Thanks to visit codestin.com
Credit goes to github.com

Skip to content

Commit 8a5b166

Browse files
erik-krogherik-krogh
committed
move initialization of sanitizer-guards to Query.qll files
1 parent 73dbe44 commit 8a5b166

10 files changed

Lines changed: 108 additions & 40 deletions

File tree

‎javascript/ql/experimental/adaptivethreatmodeling/lib/experimental/adaptivethreatmodeling/XssATM.qll‎

Lines changed: 18 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -99,10 +99,27 @@ class Configuration extends TaintTracking::Configuration {
9999
}
100100

101101
override predicate isSanitizerGuard(TaintTracking::SanitizerGuardNode guard) {
102-
guard instanceof DomBasedXss::SanitizerGuard
102+
guard instanceof PrefixStringSanitizerActivated or
103+
guard instanceof QuoteGuard or
104+
guard instanceof ContainsHtmlGuard
103105
}
104106

105107
override predicate isSanitizerEdge(DataFlow::Node pred, DataFlow::Node succ) {
106108
DomBasedXss::isOptionallySanitizedEdge(pred, succ)
107109
}
108110
}
111+
112+
private import semmle.javascript.security.dataflow.Xss::Shared as Shared
113+
114+
private class PrefixStringSanitizerActivated extends TaintTracking::SanitizerGuardNode,
115+
DomBasedXss::PrefixStringSanitizer {
116+
PrefixStringSanitizerActivated() { this = this }
117+
}
118+
119+
private class QuoteGuard extends TaintTracking::SanitizerGuardNode, Shared::QuoteGuard {
120+
QuoteGuard() { this = this }
121+
}
122+
123+
private class ContainsHtmlGuard extends TaintTracking::SanitizerGuardNode, Shared::ContainsHtmlGuard {
124+
ContainsHtmlGuard() { this = this }
125+
}

‎javascript/ql/lib/semmle/javascript/security/dataflow/DomBasedXssCustomizations.qll‎

Lines changed: 12 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -18,9 +18,6 @@ module DomBasedXss {
1818
/** A sanitizer for DOM-based XSS vulnerabilities. */
1919
abstract class Sanitizer extends Shared::Sanitizer { }
2020

21-
/** A sanitizer guard for DOM-based XSS vulnerabilities. */
22-
abstract class SanitizerGuard extends Shared::SanitizerGuard { }
23-
2421
/**
2522
* An expression whose value is interpreted as HTML
2623
* and may be inserted into the DOM through a library.
@@ -287,8 +284,6 @@ module DomBasedXss {
287284

288285
private class IsEscapedInSwitchSanitizer extends Sanitizer, Shared::IsEscapedInSwitchSanitizer { }
289286

290-
private class QuoteGuard extends SanitizerGuard, Shared::QuoteGuard { }
291-
292287
/**
293288
* Holds if there exists two dataflow edges to `succ`, where one edges is sanitized, and the other edge starts with `pred`.
294289
*/
@@ -319,8 +314,6 @@ module DomBasedXss {
319314
)
320315
}
321316

322-
private class ContainsHtmlGuard extends SanitizerGuard, Shared::ContainsHtmlGuard { }
323-
324317
/** A source of remote user input, considered as a flow source for DOM-based XSS. */
325318
class RemoteFlowSourceAsSource extends Source {
326319
RemoteFlowSourceAsSource() { this instanceof RemoteFlowSource }
@@ -335,4 +328,16 @@ module DomBasedXss {
335328

336329
/** Gets the flow-label representing tainted values where the prefix is attacker controlled. */
337330
PrefixString prefixLabel() { any() }
331+
332+
/**
333+
* A sanitizer that blocks the `PrefixString` label when the start of the string is being tested as being of a particular prefix.
334+
*/
335+
abstract class PrefixStringSanitizer extends TaintTracking::SanitizerGuardNode,
336+
TaintTracking::LabeledSanitizerGuardNode instanceof StringOps::StartsWith {
337+
override predicate sanitizes(boolean outcome, Expr e, DataFlow::FlowLabel label) {
338+
e = super.getBaseString().asExpr() and
339+
label = prefixLabel() and
340+
outcome = super.getPolarity()
341+
}
342+
}
338343
}

