Thanks to visit codestin.com
Credit goes to github.com

Skip to content

Commit b343dca

Browse files
erik-krogherik-krogh
committed
put string/object in the alert-message for sql-injection
1 parent b9ffa11 commit b343dca

4 files changed

Lines changed: 139 additions & 138 deletions

File tree

‎javascript/ql/src/Security/CWE-089/SqlInjection.ql‎

Lines changed: 5 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -18,12 +18,13 @@ import semmle.javascript.security.dataflow.SqlInjectionQuery as SqlInjection
1818
import semmle.javascript.security.dataflow.NosqlInjectionQuery as NosqlInjection
1919
import DataFlow::PathGraph
2020

21-
from DataFlow::Configuration cfg, DataFlow::PathNode source, DataFlow::PathNode sink
21+
from DataFlow::Configuration cfg, DataFlow::PathNode source, DataFlow::PathNode sink, string type
2222
where
2323
(
24-
cfg instanceof SqlInjection::Configuration or
25-
cfg instanceof NosqlInjection::Configuration
24+
cfg instanceof SqlInjection::Configuration and type = "string"
25+
or
26+
cfg instanceof NosqlInjection::Configuration and type = "object"
2627
) and
2728
cfg.hasFlowPath(source, sink)
28-
select sink.getNode(), source, sink, "This query depends on a $@.", source.getNode(),
29+
select sink.getNode(), source, sink, "This query " + type + " depends on a $@.", source.getNode(),
2930
"user-provided value"

‎javascript/ql/src/experimental/heuristics/ql/src/Security/CWE-089/SqlInjection.ql‎

Lines changed: 6 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -20,13 +20,13 @@ import semmle.javascript.security.dataflow.NosqlInjectionQuery as NosqlInjection
2020
import DataFlow::PathGraph
2121
import semmle.javascript.heuristics.AdditionalSources
2222

23-
from DataFlow::Configuration cfg, DataFlow::PathNode source, DataFlow::PathNode sink
23+
from DataFlow::Configuration cfg, DataFlow::PathNode source, DataFlow::PathNode sink, string type
2424
where
2525
(
26-
cfg instanceof SqlInjection::Configuration or
27-
cfg instanceof NosqlInjection::Configuration
26+
cfg instanceof SqlInjection::Configuration and type = "string"
27+
or
28+
cfg instanceof NosqlInjection::Configuration and type = "object"
2829
) and
29-
cfg.hasFlowPath(source, sink) and
30-
source.getNode() instanceof HeuristicSource
31-
select sink.getNode(), source, sink, "This query depends on a $@.", source.getNode(),
30+
cfg.hasFlowPath(source, sink)
31+
select sink.getNode(), source, sink, "This query " + type + " depends on a $@.", source.getNode(),
3232
"user-provided value"

‎javascript/ql/test/query-tests/Security/CWE-089/typed/SqlInjection.expected‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -37,6 +37,6 @@ edges
3737
| typedClient.ts:23:33:23:33 | v | typedClient.ts:23:27:23:35 | { id: v } |
3838
| typedClient.ts:23:33:23:33 | v | typedClient.ts:23:27:23:35 | { id: v } |
3939
#select
40-
| typedClient.ts:14:24:14:32 | { id: v } | typedClient.ts:13:22:13:29 | req.body | typedClient.ts:14:24:14:32 | { id: v } | This query depends on a $@. | typedClient.ts:13:22:13:29 | req.body | user-provided value |
41-
| typedClient.ts:22:27:22:35 | { id: v } | typedClient.ts:21:22:21:29 | req.body | typedClient.ts:22:27:22:35 | { id: v } | This query depends on a $@. | typedClient.ts:21:22:21:29 | req.body | user-provided value |
42-
| typedClient.ts:23:27:23:35 | { id: v } | typedClient.ts:21:22:21:29 | req.body | typedClient.ts:23:27:23:35 | { id: v } | This query depends on a $@. | typedClient.ts:21:22:21:29 | req.body | user-provided value |
40+
| typedClient.ts:14:24:14:32 | { id: v } | typedClient.ts:13:22:13:29 | req.body | typedClient.ts:14:24:14:32 | { id: v } | This query object depends on a $@. | typedClient.ts:13:22:13:29 | req.body | user-provided value |
41+
| typedClient.ts:22:27:22:35 | { id: v } | typedClient.ts:21:22:21:29 | req.body | typedClient.ts:22:27:22:35 | { id: v } | This query object depends on a $@. | typedClient.ts:21:22:21:29 | req.body | user-provided value |
42+
| typedClient.ts:23:27:23:35 | { id: v } | typedClient.ts:21:22:21:29 | req.body | typedClient.ts:23:27:23:35 | { id: v } | This query object depends on a $@. | typedClient.ts:21:22:21:29 | req.body | user-provided value |

0 commit comments

Comments
 (0)