Thanks to visit codestin.com
Credit goes to github.com

Skip to content

Commit 99f63b1

Browse files
asgerfasgerf
committed
JS: Port InsecureDownload
1 parent 8c00191 commit 99f63b1

3 files changed

Lines changed: 65 additions & 42 deletions

File tree

‎javascript/ql/lib/semmle/javascript/security/dataflow/InsecureDownloadQuery.qll‎

Lines changed: 26 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -12,19 +12,41 @@ import InsecureDownloadCustomizations::InsecureDownload
1212
/**
1313
* A taint tracking configuration for download of sensitive file through insecure connection.
1414
*/
15-
class Configuration extends DataFlow::Configuration {
15+
module InsecureDownloadConfig implements DataFlow::StateConfigSig {
16+
class FlowState = DataFlow::FlowLabel;
17+
18+
predicate isSource(DataFlow::Node source, DataFlow::FlowLabel label) {
19+
source.(Source).getALabel() = label
20+
}
21+
22+
predicate isSink(DataFlow::Node sink, DataFlow::FlowLabel label) {
23+
sink.(Sink).getALabel() = label
24+
}
25+
26+
predicate isBarrier(DataFlow::Node node) { node instanceof Sanitizer }
27+
}
28+
29+
/**
30+
* Taint tracking for download of sensitive file through insecure connection.
31+
*/
32+
module InsecureDownload = DataFlow::GlobalWithState<InsecureDownloadConfig>;
33+
34+
/**
35+
* DEPRECATED. Use the `InsecureDownload` module instead.
36+
*/
37+
deprecated class Configuration extends DataFlow::Configuration {
1638
Configuration() { this = "InsecureDownload" }
1739

1840
override predicate isSource(DataFlow::Node source, DataFlow::FlowLabel label) {
19-
source.(Source).getALabel() = label
41+
InsecureDownloadConfig::isSource(source, label)
2042
}
2143

2244
override predicate isSink(DataFlow::Node sink, DataFlow::FlowLabel label) {
23-
sink.(Sink).getALabel() = label
45+
InsecureDownloadConfig::isSink(sink, label)
2446
}
2547

2648
override predicate isBarrier(DataFlow::Node node) {
2749
super.isBarrier(node) or
28-
node instanceof Sanitizer
50+
InsecureDownloadConfig::isBarrier(node)
2951
}
3052
}

‎javascript/ql/src/Security/CWE-829/InsecureDownload.ql‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -13,9 +13,9 @@
1313

1414
import javascript
1515
import semmle.javascript.security.dataflow.InsecureDownloadQuery
16-
import DataFlow::PathGraph
16+
import DataFlow::DeduplicatePathGraph<InsecureDownload::PathNode, InsecureDownload::PathGraph>
1717

18-
from Configuration cfg, DataFlow::PathNode source, DataFlow::PathNode sink
19-
where cfg.hasFlowPath(source, sink)
18+
from PathNode source, PathNode sink
19+
where InsecureDownload::flowPath(source.getAnOriginalPathNode(), sink.getAnOriginalPathNode())
2020
select sink.getNode(), source, sink, "$@ of sensitive file from $@.",
2121
sink.getNode().(Sink).getDownloadCall(), "Download", source.getNode(), "HTTP source"

