Thanks to visit codestin.com
Credit goes to github.com

Skip to content

Commit e3ab5bd

Browse files
asgerfasgerf
committed
JS: Port IncompleteHtmlAttributeSanitization
1 parent 9128722 commit e3ab5bd

3 files changed

Lines changed: 50 additions & 60 deletions

File tree

‎javascript/ql/lib/semmle/javascript/security/dataflow/IncompleteHtmlAttributeSanitizationQuery.qll‎

Lines changed: 28 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -25,7 +25,34 @@ private module Label {
2525
/**
2626
* A taint-tracking configuration for reasoning about incomplete HTML sanitization vulnerabilities.
2727
*/
28-
class Configuration extends TaintTracking::Configuration {
28+
module IncompleteHtmlAttributeSanitizationConfig implements DataFlow::StateConfigSig {
29+
class FlowState = DataFlow::FlowLabel;
30+
31+
predicate isSource(DataFlow::Node source, DataFlow::FlowLabel label) {
32+
label = Label::characterToLabel(source.(Source).getAnUnsanitizedCharacter())
33+
}
34+
35+
predicate isSink(DataFlow::Node sink, DataFlow::FlowLabel label) {
36+
label = Label::characterToLabel(sink.(Sink).getADangerousCharacter())
37+
}
38+
39+
predicate isBarrier(DataFlow::Node node, DataFlow::FlowLabel lbl) {
40+
lbl = Label::characterToLabel(node.(StringReplaceCall).getAReplacedString())
41+
}
42+
43+
predicate isBarrier(DataFlow::Node n) { n instanceof Sanitizer }
44+
}
45+
46+
/**
47+
* Taint-tracking for reasoning about incomplete HTML sanitization vulnerabilities.
48+
*/
49+
module IncompleteHtmlAttributeSanitizationFlow =
50+
TaintTracking::GlobalWithState<IncompleteHtmlAttributeSanitizationConfig>;
51+
52+
/**
53+
* DEPRECATED. Use the `IncompleteHtmlAttributeSanitizationFlow` module instead.
54+
*/
55+
deprecated class Configuration extends TaintTracking::Configuration {
2956
Configuration() { this = "IncompleteHtmlAttributeSanitization" }
3057

3158
override predicate isSource(DataFlow::Node source, DataFlow::FlowLabel label) {

‎javascript/ql/src/Security/CWE-116/IncompleteHtmlAttributeSanitization.ql‎

Lines changed: 5 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -15,9 +15,9 @@
1515
*/
1616

1717
import javascript
18-
import DataFlow::PathGraph
1918
import semmle.javascript.security.dataflow.IncompleteHtmlAttributeSanitizationQuery
2019
import semmle.javascript.security.IncompleteBlacklistSanitizer
20+
import DataFlow::DeduplicatePathGraph<IncompleteHtmlAttributeSanitizationFlow::PathNode, IncompleteHtmlAttributeSanitizationFlow::PathGraph>
2121

2222
/**
2323
* Gets a pretty string of the dangerous characters for `sink`.
@@ -31,8 +31,10 @@ string prettyPrintDangerousCharaters(Sink sink) {
3131
).regexpReplaceAll(",(?=[^,]+$)", " or")
3232
}
3333

34-
from Configuration cfg, DataFlow::PathNode source, DataFlow::PathNode sink
35-
where cfg.hasFlowPath(source, sink)
34+
from PathNode source, PathNode sink
35+
where
36+
IncompleteHtmlAttributeSanitizationFlow::flowPath(source.getAnOriginalPathNode(),
37+
sink.getAnOriginalPathNode())
3638
select sink.getNode(), source, sink,
3739
// this message is slightly sub-optimal as we do not have an easy way
3840
// to get the flow labels that reach the sink, so the message includes

‎javascript/ql/test/query-tests/Security/CWE-116/IncompleteSanitization/IncompleteHtmlAttributeSanitization.expected‎

