Thanks to visit codestin.com
Credit goes to github.com

Skip to content

Commit e2fbf8a

Browse files
erik-krogherik-krogh
committed
add files uploaded with multer as RemoteFlowSource
1 parent b749112 commit e2fbf8a

3 files changed

Lines changed: 42 additions & 1 deletion

File tree

‎javascript/ql/src/semmle/javascript/frameworks/Express.qll‎

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -509,8 +509,9 @@ module Express {
509509
this = request.getAPropertyRead("cookies")
510510
or
511511
// `req.files`, treated the same as `req.body`.
512+
// `express-fileupload` uses .files, and `multer` uses .files or .file
512513
kind = "body" and
513-
this = request.getAPropertyRead("files")
514+
this = request.getAPropertyRead(["files", "file"])
514515
)
515516
or
516517
kind = "body" and

‎javascript/ql/test/query-tests/Security/CWE-078/CommandInjection.expected‎

Lines changed: 24 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -88,6 +88,18 @@ nodes
8888
| execSeries.js:18:34:18:40 | req.url |
8989
| execSeries.js:19:12:19:16 | [cmd] |
9090
| execSeries.js:19:13:19:15 | cmd |
91+
| form-parsers.js:9:8:9:39 | "touch ... nalname |
92+
| form-parsers.js:9:8:9:39 | "touch ... nalname |
93+
| form-parsers.js:9:19:9:26 | req.file |
94+
| form-parsers.js:9:19:9:26 | req.file |
95+
| form-parsers.js:9:19:9:39 | req.fil ... nalname |
96+
| form-parsers.js:13:3:13:11 | req.files |
97+
| form-parsers.js:13:3:13:11 | req.files |
98+
| form-parsers.js:13:21:13:24 | file |
99+
| form-parsers.js:14:10:14:37 | "touch ... nalname |
100+
| form-parsers.js:14:10:14:37 | "touch ... nalname |
101+
| form-parsers.js:14:21:14:24 | file |
102+
| form-parsers.js:14:21:14:37 | file.originalname |
91103
| lib/subLib/index.js:7:32:7:35 | name |
92104
| lib/subLib/index.js:8:10:8:25 | "rm -rf " + name |
93105
| lib/subLib/index.js:8:10:8:25 | "rm -rf " + name |
@@ -222,6 +234,16 @@ edges
222234
| execSeries.js:18:34:18:40 | req.url | execSeries.js:18:13:18:47 | require ... , true) |
223235
| execSeries.js:19:12:19:16 | [cmd] | execSeries.js:13:19:13:26 | commands |
224236
| execSeries.js:19:13:19:15 | cmd | execSeries.js:19:12:19:16 | [cmd] |
237+
| form-parsers.js:9:19:9:26 | req.file | form-parsers.js:9:19:9:39 | req.fil ... nalname |
238+
| form-parsers.js:9:19:9:26 | req.file | form-parsers.js:9:19:9:39 | req.fil ... nalname |
239+
| form-parsers.js:9:19:9:39 | req.fil ... nalname | form-parsers.js:9:8:9:39 | "touch ... nalname |
240+
| form-parsers.js:9:19:9:39 | req.fil ... nalname | form-parsers.js:9:8:9:39 | "touch ... nalname |
241+
| form-parsers.js:13:3:13:11 | req.files | form-parsers.js:13:21:13:24 | file |
242+
| form-parsers.js:13:3:13:11 | req.files | form-parsers.js:13:21:13:24 | file |
243+
| form-parsers.js:13:21:13:24 | file | form-parsers.js:14:21:14:24 | file |
244+
| form-parsers.js:14:21:14:24 | file | form-parsers.js:14:21:14:37 | file.originalname |
245+
| form-parsers.js:14:21:14:37 | file.originalname | form-parsers.js:14:10:14:37 | "touch ... nalname |
246+
| form-parsers.js:14:21:14:37 | file.originalname | form-parsers.js:14:10:14:37 | "touch ... nalname |
225247
| lib/subLib/index.js:7:32:7:35 | name | lib/subLib/index.js:8:22:8:25 | name |
226248
| lib/subLib/index.js:8:22:8:25 | name | lib/subLib/index.js:8:10:8:25 | "rm -rf " + name |
227249
| lib/subLib/index.js:8:22:8:25 | name | lib/subLib/index.js:8:10:8:25 | "rm -rf " + name |
@@ -293,6 +315,8 @@ edges
293315
| exec-sh2.js:10:12:10:57 | cp.spaw ... ptions) | exec-sh2.js:14:25:14:31 | req.url | exec-sh2.js:10:40:10:46 | command | This command depends on $@. | exec-sh2.js:14:25:14:31 | req.url | a user-provided value |
294316
| exec-sh.js:15:12:15:61 | cp.spaw ... ptions) | exec-sh.js:19:25:19:31 | req.url | exec-sh.js:15:44:15:50 | command | This command depends on $@. | exec-sh.js:19:25:19:31 | req.url | a user-provided value |
295317
| execSeries.js:14:41:14:47 | command | execSeries.js:18:34:18:40 | req.url | execSeries.js:14:41:14:47 | command | This command depends on $@. | execSeries.js:18:34:18:40 | req.url | a user-provided value |
318+
| form-parsers.js:9:8:9:39 | "touch ... nalname | form-parsers.js:9:19:9:26 | req.file | form-parsers.js:9:8:9:39 | "touch ... nalname | This command depends on $@. | form-parsers.js:9:19:9:26 | req.file | a user-provided value |
319+
| form-parsers.js:14:10:14:37 | "touch ... nalname | form-parsers.js:13:3:13:11 | req.files | form-parsers.js:14:10:14:37 | "touch ... nalname | This command depends on $@. | form-parsers.js:13:3:13:11 | req.files | a user-provided value |
296320
| lib/subLib/index.js:8:10:8:25 | "rm -rf " + name | child_process-test.js:85:37:85:54 | req.query.fileName | lib/subLib/index.js:8:10:8:25 | "rm -rf " + name | This command depends on $@. | child_process-test.js:85:37:85:54 | req.query.fileName | a user-provided value |
297321
| other.js:7:33:7:35 | cmd | other.js:5:25:5:31 | req.url | other.js:7:33:7:35 | cmd | This command depends on $@. | other.js:5:25:5:31 | req.url | a user-provided value |
298322
| other.js:8:28:8:30 | cmd | other.js:5:25:5:31 | req.url | other.js:8:28:8:30 | cmd | This command depends on $@. | other.js:5:25:5:31 | req.url | a user-provided value |

‎javascript/ql/test/query-tests/Security/CWE-078/form-parsers.js‎

Lines changed: 16 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,16 @@
1+
var express = require('express');
2+
var multer = require('multer');
3+
var upload = multer({ dest: 'uploads/' });
4+
5+
var app = express();
6+
var exec = require("child_process").exec;
7+
8+
app.post('/profile', upload.single('avatar'), function (req, res, next) {
9+
exec("touch " + req.file.originalname); // NOT OK
10+
});
11+
12+
app.post('/photos/upload', upload.array('photos', 12), function (req, res, next) {
13+
req.files.forEach(file => {
14+
exec("touch " + file.originalname); // NOT OK
15+
})
16+
});

0 commit comments

Comments
 (0)