Skip to content

Commit 34abef8

Browse files
erik-krogherik-krogh
committed
Merge branch 'main' into dragAndDrop
2 parents 57fac94 + cb211f8 commit 34abef8

10 files changed

Lines changed: 59 additions & 8 deletions

File tree

‎cpp/ql/src/experimental/Security/CWE/CWE-020/NoCheckBeforeUnsafePutUser.ql‎

Lines changed: 8 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -21,7 +21,7 @@ class WriteAccessCheckMacro extends Macro {
2121
VariableAccess va;
2222

2323
WriteAccessCheckMacro() {
24-
this.getName() = ["user_write_access_begin", "user_access_begin"] and
24+
this.getName() = ["user_write_access_begin", "user_access_begin", "access_ok"] and
2525
va.getEnclosingElement() = this.getAnInvocation().getAnExpandedElement()
2626
}
2727

@@ -37,7 +37,8 @@ class UnSafePutUserMacro extends Macro {
3737
}
3838

3939
Expr getUserModePtr() {
40-
result = writeUserPtr.getOperand().(AddressOfExpr).getOperand().(FieldAccess).getQualifier()
40+
result = writeUserPtr.getOperand().(AddressOfExpr).getOperand().(FieldAccess).getQualifier() or
41+
result = writeUserPtr.getOperand()
4142
}
4243
}
4344

@@ -46,11 +47,13 @@ class ExploitableUserModePtrParam extends Parameter {
4647
not exists(WriteAccessCheckMacro writeAccessCheck |
4748
DataFlow::localFlow(DataFlow::parameterNode(this),
4849
DataFlow::exprNode(writeAccessCheck.getArgument()))
50+
) and
51+
exists(UnSafePutUserMacro unsafePutUser |
52+
DataFlow::localFlow(DataFlow::parameterNode(this),
53+
DataFlow::exprNode(unsafePutUser.getUserModePtr()))
4954
)
5055
}
5156
}
5257

53-
from ExploitableUserModePtrParam p, UnSafePutUserMacro unsafePutUser
54-
where
55-
DataFlow::localFlow(DataFlow::parameterNode(p), DataFlow::exprNode(unsafePutUser.getUserModePtr()))
58+
from ExploitableUserModePtrParam p
5659
select p, "unsafe_put_user write user-mode pointer $@ without check.", p, p.toString()

‎javascript/ql/lib/semmle/javascript/Arrays.qll‎

Lines changed: 13 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -45,9 +45,20 @@ module ArrayTaintTracking {
4545
)
4646
or
4747
// `array.reduce` with tainted value in callback
48+
// The callback parameters are: (previousValue, currentValue, currentIndex, array)
4849
call.(DataFlow::MethodCallNode).getMethodName() = "reduce" and
49-
pred = call.getArgument(0).(DataFlow::FunctionNode).getAReturn() and // Require the argument to be a closure to avoid spurious call/return flow
50-
succ = call
50+
exists(DataFlow::FunctionNode callback |
51+
callback = call.getArgument(0) // Require the argument to be a closure to avoid spurious call/return flow
52+
|
53+
pred = callback.getAReturn() and
54+
succ = call
55+
or
56+
pred = call.getReceiver() and
57+
succ = callback.getParameter([1, 3]) // into currentValue or array
58+
or
59+
pred = [call.getArgument(1), callback.getAReturn()] and
60+
succ = callback.getParameter(0) // into previousValue
61+
)
5162
or
5263
// `array.push(e)`, `array.unshift(e)`: if `e` is tainted, then so is `array`.
5364
pred = call.getAnArgument() and

‎javascript/ql/lib/semmle/javascript/DOM.qll‎

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -430,6 +430,12 @@ module DOM {
430430
result.hasUnderlyingType("Element")
431431
or
432432
result.hasUnderlyingType(any(string s | s.matches("HTML%Element")))
433+
or
434+
exists(DataFlow::ClassNode cls |
435+
cls.getASuperClassNode().getALocalSource() =
436+
DataFlow::globalVarRef(any(string s | s.matches("HTML%Element"))) and
437+
result = cls.getAnInstanceReference()
438+
)
433439
}
434440

435441
module LocationSource {

‎javascript/ql/src/change-notes/2022-04-07-missing-flow-fixes.md‎

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,5 @@
1+
---
2+
category: minorAnalysis
3+
---
4+
* Improved handling of custom DOM elements, potentially leading to more alerts for the XSS queries.
5+
* Improved taint tracking through calls to the `Array.prototype.reduce` function.

