Thanks to visit codestin.com
Credit goes to github.com

Skip to content

Commit 6447234

Browse files
erik-krogherik-krogh
committed
recognize calls to Function where spread arguments are used
1 parent e829387 commit 6447234

4 files changed

Lines changed: 16 additions & 8 deletions

File tree

‎javascript/ql/lib/semmle/javascript/security/dataflow/CodeInjectionCustomizations.qll‎

Lines changed: 6 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -170,7 +170,7 @@ module CodeInjection {
170170
exists(string callName | c = DataFlow::globalVarRef(callName).getAnInvocation() |
171171
callName = "eval" and index = 0
172172
or
173-
callName = "Function"
173+
callName = "Function" and index = -1
174174
or
175175
callName = "execScript" and index = 0
176176
or
@@ -185,14 +185,13 @@ module CodeInjection {
185185
callName = "setImmediate" and index = 0
186186
)
187187
or
188-
exists(DataFlow::GlobalVarRefNode wasm, string methodName |
189-
wasm.getName() = "WebAssembly" and c = wasm.getAMemberCall(methodName)
190-
|
191-
methodName = "compile" or
192-
methodName = "compileStreaming"
193-
)
188+
c = DataFlow::globalVarRef("WebAssembly").getAMemberCall(["compile", "compileStreaming"]) and
189+
index = -1
194190
|
195191
this = c.getArgument(index)
192+
or
193+
index = -1 and
194+
this = c.getAnArgument()
196195
)
197196
or
198197
// node-serialize is not intended to be safe for untrusted inputs

‎javascript/ql/test/query-tests/Security/CWE-094/CodeInjection/CodeInjection.expected‎

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -167,6 +167,8 @@ nodes
167167
| tst.js:33:14:33:19 | source |
168168
| tst.js:35:28:35:33 | source |
169169
| tst.js:35:28:35:33 | source |
170+
| tst.js:37:33:37:38 | source |
171+
| tst.js:37:33:37:38 | source |
170172
edges
171173
| NoSQLCodeInjection.js:18:24:18:31 | req.body | NoSQLCodeInjection.js:18:24:18:37 | req.body.query |
172174
| NoSQLCodeInjection.js:18:24:18:31 | req.body | NoSQLCodeInjection.js:18:24:18:37 | req.body.query |
@@ -278,6 +280,8 @@ edges
278280
| tst.js:29:9:29:82 | source | tst.js:33:14:33:19 | source |
279281
| tst.js:29:9:29:82 | source | tst.js:35:28:35:33 | source |
280282
| tst.js:29:9:29:82 | source | tst.js:35:28:35:33 | source |
283+
| tst.js:29:9:29:82 | source | tst.js:37:33:37:38 | source |
284+
| tst.js:29:9:29:82 | source | tst.js:37:33:37:38 | source |
281285
| tst.js:29:18:29:41 | documen ... .search | tst.js:29:18:29:82 | documen ... , "$1") |
282286
| tst.js:29:18:29:41 | documen ... .search | tst.js:29:18:29:82 | documen ... , "$1") |
283287
| tst.js:29:18:29:82 | documen ... , "$1") | tst.js:29:9:29:82 | source |
@@ -336,3 +340,4 @@ edges
336340
| tst.js:31:18:31:23 | source | tst.js:29:18:29:41 | documen ... .search | tst.js:31:18:31:23 | source | $@ flows to here and is interpreted as code. | tst.js:29:18:29:41 | documen ... .search | User-provided value |
337341
| tst.js:33:14:33:19 | source | tst.js:29:18:29:41 | documen ... .search | tst.js:33:14:33:19 | source | $@ flows to here and is interpreted as code. | tst.js:29:18:29:41 | documen ... .search | User-provided value |
338342
| tst.js:35:28:35:33 | source | tst.js:29:18:29:41 | documen ... .search | tst.js:35:28:35:33 | source | $@ flows to here and is interpreted as code. | tst.js:29:18:29:41 | documen ... .search | User-provided value |
343+
| tst.js:37:33:37:38 | source | tst.js:29:18:29:41 | documen ... .search | tst.js:37:33:37:38 | source | $@ flows to here and is interpreted as code. | tst.js:29:18:29:41 | documen ... .search | User-provided value |

‎javascript/ql/test/query-tests/Security/CWE-094/CodeInjection/HeuristicSourceCodeInjection.expected‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -171,6 +171,8 @@ nodes
171171
| tst.js:33:14:33:19 | source |
172172
| tst.js:35:28:35:33 | source |
173173
| tst.js:35:28:35:33 | source |
174+
| tst.js:37:33:37:38 | source |
175+
| tst.js:37:33:37:38 | source |
174176
edges
175177
| NoSQLCodeInjection.js:18:24:18:31 | req.body | NoSQLCodeInjection.js:18:24:18:37 | req.body.query |
176178
| NoSQLCodeInjection.js:18:24:18:31 | req.body | NoSQLCodeInjection.js:18:24:18:37 | req.body.query |
@@ -286,6 +288,8 @@ edges
286288
| tst.js:29:9:29:82 | source | tst.js:33:14:33:19 | source |
287289
| tst.js:29:9:29:82 | source | tst.js:35:28:35:33 | source |
288290
| tst.js:29:9:29:82 | source | tst.js:35:28:35:33 | source |
291+
| tst.js:29:9:29:82 | source | tst.js:37:33:37:38 | source |
292+
| tst.js:29:9:29:82 | source | tst.js:37:33:37:38 | source |
289293
| tst.js:29:18:29:41 | documen ... .search | tst.js:29:18:29:82 | documen ... , "$1") |
290294
| tst.js:29:18:29:41 | documen ... .search | tst.js:29:18:29:82 | documen ... , "$1") |
291295
| tst.js:29:18:29:82 | documen ... , "$1") | tst.js:29:9:29:82 | source |

‎javascript/ql/test/query-tests/Security/CWE-094/CodeInjection/tst.js‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -34,5 +34,5 @@ $('<a>').attr("onclick", location.search.substring(1));
3434

3535
new Function("a", "b", source); // NOT OK
3636

37-
new Function(...["a", "b"], source); // NOT OK - but not flagged [INCONSISTENCY]
37+
new Function(...["a", "b"], source); // NOT OK
3838
})();

0 commit comments

Comments
 (0)