‎javascript/ql/lib/semmle/javascript/security/dataflow/DomBasedXssQuery.qll‎

Lines changed: 15 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -6,6 +6,7 @@
66
import javascript
77
private import semmle.javascript.security.TaintedUrlSuffix
88
import DomBasedXssCustomizations::DomBasedXss
9+
private import Xss::Shared as Shared
910

1011
/**
1112
* DEPRECATED. Use `Vue::VHtmlSourceWrite` instead.
@@ -71,7 +72,9 @@ class Configuration extends TaintTracking::Configuration {
7172
}
7273

7374
override predicate isSanitizerGuard(TaintTracking::SanitizerGuardNode guard) {
74-
guard instanceof SanitizerGuard
75+
guard instanceof PrefixStringSanitizer or
76+
guard instanceof QuoteGuard or
77+
guard instanceof ContainsHtmlGuard
7578
}
7679

7780
override predicate isLabeledBarrier(DataFlow::Node node, DataFlow::FlowLabel lbl) {
@@ -124,13 +127,15 @@ class Configuration extends TaintTracking::Configuration {
124127
}
125128
}
126129

127-
/**
128-
* A sanitizer that blocks the `PrefixString` label when the start of the string is being tested as being of a particular prefix.
129-
*/
130-
class PrefixStringSanitizer extends SanitizerGuard, TaintTracking::LabeledSanitizerGuardNode instanceof StringOps::StartsWith {
131-
override predicate sanitizes(boolean outcome, Expr e, DataFlow::FlowLabel label) {
132-
e = super.getBaseString().asExpr() and
133-
label = prefixLabel() and
134-
outcome = super.getPolarity()
135-
}
130+
private class PrefixStringSanitizerActivated extends TaintTracking::SanitizerGuardNode,
131+
PrefixStringSanitizer {
132+
PrefixStringSanitizerActivated() { this = this }
133+
}
134+
135+
private class QuoteGuard extends TaintTracking::SanitizerGuardNode, Shared::QuoteGuard {
136+
QuoteGuard() { this = this }
137+
}
138+
139+
private class ContainsHtmlGuard extends TaintTracking::SanitizerGuardNode, Shared::ContainsHtmlGuard {
140+
ContainsHtmlGuard() { this = this }
136141
}

‎javascript/ql/lib/semmle/javascript/security/dataflow/ReflectedXssCustomizations.qll‎

Lines changed: 0 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -17,9 +17,6 @@ module ReflectedXss {
1717
/** A sanitizer for reflected XSS vulnerabilities. */
1818
abstract class Sanitizer extends Shared::Sanitizer { }
1919

20-
/** A sanitizer guard for reflected XSS vulnerabilities. */
21-
abstract class SanitizerGuard extends Shared::SanitizerGuard { }
22-
2320
/**
2421
* An expression that is sent as part of an HTTP response, considered as an XSS sink.
2522
*
@@ -110,10 +107,6 @@ module ReflectedXss {
110107

111108
private class IsEscapedInSwitchSanitizer extends Sanitizer, Shared::IsEscapedInSwitchSanitizer { }
112109

113-
private class QuoteGuard extends SanitizerGuard, Shared::QuoteGuard { }
114-
115-
private class ContainsHtmlGuard extends SanitizerGuard, Shared::ContainsHtmlGuard { }
116-
117110
/** A third-party controllable request input, considered as a flow source for reflected XSS. */
118111
class ThirdPartyRequestInputAccessAsSource extends Source {
119112
ThirdPartyRequestInputAccessAsSource() {

‎javascript/ql/lib/semmle/javascript/security/dataflow/ReflectedXssQuery.qll‎

Lines changed: 11 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -5,6 +5,7 @@
55

66
import javascript
77
import ReflectedXssCustomizations::ReflectedXss
8+
private import Xss::Shared as Shared
89