Lines changed: 17 additions & 56 deletions
Original file line numberDiff line numberDiff line change
@@ -1,64 +1,25 @@
11
nodes
2-
| tst.js:243:9:243:31 | s().rep ... ]/g,'') |
3-
| tst.js:243:9:243:31 | s().rep ... ]/g,'') |
4-
| tst.js:243:9:243:31 | s().rep ... ]/g,'') |
5-
| tst.js:244:9:244:33 | s().rep ... /g, '') |
6-
| tst.js:244:9:244:33 | s().rep ... /g, '') |
7-
| tst.js:244:9:244:33 | s().rep ... /g, '') |
8-
| tst.js:249:9:249:33 | s().rep ... ]/g,'') |
9-
| tst.js:249:9:249:33 | s().rep ... ]/g,'') |
10-
| tst.js:249:9:249:33 | s().rep ... ]/g,'') |
11-
| tst.js:250:9:250:33 | s().rep ... ]/g,'') |
12-
| tst.js:250:9:250:33 | s().rep ... ]/g,'') |
13-
| tst.js:250:9:250:33 | s().rep ... ]/g,'') |
14-
| tst.js:253:21:253:45 | s().rep ... /g, '') |
15-
| tst.js:253:21:253:45 | s().rep ... /g, '') |
16-
| tst.js:253:21:253:45 | s().rep ... /g, '') |
17-
| tst.js:254:32:254:56 | s().rep ... /g, '') |
18-
| tst.js:254:32:254:56 | s().rep ... /g, '') |
19-
| tst.js:254:32:254:56 | s().rep ... /g, '') |
20-
| tst.js:270:61:270:85 | s().rep ... /g, '') |
21-
| tst.js:270:61:270:85 | s().rep ... /g, '') |
22-
| tst.js:270:61:270:85 | s().rep ... /g, '') |
23-
| tst.js:274:6:274:94 | arr |
24-
| tst.js:274:12:274:94 | s().val ... g , '') |
25-
| tst.js:274:12:274:94 | s().val ... g , '') |
26-
| tst.js:275:9:275:11 | arr |
27-
| tst.js:275:9:275:21 | arr.join(" ") |
28-
| tst.js:275:9:275:21 | arr.join(" ") |
29-
| tst.js:300:10:300:33 | s().rep ... ]/g,'') |
30-
| tst.js:300:10:300:33 | s().rep ... ]/g,'') |
31-
| tst.js:300:10:300:33 | s().rep ... ]/g,'') |
32-
| tst.js:301:10:301:32 | s().rep ... ]/g,'') |
33-
| tst.js:301:10:301:32 | s().rep ... ]/g,'') |
34-
| tst.js:301:10:301:32 | s().rep ... ]/g,'') |
35-
| tst.js:302:10:302:34 | s().rep ... ]/g,'') |
36-
| tst.js:302:10:302:34 | s().rep ... ]/g,'') |
37-
| tst.js:302:10:302:34 | s().rep ... ]/g,'') |
38-
| tst.js:303:10:303:34 | s().rep ... /g, '') |
39-
| tst.js:303:10:303:34 | s().rep ... /g, '') |
40-
| tst.js:303:10:303:34 | s().rep ... /g, '') |
41-
| tst.js:309:10:318:3 | s().rep ... ;";\\n\\t}) |
42-
| tst.js:309:10:318:3 | s().rep ... ;";\\n\\t}) |
43-
| tst.js:309:10:318:3 | s().rep ... ;";\\n\\t}) |
2+
| tst.js:243:9:243:31 | s().rep ... ]/g,'') | semmle.label | s().rep ... ]/g,'') |
3+
| tst.js:244:9:244:33 | s().rep ... /g, '') | semmle.label | s().rep ... /g, '') |
4+
| tst.js:249:9:249:33 | s().rep ... ]/g,'') | semmle.label | s().rep ... ]/g,'') |
5+
| tst.js:250:9:250:33 | s().rep ... ]/g,'') | semmle.label | s().rep ... ]/g,'') |
6+
| tst.js:253:21:253:45 | s().rep ... /g, '') | semmle.label | s().rep ... /g, '') |
7+
| tst.js:254:32:254:56 | s().rep ... /g, '') | semmle.label | s().rep ... /g, '') |
8+
| tst.js:270:61:270:85 | s().rep ... /g, '') | semmle.label | s().rep ... /g, '') |
9+
| tst.js:274:6:274:94 | arr | semmle.label | arr |
10+
