Thanks to visit codestin.com
Credit goes to github.com

Skip to content

Commit 8d397fe

Browse files
author
Stephan Brandauer
committed
JS: query to find dynamic creations of DOM elements that use untrusted sources
1 parent b35c709 commit 8d397fe

5 files changed

Lines changed: 114 additions & 0 deletions

File tree

‎javascript/ql/src/Security/CWE-830/DynamicCreationOfUntrustedSourceUse.ql‎

Lines changed: 58 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,58 @@
1+
/**
2+
* @name Dynamic creation of untrusted source use
3+
* @description Finds dynamically created DOM elements that may use
4+
* behaviour from http-URLs without integrity checks.
5+
* @kind path-problem
6+
* @problem.severity error
7+
* @tags security
8+
* @id js/dynamic-creation-of-untrusted-source-use
9+
*/
10+
11+
import javascript
12+
import DataFlow::PathGraph
13+
14+
predicate isCreateElementNode(DataFlow::CallNode call, string name) {
15+
call = DataFlow::globalVarRef("document").getAMethodCall("createElement") and
16+
call.getArgument(0).getStringValue().toLowerCase() = name
17+
}
18+
19+
predicate isCreateScriptNodeWoIntegrityCheck(DataFlow::CallNode call) {
20+
isCreateElementNode(call, "script") and
21+
not exists(DataFlow::Node rhs | isScriptPropWrite(call, "integrity", rhs))
22+
}
23+
24+
predicate isScriptPropWrite(
25+
DataFlow::CallNode createElementCall, string propName, DataFlow::Node rhs
26+
) {
27+
exists(DataFlow::PropWrite assignment |
28+
isCreateElementNode(createElementCall, "script") and
29+
assignment.writes(createElementCall.getALocalUse(), propName, rhs)
30+
)
31+
}
32+
33+
class DynamicCreationOfUntrustedSourceUseCfg extends TaintTracking::Configuration {
34+
DynamicCreationOfUntrustedSourceUseCfg() { this = "DynamicCreationOfUntrustedSourceUseCfg" }
35+
36+
override predicate isSource(DataFlow::Node source) {
37+
exists(StringLiteral s | source = s.flow() |
38+
s.getValue() = ["http:", "//"] + any(string rest) // TODO match HTTP HtTp etc
39+
)
40+
}
41+
42+
override predicate isSink(DataFlow::Node sink) {
43+
exists(DataFlow::CallNode createElementCall |
44+
isScriptPropWrite(createElementCall, "src", sink) and
45+
isCreateScriptNodeWoIntegrityCheck(createElementCall)
46+
or
47+
exists(DataFlow::CallNode iframeCreateCall, DataFlow::PropWrite srcWrite |
48+
isCreateElementNode(iframeCreateCall, "iframe") and
49+
srcWrite.getRhs() = sink and
50+
srcWrite.getBase() = iframeCreateCall.getALocalUse()
51+
)
52+
)
53+
}
54+
}
55+
56+
from DynamicCreationOfUntrustedSourceUseCfg cfg, DataFlow::PathNode source, DataFlow::PathNode sink
57+
where cfg.hasFlowPath(source, sink)
58+
select sink.getNode(), source, sink, "Illegal flow from $@.", source.getNode(), "here"

‎javascript/ql/src/change-notes/2022-02-14-dynamic-creation-of-untrusted-source-use.md‎

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,6 @@
1+
---
2+
category: newQuery
3+
---
4+
* A new query, `js/dynamic-creation-of-untrusted-source-use`, has been added to the query suite. It finds code
5+
that creates HTML elements that load functionality from untrusted sources, like a `script`- or `iframe`-element using http-links.
6+
The query is run by default.

