Thanks to visit codestin.com
Credit goes to github.com

Skip to content

Commit 92816b1

Browse files
asgerfasgerf
committed
JS: Port ClientSideRequestForgery
1 parent b221662 commit 92816b1

4 files changed

Lines changed: 63 additions & 42 deletions

File tree

‎javascript/ql/lib/semmle/javascript/security/dataflow/ClientSideRequestForgeryQuery.qll‎

Lines changed: 28 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -14,7 +14,34 @@ import RequestForgeryCustomizations::RequestForgery
1414
/**
1515
* A taint tracking configuration for client-side request forgery.
1616
*/
17-
class Configuration extends TaintTracking::Configuration {
17+
module ClientSideRequestForgeryConfig implements DataFlow::ConfigSig {
18+
predicate isSource(DataFlow::Node source) {
19+
exists(Source src |
20+
source = src and
21+
not src.isServerSide()
22+
)
23+
}
24+
25+
predicate isSink(DataFlow::Node sink) { sink instanceof Sink }
26+
27+
predicate isBarrier(DataFlow::Node node) { node instanceof Sanitizer }
28+
29+
predicate isBarrierOut(DataFlow::Node node) { sanitizingPrefixEdge(node, _) }
30+
31+
predicate isAdditionalFlowStep(DataFlow::Node pred, DataFlow::Node succ) {
32+
isAdditionalRequestForgeryStep(pred, succ)
33+
}
34+
}
35+
36+
/**
37+
* Taint tracking for client-side request forgery.
38+
*/
39+
module ClientSideRequestForgeryFlow = TaintTracking::Global<ClientSideRequestForgeryConfig>;
40+
41+
/**
42+
* DEPRECATED. Use the `ClientSideRequestForgeryFlow` module instead.
43+
*/
44+
deprecated class Configuration extends TaintTracking::Configuration {
1845
Configuration() { this = "ClientSideRequestForgery" }
1946

2047
override predicate isSource(DataFlow::Node source) {

‎javascript/ql/src/Security/CWE-918/ClientSideRequestForgery.ql‎

Lines changed: 5 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -13,11 +13,13 @@
1313

1414
import javascript
1515
import semmle.javascript.security.dataflow.ClientSideRequestForgeryQuery
16-
import DataFlow::PathGraph
16+
import ClientSideRequestForgeryFlow::PathGraph
1717

18-
from Configuration cfg, DataFlow::PathNode source, DataFlow::PathNode sink, DataFlow::Node request
18+
from
19+
ClientSideRequestForgeryFlow::PathNode source, ClientSideRequestForgeryFlow::PathNode sink,
20+
DataFlow::Node request
1921
where
20-
cfg.hasFlowPath(source, sink) and
22+
ClientSideRequestForgeryFlow::flowPath(source, sink) and
2123
request = sink.getNode().(Sink).getARequest()
2224
select request, source, sink, "The $@ of this request depends on a $@.", sink.getNode(),
2325
sink.getNode().(Sink).getKind(), source, "user-provided value"

‎javascript/ql/test/query-tests/Security/CWE-918/ClientSideRequestForgery.expected‎