‎javascript/ql/test/query-tests/Security/CWE-829/InsecureDownload.expected‎

Lines changed: 36 additions & 35 deletions
Original file line numberDiff line numberDiff line change
@@ -1,43 +1,44 @@
11
nodes
2-
| insecure-download.js:5:16:5:28 | installer.url |
3-
| insecure-download.js:5:16:5:28 | installer.url |
4-
| insecure-download.js:9:27:9:138 | 'http:/ ... ll.exe' |
5-
| insecure-download.js:9:27:9:138 | 'http:/ ... ll.exe' |
6-
| insecure-download.js:15:18:15:40 | buildTo ... llerUrl |
7-
| insecure-download.js:30:12:30:42 | "http:/ ... fe.APK" |
8-
| insecure-download.js:30:12:30:42 | "http:/ ... fe.APK" |
9-
| insecure-download.js:30:12:30:42 | "http:/ ... fe.APK" |
10-
| insecure-download.js:36:9:36:45 | url |
11-
| insecure-download.js:36:15:36:45 | "http:/ ... fe.APK" |
12-
| insecure-download.js:36:15:36:45 | "http:/ ... fe.APK" |
13-
| insecure-download.js:37:23:37:25 | url |
14-
| insecure-download.js:37:23:37:25 | url |
15-
| insecure-download.js:39:26:39:28 | url |
16-
| insecure-download.js:39:26:39:28 | url |
17-
| insecure-download.js:41:12:41:41 | "ftp:// ... fe.APK" |
18-
| insecure-download.js:41:12:41:41 | "ftp:// ... fe.APK" |
19-
| insecure-download.js:41:12:41:41 | "ftp:// ... fe.APK" |
20-
| insecure-download.js:48:12:48:38 | "http:/ ... unsafe" |
21-
| insecure-download.js:48:12:48:38 | "http:/ ... unsafe" |
22-
| insecure-download.js:48:12:48:38 | "http:/ ... unsafe" |
23-
| insecure-download.js:52:11:52:45 | "http:/ ... nknown" |
24-
| insecure-download.js:52:11:52:45 | "http:/ ... nknown" |
25-
| insecure-download.js:52:11:52:45 | "http:/ ... nknown" |
2+
| insecure-download.js:4:28:4:36 | installer [url] | semmle.label | installer [url] |
3+
| insecure-download.js:5:16:5:24 | installer [url] | semmle.label | installer [url] |
4+
| insecure-download.js:5:16:5:28 | installer.url | semmle.label | installer.url |
5+
| insecure-download.js:7:9:11:5 | constants [buildTools, installerUrl] | semmle.label | constants [buildTools, installerUrl] |
6+
| insecure-download.js:7:21:11:5 | {\\n ... }\\n } [buildTools, installerUrl] | semmle.label | {\\n ... }\\n } [buildTools, installerUrl] |
7+
| insecure-download.js:8:21:10:9 | {\\n ... } [installerUrl] | semmle.label | {\\n ... } [installerUrl] |
8+
| insecure-download.js:9:27:9:138 | 'http:/ ... ll.exe' | semmle.label | 'http:/ ... ll.exe' |
9+
| insecure-download.js:13:15:13:47 | buildTools [installerUrl] | semmle.label | buildTools [installerUrl] |
10+
| insecure-download.js:13:28:13:36 | constants [buildTools, installerUrl] | semmle.label | constants [buildTools, installerUrl] |
11+
| insecure-download.js:13:28:13:47 | constants.buildTools [installerUrl] | semmle.label | constants.buildTools [installerUrl] |
12+
| insecure-download.js:14:16:16:9 | {\\n ... } [url] | semmle.label | {\\n ... } [url] |
13+
| insecure-download.js:15:18:15:27 | buildTools [installerUrl] | semmle.label | buildTools [installerUrl] |
14+
| insecure-download.js:15:18:15:40 | buildTo ... llerUrl | semmle.label | buildTo ... llerUrl |
15+
| insecure-download.js:19:19:19:46 | getBuil ... rPath() [url] | semmle.label | getBuil ... rPath() [url] |
16+
| insecure-download.js:30:12:30:42 | "http:/ ... fe.APK" | semmle.label | "http:/ ... fe.APK" |
17+
| insecure-download.js:36:9:36:45 | url | semmle.label | url |
18+
| insecure-download.js:36:15:36:45 | "http:/ ... fe.APK" | semmle.label | "http:/ ... fe.APK" |
19+
| insecure-download.js:37:23:37:25 | url | semmle.label | url |
20+
| insecure-download.js:39:26:39:28 | url | semmle.label | url |
21+
| insecure-download.js:41:12:41:41 | "ftp:// ... fe.APK" | semmle.label | "ftp:// ... fe.APK" |
22+
| insecure-download.js:48:12:48:38 | "http:/ ... unsafe" | semmle.label | "http:/ ... unsafe" |
23+
| insecure-download.js:52:11:52:45 | "http:/ ... nknown" | semmle.label | "http:/ ... nknown" |
2624
edges
27-
