Thanks to visit codestin.com
Credit goes to github.com

Skip to content

Commit 790526b

Browse files
asgerfasgerf
committed
JS: Some fixes and address review comments
1 parent 8a3fba0 commit 790526b

2 files changed

Lines changed: 63 additions & 49 deletions

File tree

‎javascript/ql/src/semmle/javascript/frameworks/DateFunctions.qll‎

Lines changed: 61 additions & 47 deletions
Original file line numberDiff line numberDiff line change
@@ -1,61 +1,75 @@
1+
/** Provides taint steps modeling flow through date-manipulation libraries. */
12
private import javascript
23

3-
private API::Node formatFunction() {
4-
result = API::moduleImport(["date-fns", "date-fns/utc"]).getMember(["format", "lightFormat"])
5-
or
6-
result =
7-
API::moduleImport(["date-fns/format", "date-fns/lightFormat", "date-fns/utc/format",
8-
"date-fns/utc/lightFormat"])
9-
}
4+
private module DateFns {
5+
private API::Node formatFunction() {
6+
result = API::moduleImport(["date-fns", "date-fns/esm"]).getMember(["format", "lightFormat"])
7+
or
8+
result =
9+
API::moduleImport(["date-fns/format", "date-fns/lightFormat", "date-fns/esm/format",
10+
"date-fns/esm/lightFormat"])
11+
}
1012

11-
private API::Node formatFunctionCurried() {
12-
result =
13-
API::moduleImport(["date-fns/fp", "date-fns/fp/utc"]).getMember(["format", "lightFormat"])
14-
or
15-
result =
16-
API::moduleImport(["date-fns/fp/format", "date-fns/fp/lightFormat", "date-fns/fp/utc/format",
17-
"date-fns/fp/utc/lightFormat"])
18-
}
13+
private API::Node curriedFormatFunction() {
14+
result =
15+
API::moduleImport(["date-fns/fp", "date-fns/esm/fp"]).getMember(["format", "lightFormat"])
16+
or
17+
result =
18+
API::moduleImport(["date-fns/fp/format", "date-fns/fp/lightFormat", "date-fns/esm/fp/format",
19+
"date-fns/esm/fp/lightFormat"])
20+
}
1921

20-
/**
21-
* Taint step of form: `f -> format(date, f)`
22-
*
23-
* A format string can use single-quotes to include mostly arbitrary text.
24-
*/
25-
private class DateFnsFormatStep extends TaintTracking::AdditionalTaintStep, DataFlow::CallNode {
26-
DateFnsFormatStep() { this = formatFunction().getACall() }
27-
28-
override predicate step(DataFlow::Node pred, DataFlow::Node succ) {
29-
pred = getArgument(1) and
30-
succ = this
22+
/**
23+
* Taint step of form: `f -> format(date, f)`
24+
*
25+
* A format string can use single-quotes to include mostly arbitrary text.
26+
*/
27+
private class FormatStep extends TaintTracking::AdditionalTaintStep, DataFlow::CallNode {
28+
FormatStep() { this = formatFunction().getACall() }
29+
30+
override predicate step(DataFlow::Node pred, DataFlow::Node succ) {
31+
pred = getArgument(1) and
32+
succ = this
33+
}
3134
}
32-
}
3335

34-
/**
35-
* Taint step of form: `f -> format(f)(date)`
36-
*/
37-
private class DateFnsCurriedFormatStep extends TaintTracking::AdditionalTaintStep,
38-
DataFlow::CallNode {
39-
DateFnsCurriedFormatStep() { this = formatFunctionCurried().getACall() }
36+
/**
37+
* Taint step of form: `f -> format(f)(date)`
38+
*/
39+
private class CurriedFormatStep extends TaintTracking::AdditionalTaintStep,
40+
DataFlow::CallNode {
41+
CurriedFormatStep() { this = curriedFormatFunction().getACall() }
4042

41-
override predicate step(DataFlow::Node pred, DataFlow::Node succ) {
42-
pred = getArgument(0) and
43-
succ = getACall()
43+
override predicate step(DataFlow::Node pred, DataFlow::Node succ) {
44+
pred = getArgument(0) and
45+
succ = getACall()
46+
}
4447
}
4548
}
4649

47-
/**
48-
* Taint step of form: `f -> momentObj.format(f)`
49-
*
50-
* The format string can use backslash-escaping to include mostly arbitrary text.
51-
*/
52-
private class MomentFormatStep extends TaintTracking::AdditionalTaintStep, DataFlow::CallNode {
53-
MomentFormatStep() {
54-
this = API::moduleImport("moment").getASuccessor*().getMember("format").getACall()
50+
private module Moment {
51+
/** Gets a reference to a `moment` object. */
52+
private API::Node moment() {
53+
result = API::moduleImport("moment")
54+
or
55+
result = moment().getReturn()
56+
or
57+
result = moment().getAMember()
5558
}
5659

57-
override predicate step(DataFlow::Node pred, DataFlow::Node succ) {
58-
pred = getArgument(0) and
59-
succ = this
60+
/**
61+
* Taint step of form: `f -> momentObj.format(f)`
62+
*
63+
* The format string can use backslash-escaping to include mostly arbitrary text.
64+
*/
65+
private class MomentFormatStep extends TaintTracking::AdditionalTaintStep, DataFlow::CallNode {
66+
MomentFormatStep() {
67+
this = moment().getMember("format").getACall()
68+
}
69+
70+
override predicate step(DataFlow::Node pred, DataFlow::Node succ) {
71+
pred = getArgument(0) and
72+
succ = this
73+
}
6074
}
6175
}

‎javascript/ql/test/query-tests/Security/CWE-079/DomBasedXss/dates.js‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,14 +1,14 @@
11
import dateFns from 'date-fns';
22
import dateFnsFp from 'date-fns/fp';
3-
import dateFnsUtc from 'date-fns/utc';
3+
import dateFnsEsm from 'date-fns/esm';
44
import moment from 'moment';
55

66
function main() {
77
let time = new Date();
88
let taint = decodeURIComponent(window.location.hash.substring(1));
99

1010
document.body.innerHTML = `Time is ${dateFns.format(time, taint)}`; // NOT OK
11-
document.body.innerHTML = `Time is ${dateFnsUtc.format(time, taint)}`; // NOT OK
11+
document.body.innerHTML = `Time is ${dateFnsEsm.format(time, taint)}`; // NOT OK
1212
document.body.innerHTML = `Time is ${dateFnsFp.format(taint)(time)}`; // NOT OK
1313
document.body.innerHTML = `Time is ${dateFns.format(taint, time)}`; // OK - time arg is safe
1414
document.body.innerHTML = `Time is ${dateFnsFp.format(time)(taint)}`; // OK - time arg is safe

0 commit comments

Comments
 (0)