Skip to content

Commit cfd567f

Browse files
esbenaesbena
committed
JS: fix FP for js/unsafe-jquery-plugin
1 parent 9e24792 commit cfd567f

3 files changed

Lines changed: 7 additions & 27 deletions

File tree

‎javascript/ql/src/semmle/javascript/security/dataflow/UnsafeJQueryPlugin.qll‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -35,7 +35,7 @@ module UnsafeJQueryPlugin {
3535
override predicate isSanitizerGuard(TaintTracking::SanitizerGuardNode node) {
3636
super.isSanitizerGuard(node) or
3737
node instanceof IsElementSanitizer or
38-
node instanceof IsJQueryObjectSanitizer
38+
node instanceof PropertyPrecenseSanitizer
3939
}
4040
}
4141
}

‎javascript/ql/src/semmle/javascript/security/dataflow/UnsafeJQueryPluginCustomizations.qll‎

Lines changed: 6 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -171,14 +171,16 @@ module UnsafeJQueryPlugin {
171171
}
172172

173173
/**
174-
* Expression of form `typeof x.jquery !== "undefined"` or `x.jquery`, which sanitizes `x`.
174+
* Expression of like `typeof x.<?> !== "undefined"` or `x.<?>`, which sanitizes `x`, as it is unlikely to be a string afterwards.
175175
*/
176-
class IsJQueryObjectSanitizer extends TaintTracking::SanitizerGuardNode, DataFlow::ValueNode {
176+
class PropertyPrecenseSanitizer extends TaintTracking::SanitizerGuardNode, DataFlow::ValueNode {
177177
DataFlow::Node input;
178178
boolean polarity;
179179

180-
IsJQueryObjectSanitizer() {
181-
exists(DataFlow::PropRead read | read.accesses(input, "jquery") |
180+
PropertyPrecenseSanitizer() {
181+
exists(DataFlow::PropRead read, string name |
182+
not name = "length" and read.accesses(input, name)
183+
|
182184
exists(EqualityTest test |
183185
polarity = test.getPolarity().booleanNot() and
184186
this = test.flow()