| insecure-download.js:9:27:9:138 | 'http:/ ... ll.exe' | insecure-download.js:15:18:15:40 | buildTo ... llerUrl |
28-
| insecure-download.js:9:27:9:138 | 'http:/ ... ll.exe' | insecure-download.js:15:18:15:40 | buildTo ... llerUrl |
29-
| insecure-download.js:15:18:15:40 | buildTo ... llerUrl | insecure-download.js:5:16:5:28 | installer.url |
30-
| insecure-download.js:15:18:15:40 | buildTo ... llerUrl | insecure-download.js:5:16:5:28 | installer.url |
31-
| insecure-download.js:30:12:30:42 | "http:/ ... fe.APK" | insecure-download.js:30:12:30:42 | "http:/ ... fe.APK" |
25+
| insecure-download.js:4:28:4:36 | installer [url] | insecure-download.js:5:16:5:24 | installer [url] |
26+
| insecure-download.js:5:16:5:24 | installer [url] | insecure-download.js:5:16:5:28 | installer.url |
27+
| insecure-download.js:7:9:11:5 | constants [buildTools, installerUrl] | insecure-download.js:13:28:13:36 | constants [buildTools, installerUrl] |
28+
| insecure-download.js:7:21:11:5 | {\\n ... }\\n } [buildTools, installerUrl] | insecure-download.js:7:9:11:5 | constants [buildTools, installerUrl] |
29+
| insecure-download.js:8:21:10:9 | {\\n ... } [installerUrl] | insecure-download.js:7:21:11:5 | {\\n ... }\\n } [buildTools, installerUrl] |
30+
| insecure-download.js:9:27:9:138 | 'http:/ ... ll.exe' | insecure-download.js:8:21:10:9 | {\\n ... } [installerUrl] |
31+
| insecure-download.js:13:15:13:47 | buildTools [installerUrl] | insecure-download.js:15:18:15:27 | buildTools [installerUrl] |
32+
| insecure-download.js:13:28:13:36 | constants [buildTools, installerUrl] | insecure-download.js:13:28:13:47 | constants.buildTools [installerUrl] |
33+
| insecure-download.js:13:28:13:47 | constants.buildTools [installerUrl] | insecure-download.js:13:15:13:47 | buildTools [installerUrl] |
34+
| insecure-download.js:14:16:16:9 | {\\n ... } [url] | insecure-download.js:19:19:19:46 | getBuil ... rPath() [url] |
35+
| insecure-download.js:15:18:15:27 | buildTools [installerUrl] | insecure-download.js:15:18:15:40 | buildTo ... llerUrl |
36+
| insecure-download.js:15:18:15:40 | buildTo ... llerUrl | insecure-download.js:14:16:16:9 | {\\n ... } [url] |
37+
| insecure-download.js:19:19:19:46 | getBuil ... rPath() [url] | insecure-download.js:4:28:4:36 | installer [url] |
3238
| insecure-download.js:36:9:36:45 | url | insecure-download.js:37:23:37:25 | url |
33-
| insecure-download.js:36:9:36:45 | url | insecure-download.js:37:23:37:25 | url |
34-
| insecure-download.js:36:9:36:45 | url | insecure-download.js:39:26:39:28 | url |
3539
| insecure-download.js:36:9:36:45 | url | insecure-download.js:39:26:39:28 | url |
3640
| insecure-download.js:36:15:36:45 | "http:/ ... fe.APK" | insecure-download.js:36:9:36:45 | url |
37-
| insecure-download.js:36:15:36:45 | "http:/ ... fe.APK" | insecure-download.js:36:9:36:45 | url |
38-
| insecure-download.js:41:12:41:41 | "ftp:// ... fe.APK" | insecure-download.js:41:12:41:41 | "ftp:// ... fe.APK" |
39-
| insecure-download.js:48:12:48:38 | "http:/ ... unsafe" | insecure-download.js:48:12:48:38 | "http:/ ... unsafe" |
40-
| insecure-download.js:52:11:52:45 | "http:/ ... nknown" | insecure-download.js:52:11:52:45 | "http:/ ... nknown" |
41+
subpaths
4142
#select
4243
| insecure-download.js:5:16:5:28 | installer.url | insecure-download.js:9:27:9:138 | 'http:/ ... ll.exe' | insecure-download.js:5:16:5:28 | installer.url | $@ of sensitive file from $@. | insecure-download.js:5:9:5:44 | nugget( ... => { }) | Download | insecure-download.js:9:27:9:138 | 'http:/ ... ll.exe' | HTTP source |
4344
| insecure-download.js:30:12:30:42 | "http:/ ... fe.APK" | insecure-download.js:30:12:30:42 | "http:/ ... fe.APK" | insecure-download.js:30:12:30:42 | "http:/ ... fe.APK" | $@ of sensitive file from $@. | insecure-download.js:30:5:30:43 | nugget( ... e.APK") | Download | insecure-download.js:30:12:30:42 | "http:/ ... fe.APK" | HTTP source |

0 commit comments

Comments
 (0)