Lines changed: 18 additions & 34 deletions
Original file line numberDiff line numberDiff line change
@@ -1,50 +1,34 @@
1-
nodes
2-
| clientSide.js:11:11:11:53 | query |
3-
| clientSide.js:11:19:11:40 | window. ... .search |
4-
| clientSide.js:11:19:11:40 | window. ... .search |
5-
| clientSide.js:11:19:11:53 | window. ... ring(1) |
6-
| clientSide.js:12:13:12:54 | 'https: ... + '/id' |
7-
| clientSide.js:12:13:12:54 | 'https: ... + '/id' |
8-
| clientSide.js:12:42:12:46 | query |
9-
| clientSide.js:14:13:14:63 | 'https: ... .search |
10-
| clientSide.js:14:13:14:63 | 'https: ... .search |
11-
| clientSide.js:14:42:14:63 | window. ... .search |
12-
| clientSide.js:14:42:14:63 | window. ... .search |
13-
| clientSide.js:16:11:16:54 | fragment |
14-
| clientSide.js:16:22:16:41 | window.location.hash |
15-
| clientSide.js:16:22:16:41 | window.location.hash |
16-
| clientSide.js:16:22:16:54 | window. ... ring(1) |
17-
| clientSide.js:17:13:17:57 | 'https: ... + '/id' |
18-
| clientSide.js:17:13:17:57 | 'https: ... + '/id' |
19-
| clientSide.js:17:42:17:49 | fragment |
20-
| clientSide.js:20:11:20:28 | name |
21-
| clientSide.js:20:18:20:28 | window.name |
22-
| clientSide.js:20:18:20:28 | window.name |
23-
| clientSide.js:21:13:21:53 | 'https: ... + '/id' |
24-
| clientSide.js:21:13:21:53 | 'https: ... + '/id' |
25-
| clientSide.js:21:42:21:45 | name |
261
edges
272
| clientSide.js:11:11:11:53 | query | clientSide.js:12:42:12:46 | query |
283
| clientSide.js:11:19:11:40 | window. ... .search | clientSide.js:11:19:11:53 | window. ... ring(1) |
29-
| clientSide.js:11:19:11:40 | window. ... .search | clientSide.js:11:19:11:53 | window. ... ring(1) |
304
| clientSide.js:11:19:11:53 | window. ... ring(1) | clientSide.js:11:11:11:53 | query |
315
| clientSide.js:12:42:12:46 | query | clientSide.js:12:13:12:54 | 'https: ... + '/id' |
32-
| clientSide.js:12:42:12:46 | query | clientSide.js:12:13:12:54 | 'https: ... + '/id' |
33-
| clientSide.js:14:42:14:63 | window. ... .search | clientSide.js:14:13:14:63 | 'https: ... .search |
34-
| clientSide.js:14:42:14:63 | window. ... .search | clientSide.js:14:13:14:63 | 'https: ... .search |
35-
| clientSide.js:14:42:14:63 | window. ... .search | clientSide.js:14:13:14:63 | 'https: ... .search |
366
| clientSide.js:14:42:14:63 | window. ... .search | clientSide.js:14:13:14:63 | 'https: ... .search |
377
| clientSide.js:16:11:16:54 | fragment | clientSide.js:17:42:17:49 | fragment |
388
| clientSide.js:16:22:16:41 | window.location.hash | clientSide.js:16:22:16:54 | window. ... ring(1) |
39-
| clientSide.js:16:22:16:41 | window.location.hash | clientSide.js:16:22:16:54 | window. ... ring(1) |
409
| clientSide.js:16:22:16:54 | window. ... ring(1) | clientSide.js:16:11:16:54 | fragment |
4110
| clientSide.js:17:42:17:49 | fragment | clientSide.js:17:13:17:57 | 'https: ... + '/id' |
42-
| clientSide.js:17:42:17:49 | fragment | clientSide.js:17:13:17:57 | 'https: ... + '/id' |
4311
| clientSide.js:20:11:20:28 | name | clientSide.js:21:42:21:45 | name |
4412
| clientSide.js:20:18:20:28 | window.name | clientSide.js:20:11:20:28 | name |
45-
| clientSide.js:20:18:20:28 | window.name | clientSide.js:20:11:20:28 | name |
46-
| clientSide.js:21:42:21:45 | name | clientSide.js:21:13:21:53 | 'https: ... + '/id' |
4713
| clientSide.js:21:42:21:45 | name | clientSide.js:21:13:21:53 | 'https: ... + '/id' |
14+
nodes
15+
| clientSide.js:11:11:11:53 | query | semmle.label | query |
16+
| clientSide.js:11:19:11:40 | window. ... .search | semmle.label | window. ... .search |
17+
| clientSide.js:11:19:11:53 | window. ... ring(1) | semmle.label | window. ... ring(1) |
18+
| clientSide.js:12:13:12:54 | 'https: ... + '/id' | semmle.label | 'https: ... + '/id' |
19+
| clientSide.js:12:42:12:46 | query | semmle.label | query |
20+
| clientSide.js:14:13:14:63 | 'https: ... .search | semmle.label | 'https: ... .search |
21+
| clientSide.js:14:42:14:63 | window. ... .search | semmle.label | window. ... .search |
22+
| clientSide.js:16:11:16:54 | fragment | semmle.label | fragment |
23+
| clientSide.js:16:22:16:41 | window.location.hash | semmle.label | window.location.hash |
24+
| clientSide.js:16:22:16:54 | window. ... ring(1) | semmle.label | window. ... ring(1) |
25+
| clientSide.js:17:13:17:57 | 'https: ... + '/id' | semmle.label | 'https: ... + '/id' |
26+
| clientSide.js:17:42:17:49 | fragment | semmle.label | fragment |
27+
| clientSide.js:20:11:20:28 | name | semmle.label | name |
28+
| clientSide.js:20:18:20:28 | window.name | semmle.label | window.name |
29+
| clientSide.js:21:13:21:53 | 'https: ... + '/id' | semmle.label | 'https: ... + '/id' |
30+
| clientSide.js:21:42:21:45 | name | semmle.label | name |
31+
subpaths
4832
#select
4933
| clientSide.js:12:5:12:55 | request ... '/id') | clientSide.js:11:19:11:40 | window. ... .search | clientSide.js:12:13:12:54 | 'https: ... + '/id' | The $@ of this request depends on a $@. | clientSide.js:12:13:12:54 | 'https: ... + '/id' | URL | clientSide.js:11:19:11:40 | window. ... .search | user-provided value |
5034
| clientSide.js:14:5:14:64 | request ... search) | clientSide.js:14:42:14:63 | window. ... .search | clientSide.js:14:13:14:63 | 'https: ... .search | The $@ of this request depends on a $@. | clientSide.js:14:13:14:63 | 'https: ... .search | URL | clientSide.js:14:42:14:63 | window. ... .search | user-provided value |

‎javascript/ql/test/query-tests/Security/CWE-918/Consistency.ql‎

Lines changed: 12 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -4,14 +4,22 @@ import semmle.javascript.security.dataflow.ClientSideRequestForgeryQuery as Clie
44
import testUtilities.ConsistencyChecking
55

66
query predicate resultInWrongFile(DataFlow::Node node) {
7-
exists(DataFlow::Configuration cfg, string filePattern |
8-
cfg instanceof RequestForgery::Configuration and
7+
exists(string filePattern |
8+
RequestForgery::RequestForgeryFlow::flowTo(node) and
99
filePattern = ".*serverSide.*"
1010
or
11-
cfg instanceof ClientSideRequestForgery::Configuration and
11+
ClientSideRequestForgery::ClientSideRequestForgeryFlow::flowTo(node) and
1212
filePattern = ".*clientSide.*"
1313
|
14-
cfg.hasFlow(_, node) and
1514
not node.getFile().getRelativePath().regexpMatch(filePattern)
1615
)
1716
}
17+
18+
class Consistency extends ConsistencyConfiguration {
19+
Consistency() { this = "Consistency" }
20+
21+
override DataFlow::Node getAnAlert() {
22+
RequestForgery::RequestForgeryFlow::flowTo(result) or
23+
ClientSideRequestForgery::ClientSideRequestForgeryFlow::flowTo(result)
24+
}
25+
}

0 commit comments

Comments
 (0)