‎javascript/ql/test/query-tests/Security/CWE-079/UnsafeJQueryPlugin.expected‎

Lines changed: 0 additions & 22 deletions
Original file line numberDiff line numberDiff line change
@@ -23,14 +23,6 @@ nodes
2323
| unsafe-jquery-plugin.js:52:6:52:11 | target |
2424
| unsafe-jquery-plugin.js:60:6:60:11 | target |
2525
| unsafe-jquery-plugin.js:60:6:60:11 | target |
26-
| unsafe-jquery-plugin.js:65:47:65:53 | options |
27-
| unsafe-jquery-plugin.js:65:47:65:53 | options |
28-
| unsafe-jquery-plugin.js:67:24:67:44 | $.exten ... ptions) |
29-
| unsafe-jquery-plugin.js:67:33:67:34 | {} |
30-
| unsafe-jquery-plugin.js:67:37:67:43 | options |
31-
| unsafe-jquery-plugin.js:68:45:68:56 | this.options |
32-
| unsafe-jquery-plugin.js:68:45:68:63 | this.options.parent |
33-
| unsafe-jquery-plugin.js:68:45:68:63 | this.options.parent |
3426
| unsafe-jquery-plugin.js:71:38:71:44 | options |
3527
| unsafe-jquery-plugin.js:71:38:71:44 | options |
3628
| unsafe-jquery-plugin.js:72:5:72:11 | options |
@@ -129,8 +121,6 @@ nodes
129121
| unsafe-jquery-plugin.js:165:7:165:29 | target |
130122
| unsafe-jquery-plugin.js:165:16:165:22 | options |
131123
| unsafe-jquery-plugin.js:165:16:165:29 | options.target |
132-
| unsafe-jquery-plugin.js:167:6:167:11 | target |
133-
| unsafe-jquery-plugin.js:167:6:167:11 | target |
134124
| unsafe-jquery-plugin.js:170:6:170:11 | target |
135125
| unsafe-jquery-plugin.js:170:6:170:11 | target |
136126
edges
@@ -160,14 +150,6 @@ edges
160150
| unsafe-jquery-plugin.js:11:7:11:29 | target | unsafe-jquery-plugin.js:60:6:60:11 | target |
161151
| unsafe-jquery-plugin.js:11:16:11:22 | options | unsafe-jquery-plugin.js:11:16:11:29 | options.target |
162152
| unsafe-jquery-plugin.js:11:16:11:29 | options.target | unsafe-jquery-plugin.js:11:7:11:29 | target |
163-
| unsafe-jquery-plugin.js:65:47:65:53 | options | unsafe-jquery-plugin.js:67:37:67:43 | options |
164-
| unsafe-jquery-plugin.js:65:47:65:53 | options | unsafe-jquery-plugin.js:67:37:67:43 | options |
165-
| unsafe-jquery-plugin.js:67:24:67:44 | $.exten ... ptions) | unsafe-jquery-plugin.js:68:45:68:56 | this.options |
166-
| unsafe-jquery-plugin.js:67:33:67:34 | {} | unsafe-jquery-plugin.js:67:24:67:44 | $.exten ... ptions) |
167-
| unsafe-jquery-plugin.js:67:37:67:43 | options | unsafe-jquery-plugin.js:67:24:67:44 | $.exten ... ptions) |
168-
| unsafe-jquery-plugin.js:67:37:67:43 | options | unsafe-jquery-plugin.js:67:33:67:34 | {} |
169-
| unsafe-jquery-plugin.js:68:45:68:56 | this.options | unsafe-jquery-plugin.js:68:45:68:63 | this.options.parent |
170-
| unsafe-jquery-plugin.js:68:45:68:56 | this.options | unsafe-jquery-plugin.js:68:45:68:63 | this.options.parent |
171153
| unsafe-jquery-plugin.js:71:38:71:44 | options | unsafe-jquery-plugin.js:72:5:72:11 | options |
172154
| unsafe-jquery-plugin.js:71:38:71:44 | options | unsafe-jquery-plugin.js:72:5:72:11 | options |
173155
| unsafe-jquery-plugin.js:72:5:72:11 | options | unsafe-jquery-plugin.js:72:5:72:15 | options.foo |
@@ -260,8 +242,6 @@ edges
260242
| unsafe-jquery-plugin.js:163:40:163:46 | options | unsafe-jquery-plugin.js:163:40:163:53 | options.target |
261243
| unsafe-jquery-plugin.js:163:40:163:53 | options.target | unsafe-jquery-plugin.js:163:5:163:54 | somethi ... target) |
262244
| unsafe-jquery-plugin.js:163:40:163:53 | options.target | unsafe-jquery-plugin.js:163:5:163:54 | somethi ... target) |
263-
| unsafe-jquery-plugin.js:165:7:165:29 | target | unsafe-jquery-plugin.js:167:6:167:11 | target |
264-
| unsafe-jquery-plugin.js:165:7:165:29 | target | unsafe-jquery-plugin.js:167:6:167:11 | target |
265245
| unsafe-jquery-plugin.js:165:7:165:29 | target | unsafe-jquery-plugin.js:170:6:170:11 | target |
266246
| unsafe-jquery-plugin.js:165:7:165:29 | target | unsafe-jquery-plugin.js:170:6:170:11 | target |
