:15:45:18 | sink |
31+
| sinks.js:46:5:46:20 | '<div foo="foo"' |
2932
| sinks.js:46:24:46:27 | sink |
33+
| sinks.js:46:31:46:42 | 'bar="bar">' |
3034
| sinks.js:48:5:48:20 | "SELECT " + sink |
3135
| sinks.js:50:5:50:21 | "/foo/bar" + sink |
3236
| sinks.js:51:5:51:21 | "foo/bar/" + sink |

0 commit comments

Comments
 (0)