Thanks to visit codestin.com
Credit goes to github.com

Skip to content

Commit 6e3f4bd

Browse files
asgerfasgerf
committed
JS: Port UnsafeHtmlConstruction
1 parent 7f4d42d commit 6e3f4bd

4 files changed

Lines changed: 150 additions & 253 deletions

File tree

‎javascript/ql/lib/semmle/javascript/security/dataflow/UnsafeHtmlConstructionCustomizations.qll‎

Lines changed: 26 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -61,6 +61,30 @@ module UnsafeHtmlConstruction {
6161
abstract string describe();
6262
}
6363

64+
/**
65+
* A barrier guard for unsafe HTML constructed from library input vulnerabilities.
66+
*/
67+
abstract class BarrierGuard extends DataFlow::Node {
68+
/**
69+
* Holds if this node acts as a barrier for data flow, blocking further flow from `e` if `this` evaluates to `outcome`.
70+
*/
71+
predicate blocksExpr(boolean outcome, Expr e) { none() }
72+
73+
/**
74+
* Holds if this node acts as a barrier for `label`, blocking further flow from `e` if `this` evaluates to `outcome`.
75+
*/
76+
predicate blocksExpr(boolean outcome, Expr e, DataFlow::FlowLabel label) { none() }
77+
}
78+
79+
/** A subclass of `BarrierGuard` that is used for backward compatibility with the old data flow library. */
80+
abstract class BarrierGuardLegacy extends BarrierGuard, TaintTracking::SanitizerGuardNode {
81+
override predicate sanitizes(boolean outcome, Expr e) { this.blocksExpr(outcome, e) }
82+
83+
override predicate sanitizes(boolean outcome, Expr e, DataFlow::FlowLabel label) {
84+
this.blocksExpr(outcome, e, label)
85+
}
86+
}
87+
6488
/**
6589
* A sink for `js/html-constructed-from-input` that constructs some HTML where
6690
* that HTML is later used in `xssSink`.
@@ -176,14 +200,14 @@ module UnsafeHtmlConstruction {
176200
}
177201

178202
/** A test for the value of `typeof x`, restricting the potential types of `x`. */
179-
class TypeTestGuard extends TaintTracking::LabeledSanitizerGuardNode, DataFlow::ValueNode {
203+
class TypeTestGuard extends BarrierGuardLegacy, DataFlow::ValueNode {
180204
override EqualityTest astNode;
181205
Expr operand;
182206
boolean polarity;
183207

184208
TypeTestGuard() { TaintTracking::isStringTypeGuard(astNode, operand, polarity) }
185209

186-
override predicate sanitizes(boolean outcome, Expr e, DataFlow::FlowLabel lbl) {
210+
override predicate blocksExpr(boolean outcome, Expr e, DataFlow::FlowLabel lbl) {
187211
polarity = outcome and
188212
e = operand and
189213
lbl.isTaint()

‎javascript/ql/lib/semmle/javascript/security/dataflow/UnsafeHtmlConstructionQuery.qll‎