‎javascript/ql/test/query-tests/Security/CWE-830/DynamicCreationOfUntrustedSourceUse.expected‎

Lines changed: 20 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,20 @@
1+
nodes
2+
| dynamic.html:8:27:8:97 | ('https ... //www') |
3+
| dynamic.html:8:27:8:118 | ('https ... /ga.js' |
4+
| dynamic.html:8:27:8:118 | ('https ... /ga.js' |
5+
| dynamic.html:8:28:8:96 | 'https: ... ://www' |
6+
| dynamic.html:8:85:8:96 | 'http://www' |
7+
| dynamic.html:8:85:8:96 | 'http://www' |
8+
| dynamic.html:18:26:18:50 | 'http:/ ... e.com/' |
9+
| dynamic.html:18:26:18:50 | 'http:/ ... e.com/' |
10+
| dynamic.html:18:26:18:50 | 'http:/ ... e.com/' |
11+
edges
12+
| dynamic.html:8:27:8:97 | ('https ... //www') | dynamic.html:8:27:8:118 | ('https ... /ga.js' |
13+
| dynamic.html:8:27:8:97 | ('https ... //www') | dynamic.html:8:27:8:118 | ('https ... /ga.js' |
14+
| dynamic.html:8:28:8:96 | 'https: ... ://www' | dynamic.html:8:27:8:97 | ('https ... //www') |
15+
| dynamic.html:8:85:8:96 | 'http://www' | dynamic.html:8:28:8:96 | 'https: ... ://www' |
16+
| dynamic.html:8:85:8:96 | 'http://www' | dynamic.html:8:28:8:96 | 'https: ... ://www' |
17+
| dynamic.html:18:26:18:50 | 'http:/ ... e.com/' | dynamic.html:18:26:18:50 | 'http:/ ... e.com/' |
18+
#select
19+
| dynamic.html:8:27:8:118 | ('https ... /ga.js' | dynamic.html:8:85:8:96 | 'http://www' | dynamic.html:8:27:8:118 | ('https ... /ga.js' | Illegal flow from $@. | dynamic.html:8:85:8:96 | 'http://www' | here |
20+
| dynamic.html:18:26:18:50 | 'http:/ ... e.com/' | dynamic.html:18:26:18:50 | 'http:/ ... e.com/' | dynamic.html:18:26:18:50 | 'http:/ ... e.com/' | Illegal flow from $@. | dynamic.html:18:26:18:50 | 'http:/ ... e.com/' | here |

‎javascript/ql/test/query-tests/Security/CWE-830/DynamicCreationOfUntrustedSourceUse.qlref‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1 @@
1+
Security/CWE-830/DynamicCreationOfUntrustedSourceUse.ql

‎javascript/ql/test/query-tests/Security/CWE-830/dynamic.html‎

Lines changed: 29 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,29 @@
1+
<html>
2+
<head>
3+
<script type="text/javascript">
4+
(function() {
5+
// NOT OK (no integrity attribute)
6+
var scrpt = document.createElement('script');
7+
scrpt.type = 'text/javascript';
8+
scrpt.src = ('https:' == document.location.protocol ? 'https://ssl' : 'http://www') + '.cdn.local/ga.js';
9+
10+
// OK (integrity digest present)
11+
var scrpt2 = document.createElement('script');
12+
scrpt2.type = 'text/javascript';
13+
scrpt2.src = ('https:' == document.location.protocol ? 'https://ssl' : 'http://www') + '.cdn.local/ga.js';
14+
scrpt2.integrity = 'sha256-h0UuK3mE9taiYlB5u9vT9A0s/XDgkfVd+F4VhN/sky=';
15+
16+
// NOT OK (http URL)
17+
var ifrm = document.createElement('iframe');
18+
ifrm.src = 'http://www.example.com/';
19+
20+
// OK (https URL)
21+
var ifrm2 = document.createElement('iframe');
22+
ifrm2.src = 'https://www.example.com/';
23+
})();
24+
</script>
25+
</head>
26+
<body>
27+
hello
28+
</body>
29+
</html>

0 commit comments

Comments
 (0)