‎javascript/ql/test/library-tests/TaintTracking/BasicTaintTracking.expected‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -16,6 +16,7 @@ typeInferenceMismatch
1616
| arrays.js:2:15:2:22 | source() | arrays.js:8:10:8:22 | arrayIfy(foo) |
1717
| arrays.js:2:15:2:22 | source() | arrays.js:11:10:11:28 | union(["bla"], foo) |
1818
| arrays.js:2:15:2:22 | source() | arrays.js:14:10:14:18 | flat(foo) |
19+
| arrays.js:2:15:2:22 | source() | arrays.js:19:10:19:12 | res |
1920
| booleanOps.js:2:11:2:18 | source() | booleanOps.js:4:8:4:8 | x |
2021
| booleanOps.js:2:11:2:18 | source() | booleanOps.js:13:10:13:10 | x |
2122
| booleanOps.js:2:11:2:18 | source() | booleanOps.js:19:10:19:10 | x |

‎javascript/ql/test/library-tests/TaintTracking/arrays.js‎

Lines changed: 6 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -12,4 +12,9 @@ function test() {
1212

1313
const flat = require("arr-flatten");
1414
sink(flat(foo)); // NOT OK
15-
}
15+
16+
let res = foo.reduce((prev, current) => {
17+
return prev + '<b>' + current + '</b>';
18+
}, '');
19+
sink(res); // NOT OK
20+
}

‎javascript/ql/test/query-tests/Security/CWE-079/DomBasedXss/Xss.expected‎

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -152,6 +152,10 @@ nodes
152152
| clipboard.ts:73:29:73:39 | droppedHtml |
153153
| clipboard.ts:73:29:73:39 | droppedHtml |
154154
| clipboard.ts:73:29:73:39 | droppedHtml |
155+
| custom-element.js:5:26:5:36 | window.name |
156+
| custom-element.js:5:26:5:36 | window.name |
157+
| custom-element.js:5:26:5:36 | window.name |
158+
| custom-element.js:5:26:5:36 | window.name |
155159
| d3.js:4:12:4:22 | window.name |
156160
| d3.js:4:12:4:22 | window.name |
157161
| d3.js:4:12:4:22 | window.name |
@@ -1198,6 +1202,7 @@ edges
11981202
| clipboard.ts:71:27:71:62 | e.clipb ... /html') | clipboard.ts:71:13:71:62 | droppedHtml |
11991203
| clipboard.ts:71:27:71:62 | e.clipb ... /html') | clipboard.ts:71:13:71:62 | droppedHtml |
12001204
| clipboard.ts:71:27:71:62 | e.clipb ... /html') | clipboard.ts:71:13:71:62 | droppedHtml |
1205+
| custom-element.js:5:26:5:36 | window.name | custom-element.js:5:26:5:36 | window.name |
12011206
| d3.js:4:12:4:22 | window.name | d3.js:11:15:11:24 | getTaint() |
12021207
| d3.js:4:12:4:22 | window.name | d3.js:11:15:11:24 | getTaint() |
12031208
| d3.js:4:12:4:22 | window.name | d3.js:11:15:11:24 | getTaint() |
@@ -2159,6 +2164,7 @@ edges
21592164
| clipboard.ts:33:19:33:68 | e.origi ... /html') | clipboard.ts:33:19:33:68 | e.origi ... /html') | clipboard.ts:33:19:33:68 | e.origi ... /html') | Cross-site scripting vulnerability due to $@. | clipboard.ts:33:19:33:68 | e.origi ... /html') | user-provided value |
21602165
| clipboard.ts:50:29:50:32 | html | clipboard.ts:43:22:43:55 | clipboa ... /html') | clipboard.ts:50:29:50:32 | html | Cross-site scripting vulnerability due to $@. | clipboard.ts:43:22:43:55 | clipboa ... /html') | user-provided value |
21612166
| clipboard.ts:73:29:73:39 | droppedHtml | clipboard.ts:71:27:71:62 | e.clipb ... /html') | clipboard.ts:73:29:73:39 | droppedHtml | Cross-site scripting vulnerability due to $@. | clipboard.ts:71:27:71:62 | e.clipb ... /html') | user-provided value |
2167+
| custom-element.js:5:26:5:36 | window.name | custom-element.js:5:26:5:36 | window.name | custom-element.js:5:26:5:36 | window.name | Cross-site scripting vulnerability due to $@. | custom-element.js:5:26:5:36 | window.name | user-provided value |
21622168
| d3.js:11:15:11:24 | getTaint() | d3.js:4:12:4:22 | window.name | d3.js:11:15:11:24 | getTaint() | Cross-site scripting vulnerability due to $@. | d3.js:4:12:4:22 | window.name | user-provided value |
21632169
| d3.js:12:20:12:29 | getTaint() | d3.js:4:12:4:22 | window.name | d3.js:12:20:12:29 | getTaint() | Cross-site scripting vulnerability due to $@. | d3.js:4:12:4:22 | window.name | user-provided value |
21642170
| d3.js:14:20:14:29 | getTaint() | d3.js:4:12:4:22 | window.name | d3.js:14:20:14:29 | getTaint() | Cross-site scripting vulnerability due to $@. | d3.js:4:12:4:22 | window.name | user-provided value |

