Thanks to visit codestin.com
Credit goes to github.com

Skip to content

Commit b8847db

Browse files
asgerfasgerf
committed
JS: Port Xxe
1 parent c2d170b commit b8847db

3 files changed

Lines changed: 34 additions & 46 deletions

File tree

‎javascript/ql/lib/semmle/javascript/security/dataflow/XxeQuery.qll‎

Lines changed: 17 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -13,7 +13,23 @@ import XxeCustomizations::Xxe
1313
/**
1414
* A taint-tracking configuration for reasoning about XXE vulnerabilities.
1515
*/
16-
class Configuration extends TaintTracking::Configuration {
16+
module XxeConfig implements DataFlow::ConfigSig {
17+
predicate isSource(DataFlow::Node source) { source instanceof Source }
18+
19+
predicate isSink(DataFlow::Node sink) { sink instanceof Sink }
20+
21+
predicate isBarrier(DataFlow::Node node) { node instanceof Sanitizer }
22+
}
23+
24+
/**
25+
* Taint-tracking for reasoning about XXE vulnerabilities.
26+
*/
27+
module XxeFlow = TaintTracking::Global<XxeConfig>;
28+
29+
/**
30+
* DEPRECATED. Use the `XxeFlow` module instead.
31+
*/
32+
deprecated class Configuration extends TaintTracking::Configuration {
1733
Configuration() { this = "Xxe" }
1834

1935
override predicate isSource(DataFlow::Node source) { source instanceof Source }

‎javascript/ql/src/Security/CWE-611/Xxe.ql‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -14,10 +14,10 @@
1414

1515
import javascript
1616
import semmle.javascript.security.dataflow.XxeQuery
17-
import DataFlow::PathGraph
17+
import XxeFlow::PathGraph
1818

19-
from Configuration cfg, DataFlow::PathNode source, DataFlow::PathNode sink
20-
where cfg.hasFlowPath(source, sink)
19+
from XxeFlow::PathNode source, XxeFlow::PathNode sink
20+
where XxeFlow::flowPath(source, sink)
2121
select sink.getNode(), source, sink,
2222
"XML parsing depends on a $@ without guarding against external entity expansion.",
2323
source.getNode(), "user-provided value"

