Thanks to visit codestin.com
Credit goes to github.com

Skip to content

Commit 68584e5

Browse files
asgerfasgerf
committed
JS: Replace isOptionallySanitizedEdge with a node
1 parent 3691b83 commit 68584e5

6 files changed

Lines changed: 27 additions & 27 deletions

File tree

‎javascript/ql/experimental/adaptivethreatmodeling/lib/experimental/adaptivethreatmodeling/XssATM.qll‎

Lines changed: 2 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -23,18 +23,15 @@ class DomBasedXssAtmConfig extends AtmConfig {
2323

2424
override predicate isSanitizer(DataFlow::Node node) {
2525
super.isSanitizer(node) or
26-
node instanceof DomBasedXss::Sanitizer
26+
node instanceof DomBasedXss::Sanitizer or
27+
DomBasedXss::isOptionallySanitizedNode(node)
2728
}
2829

2930
override predicate isSanitizerGuard(TaintTracking::SanitizerGuardNode guard) {
3031
guard instanceof PrefixStringSanitizerActivated or
3132
guard instanceof QuoteGuard or
3233
guard instanceof ContainsHtmlGuard
3334
}
34-
35-
override predicate isSanitizerEdge(DataFlow::Node pred, DataFlow::Node succ) {
36-
DomBasedXss::isOptionallySanitizedEdge(pred, succ)
37-
}
3835
}
3936

4037
private import semmle.javascript.security.dataflow.Xss::Shared as Shared

‎javascript/ql/experimental/adaptivethreatmodeling/lib/experimental/adaptivethreatmodeling/XssThroughDomATM.qll‎

Lines changed: 2 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -23,7 +23,8 @@ class XssThroughDomAtmConfig extends AtmConfig {
2323

2424
override predicate isSanitizer(DataFlow::Node node) {
2525
super.isSanitizer(node) or
26-
node instanceof DomBasedXss::Sanitizer
26+
node instanceof DomBasedXss::Sanitizer or
27+
DomBasedXss::isOptionallySanitizedNode(node)
2728
}
2829

2930
override predicate isSanitizerGuard(TaintTracking::SanitizerGuardNode guard) {
@@ -34,10 +35,6 @@ class XssThroughDomAtmConfig extends AtmConfig {
3435
guard instanceof QuoteGuard or
3536
guard instanceof ContainsHtmlGuard
3637
}
37-
38-
override predicate isSanitizerEdge(DataFlow::Node pred, DataFlow::Node succ) {
39-
DomBasedXss::isOptionallySanitizedEdge(pred, succ)
40-
}
4138
}
4239

4340
/**

‎javascript/ql/lib/semmle/javascript/security/dataflow/DomBasedXssCustomizations.qll‎

Lines changed: 16 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -290,9 +290,13 @@ module DomBasedXss {
290290
private class HtmlSanitizerAsSanitizer extends Sanitizer instanceof HtmlSanitizerCall { }
291291

292292
/**
293+
* DEPRECATED. Use `isOptionallySanitizedNode` instead.
294+
*
293295
* Holds if there exists two dataflow edges to `succ`, where one edges is sanitized, and the other edge starts with `pred`.
294296
*/
295-
predicate isOptionallySanitizedEdge(DataFlow::Node pred, DataFlow::Node succ) {
297+
deprecated predicate isOptionallySanitizedEdge = isOptionallySanitizedEdgeInternal/2;
298+
299+
private predicate isOptionallySanitizedEdgeInternal(DataFlow::Node pred, DataFlow::Node succ) {
296300
exists(HtmlSanitizerCall sanitizer |
297301
// sanitized = sanitize ? sanitizer(source) : source;
298302
exists(ConditionalExpr branch, Variable var, VarAccess access |
@@ -319,6 +323,17 @@ module DomBasedXss {
319323
)
320324
}
321325

326+
/**
327+
* Holds if `node` should be considered optionally sanitized as it occurs in a branch
328+
* that controls whether sanitization is enabled.
329+
*
330+
* For example, in `sanitized = sanitize ? sanitizer(source) : source`, the right-hand `source` expression
331+
* is considered an optionally sanitized node.
332+
*/
333+
predicate isOptionallySanitizedNode(DataFlow::Node node) {
334+
isOptionallySanitizedEdgeInternal(_, node)
335+
}
336+
322337
/** A source of remote user input, considered as a flow source for DOM-based XSS. */
323338
class RemoteFlowSourceAsSource extends Source instanceof RemoteFlowSource { }
324339

‎javascript/ql/lib/semmle/javascript/security/dataflow/DomBasedXssQuery.qll‎

Lines changed: 3 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -86,13 +86,9 @@ class Configuration extends TaintTracking::Configuration {
8686
// we assume that `.join()` calls have a prefix, and thus block the prefix label.
8787
node = any(DataFlow::MethodCallNode call | call.getMethodName() = "join") and
8888
lbl = prefixLabel()
89-
}
90-
91-
override predicate isSanitizerEdge(
92-
DataFlow::Node pred, DataFlow::Node succ, DataFlow::FlowLabel label
93-
) {
94-
isOptionallySanitizedEdge(pred, succ) and
95-
label = [DataFlow::FlowLabel::taint(), prefixLabel(), TaintedUrlSuffix::label()]
89+
or
90+
isOptionallySanitizedNode(node) and
91+
lbl = [DataFlow::FlowLabel::taint(), prefixLabel(), TaintedUrlSuffix::label()]
9692
}
9793

9894
override predicate isAdditionalFlowStep(

‎javascript/ql/lib/semmle/javascript/security/dataflow/UnsafeHtmlConstructionQuery.qll‎

Lines changed: 2 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -31,10 +31,8 @@ class Configration extends TaintTracking::Configuration {
3131
node instanceof DomBasedXss::Sanitizer
3232
or
3333
node instanceof UnsafeJQueryPlugin::Sanitizer
34-
}
35-
36-
override predicate isSanitizerEdge(DataFlow::Node pred, DataFlow::Node succ) {
37-
DomBasedXss::isOptionallySanitizedEdge(pred, succ)
34+
or
35+
DomBasedXss::isOptionallySanitizedNode(node)
3836
}
3937

4038
// override to require that there is a path without unmatched return steps

‎javascript/ql/lib/semmle/javascript/security/dataflow/XssThroughDomQuery.qll‎

Lines changed: 2 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -20,7 +20,8 @@ class Configuration extends TaintTracking::Configuration {
2020

2121
override predicate isSanitizer(DataFlow::Node node) {
2222
super.isSanitizer(node) or
23-
node instanceof DomBasedXss::Sanitizer
23+
node instanceof DomBasedXss::Sanitizer or
24+
DomBasedXss::isOptionallySanitizedNode(node)
2425
}
2526

2627
override predicate isSanitizerGuard(TaintTracking::SanitizerGuardNode guard) {
@@ -32,10 +33,6 @@ class Configuration extends TaintTracking::Configuration {
3233
guard instanceof ContainsHtmlGuard
3334
}
3435

35-
override predicate isSanitizerEdge(DataFlow::Node pred, DataFlow::Node succ) {
36-
DomBasedXss::isOptionallySanitizedEdge(pred, succ)
37-
}
38-
3936
override predicate isAdditionalTaintStep(DataFlow::Node pred, DataFlow::Node succ) {
4037
succ = DataFlow::globalVarRef("URL").getAMemberCall("createObjectURL") and
4138
pred = succ.(DataFlow::InvokeNode).getArgument(0)

0 commit comments

Comments
 (0)