Thanks to visit codestin.com
Credit goes to github.com

Skip to content

Commit a03f4ed

Browse files
erik-krogherik-krogh
committed
add remote flow source for busboy 
1 parent e2fbf8a commit a03f4ed

4 files changed

Lines changed: 54 additions & 1 deletion

File tree

‎javascript/ql/src/javascript.qll‎

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -85,10 +85,11 @@ import semmle.javascript.frameworks.Electron
8585
import semmle.javascript.frameworks.EventEmitter
8686
import semmle.javascript.frameworks.Files
8787
import semmle.javascript.frameworks.Firebase
88-
import semmle.javascript.frameworks.Immutable
88+
import semmle.javascript.frameworks.FormParsers
8989
import semmle.javascript.frameworks.jQuery
9090
import semmle.javascript.frameworks.JWT
9191
import semmle.javascript.frameworks.Handlebars
92+
import semmle.javascript.frameworks.Immutable
9293
import semmle.javascript.frameworks.LazyCache
9394
import semmle.javascript.frameworks.LodashUnderscore
9495
import semmle.javascript.frameworks.Logging

‎javascript/ql/src/semmle/javascript/frameworks/FormParsers.qll‎

Lines changed: 30 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,30 @@
1+
/**
2+
* Provides classes for modelling the server-side form/file parsing libraries.
3+
*/
4+
5+
import javascript
6+
7+
/**
8+
* Classes and predicate modelling the `Busboy` library.
9+
*/
10+
module Busboy {
11+
/**
12+
* A `Busboy` instance that has request data flowing into it.
13+
*/
14+
private DataFlow::NewNode busboy() {
15+
result = DataFlow::moduleImport("busboy").getAnInstantiation() and
16+
exists(MethodCallExpr pipe |
17+
pipe.calls(any(HTTP::RequestExpr req), "pipe") and
18+
result.flowsToExpr(pipe.getArgument(0))
19+
)
20+
}
21+
22+
/**
23+
* A source of remote flow from the `Busboy` library.
24+
*/
25+
class BusBoyRemoteFlow extends RemoteFlowSource {
26+
BusBoyRemoteFlow() { this = busboy().getAMemberCall("on").getABoundCallbackParameter(1, _) }
27+
28+
override string getSourceType() { result = "Busbuy parsed user value" }
29+
}
30+
}

‎javascript/ql/test/query-tests/Security/CWE-078/CommandInjection.expected‎

Lines changed: 10 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -100,6 +100,11 @@ nodes
100100
| form-parsers.js:14:10:14:37 | "touch ... nalname |
101101
| form-parsers.js:14:21:14:24 | file |
102102
| form-parsers.js:14:21:14:37 | file.originalname |
103+
| form-parsers.js:24:48:24:55 | filename |
104+
| form-parsers.js:24:48:24:55 | filename |
105+
| form-parsers.js:25:10:25:28 | "touch " + filename |
106+
| form-parsers.js:25:10:25:28 | "touch " + filename |
107+
| form-parsers.js:25:21:25:28 | filename |
103108
| lib/subLib/index.js:7:32:7:35 | name |
104109
| lib/subLib/index.js:8:10:8:25 | "rm -rf " + name |
105110
| lib/subLib/index.js:8:10:8:25 | "rm -rf " + name |
@@ -244,6 +249,10 @@ edges
244249
| form-parsers.js:14:21:14:24 | file | form-parsers.js:14:21:14:37 | file.originalname |
245250
| form-parsers.js:14:21:14:37 | file.originalname | form-parsers.js:14:10:14:37 | "touch ... nalname |
246251
| form-parsers.js:14:21:14:37 | file.originalname | form-parsers.js:14:10:14:37 | "touch ... nalname |
252+
| form-parsers.js:24:48:24:55 | filename | form-parsers.js:25:21:25:28 | filename |
253+
| form-parsers.js:24:48:24:55 | filename | form-parsers.js:25:21:25:28 | filename |
254+
| form-parsers.js:25:21:25:28 | filename | form-parsers.js:25:10:25:28 | "touch " + filename |
255+
| form-parsers.js:25:21:25:28 | filename | form-parsers.js:25:10:25:28 | "touch " + filename |
247256
| lib/subLib/index.js:7:32:7:35 | name | lib/subLib/index.js:8:22:8:25 | name |
248257
| lib/subLib/index.js:8:22:8:25 | name | lib/subLib/index.js:8:10:8:25 | "rm -rf " + name |
249258
| lib/subLib/index.js:8:22:8:25 | name | lib/subLib/index.js:8:10:8:25 | "rm -rf " + name |
@@ -317,6 +326,7 @@ edges
317326
| execSeries.js:14:41:14:47 | command | execSeries.js:18:34:18:40 | req.url | execSeries.js:14:41:14:47 | command | This command depends on $@. | execSeries.js:18:34:18:40 | req.url | a user-provided value |
318327
| form-parsers.js:9:8:9:39 | "touch ... nalname | form-parsers.js:9:19:9:26 | req.file | form-parsers.js:9:8:9:39 | "touch ... nalname | This command depends on $@. | form-parsers.js:9:19:9:26 | req.file | a user-provided value |
319328
| form-parsers.js:14:10:14:37 | "touch ... nalname | form-parsers.js:13:3:13:11 | req.files | form-parsers.js:14:10:14:37 | "touch ... nalname | This command depends on $@. | form-parsers.js:13:3:13:11 | req.files | a user-provided value |
329+
| form-parsers.js:25:10:25:28 | "touch " + filename | form-parsers.js:24:48:24:55 | filename | form-parsers.js:25:10:25:28 | "touch " + filename | This command depends on $@. | form-parsers.js:24:48:24:55 | filename | a user-provided value |
320330
| lib/subLib/index.js:8:10:8:25 | "rm -rf " + name | child_process-test.js:85:37:85:54 | req.query.fileName | lib/subLib/index.js:8:10:8:25 | "rm -rf " + name | This command depends on $@. | child_process-test.js:85:37:85:54 | req.query.fileName | a user-provided value |
321331
| other.js:7:33:7:35 | cmd | other.js:5:25:5:31 | req.url | other.js:7:33:7:35 | cmd | This command depends on $@. | other.js:5:25:5:31 | req.url | a user-provided value |
322332
| other.js:8:28:8:30 | cmd | other.js:5:25:5:31 | req.url | other.js:8:28:8:30 | cmd | This command depends on $@. | other.js:5:25:5:31 | req.url | a user-provided value |

‎javascript/ql/test/query-tests/Security/CWE-078/form-parsers.js‎

Lines changed: 12 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -14,3 +14,15 @@ app.post('/photos/upload', upload.array('photos', 12), function (req, res, next)
1414
exec("touch " + file.originalname); // NOT OK
1515
})
1616
});
17+
18+
19+
var http = require('http');
20+
var Busboy = require('busboy');
21+
22+
http.createServer(function (req, res) {
23+
var busboy = new Busboy({ headers: req.headers });
24+
busboy.on('file', function (fieldname, file, filename, encoding, mimetype) {
25+
exec("touch " + filename); // NOT OK
26+
});
27+
req.pipe(busboy);
28+
}).listen(8000);

0 commit comments

Comments
 (0)