910
/**
1011
* A taint-tracking configuration for reasoning about XSS.
@@ -22,6 +23,15 @@ class Configuration extends TaintTracking::Configuration {
2223
}
2324

2425
override predicate isSanitizerGuard(TaintTracking::SanitizerGuardNode guard) {
25-
guard instanceof SanitizerGuard
26+
guard instanceof QuoteGuard or
27+
guard instanceof ContainsHtmlGuard
2628
}
2729
}
30+
31+
private class QuoteGuard extends TaintTracking::SanitizerGuardNode, Shared::QuoteGuard {
32+
QuoteGuard() { this = this }
33+
}
34+
35+
private class ContainsHtmlGuard extends TaintTracking::SanitizerGuardNode, Shared::ContainsHtmlGuard {
36+
ContainsHtmlGuard() { this = this }
37+
}

‎javascript/ql/lib/semmle/javascript/security/dataflow/StoredXssCustomizations.qll‎

Lines changed: 0 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -17,9 +17,6 @@ module StoredXss {
1717
/** A sanitizer for stored XSS vulnerabilities. */
1818
abstract class Sanitizer extends Shared::Sanitizer { }
1919

20-
/** A sanitizer guard for stored XSS vulnerabilities. */
21-
abstract class SanitizerGuard extends Shared::SanitizerGuard { }
22-
2320
/** An arbitrary XSS sink, considered as a flow sink for stored XSS. */
2421
private class AnySink extends Sink {
2522
AnySink() { this instanceof Shared::Sink }
@@ -40,8 +37,4 @@ module StoredXss {
4037
}
4138

4239
private class IsEscapedInSwitchSanitizer extends Sanitizer, Shared::IsEscapedInSwitchSanitizer { }
43-
44-
private class QuoteGuard extends SanitizerGuard, Shared::QuoteGuard { }
45-
46-
private class ContainsHtmlGuard extends SanitizerGuard, Shared::ContainsHtmlGuard { }
4740
}

‎javascript/ql/lib/semmle/javascript/security/dataflow/StoredXssQuery.qll‎

Lines changed: 11 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -5,6 +5,7 @@
55

66
import javascript
77
import StoredXssCustomizations::StoredXss
8+
private import Xss::Shared as Shared
89

910
/**
1011
* A taint-tracking configuration for reasoning about XSS.
@@ -22,7 +23,8 @@ class Configuration extends TaintTracking::Configuration {
2223
}
2324

2425
override predicate isSanitizerGuard(TaintTracking::SanitizerGuardNode guard) {
25-
guard instanceof SanitizerGuard
26+
guard instanceof QuoteGuard or
27+
guard instanceof ContainsHtmlGuard
2628
}
2729
}
2830

@@ -35,3 +37,11 @@ class FileNameSourceAsSource extends Source {
3537
class UserControlledTorrentInfoAsSource extends Source {
3638
UserControlledTorrentInfoAsSource() { this instanceof ParseTorrent::UserControlledTorrentInfo }
3739
}
40+
41+
private class QuoteGuard extends TaintTracking::SanitizerGuardNode, Shared::QuoteGuard {
42+
QuoteGuard() { this = this }
43+
}
44+
45+
private class ContainsHtmlGuard extends TaintTracking::SanitizerGuardNode, Shared::ContainsHtmlGuard {
46+
ContainsHtmlGuard() { this = this }
47+
}

‎javascript/ql/lib/semmle/javascript/security/dataflow/UnsafeHtmlConstructionQuery.qll‎

