Skip to content

Commit 58f4cd7

Browse files
am0o0am0o0
committed
add TypeORM to javascript.qll file
add tests improvement on comments
1 parent 0eb0c23 commit 58f4cd7

9 files changed

Lines changed: 366 additions & 20 deletions

File tree

‎javascript/ql/lib/javascript.qll‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -126,6 +126,7 @@ import semmle.javascript.frameworks.ShellJS
126126
import semmle.javascript.frameworks.Snapdragon
127127
import semmle.javascript.frameworks.SystemCommandExecutors
128128
import semmle.javascript.frameworks.SQL
129+
import semmle.javascript.frameworks.TypeORM
129130
import semmle.javascript.frameworks.SocketIO
130131
import semmle.javascript.frameworks.StringFormatters
131132
import semmle.javascript.frameworks.TorrentLibraries

‎javascript/ql/lib/semmle/javascript/frameworks/TypeORM.qll‎

Lines changed: 30 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -1,20 +1,31 @@
11
import javascript
22

3+
/**
4+
* Provides SQL injection Sinks for [TypeORM](https://www.npmjs.com/package/typeorm) package
5+
*/
36
module TypeOrm {
4-
// Gets an expression that constructs or returns a TypeORM database instance.
7+
/**
8+
* Gets an expression that constructs or returns a TypeORM database instance.
9+
*/
510
API::Node dataSource() {
611
result = API::moduleImport("typeorm").getMember("DataSource").getInstance()
712
}
813

9-
// Gets an `QueryRunner`
14+
/**
15+
* Gets an `QueryRunner`
16+
*/
1017
API::Node queryRunner() { result = dataSource().getMember("createQueryRunner").getReturn() }
1118

12-
// Gets `createQueryBuilder` return value from a Active record based Entity
19+
/**
20+
* Gets `createQueryBuilder` return value from a Active record based Entity
21+
*/
1322
API::Node activeRecordQueryBuilder() {
1423
result = queryRunner().getMember("manager").getMember("createQueryBuilder").getReceiver()
1524
}
1625

17-
// Gets `createQueryBuilder` return value from a Data Mapper based Entity
26+
/**
27+
* Gets `createQueryBuilder` return value from a Data Mapper based Entity
28+
*/
1829
API::Node dataMapperQueryBuilder() {
1930
result =
2031
[
@@ -27,13 +38,17 @@ module TypeOrm {
2738
].getMember("createQueryBuilder").getReturn()
2839
}
2940

30-
// Gets return value of a `createQueryBuilder`
41+
/**
42+
* Gets return value of a `createQueryBuilder`
43+
*/
3144
API::Node queryBuilderInstance() {
3245
result = dataMapperQueryBuilder() or
3346
result = activeRecordQueryBuilder()
3447
}
3548

36-
// Gets The Brackets that are SQL Subqueries equivalent
49+
/**
50+
* Gets The Brackets that are SQL Subqueries equivalent
51+
*/
3752
API::Node brackets() {
3853
result =
3954
API::moduleImport("typeorm")
@@ -42,7 +57,9 @@ module TypeOrm {
4257
.getParameter(0)
4358
}
4459

45-
// Gets any Successor node of Brackets, NotBrackets
60+
/**
61+
* Gets any Successor node of Brackets, NotBrackets
62+
*/
4663
API::Node getASuccessorOfBrackets() {
4764
result = brackets() or
4865
result = getASuccessorOfBrackets().getAMember() or
@@ -52,7 +69,9 @@ module TypeOrm {
5269
result = getASuccessorOfBrackets().getInstance()
5370
}
5471

55-
// Gets any Successor node of createQueryBuilder
72+
/**
73+
* Gets any Successor node of createQueryBuilder
74+
*/
5675
API::Node getASuccessorOfBuilderInstance() {
5776
result = queryBuilderInstance() or
5877
result = getASuccessorOfBuilderInstance().getAMember() or
@@ -80,7 +99,9 @@ module TypeOrm {
8099
]
81100
}
82101

