JavaScript: Refactor HostHeaderPoisoningInEmailGeneration query.

Max Schaefer · Max Schaefer · commit 9b4ae9e4d340 · 2018-11-14T09:16:40.000Z
diff --git a/javascript/ql/src/Security/CWE-640/HostHeaderPoisoningInEmailGeneration.ql b/javascript/ql/src/Security/CWE-640/HostHeaderPoisoningInEmailGeneration.ql
@@ -1,29 +1,18 @@
 /**
  * @name Host header poisoning in email generation
- * @description Using the HTTP Host header to construct a link in an email can facilitate phishing attacks and leak password reset tokens.
+ * @description Using the HTTP Host header to construct a link in an email can facilitate phishing
+ *              attacks and leak password reset tokens.
  * @kind problem
  * @problem.severity error
  * @precision high
  * @id js/host-header-forgery-in-email-generation
  * @tags security
  *       external/cwe/cwe-640
  */
-import javascript
-
-class TaintedHostHeader extends TaintTracking::Configuration {
-  TaintedHostHeader() { this = "TaintedHostHeader" }
 
-  override predicate isSource(DataFlow::Node node) {
-    exists (HTTP::RequestHeaderAccess input | node = input |
-      input.getKind() = "header" and
-      input.getAHeaderName() = "host")
-  }
-
-  override predicate isSink(DataFlow::Node node) {
-    exists (EmailSender email | node = email.getABody())
-  }
-}
+import javascript
+import semmle.javascript.security.dataflow.HostHeaderPoisoningInEmailGeneration::HostHeaderPoisoningInEmailGeneration
 
-from TaintedHostHeader taint, DataFlow::Node src, DataFlow::Node sink
-where taint.hasFlow(src, sink)
-select sink, "Links in this email can be hijacked by poisoning the HTTP host header $@.", src, "here"
+from Configuration cfg, DataFlow::Node source, DataFlow::Node sink
+where cfg.hasFlow(source, sink)
+select sink, "Links in this email can be hijacked by poisoning the HTTP host header $@.", source, "here"
diff --git a/javascript/ql/src/semmle/javascript/security/dataflow/HostHeaderPoisoningInEmailGeneration.qll b/javascript/ql/src/semmle/javascript/security/dataflow/HostHeaderPoisoningInEmailGeneration.qll
@@ -0,0 +1,26 @@
+/**
+ * Provides a taint tracking configuration for reasoning about host header
+ * poisoning in email generation.
+ */
+
+import javascript
+
+module HostHeaderPoisoningInEmailGeneration {
+  /**
+   * A taint tracking configuration for host header poisoning in email generation.
+   */
+  class Configuration extends TaintTracking::Configuration {
+    Configuration() { this = "TaintedHostHeader" }
+
+    override predicate isSource(DataFlow::Node node) {
+      exists (HTTP::RequestHeaderAccess input | node = input |
+        input.getKind() = "header" and
+        input.getAHeaderName() = "host"
+      )
+    }
+
+    override predicate isSink(DataFlow::Node node) {
+      exists (EmailSender email | node = email.getABody())
+    }
+  }
+}