Lines changed: 21 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -39,4 +39,25 @@ class Configration extends TaintTracking::Configuration {
3939
override predicate isAdditionalTaintStep(DataFlow::Node pred, DataFlow::Node succ) {
4040
DataFlow::localFieldStep(pred, succ)
4141
}
42+
43+
override predicate isSanitizerGuard(TaintTracking::SanitizerGuardNode guard) {
44+
guard instanceof PrefixStringSanitizer or
45+
guard instanceof QuoteGuard or
46+
guard instanceof ContainsHtmlGuard
47+
}
48+
}
49+
50+
private import semmle.javascript.security.dataflow.Xss::Shared as Shared
51+
52+
private class PrefixStringSanitizer extends TaintTracking::SanitizerGuardNode,
53+
DomBasedXss::PrefixStringSanitizer {
54+
PrefixStringSanitizer() { this = this }
55+
}
56+
57+
private class QuoteGuard extends TaintTracking::SanitizerGuardNode, Shared::QuoteGuard {
58+
QuoteGuard() { this = this }
59+
}
60+
61+
private class ContainsHtmlGuard extends TaintTracking::SanitizerGuardNode, Shared::ContainsHtmlGuard {
62+
ContainsHtmlGuard() { this = this }
4263
}

‎javascript/ql/lib/semmle/javascript/security/dataflow/Xss.qll‎

Lines changed: 2 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -23,9 +23,6 @@ module Shared {
2323
/** A sanitizer for XSS vulnerabilities. */
2424
abstract class Sanitizer extends DataFlow::Node { }
2525

26-
/** A sanitizer guard for XSS vulnerabilities. */
27-
abstract class SanitizerGuard extends TaintTracking::SanitizerGuardNode { }
28-
2926
/**
3027
* A global regexp replacement involving the `<`, `'`, or `"` meta-character, viewed as a sanitizer for
3128
* XSS vulnerabilities.
@@ -70,7 +67,7 @@ module Shared {
7067
/**
7168
* A guard that checks if a string can contain quotes, which is a guard for strings that are inside a HTML attribute.
7269
*/
73-
class QuoteGuard extends SanitizerGuard, StringOps::Includes {
70+
abstract class QuoteGuard extends TaintTracking::SanitizerGuardNode, StringOps::Includes {
7471
QuoteGuard() {
7572
this.getSubstring().mayHaveStringValue("\"") and
7673
this.getBaseString()
@@ -87,7 +84,7 @@ module Shared {
8784
* A sanitizer guard that checks for the existence of HTML chars in a string.
8885
* E.g. `/["'&<>]/.exec(str)`.
8986
*/
90-
class ContainsHtmlGuard extends SanitizerGuard, StringOps::RegExpTest {
87+
abstract class ContainsHtmlGuard extends TaintTracking::SanitizerGuardNode, StringOps::RegExpTest {
9188
ContainsHtmlGuard() {
9289
exists(RegExpCharacterClass regExp |
9390
regExp = this.getRegExp() and

‎javascript/ql/lib/semmle/javascript/security/dataflow/XssThroughDomQuery.qll‎

Lines changed: 18 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -28,7 +28,9 @@ class Configuration extends TaintTracking::Configuration {
2828
guard instanceof TypeTestGuard or
2929
guard instanceof UnsafeJQuery::PropertyPresenceSanitizer or
3030
guard instanceof UnsafeJQuery::NumberGuard or
31-
guard instanceof DomBasedXss::SanitizerGuard
31+
guard instanceof PrefixStringSanitizer or
32+
guard instanceof QuoteGuard or
33+
guard instanceof ContainsHtmlGuard
3234
}
3335

3436
override predicate isSanitizerEdge(DataFlow::Node pred, DataFlow::Node succ) {
@@ -49,3 +51,18 @@ class Configuration extends TaintTracking::Configuration {
4951
)
5052
}
5153
}
54+
55+
private import semmle.javascript.security.dataflow.Xss::Shared as Shared
56+
57+
private class PrefixStringSanitizer extends TaintTracking::SanitizerGuardNode,
58+
DomBasedXss::PrefixStringSanitizer {
59+
PrefixStringSanitizer() { this = this }
60+
}
61+
62+
private class QuoteGuard extends TaintTracking::SanitizerGuardNode, Shared::QuoteGuard {
63+
QuoteGuard() { this = this }
64+
}
65+
66+
private class ContainsHtmlGuard extends TaintTracking::SanitizerGuardNode, Shared::ContainsHtmlGuard {
67+
ContainsHtmlGuard() { this = this }
68+
}

0 commit comments

Comments
 (0)