‎javascript/ql/test/query-tests/Security/CWE-611/Xxe.expected‎

Lines changed: 14 additions & 42 deletions
Original file line numberDiff line numberDiff line change
@@ -1,49 +1,21 @@
1-
nodes
2-
| domparser.js:2:7:2:36 | src |
3-
| domparser.js:2:13:2:36 | documen ... .search |
4-
| domparser.js:2:13:2:36 | documen ... .search |
5-
| domparser.js:11:55:11:57 | src |
6-
| domparser.js:11:55:11:57 | src |
7-
| domparser.js:14:57:14:59 | src |
8-
| domparser.js:14:57:14:59 | src |
9-
| libxml.noent.js:6:21:6:41 | req.par ... e-xml") |
10-
| libxml.noent.js:6:21:6:41 | req.par ... e-xml") |
11-
| libxml.noent.js:6:21:6:41 | req.par ... e-xml") |
12-
| libxml.noent.js:11:21:11:41 | req.par ... e-xml") |
13-
| libxml.noent.js:11:21:11:41 | req.par ... e-xml") |
14-
| libxml.noent.js:11:21:11:41 | req.par ... e-xml") |
15-
| libxml.noent.js:14:27:14:47 | req.par ... e-xml") |
16-
| libxml.noent.js:14:27:14:47 | req.par ... e-xml") |
17-
| libxml.noent.js:14:27:14:47 | req.par ... e-xml") |
18-
| libxml.noent.js:16:27:16:35 | req.files |
19-
| libxml.noent.js:16:27:16:35 | req.files |
20-
| libxml.noent.js:16:27:16:44 | req.files.products |
21-
| libxml.noent.js:16:27:16:49 | req.fil ... ts.data |
22-
| libxml.noent.js:16:27:16:66 | req.fil ... 'utf8') |
23-
| libxml.noent.js:16:27:16:66 | req.fil ... 'utf8') |
24-
| libxml.sax.js:6:22:6:42 | req.par ... e-xml") |
25-
| libxml.sax.js:6:22:6:42 | req.par ... e-xml") |
26-
| libxml.sax.js:6:22:6:42 | req.par ... e-xml") |
27-
| libxml.saxpush.js:6:15:6:35 | req.par ... e-xml") |
28-
| libxml.saxpush.js:6:15:6:35 | req.par ... e-xml") |
29-
| libxml.saxpush.js:6:15:6:35 | req.par ... e-xml") |
301
edges
312
| domparser.js:2:7:2:36 | src | domparser.js:11:55:11:57 | src |
32-
| domparser.js:2:7:2:36 | src | domparser.js:11:55:11:57 | src |
33-
| domparser.js:2:7:2:36 | src | domparser.js:14:57:14:59 | src |
343
| domparser.js:2:7:2:36 | src | domparser.js:14:57:14:59 | src |
354
| domparser.js:2:13:2:36 | documen ... .search | domparser.js:2:7:2:36 | src |
36-
| domparser.js:2:13:2:36 | documen ... .search | domparser.js:2:7:2:36 | src |
37-
| libxml.noent.js:6:21:6:41 | req.par ... e-xml") | libxml.noent.js:6:21:6:41 | req.par ... e-xml") |
38-
| libxml.noent.js:11:21:11:41 | req.par ... e-xml") | libxml.noent.js:11:21:11:41 | req.par ... e-xml") |
39-
| libxml.noent.js:14:27:14:47 | req.par ... e-xml") | libxml.noent.js:14:27:14:47 | req.par ... e-xml") |
40-
| libxml.noent.js:16:27:16:35 | req.files | libxml.noent.js:16:27:16:44 | req.files.products |
41-
| libxml.noent.js:16:27:16:35 | req.files | libxml.noent.js:16:27:16:44 | req.files.products |
42-
| libxml.noent.js:16:27:16:44 | req.files.products | libxml.noent.js:16:27:16:49 | req.fil ... ts.data |
43-
| libxml.noent.js:16:27:16:49 | req.fil ... ts.data | libxml.noent.js:16:27:16:66 | req.fil ... 'utf8') |
44-
| libxml.noent.js:16:27:16:49 | req.fil ... ts.data | libxml.noent.js:16:27:16:66 | req.fil ... 'utf8') |
45-
| libxml.sax.js:6:22:6:42 | req.par ... e-xml") | libxml.sax.js:6:22:6:42 | req.par ... e-xml") |
46-
| libxml.saxpush.js:6:15:6:35 | req.par ... e-xml") | libxml.saxpush.js:6:15:6:35 | req.par ... e-xml") |
5+
| libxml.noent.js:16:27:16:35 | req.files | libxml.noent.js:16:27:16:66 | req.fil ... 'utf8') |
6+
nodes
7+
| domparser.js:2:7:2:36 | src | semmle.label | src |
8+
| domparser.js:2:13:2:36 | documen ... .search | semmle.label | documen ... .search |
9+
| domparser.js:11:55:11:57 | src | semmle.label | src |
10+
| domparser.js:14:57:14:59 | src | semmle.label | src |
11+
| libxml.noent.js:6:21:6:41 | req.par ... e-xml") | semmle.label | req.par ... e-xml") |
12+
| libxml.noent.js:11:21:11:41 | req.par ... e-xml") | semmle.label | req.par ... e-xml") |
13+
| libxml.noent.js:14:27:14:47 | req.par ... e-xml") | semmle.label | req.par ... e-xml") |
14+
| libxml.noent.js:16:27:16:35 | req.files | semmle.label | req.files |
15+
| libxml.noent.js:16:27:16:66 | req.fil ... 'utf8') | semmle.label | req.fil ... 'utf8') |
16+
| libxml.sax.js:6:22:6:42 | req.par ... e-xml") | semmle.label | req.par ... e-xml") |
17+
| libxml.saxpush.js:6:15:6:35 | req.par ... e-xml") | semmle.label | req.par ... e-xml") |
18+
subpaths
4719
#select
4820
| domparser.js:11:55:11:57 | src | domparser.js:2:13:2:36 | documen ... .search | domparser.js:11:55:11:57 | src | XML parsing depends on a $@ without guarding against external entity expansion. | domparser.js:2:13:2:36 | documen ... .search | user-provided value |
4921
| domparser.js:14:57:14:59 | src | domparser.js:2:13:2:36 | documen ... .search | domparser.js:14:57:14:59 | src | XML parsing depends on a $@ without guarding against external entity expansion. | domparser.js:2:13:2:36 | documen ... .search | user-provided value |

0 commit comments

Comments
 (0)