|
| 1 | +/** |
| 2 | + * @name Creating biased random numbers from cryptographically secure source. |
| 3 | + * @description Some mathematical operations on random numbers can cause bias in |
| 4 | + * the results and compromise security. |
| 5 | + * @kind problem |
| 6 | + * @problem.severity warning |
| 7 | + * @precision high |
| 8 | + * @id js/biased-cryptographic-random |
| 9 | + * @tags security |
| 10 | + * external/cwe/cwe-327 |
| 11 | + */ |
| 12 | + |
| 13 | +import javascript |
| 14 | +private import semmle.javascript.dataflow.internal.StepSummary |
| 15 | +private import semmle.javascript.security.dataflow.InsecureRandomnessCustomizations |
| 16 | +private import semmle.javascript.dataflow.InferredTypes |
| 17 | + |
| 18 | +/** |
| 19 | + * Gets a number that is a power of 2. |
| 20 | + */ |
| 21 | +private int powerOfTwo() { |
| 22 | + result = 1 |
| 23 | + or |
| 24 | + result = 2 * powerOfTwo() and |
| 25 | + not result < 0 |
| 26 | +} |
| 27 | + |
| 28 | +/** |
| 29 | + * Gets a node that has value 2^n for some n. |
| 30 | + */ |
| 31 | +private DataFlow::Node isPowerOfTwo() { |
| 32 | + exists(DataFlow::Node prev | |
| 33 | + prev.getIntValue() = powerOfTwo() |
| 34 | + or |
| 35 | + // Getting around the 32 bit ints in QL. These are some hex values of the form 0x10000000 |
| 36 | + prev.asExpr().(NumberLiteral).getValue() = |
| 37 | + ["281474976710656", "17592186044416", "1099511627776", "68719476736", "4294967296"] |
| 38 | + | |
| 39 | + result = prev.getASuccessor*() |
| 40 | + ) |
| 41 | +} |
| 42 | + |
| 43 | +/** |
| 44 | + * Gets a node that has value (2^n)-1 for some n. |
| 45 | + */ |
| 46 | +private DataFlow::Node isPowerOfTwoMinusOne() { |
| 47 | + exists(DataFlow::Node prev | |
| 48 | + prev.getIntValue() = powerOfTwo() - 1 |
| 49 | + or |
| 50 | + // Getting around the 32 bit ints in QL. These are some hex values of the form 0xfffffff |
| 51 | + prev.asExpr().(NumberLiteral).getValue() = |
| 52 | + ["281474976710655", "17592186044415", "1099511627775", "68719476735", "4294967295"] |
| 53 | + | |
| 54 | + result = prev.getASuccessor*() |
| 55 | + ) |
| 56 | +} |
| 57 | + |
| 58 | +/** |
| 59 | + * Gets a Buffer/TypedArray containing cryptographically secure random numbers. |
| 60 | + */ |
| 61 | +private DataFlow::SourceNode randomBufferSource() { |
| 62 | + result = DataFlow::moduleMember("crypto", ["randomBytes", "randomFillSync"]).getACall() |
| 63 | + or |
| 64 | + exists(DataFlow::CallNode call | |
| 65 | + call = DataFlow::moduleMember("crypto", ["randomFill", "randomFillSync"]) and |
| 66 | + result = call.getArgument(0).getALocalSource() |
| 67 | + ) |
| 68 | + or |
| 69 | + result = DataFlow::globalVarRef("crypto").getAMethodCall("getRandomValues") |
| 70 | + or |
| 71 | + result = DataFlow::moduleImport("secure-random").getACall() |
| 72 | + or |
| 73 | + result = |
| 74 | + DataFlow::moduleImport("secure-random") |
| 75 | + .getAMethodCall(["randomArray", "randomUint8Array", "randomBuffer"]) |
| 76 | +} |
| 77 | + |
| 78 | +/** |
| 79 | + * Gets the pseudo-property used to track elements inside a Buffer. |
| 80 | + * The API for `Set` is close enough to the API for `Buffer` that we can reuse the type-tracking steps. |
| 81 | + */ |
| 82 | +private string prop() { result = DataFlow::PseudoProperties::setElement() } |
| 83 | + |
| 84 | +/** |
| 85 | + * Gets a reference to a cryptographically secure random number produced by `source` and type tracked using `t`. |
| 86 | + */ |
| 87 | +private DataFlow::Node goodRandom(DataFlow::TypeTracker t, DataFlow::SourceNode source) { |
| 88 | + t.startInProp(prop()) and |
| 89 | + result = randomBufferSource() and |
| 90 | + result = source |
| 91 | + or |
| 92 | + // Loading a number from a `Buffer`. |
| 93 | + exists(DataFlow::TypeTracker t2 | t = t2.append(LoadStep(prop())) | |
| 94 | + // the random generators return arrays/Buffers of random numbers, we therefore track through an indexed read. |
| 95 | + exists(DataFlow::PropRead read | result = read | |
| 96 | + read.getBase() = goodRandom(t2, source) and |
| 97 | + not read.getPropertyNameExpr() instanceof Label |
| 98 | + ) |
| 99 | + or |
| 100 | + // reading a number from a Buffer. |
| 101 | + exists(DataFlow::MethodCallNode call | result = call | |
| 102 | + call.getReceiver() = goodRandom(t2, source) and |
| 103 | + call |
| 104 | + .getMethodName() |
| 105 | + .regexpMatch("read(BigInt|BigUInt|Double|Float|Int|UInt)(8|16|32|64)?(BE|LE)?") |
| 106 | + ) |
| 107 | + ) |
| 108 | + or |
| 109 | + exists(DataFlow::TypeTracker t2 | t = t2.smallstep(goodRandom(t2, source), result)) |
| 110 | + or |
