Thanks to visit codestin.com
Credit goes to github.com

Skip to content

Commit b07a3e6

Browse files
semmle-qlcisemmle-qlci
authored
Merge pull request #1439 from esben-semmle/js/configuration-node-separation
Approved by asger-semmle, xiemaisi
2 parents ba4812c + 051c6ca commit b07a3e6

3 files changed

Lines changed: 112 additions & 97 deletions

File tree

‎javascript/ql/src/semmle/javascript/heuristics/AdditionalSinks.qll‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -6,7 +6,7 @@
66

77
import javascript
88
private import SyntacticHeuristics
9-
private import semmle.javascript.security.dataflow.CodeInjection
9+
private import semmle.javascript.security.dataflow.CodeInjectionCustomizations
1010
private import semmle.javascript.security.dataflow.CommandInjection
1111
private import semmle.javascript.security.dataflow.DomBasedXss as DomBasedXss
1212
private import semmle.javascript.security.dataflow.ReflectedXss as ReflectedXss

‎javascript/ql/src/semmle/javascript/security/dataflow/CodeInjection.qll‎

Lines changed: 7 additions & 96 deletions
Original file line numberDiff line numberDiff line change
@@ -1,25 +1,16 @@
11
/**
2-
* Provides a taint-tracking configuration for reasoning about code injection.
2+
* Provides a taint-tracking configuration for reasoning about code
3+
* injection vulnerabilities.
4+
*
5+
* Note, for performance reasons: only import this file if
6+
* `CodeInjection::Configuration` is needed, otherwise
7+
* `CodeInjectionCustomizations` should be imported instead.
38
*/
49

510
import javascript
6-
import semmle.javascript.security.dataflow.RemoteFlowSources
711

812
module CodeInjection {
9-
/**
10-
* A data flow source for code injection vulnerabilities.
11-
*/
12-
abstract class Source extends DataFlow::Node { }
13-
14-
/**
15-
* A data flow sink for code injection vulnerabilities.
16-
*/
17-
abstract class Sink extends DataFlow::Node { }
18-
19-
/**
20-
* A sanitizer for code injection vulnerabilities.
21-
*/
22-
abstract class Sanitizer extends DataFlow::Node { }
13+
import CodeInjectionCustomizations::CodeInjection
2314

2415
/**
2516
* A taint-tracking configuration for reasoning about code injection vulnerabilities.
@@ -42,84 +33,4 @@ module CodeInjection {
4233
src = trg.(HtmlSanitizerCall).getInput()
4334
}
4435
}
45-
46-
/** A source of remote user input, considered as a flow source for code injection. */
47-
class RemoteFlowSourceAsSource extends Source {
48-
RemoteFlowSourceAsSource() { this instanceof RemoteFlowSource }
49-
}
50-
51-
/**
52-
* An access to a property that may hold (parts of) the document URL.
53-
*/
54-
class LocationSource extends Source {
55-
LocationSource() { this = DOM::locationSource() }
56-
}
57-
58-
/**
59-
* An expression which may be interpreted as an AngularJS expression.
60-
*/
61-
class AngularJSExpressionSink extends Sink, DataFlow::ValueNode {
62-
AngularJSExpressionSink() {
63-
any(AngularJS::AngularJSCall call).interpretsArgumentAsCode(this.asExpr())
64-
}
65-
}
66-
67-
/**
68-
* An expression which may be evaluated as JavaScript in NodeJS using the
69-
* `vm` module.
70-
*/
71-
class NodeJSVmSink extends Sink, DataFlow::ValueNode {
72-
NodeJSVmSink() { exists(NodeJSLib::VmModuleMethodCall call | this = call.getACodeArgument()) }
73-
}
74-
75-
/**
76-
* An expression which may be evaluated as JavaScript.
77-
*/
78-
class EvalJavaScriptSink extends Sink, DataFlow::ValueNode {
79-
EvalJavaScriptSink() {
80-
exists(DataFlow::InvokeNode c, int index |
81-
exists(string callName | c = DataFlow::globalVarRef(callName).getAnInvocation() |
82-
callName = "eval" and index = 0
83-
or
84-
callName = "Function"
85-
or
86-
callName = "execScript" and index = 0
87-
or
88-
callName = "executeJavaScript" and index = 0
89-
or
90-
callName = "execCommand" and index = 0
91-
or
92-
callName = "setTimeout" and index = 0
93-
or
94-
callName = "setInterval" and index = 0
95-
or
96-
callName = "setImmediate" and index = 0
97-
)
98-
or
99-
exists(DataFlow::GlobalVarRefNode wasm, string methodName |
100-
wasm.getName() = "WebAssembly" and c = wasm.getAMemberCall(methodName)
101-
|
102-
methodName = "compile" or
103-
methodName = "compileStreaming"
104-
)
105-
|
106-
this = c.getArgument(index)
107-
)
108-
}
109-
}
110-
111-
/**
112-
* An expression which is injected as JavaScript into a React Native `WebView`.
113-
*/
114-
class WebViewInjectedJavaScriptSink extends Sink {
115-
WebViewInjectedJavaScriptSink() {
116-
exists(ReactNative::WebViewElement webView |
117-
// `injectedJavaScript` property of React Native `WebView`
118-
this = webView.getAPropertyWrite("injectedJavaScript").getRhs()
119-
or
120-
// argument to `injectJavascript` method of React Native `WebView`
121-
this = webView.getAMethodCall("injectJavaScript").getArgument(0)
122-
)
123-
}
124-
}
12536
}