Lines changed: 62 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -12,7 +12,66 @@ import semmle.javascript.security.TaintedObject
1212
/**
1313
* A taint-tracking configuration for reasoning about unsafe HTML constructed from library input vulnerabilities.
1414
*/
15-
class Configration extends TaintTracking::Configuration {
15+
module UnsafeHtmlConstructionConfig implements DataFlow::StateConfigSig {
16+
class FlowState = DataFlow::FlowLabel;
17+
18+
predicate isSource(DataFlow::Node source, DataFlow::FlowLabel label) {
19+
source instanceof Source and
20+
label = [TaintedObject::label(), DataFlow::FlowLabel::taint(), DataFlow::FlowLabel::data()]
21+
}
22+
23+
predicate isSink(DataFlow::Node sink, DataFlow::FlowLabel label) {
24+
sink instanceof Sink and
25+
label = DataFlow::FlowLabel::taint()
26+
}
27+
28+
predicate isBarrier(DataFlow::Node node) {
29+
node instanceof DomBasedXss::Sanitizer
30+
or
31+
node instanceof UnsafeJQueryPlugin::Sanitizer
32+
or
33+
DomBasedXss::isOptionallySanitizedNode(node)
34+
}
35+
36+
predicate isBarrier(DataFlow::Node node, DataFlow::FlowLabel label) {
37+
TaintTracking::defaultSanitizer(node) and label.isTaint()
38+
or
39+
node = DataFlow::MakeLabeledBarrierGuard<BarrierGuard>::getABarrierNode(label)
40+
}
41+
42+
predicate isAdditionalFlowStep(
43+
DataFlow::Node pred, DataFlow::FlowLabel inlbl, DataFlow::Node succ, DataFlow::FlowLabel outlbl
44+
) {
45+
// TODO: localFieldStep is too expensive with dataflow2
46+
// DataFlow::localFieldStep(pred, succ) and
47+
// inlbl.isTaint() and
48+
// outlbl.isTaint()
49+
none()
50+
or
51+
TaintedObject::step(pred, succ, inlbl, outlbl)
52+
or
53+
// property read from a tainted object is considered tainted
54+
succ.(DataFlow::PropRead).getBase() = pred and
55+
inlbl = TaintedObject::label() and
56+
outlbl = DataFlow::FlowLabel::taint()
57+
or
58+
TaintTracking::defaultTaintStep(pred, succ) and
59+
inlbl.isTaint() and
60+
outlbl = inlbl
61+
}
62+
63+
DataFlow::FlowFeature getAFeature() { result instanceof DataFlow::FeatureHasSourceCallContext }
64+
}
65+
66+
/**
67+
* Taint-tracking for reasoning about unsafe HTML constructed from library input vulnerabilities.
68+
*/
69+
module UnsafeHtmlConstructionFlow = DataFlow::GlobalWithState<UnsafeHtmlConstructionConfig>;
70+
71+
/**
72+
* DEPRECATED. Use the `UnsafeHtmlConstructionFlow` module instead.
73+
*/
74+
deprecated class Configration extends TaintTracking::Configuration {
1675
Configration() { this = "UnsafeHtmlConstruction" }
1776

1877
override predicate isSource(DataFlow::Node source, DataFlow::FlowLabel label) {
@@ -65,11 +124,10 @@ class Configration extends TaintTracking::Configuration {
65124

66125
private import semmle.javascript.security.dataflow.Xss::Shared as Shared
67126

68-
private class QuoteGuard extends TaintTracking::SanitizerGuardNode, Shared::QuoteGuard {
127+
private class QuoteGuard extends Shared::QuoteGuard {
69128
QuoteGuard() { this = this }
70129
}
71130

72-
private class ContainsHtmlGuard extends TaintTracking::SanitizerGuardNode, Shared::ContainsHtmlGuard
73-
{
131+
private class ContainsHtmlGuard extends Shared::ContainsHtmlGuard {
74132
ContainsHtmlGuard() { this = this }
75133
}

‎javascript/ql/src/Security/CWE-079/UnsafeHtmlConstruction.ql‎

Lines changed: 5 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -13,11 +13,13 @@
1313
*/
1414

1515
import javascript
16-
import DataFlow::PathGraph
1716
import semmle.javascript.security.dataflow.UnsafeHtmlConstructionQuery
17+
import DataFlow::DeduplicatePathGraph<UnsafeHtmlConstructionFlow::PathNode, UnsafeHtmlConstructionFlow::PathGraph>
1818

19-
from DataFlow::Configuration cfg, DataFlow::PathNode source, DataFlow::PathNode sink, Sink sinkNode
20-
where cfg.hasFlowPath(source, sink) and sink.getNode() = sinkNode
19+
from PathNode source, PathNode sink, Sink sinkNode
20+
where
21+
UnsafeHtmlConstructionFlow::flowPath(source.getAnOriginalPathNode(), sink.getAnOriginalPathNode()) and
22+
sink.getNode() = sinkNode
2123
select sinkNode, source, sink,
2224
"This " + sinkNode.describe() + " which depends on $@ might later allow $@.", source.getNode(),
2325
"library input", sinkNode.getSink(), sinkNode.getVulnerabilityKind().toLowerCase()

0 commit comments

Comments
 (0)