normalize auth-headers to lowercase

erik-krogh · erik-krogh · commit 6b579dfad390 · 2021-08-03T09:09:47.000+02:00
diff --git a/javascript/ql/src/semmle/javascript/security/SensitiveActions.qll b/javascript/ql/src/semmle/javascript/security/SensitiveActions.qll
@@ -197,22 +197,22 @@ module PasswordHeuristics {
     isDummyPassword(header)
     or
     exists(string prefix, string suffix | prefix = getAnHTTPAuthenticationScheme() |
-      header = prefix + " " + suffix and
+      header.toLowerCase() = prefix + " " + suffix and
       isDummyPassword(suffix)
     )
     or
-    header.trim() = getAnHTTPAuthenticationScheme()
+    header.trim().toLowerCase() = getAnHTTPAuthenticationScheme()
   }
 
   /**
-   * Gets a HTTP authentication scheme.
+   * Gets a HTTP authentication scheme normalized to lowercase.
    * From this list: https://www.iana.org/assignments/http-authschemes/http-authschemes.xhtml
    */
   private string getAnHTTPAuthenticationScheme() {
     result =
       [
         "Basic", "Bearer", "Digest", "HOBA", "Mutual", "Negotiate", "OAuth", "SCRAM-SHA-1",
         "SCRAM-SHA-256", "vapid"
-      ]
+      ].toLowerCase()
   }
 }

Original file line number	Diff line number	Diff line change
`@@ -197,22 +197,22 @@ module PasswordHeuristics {`
`197`	`197`	`isDummyPassword(header)`
`198`	`198`	`or`
`199`	`199`	`exists(string prefix, string suffix \| prefix = getAnHTTPAuthenticationScheme() \|`
`200`		`- header = prefix + " " + suffix and`
	`200`	`+ header.toLowerCase() = prefix + " " + suffix and`
`201`	`201`	`isDummyPassword(suffix)`
`202`	`202`	`)`
`203`	`203`	`or`
`204`		`- header.trim() = getAnHTTPAuthenticationScheme()`
	`204`	`+ header.trim().toLowerCase() = getAnHTTPAuthenticationScheme()`
`205`	`205`	`}`
`206`	`206`
`207`	`207`	`/**`
`208`		`- * Gets a HTTP authentication scheme.`
	`208`	`+ * Gets a HTTP authentication scheme normalized to lowercase.`
`209`	`209`	`* From this list: https://www.iana.org/assignments/http-authschemes/http-authschemes.xhtml`
`210`	`210`	`*/`
`211`	`211`	`private string getAnHTTPAuthenticationScheme() {`
`212`	`212`	`result =`
`213`	`213`	`[`
`214`	`214`	`"Basic", "Bearer", "Digest", "HOBA", "Mutual", "Negotiate", "OAuth", "SCRAM-SHA-1",`
`215`	`215`	`"SCRAM-SHA-256", "vapid"`
`216`		`- ]`
	`216`	`+ ].toLowerCase()`
`217`	`217`	`}`
`218`	`218`	`}`