83-
// Gets functions that return results
102+
/**
103+
* Gets functions that return results
104+
*/
84105
string queryBuilderResult() {
85106
result = ["getOne", "getOneOrFail", "getMany", "getRawOne", "getRawMany", "stream"]
86107
}

‎javascript/ql/test/library-tests/frameworks/SQL/SqlString.expected‎

Lines changed: 7 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -70,8 +70,12 @@
7070
| spanner.js:26:12:26:38 | 'UPDATE ... = @baz' |
7171
| spanner.js:31:18:31:24 | queries |
7272
| spannerImport.js:4:8:4:17 | "SQL code" |
73+
| sqlite3.js:7:8:7:45 | "UPDATE ... id = ?" |
74+
| sqlite3.js:8:8:8:45 | "UPDATE ... id = ?" |
7375
| sqlite-types.ts:4:12:4:49 | "UPDATE ... id = ?" |
74-
| sqlite.js:7:8:7:45 | "UPDATE ... id = ?" |
75-
| sqlite.js:8:8:8:45 | "UPDATE ... id = ?" |
76+
| sqlite.js:9:10:9:65 | 'SELECT ... id = 1" |
77+
| sqlite.js:12:10:12:65 | 'SELECT ... id = 1" |
78+
| sqlite.js:15:10:15:74 | 'INSERT ... ',100)' |
79+
| sqlite.js:18:14:19:18 | 'SELECT ... id = 1" |
80+
| sqlite.js:25:19:25:74 | 'SELECT ... id = 1" |
7681
| sqliteArray.js:6:12:6:49 | "UPDATE ... id = ?" |
77-
| sqliteImport.js:2:8:2:44 | "UPDATE ... id = ?" |

‎javascript/ql/test/library-tests/frameworks/SQL/sqlite.js‎

Lines changed: 32 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -1,10 +1,34 @@
1-
// Adapted from https://github.com/mapbox/node-sqlite3/wiki/API, which is
2-
// part of the node-sqlite3 project, which is licensed under the BSD 3-Clause
3-
// License; see file node-sqlite3-LICENSE.
4-
var sqlite = require('sqlite3');
1+
import sqlite3 from 'sqlite3'
2+
import { open } from 'sqlite'
3+
4+
const unsafe = "unsafe"
5+
open({
6+
filename: 'database.sqlite',
7+
driver: sqlite3.Database
8+
}).then(async (db) => {
9+
db.get('SELECT name,id FROM table1 WHERE id > 5' + " OR id = 1").then(results => {
10+
console.log(results)
11+
})
12+
db.all('SELECT name,id FROM table1 WHERE id > 5' + " OR id = 1").then(results => {
13+
console.log(results)
14+
})
15+
db.run('INSERT INTO table1 (name,id) VALUES (' + `"${unsafe}"` + ',100)').then(results => {
16+
console.log(results)
17+
})
18+
db.prepare('SELECT name,id FROM table1 WHERE id > 5'
19+
+ " OR id = 1").then(results => {
20+
results.all().then(result => {
21+
console.log(result)
22+
})
23+
})
24+
try {
25+
await db.each('SELECT name,id FROM table1 WHERE id > 5' + " OR id = 1", (err, row) => {
26+
console.log(row)
27+
})
28+
29+
} catch (e) {
30+
throw e
31+
}
32+
})
533

6-
var db = new sqlite.Database(":memory:");
7-
db.run("UPDATE tbl SET name = ? WHERE id = ?", "bar", 2)
8-
.run("UPDATE tbl SET name = ? WHERE id = ?", "foo", 3);
934

10-
exports.db = db;