| tst.js:274:12:274:94 | s().val ... g , '') | semmle.label | s().val ... g , '') |
11+
| tst.js:275:9:275:11 | arr | semmle.label | arr |
12+
| tst.js:275:9:275:21 | arr.join(" ") | semmle.label | arr.join(" ") |
13+
| tst.js:300:10:300:33 | s().rep ... ]/g,'') | semmle.label | s().rep ... ]/g,'') |
14+
| tst.js:301:10:301:32 | s().rep ... ]/g,'') | semmle.label | s().rep ... ]/g,'') |
15+
| tst.js:302:10:302:34 | s().rep ... ]/g,'') | semmle.label | s().rep ... ]/g,'') |
16+
| tst.js:303:10:303:34 | s().rep ... /g, '') | semmle.label | s().rep ... /g, '') |
17+
| tst.js:309:10:318:3 | s().rep ... ;";\\n\\t}) | semmle.label | s().rep ... ;";\\n\\t}) |
4418
edges
45-
| tst.js:243:9:243:31 | s().rep ... ]/g,'') | tst.js:243:9:243:31 | s().rep ... ]/g,'') |
46-
| tst.js:244:9:244:33 | s().rep ... /g, '') | tst.js:244:9:244:33 | s().rep ... /g, '') |
47-
| tst.js:249:9:249:33 | s().rep ... ]/g,'') | tst.js:249:9:249:33 | s().rep ... ]/g,'') |
48-
| tst.js:250:9:250:33 | s().rep ... ]/g,'') | tst.js:250:9:250:33 | s().rep ... ]/g,'') |
49-
| tst.js:253:21:253:45 | s().rep ... /g, '') | tst.js:253:21:253:45 | s().rep ... /g, '') |
50-
| tst.js:254:32:254:56 | s().rep ... /g, '') | tst.js:254:32:254:56 | s().rep ... /g, '') |
51-
| tst.js:270:61:270:85 | s().rep ... /g, '') | tst.js:270:61:270:85 | s().rep ... /g, '') |
5219
| tst.js:274:6:274:94 | arr | tst.js:275:9:275:11 | arr |
5320
| tst.js:274:12:274:94 | s().val ... g , '') | tst.js:274:6:274:94 | arr |
54-
| tst.js:274:12:274:94 | s().val ... g , '') | tst.js:274:6:274:94 | arr |
55-
| tst.js:275:9:275:11 | arr | tst.js:275:9:275:21 | arr.join(" ") |
5621
| tst.js:275:9:275:11 | arr | tst.js:275:9:275:21 | arr.join(" ") |
57-
| tst.js:300:10:300:33 | s().rep ... ]/g,'') | tst.js:300:10:300:33 | s().rep ... ]/g,'') |
58-
| tst.js:301:10:301:32 | s().rep ... ]/g,'') | tst.js:301:10:301:32 | s().rep ... ]/g,'') |
59-
| tst.js:302:10:302:34 | s().rep ... ]/g,'') | tst.js:302:10:302:34 | s().rep ... ]/g,'') |
60-
| tst.js:303:10:303:34 | s().rep ... /g, '') | tst.js:303:10:303:34 | s().rep ... /g, '') |
61-
| tst.js:309:10:318:3 | s().rep ... ;";\\n\\t}) | tst.js:309:10:318:3 | s().rep ... ;";\\n\\t}) |
22+
subpaths
6223
#select
6324
| tst.js:243:9:243:31 | s().rep ... ]/g,'') | tst.js:243:9:243:31 | s().rep ... ]/g,'') | tst.js:243:9:243:31 | s().rep ... ]/g,'') | Cross-site scripting vulnerability as the output of $@ may contain double quotes when it reaches this attribute definition. | tst.js:243:9:243:31 | s().rep ... ]/g,'') | this final HTML sanitizer step |
6425
| tst.js:244:9:244:33 | s().rep ... /g, '') | tst.js:244:9:244:33 | s().rep ... /g, '') | tst.js:244:9:244:33 | s().rep ... /g, '') | Cross-site scripting vulnerability as the output of $@ may contain double quotes when it reaches this attribute definition. | tst.js:244:9:244:33 | s().rep ... /g, '') | this final HTML sanitizer step |

0 commit comments

Comments
 (0)