267247
| unsafe-jquery-plugin.js:165:16:165:22 | options | unsafe-jquery-plugin.js:165:16:165:29 | options.target |
@@ -276,7 +256,6 @@ edges
276256
| unsafe-jquery-plugin.js:48:6:48:11 | target | unsafe-jquery-plugin.js:2:38:2:44 | options | unsafe-jquery-plugin.js:48:6:48:11 | target | Potential XSS vulnerability in the $@. | unsafe-jquery-plugin.js:2:19:63:2 | functio ... \\t\\t}\\n\\n\\t} | '$.fn.my_plugin' plugin |
277257
| unsafe-jquery-plugin.js:52:6:52:11 | target | unsafe-jquery-plugin.js:2:38:2:44 | options | unsafe-jquery-plugin.js:52:6:52:11 | target | Potential XSS vulnerability in the $@. | unsafe-jquery-plugin.js:2:19:63:2 | functio ... \\t\\t}\\n\\n\\t} | '$.fn.my_plugin' plugin |
278258
| unsafe-jquery-plugin.js:60:6:60:11 | target | unsafe-jquery-plugin.js:2:38:2:44 | options | unsafe-jquery-plugin.js:60:6:60:11 | target | Potential XSS vulnerability in the $@. | unsafe-jquery-plugin.js:2:19:63:2 | functio ... \\t\\t}\\n\\n\\t} | '$.fn.my_plugin' plugin |
279-
| unsafe-jquery-plugin.js:68:45:68:63 | this.options.parent | unsafe-jquery-plugin.js:65:47:65:53 | options | unsafe-jquery-plugin.js:68:45:68:63 | this.options.parent | Potential XSS vulnerability in the $@. | unsafe-jquery-plugin.js:65:19:69:2 | functio ... T OK\\n\\t} | '$.fn.my_plugin' plugin |
280259
| unsafe-jquery-plugin.js:72:5:72:23 | options.foo.bar.baz | unsafe-jquery-plugin.js:71:38:71:44 | options | unsafe-jquery-plugin.js:72:5:72:23 | options.foo.bar.baz | Potential XSS vulnerability in the $@. | unsafe-jquery-plugin.js:71:19:74:2 | functio ... / OK\\n\\t} | '$.fn.my_plugin' plugin |
281260
| unsafe-jquery-plugin.js:77:17:77:35 | options.foo.bar.baz | unsafe-jquery-plugin.js:76:38:76:44 | options | unsafe-jquery-plugin.js:77:17:77:35 | options.foo.bar.baz | Potential XSS vulnerability in the $@. | unsafe-jquery-plugin.js:76:19:78:2 | functio ... T OK\\n\\t} | '$.fn.my_plugin' plugin |
282261
| unsafe-jquery-plugin.js:90:6:90:6 | t | unsafe-jquery-plugin.js:84:38:84:44 | options | unsafe-jquery-plugin.js:90:6:90:6 | t | Potential XSS vulnerability in the $@. | unsafe-jquery-plugin.js:84:19:93:2 | functio ... ns);\\n\\t} | '$.fn.my_plugin' plugin |
@@ -291,5 +270,4 @@ edges
291270
| unsafe-jquery-plugin.js:157:44:157:59 | options.target.a | unsafe-jquery-plugin.js:153:38:153:44 | options | unsafe-jquery-plugin.js:157:44:157:59 | options.target.a | Potential XSS vulnerability in the $@. | unsafe-jquery-plugin.js:153:19:158:2 | functio ... gged\\n\\t} | '$.fn.my_plugin' plugin |
292271
| unsafe-jquery-plugin.js:161:5:161:30 | anyPref ... .target | unsafe-jquery-plugin.js:160:38:160:44 | options | unsafe-jquery-plugin.js:161:5:161:30 | anyPref ... .target | Potential XSS vulnerability in the $@. | unsafe-jquery-plugin.js:160:19:173:2 | functio ... \\t\\t}\\n\\n\\t} | '$.fn.my_plugin' plugin |
293272
| unsafe-jquery-plugin.js:163:5:163:54 | somethi ... target) | unsafe-jquery-plugin.js:160:38:160:44 | options | unsafe-jquery-plugin.js:163:5:163:54 | somethi ... target) | Potential XSS vulnerability in the $@. | unsafe-jquery-plugin.js:160:19:173:2 | functio ... \\t\\t}\\n\\n\\t} | '$.fn.my_plugin' plugin |
294-
| unsafe-jquery-plugin.js:167:6:167:11 | target | unsafe-jquery-plugin.js:160:38:160:44 | options | unsafe-jquery-plugin.js:167:6:167:11 | target | Potential XSS vulnerability in the $@. | unsafe-jquery-plugin.js:160:19:173:2 | functio ... \\t\\t}\\n\\n\\t} | '$.fn.my_plugin' plugin |
295273
| unsafe-jquery-plugin.js:170:6:170:11 | target | unsafe-jquery-plugin.js:160:38:160:44 | options | unsafe-jquery-plugin.js:170:6:170:11 | target | Potential XSS vulnerability in the $@. | unsafe-jquery-plugin.js:160:19:173:2 | functio ... \\t\\t}\\n\\n\\t} | '$.fn.my_plugin' plugin |

0 commit comments

Comments
 (0)