‎javascript/ql/test/library-tests/frameworks/SQL/sqlite3.js‎

Lines changed: 10 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,10 @@
1+
// Adapted from https://github.com/mapbox/node-sqlite3/wiki/API, which is
2+
// part of the node-sqlite3 project, which is licensed under the BSD 3-Clause
3+
// License; see file node-sqlite3-LICENSE.
4+
var sqlite = require('sqlite3');
5+
6+
var db = new sqlite.Database(":memory:");
7+
db.run("UPDATE tbl SET name = ? WHERE id = ?", "bar", 2)
8+
.run("UPDATE tbl SET name = ? WHERE id = ?", "foo", 3);
9+
10+
exports.db = db;

‎javascript/ql/test/library-tests/frameworks/TypeOrm/SqlString.expected‎

Lines changed: 43 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,43 @@
1+
| test.ts:70:17:70:27 | "user.name" |
2+
| test.ts:71:16:71:46 | "user.r ... stered" |
3+
| test.ts:80:29:80:46 | "Vulnerable \\")--" |
4+
| test.ts:85:13:85:57 | ["first ... --\\" "] |
5+
| test.ts:86:13:86:37 | ["exter ... ")-- "] |
6+
| test.ts:93:33:93:50 | "Vulnerable \\")--" |
7+
| test.ts:94:16:94:49 | "user2. ... OR 1=1" |
8+
| test.ts:100:15:100:19 | User2 |
9+
| test.ts:101:16:101:30 | "id = 1 OR 1=1" |
10+
| test.ts:107:53:107:73 | "select ... USER2" |
11+
| test.ts:112:17:112:19 | "*" |
12+
| test.ts:113:16:113:28 | "user.id >=3" |
13+
| test.ts:121:47:121:68 | "User.i ... OR 1=1" |
14+
| test.ts:127:66:127:87 | "User.i ... OR 1=1" |
15+
| test.ts:134:16:142:9 | (qb) => ... } |
16+
| test.ts:137:25:137:41 | "User2.firstName" |
17+
| test.ts:138:23:138:27 | User2 |
18+
| test.ts:139:24:139:47 | "user2. ... stered" |
19+
| test.ts:150:93:150:109 | "User2.id =:kind" |
20+
| test.ts:152:92:152:120 | "User2. ... OR 1=1" |
21+
| test.ts:159:17:159:23 | "User2" |
22+
| test.ts:160:15:160:19 | User2 |
23+
| test.ts:161:16:161:31 | "User2.id = :id" |
24+
| test.ts:167:51:167:79 | "User2. ... OR 1=1" |
25+
| test.ts:171:53:171:62 | "User2.id" |
26+
| test.ts:171:72:171:101 | "User2. ... stName" |
27+
| test.ts:176:52:176:81 | "photo. ... emoved" |
28+
| test.ts:182:53:182:62 | "User2.id" |
29+
| test.ts:182:72:182:101 | "User2. ... stName" |
30+
| test.ts:188:51:188:80 | "User2. ... stName" |
31+
| test.ts:192:13:196:14 | new Bra ... }) |
32+
| test.ts:193:26:193:55 | "User2. ... stName" |
33+
| test.ts:195:28:195:73 | "User2. ... R (1=1" |
34+
| test.ts:198:18:198:27 | "User2.id" |
35+
| test.ts:198:38:198:43 | "id=1" |
36+
| test.ts:204:25:204:29 | "1=1" |
37+
| test.ts:210:16:210:32 | "User2.id =:kind" |
38+
| test.ts:212:13:216:14 | new Bra ... }) |
39+
| test.ts:213:26:213:55 | "User2. ... stName" |
40+
| test.ts:215:28:215:73 | "User2. ... R (1=1" |
41+
| test.ts:218:13:222:14 | new Not ... }) |
42+
| test.ts:219:26:219:55 | "User2. ... stName" |
43+
| test.ts:221:28:221:55 | "User2. ... stName" |

‎javascript/ql/test/library-tests/frameworks/TypeOrm/SqlString.ql‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,3 @@
1+
import javascript
2+
3+
select any(SQL::SqlString s)

0 commit comments

Comments
 (0)