Thanks to visit codestin.com
Credit goes to github.com

Skip to content

Commit 6399079

Browse files
erik-krogherik-krogh
committed
add home/rootdir as leaking folders
1 parent 6675dda commit 6399079

3 files changed

Lines changed: 27 additions & 13 deletions

File tree

‎javascript/ql/src/Security/CWE-200/PrivateFileExposure.ql‎

Lines changed: 22 additions & 12 deletions
Original file line numberDiff line numberDiff line change
@@ -69,19 +69,33 @@ pragma[noinline]
6969
Folder getAPackageJSONFolder() { result = any(PackageJSON json).getFile().getParentContainer() }
7070

7171
/**
72-
* Gets a reference to `dirname` that might cause information to be leaked.
73-
* That can happen if there is a `package.json` file in the same folder.
74-
* (It is assumed that the presence of a `package.json` file means that a `node_modules` folder can also exist.
72+
* Gets a reference to `dirname`, the home folder, the current working folder, or the root folder.
73+
* All of these might cause information to be leaked.
74+
*
75+
* For `dirname` that can happen if there is a `package.json` file in the same folder.
76+
* It is assumed that the presence of a `package.json` file means that a `node_modules` folder can also exist.
77+
*
78+
* For the root/home/working folder, they contain so much information that they must leak information somehow (e.g. ssh keys in the `~/.ssh` folder).
7579
*/
76-
DataFlow::Node dirname() {
80+
DataFlow::Node getALeakingFolder(string description) {
7781
exists(ModuleScope ms | result.asExpr() = ms.getVariable("__dirname").getAnAccess()) and
78-
result.getFile().getParentContainer() = getAPackageJSONFolder()
82+
result.getFile().getParentContainer() = getAPackageJSONFolder() and
83+
description = "the folder " + result.getFile().getParentContainer().getRelativePath()
84+
or
85+
result = DataFlow::moduleImport("os").getAMemberCall("homedir") and
86+
description = "the home folder "
87+
or
88+
result.mayHaveStringValue("/") and
89+
description = "the root folder"
90+
or
91+
result.getStringValue() = [".", "./"] and
92+
description = "the current working folder"
7993
or
80-
result.getAPredecessor() = dirname()
94+
result.getAPredecessor() = getALeakingFolder(description)
8195
or
8296
exists(StringOps::ConcatenationRoot root | root = result |
8397
root.getNumOperand() = 2 and
84-
root.getOperand(0) = dirname() and
98+
root.getOperand(0) = getALeakingFolder(description) and
8599
root.getOperand(1).getStringValue() = "/"
86100
)
87101
}
@@ -94,11 +108,7 @@ DataFlow::Node getAPrivateFolderPath(string description) {
94108
result = getANodeModulePath(path) and description = "the folder \"" + path + "\""
95109
)
96110
or
97-
result = dirname() and
98-
description = "the folder " + result.getFile().getParentContainer().getRelativePath()
99-
or
100-
result.getStringValue() = [".", "./"] and
101-
description = "the current working folder"
111+
result = getALeakingFolder(description)
102112
}
103113

104114
/**

‎javascript/ql/test/query-tests/Security/CWE-200/PrivateFileExposure.expected‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -16,3 +16,5 @@
1616
| private-file-exposure.js:22:1:22:58 | app.use ... lar/')) | Serves the folder "/node_modules/angular/", which can contain private information. |
1717
| private-file-exposure.js:40:1:40:88 | app.use ... lar/')) | Serves the folder "/node_modules/angular/", which can contain private information. |
1818
| private-file-exposure.js:41:1:41:97 | app.use ... lar/')) | Serves the folder "/node_modules/angular/", which can contain private information. |
19+
| private-file-exposure.js:42:1:42:66 | app.use ... dir())) | Serves the home folder , which can contain private information. |
20+
| private-file-exposure.js:43:1:43:46 | app.use ... )("/")) | Serves the root folder, which can contain private information. |

‎javascript/ql/test/query-tests/Security/CWE-200/private-file-exposure.js‎

Lines changed: 3 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -38,4 +38,6 @@ app.use('/monthly', express.static(__dirname + '/')); // GOOD, because there is
3838

3939
const connect = require("connect");
4040
app.use('/angular', connect.static(path.join(__dirname, "/node_modules") + '/angular/')); // NOT OK
41-
app.use('/angular', require('serve-static')(path.join(__dirname, "/node_modules") + '/angular/')); // NOT OK
41+
app.use('/angular', require('serve-static')(path.join(__dirname, "/node_modules") + '/angular/')); // NOT OK
42+
app.use('/home', require('serve-static')(require("os").homedir())); // NOT OK
43+
app.use('/root', require('serve-static')("/")); // NOT OK

0 commit comments

Comments
 (0)