JS: Port RequestForgery

asgerf · asgerf · commit b2216627be79 · 2023-10-13T13:15:03.000+02:00
diff --git a/javascript/ql/lib/semmle/javascript/security/dataflow/RequestForgeryQuery.qll b/javascript/ql/lib/semmle/javascript/security/dataflow/RequestForgeryQuery.qll
@@ -12,23 +12,48 @@ import UrlConcatenation
 import RequestForgeryCustomizations::RequestForgery
 
 /**
- * A taint tracking configuration for request forgery.
+ * A taint tracking configuration for server-side request forgery.
  */
-class Configuration extends TaintTracking::Configuration {
+module RequestForgeryConfig implements DataFlow::ConfigSig {
+  predicate isSource(DataFlow::Node source) { source.(Source).isServerSide() }
+
+  predicate isSink(DataFlow::Node sink) { sink instanceof Sink }
+
+  predicate isBarrier(DataFlow::Node node) { node instanceof Sanitizer }
+
+  predicate isBarrierOut(DataFlow::Node node) { sanitizingPrefixEdge(node, _) }
+
+  predicate isAdditionalFlowStep(DataFlow::Node pred, DataFlow::Node succ) {
+    isAdditionalRequestForgeryStep(pred, succ)
+  }
+}
+
+/**
+ * Taint tracking for server-side request forgery.
+ */
+module RequestForgeryFlow = TaintTracking::Global<RequestForgeryConfig>;
+
+/**
+ * DEPRECATED. Use the `RequestForgeryFlow` module instead.
+ */
+deprecated class Configuration extends TaintTracking::Configuration {
   Configuration() { this = "RequestForgery" }
 
-  override predicate isSource(DataFlow::Node source) { source.(Source).isServerSide() }
+  override predicate isSource(DataFlow::Node source) { RequestForgeryConfig::isSource(source) }
 
-  override predicate isSink(DataFlow::Node sink) { sink instanceof Sink }
+  override predicate isSink(DataFlow::Node sink) { RequestForgeryConfig::isSink(sink) }
 
   override predicate isSanitizer(DataFlow::Node node) {
-    super.isSanitizer(node) or
+    super.isSanitizer(node)
+    or
     node instanceof Sanitizer
   }
 
-  override predicate isSanitizerOut(DataFlow::Node node) { sanitizingPrefixEdge(node, _) }
+  override predicate isSanitizerOut(DataFlow::Node node) {
+    RequestForgeryConfig::isBarrierOut(node)
+  }
 
   override predicate isAdditionalTaintStep(DataFlow::Node pred, DataFlow::Node succ) {
-    isAdditionalRequestForgeryStep(pred, succ)
+    RequestForgeryConfig::isAdditionalFlowStep(pred, succ)
   }
 }
diff --git a/javascript/ql/src/Security/CWE-918/RequestForgery.ql b/javascript/ql/src/Security/CWE-918/RequestForgery.ql
@@ -12,11 +12,11 @@
 
 import javascript
 import semmle.javascript.security.dataflow.RequestForgeryQuery
-import DataFlow::PathGraph
+import RequestForgeryFlow::PathGraph
 
-from Configuration cfg, DataFlow::PathNode source, DataFlow::PathNode sink, DataFlow::Node request
+from RequestForgeryFlow::PathNode source, RequestForgeryFlow::PathNode sink, DataFlow::Node request
 where
-  cfg.hasFlowPath(source, sink) and
+  RequestForgeryFlow::flowPath(source, sink) and
   request = sink.getNode().(Sink).getARequest()
 select request, source, sink, "The $@ of this request depends on a $@.", sink.getNode(),
   sink.getNode().(Sink).getKind(), source, "user-provided value"
diff --git a/javascript/ql/test/query-tests/Security/CWE-918/RequestForgery.expected b/javascript/ql/test/query-tests/Security/CWE-918/RequestForgery.expected