| 111 | + // re-using the collection steps for `Set`. |
| 112 | + exists(DataFlow::TypeTracker t2 | |
| 113 | + result = CollectionsTypeTracking::collectionStep(goodRandom(t2, source), t, t2) |
| 114 | + ) |
| 115 | + or |
| 116 | + InsecureRandomness::isAdditionalTaintStep(goodRandom(t.continue(), source), result) and |
| 117 | + // bit shifts and multiplication by powers of two are generally used for constructing larger numbers from smaller numbers. |
| 118 | + not exists(BinaryExpr binop | binop = result.asExpr() | |
| 119 | + binop.getOperator().regexpMatch(".*(<|>).*") |
| 120 | + or |
| 121 | + binop.getOperator() = "*" and isPowerOfTwo().asExpr() = binop.getAnOperand() |
| 122 | + or |
| 123 | + // string concat does not produce a number |
| 124 | + unique(InferredType type | type = binop.flow().analyze().getAType()) = TTString() |
| 125 | + ) |
| 126 | +} |
| 127 | + |
| 128 | +/** |
| 129 | + * Gets a reference to a cryptographically secure random number produced by `source`. |
| 130 | + */ |
| 131 | +DataFlow::Node goodRandom(DataFlow::SourceNode source) { |
| 132 | + result = goodRandom(DataFlow::TypeTracker::end(), source) |
| 133 | +} |
| 134 | + |
| 135 | +/** |
| 136 | + * Gets a node that that produces a biased result from otherwise cryptographically secure random numbers produced by `source`. |
| 137 | + */ |
| 138 | +DataFlow::Node badCrypto(string description, DataFlow::SourceNode source) { |
| 139 | + // addition and multiplication - always bad when both the lhs and rhs are random. |
| 140 | + exists(BinaryExpr binop | result.asExpr() = binop | |
| 141 | + goodRandom(_).asExpr() = binop.getLeftOperand() and |
| 142 | + goodRandom(_).asExpr() = binop.getRightOperand() and |
| 143 | + goodRandom(source).asExpr() = binop.getAnOperand() and |
| 144 | + ( |
| 145 | + binop.getOperator() = "+" and description = "addition" |
| 146 | + or |
| 147 | + binop.getOperator() = "*" and description = "multiplication" |
| 148 | + ) |
| 149 | + ) |
| 150 | + or |
| 151 | + // division - bad if result is rounded. |
| 152 | + exists(DivExpr div | result.asExpr() = div | |
| 153 | + goodRandom(source).asExpr() = div.getLeftOperand() and |
| 154 | + description = "division and rounding the result" and |
| 155 | + not div.getRightOperand() = isPowerOfTwoMinusOne().asExpr() and // division by (2^n)-1 most of the time produces a uniformly random number between 0 and 1. |
| 156 | + DataFlow::globalVarRef("Math") |
| 157 | + .getAMemberCall(["round", "floor", "ceil"]) |
| 158 | + .getArgument(0) |
| 159 | + .asExpr() = div |
| 160 | + ) |
| 161 | + or |
| 162 | + // modulo - only bad if not by a power of 2 - and the result is not checked for bias |
| 163 | + exists(ModExpr mod, DataFlow::Node random | result.asExpr() = mod and mod.getOperator() = "%" | |
| 164 | + description = "modulo" and |
| 165 | + goodRandom(source) = random and |
| 166 | + random.asExpr() = mod.getLeftOperand() and |
| 167 | + // division by a power of 2 is OK. E.g. if `x` is uniformly random is in the range [0..255] then `x % 32` is uniformly random in the range [0..31]. |
| 168 | + not mod.getRightOperand() = isPowerOfTwo().asExpr() and |
| 169 | + // not exists a comparison that checks if the result is potentially biased. |
| 170 | + not exists(BinaryExpr comparison | comparison.getOperator() = [">", "<", "<=", ">="] | |
| 171 | + AccessPath::getAnAliasedSourceNode(random.getALocalSource()) |
| 172 | + .flowsToExpr(comparison.getAnOperand()) |
| 173 | + or |
| 174 | + exists(DataFlow::PropRead otherRead | |
| 175 | + otherRead = random.(DataFlow::PropRead).getBase().getALocalSource().getAPropertyRead() and |
| 176 | + not exists(otherRead.getPropertyName()) and |
| 177 | + otherRead.flowsToExpr(comparison.getAnOperand()) |
| 178 | + ) |
| 179 | + ) |
| 180 | + ) |
| 181 | + or |
| 182 | + // create a number from a string - always a bad idea. |
| 183 | + exists(DataFlow::CallNode number, StringOps::ConcatenationRoot root | result = number | |
| 184 | + number = DataFlow::globalVarRef(["Number", "parseInt", "parseFloat"]).getACall() and |
| 185 | + root = number.getArgument(0) and |
| 186 | + goodRandom(source) = root.getALeaf() and |
| 187 | + exists(root.getALeaf().getStringValue()) and |
| 188 | + description = "string concatenation" |
| 189 | + ) |
| 190 | +} |
| 191 | + |
| 192 | +from DataFlow::Node node, string description, DataFlow::SourceNode source |
| 193 | +where node = badCrypto(description, source) |
| 194 | +select node, "Using " + description + " on a $@ produces biased results.", source, |
| 195 | + "cryptographically secure random number" |
0 commit comments