‎javascript/ql/src/semmle/javascript/security/dataflow/CodeInjectionCustomizations.qll‎

Lines changed: 104 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,104 @@
1+
/**
2+
* Provides default sources, sinks and sanitisers for reasoning about
3+
* code injection vulnerabilities, as well as extension points for
4+
* adding your own.
5+
*/
6+
7+
import javascript
8+
9+
module CodeInjection {
10+
/**
11+
* A data flow source for code injection vulnerabilities.
12+
*/
13+
abstract class Source extends DataFlow::Node { }
14+
15+
/**
16+
* A data flow sink for code injection vulnerabilities.
17+
*/
18+
abstract class Sink extends DataFlow::Node { }
19+
20+
/**
21+
* A sanitizer for code injection vulnerabilities.
22+
*/
23+
abstract class Sanitizer extends DataFlow::Node { }
24+
25+
/** A source of remote user input, considered as a flow source for code injection. */
26+
class RemoteFlowSourceAsSource extends Source {
27+
RemoteFlowSourceAsSource() { this instanceof RemoteFlowSource }
28+
}
29+
30+
/**
31+
* An access to a property that may hold (parts of) the document URL.
32+
*/
33+
class LocationSource extends Source {
34+
LocationSource() { this = DOM::locationSource() }
35+
}
36+
37+
/**
38+
* An expression which may be interpreted as an AngularJS expression.
39+
*/
40+
class AngularJSExpressionSink extends Sink, DataFlow::ValueNode {
41+
AngularJSExpressionSink() {
42+
any(AngularJS::AngularJSCall call).interpretsArgumentAsCode(this.asExpr())
43+
}
44+
}
45+
46+
/**
47+
* An expression which may be evaluated as JavaScript in NodeJS using the
48+
* `vm` module.
49+
*/
50+
class NodeJSVmSink extends Sink, DataFlow::ValueNode {
51+
NodeJSVmSink() { exists(NodeJSLib::VmModuleMethodCall call | this = call.getACodeArgument()) }
52+
}
53+
54+
/**
55+
* An expression which may be evaluated as JavaScript.
56+
*/
57+
class EvalJavaScriptSink extends Sink, DataFlow::ValueNode {
58+
EvalJavaScriptSink() {
59+
exists(DataFlow::InvokeNode c, int index |
60+
exists(string callName | c = DataFlow::globalVarRef(callName).getAnInvocation() |
61+
callName = "eval" and index = 0
62+
or
63+
callName = "Function"
64+
or
65+
callName = "execScript" and index = 0
66+
or
67+
callName = "executeJavaScript" and index = 0
68+
or
69+
callName = "execCommand" and index = 0
70+
or
71+
callName = "setTimeout" and index = 0
72+
or
73+
callName = "setInterval" and index = 0
74+
or
75+
callName = "setImmediate" and index = 0
76+
)
77+
or
78+
exists(DataFlow::GlobalVarRefNode wasm, string methodName |
79+
wasm.getName() = "WebAssembly" and c = wasm.getAMemberCall(methodName)
80+
|
81+
methodName = "compile" or
82+
methodName = "compileStreaming"
83+
)
84+
|
85+
this = c.getArgument(index)
86+
)
87+
}
88+
}
89+
90+
/**
91+
* An expression which is injected as JavaScript into a React Native `WebView`.
92+
*/
93+
class WebViewInjectedJavaScriptSink extends Sink {
94+
WebViewInjectedJavaScriptSink() {
95+
exists(ReactNative::WebViewElement webView |
96+
// `injectedJavaScript` property of React Native `WebView`
97+
this = webView.getAPropertyWrite("injectedJavaScript").getRhs()
98+
or
99+
// argument to `injectJavascript` method of React Native `WebView`
100+
this = webView.getAMethodCall("injectJavaScript").getArgument(0)
101+
)
102+
}
103+
}
104+
}

0 commit comments

Comments
 (0)