‎javascript/ql/test/query-tests/Security/CWE-079/DomBasedXss/XssWithAdditionalSources.expected‎

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -152,6 +152,10 @@ nodes
152152
| clipboard.ts:73:29:73:39 | droppedHtml |
153153
| clipboard.ts:73:29:73:39 | droppedHtml |
154154
| clipboard.ts:73:29:73:39 | droppedHtml |
155+
| custom-element.js:5:26:5:36 | window.name |
156+
| custom-element.js:5:26:5:36 | window.name |
157+
| custom-element.js:5:26:5:36 | window.name |
158+
| custom-element.js:5:26:5:36 | window.name |
155159
| d3.js:4:12:4:22 | window.name |
156160
| d3.js:4:12:4:22 | window.name |
157161
| d3.js:4:12:4:22 | window.name |
@@ -1248,6 +1252,7 @@ edges
12481252
| clipboard.ts:71:27:71:62 | e.clipb ... /html') | clipboard.ts:71:13:71:62 | droppedHtml |
12491253
| clipboard.ts:71:27:71:62 | e.clipb ... /html') | clipboard.ts:71:13:71:62 | droppedHtml |
12501254
| clipboard.ts:71:27:71:62 | e.clipb ... /html') | clipboard.ts:71:13:71:62 | droppedHtml |
1255+
| custom-element.js:5:26:5:36 | window.name | custom-element.js:5:26:5:36 | window.name |
12511256
| d3.js:4:12:4:22 | window.name | d3.js:11:15:11:24 | getTaint() |
12521257
| d3.js:4:12:4:22 | window.name | d3.js:11:15:11:24 | getTaint() |
12531258
| d3.js:4:12:4:22 | window.name | d3.js:11:15:11:24 | getTaint() |

‎javascript/ql/test/query-tests/Security/CWE-079/DomBasedXss/custom-element.js‎

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,7 @@
1+
import * as dummy from 'dummy';
2+
3+
class CustomElm extends HTMLElement {
4+
test() {
5+
this.innerHTML = window.name; // NOT OK
6+
}
7+
}

‎javascript/ql/test/query-tests/Security/CWE-312/BuildArtifactLeak.expected‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -37,12 +37,14 @@ edges
3737
| build-leaks.js:15:24:15:34 | process.env | build-leaks.js:14:18:14:20 | env |
3838
| build-leaks.js:15:24:15:34 | process.env | build-leaks.js:14:18:14:20 | env |
3939
| build-leaks.js:16:20:16:22 | env | build-leaks.js:13:17:19:10 | Object. ... }) |
40+
| build-leaks.js:16:20:16:22 | env | build-leaks.js:14:18:14:20 | env |
4041
| build-leaks.js:21:11:26:5 | stringifed | build-leaks.js:30:22:30:31 | stringifed |
4142
| build-leaks.js:21:24:26:5 | {\\n ... )\\n } | build-leaks.js:21:11:26:5 | stringifed |
4243
| build-leaks.js:22:24:25:14 | Object. ... }, {}) | build-leaks.js:21:24:26:5 | {\\n ... )\\n } |
4344
| build-leaks.js:22:49:22:51 | env | build-leaks.js:24:20:24:22 | env |
4445
| build-leaks.js:23:39:23:41 | raw | build-leaks.js:22:49:22:51 | env |
4546
| build-leaks.js:24:20:24:22 | env | build-leaks.js:22:24:25:14 | Object. ... }, {}) |
47+
| build-leaks.js:24:20:24:22 | env | build-leaks.js:22:49:22:51 | env |
4648
| build-leaks.js:30:22:30:31 | stringifed | build-leaks.js:34:26:34:57 | getEnv( ... ngified |
4749
| build-leaks.js:30:22:30:31 | stringifed | build-leaks.js:34:26:34:57 | getEnv( ... ngified |
4850
| build-leaks.js:40:9:40:60 | pw | build-leaks.js:41:82:41:83 | pw |

0 commit comments

Comments
 (0)