hohn/codeql-javascript-multiflow
1
0
Fork 0
mirror of https://github.com/hohn/codeql-javascript-multiflow.git synced 2025-12-16 12:03:03 +01:00
Code Issues Packages Projects Releases Wiki Activity

Add flow config from 'new db()' to 'db.exec()'

Browse Source
This commit is contained in:
Michael Hohn
2023-11-26 14:06:44 -08:00
committed by =Michael Hohn
parent 247b71294a
commit 18b8c9e98c
6 changed files with 196 additions and 25 deletions
Download Patch File Download Diff File Expand all files Collapse all files

57
session/session.ql
View File

@@ -1,43 +1,52 @@
/**
* @kind path-problem
*/
import javascript
import DataFlow::PathGraph
// Ultimate source
// ----------------
// var line = stdinBuffer.toString();
predicate uSource(MethodCallExpr sbts) {
// sbts.getReceiver().(DotExpr).getPropertyNameExpr().(Identifier).getName() = "toString"
sbts.getMethodName().matches("%toString%")
}
predicate uSource(MethodCallExpr sbts) { sbts.getMethodName().matches("%toString%") }
// Ultimate sink
// ----------------
// db.exec(query);
predicate uSink(MethodCallExpr dbe) {
// sbts.getReceiver().(DotExpr).getPropertyNameExpr().(Identifier).getName() = "toString"
dbe.getMethodName().matches("%exec%")
}
predicate uSink(MethodCallExpr dbe) { dbe.getMethodName().matches("%exec%") }
// Intermediate flow sink
// Flow sink origin
// ------------------------
// Connect
// const db = new sqlite3.Database(
// to its use
// db.exec(query);
//
// class IntermediateSink extends DataFlow::Configuration {
// IntermediateSink() { this = "IntermediateSink" }
//
class FlowSinkOrigin extends DataFlow::FlowLabel {
FlowSinkOrigin() { this = "FlowSinkOrigin" }
}
// override predicate isSource(DataFlow::Node nd) {
// exists(JsonParserCall jpc | nd = jpc.getOutput())
// }
class IdentifyFlowSink extends DataFlow::Configuration {
IdentifyFlowSink() { this = "IdentifyFlowSink" }
// override predicate isSink(DataFlow::Node nd) { exists(DataFlow::PropRef pr | nd = pr.getBase()) }
// }
override predicate isSource(DataFlow::Node nd, DataFlow::FlowLabel lbl) {
// const db = new sqlite3.Database(
exists(NewExpr newdb |
newdb.getCalleeName() = "Database" and
nd.asExpr() = newdb
)
}
// from IntermediateSink cfg, DataFlow::Node source, DataFlow::Node sink
// where cfg.hasFlow(source, sink)
// select sink, "Property access on JSON value originating $@.", source, "here"
override predicate isSink(DataFlow::Node nd, DataFlow::FlowLabel lbl) {
// db.exec(query);
exists(Expr db, MethodCallExpr exec |
exec.getMethodName() = "exec" and
db = exec.getReceiver() and
nd.asExpr() = db
)
}
}
from MethodCallExpr sbts
where uSource(sbts)
select sbts
from IdentifyFlowSink cfg, DataFlow::PathNode source, DataFlow::PathNode sink
where cfg.hasFlowPath(source, sink)
select sink, source, sink, "Database originating $@", source, "here"