permit http urls to 127.0.0.1 and others

Stephan Brandauer · Stephan Brandauer · commit b35c70994f9b · 2022-02-22T11:41:52.000+01:00
diff --git a/javascript/ql/src/Security/CWE-830/FunctionalityFromUntrustedSource.ql b/javascript/ql/src/Security/CWE-830/FunctionalityFromUntrustedSource.ql
@@ -15,20 +15,23 @@ import javascript
 import semmle.javascript.HTML
 
 bindingset[host]
-predicate isAllowedHost(string host) { host.toLowerCase().regexpMatch("localhost(:[0-9]+)?/.*") }
+predicate isLocalhostPrefix(string host) {
+  host.toLowerCase()
+      .regexpMatch([
+          "localhost(:[0-9]+)?/.*", "127.0.0.1(:[0-9]+)?/.*", "::1/.*", "\\[::1\\]:[0-9]+/.*"
+        ])
+}
 
 bindingset[path]
 predicate isUntrustedSourcePath(string path) {
   path.substring(0, 2) = "//"
   or
   exists(string hostPath | hostPath = path.regexpCapture("http://(.*)", 1) |
-    not isAllowedHost(hostPath)
+    not isLocalhostPrefix(hostPath)
   )
 }
 
 abstract class IncludesUntrustedContent extends HTML::Element {
-  IncludesUntrustedContent() { this = this }
-
   /** Gets an explanation why this source is untrusted. */
   abstract string getProblem();
 }
@@ -41,17 +44,17 @@ class ScriptElementWithUntrustedContent extends IncludesUntrustedContent, HTML::
   }
 
   override string getProblem() {
-    result = "script elements should use an https link and/or use the integrity attribute"
+    result = "script elements should use an HTTPS url and/or use the integrity attribute"
   }
 }
 
 /** An iframe element that includes untrusted content. */
 class IframeElementWithUntrustedContent extends HTML::IframeElement, IncludesUntrustedContent {
   IframeElementWithUntrustedContent() { isUntrustedSourcePath(this.getSourcePath()) }
 
-  override string getProblem() { result = "iframe elements should use an https link" }
+  override string getProblem() { result = "iframe elements should use an HTTPS url" }
 }
 
 from IncludesUntrustedContent s, string problem
 where problem = s.getProblem()
-select s, "HTML-element imports untrusted content (" + problem + ")"
+select s, "HTML-element uses untrusted content (" + problem + ")"
diff --git a/javascript/ql/test/query-tests/Security/CWE-830/test.html b/javascript/ql/test/query-tests/Security/CWE-830/test.html
@@ -9,5 +9,8 @@
         <iframe src="http://test.local/foo.html"></iframe> <!-- NOT OK -->
         <iframe src="https://test.local/foo.html"></iframe> <!-- OK (https) -->
         <iframe src="//test.local/foo.html"></iframe> <!-- NOT OK (protocol-relative url) -->
+        <iframe src="http://::1/foo.html"></iframe> <!-- OK (localhost) -->
+        <iframe src="http://[::1]:80/foo.html"></iframe> <!-- OK (localhost) -->
+        <iframe src="http://127.0.0.1:444/foo.html"></iframe> <!-- OK (localhost) -->
     </body>
 </html>
