hohn/codeql
1
0
Fork 0
mirror of https://github.com/github/codeql.git synced 2026-04-27 01:35:13 +02:00
Code Issues Packages Projects Releases Wiki Activity

JS: Migrate DeepObjectResourceExhaustion

Browse Source
This commit is contained in:
Asger F
2024-12-11 15:15:02 +01:00
parent 5f42a715f6
commit 15d999a9dc
2 changed files with 18 additions and 13 deletions
Download Patch File Download Diff File Expand all files Collapse all files

13
javascript/ql/lib/semmle/javascript/security/dataflow/DeepObjectResourceExhaustionCustomizations.qll
View File

@@ -11,21 +11,26 @@ private import semmle.javascript.security.TaintedObjectCustomizations
* DoS attacks due to inefficient handling of user-controlled objects.
*/
module DeepObjectResourceExhaustion {
import semmle.javascript.security.CommonFlowState
/**
* A data flow source for inefficient handling of user-controlled objects.
*/
abstract class Source extends DataFlow::Node {
/** Gets a flow label to associate with this source. */
DataFlow::FlowLabel getAFlowLabel() { result = TaintedObject::label() }
/** Gets a flow state to associate with this source. */
FlowState getAFlowState() { result.isTaintedObject() }
/** DEPRECATED. Use `getAFlowState()` instead. */
deprecated DataFlow::FlowLabel getAFlowLabel() { result = this.getAFlowState().toFlowLabel() }
}
private class TaintedObjectSourceAsSource extends Source instanceof TaintedObject::Source {
override DataFlow::FlowLabel getAFlowLabel() { result = TaintedObject::label() }
override FlowState getAFlowState() { result.isTaintedObject() }
}
/** An active threat-model source, considered as a flow source. */
private class ActiveThreatModelSourceAsSource extends Source, ActiveThreatModelSource {
override DataFlow::FlowLabel getAFlowLabel() { result.isTaint() }
override FlowState getAFlowState() { result.isTaint() }
}
/**

18
javascript/ql/lib/semmle/javascript/security/dataflow/DeepObjectResourceExhaustionQuery.qll
View File

@@ -12,26 +12,26 @@ import DeepObjectResourceExhaustionCustomizations::DeepObjectResourceExhaustion
* of user-controlled objects.
*/
module DeepObjectResourceExhaustionConfig implements DataFlow::StateConfigSig {
class FlowState = DataFlow::FlowLabel;
import semmle.javascript.security.CommonFlowState
predicate isSource(DataFlow::Node source, DataFlow::FlowLabel label) {
source.(Source).getAFlowLabel() = label
predicate isSource(DataFlow::Node source, FlowState state) {
source.(Source).getAFlowState() = state
}
predicate isSink(DataFlow::Node sink, DataFlow::FlowLabel label) {
sink instanceof Sink and label = TaintedObject::label()
predicate isSink(DataFlow::Node sink, FlowState state) {
sink instanceof Sink and state.isTaintedObject()
}
predicate isBarrier(DataFlow::Node node, DataFlow::FlowLabel label) {
node = TaintedObject::SanitizerGuard::getABarrierNode(label)
predicate isBarrier(DataFlow::Node node, FlowState state) {
node = TaintedObject::SanitizerGuard::getABarrierNode(state)
}
predicate isBarrier(DataFlow::Node node) { node instanceof Sanitizer }
predicate isAdditionalFlowStep(
DataFlow::Node src, DataFlow::FlowLabel inlbl, DataFlow::Node trg, DataFlow::FlowLabel outlbl
DataFlow::Node node1, FlowState state1, DataFlow::Node node2, FlowState state2
) {
TaintedObject::step(src, trg, inlbl, outlbl)
TaintedObject::isAdditionalFlowStep(node1, state1, node2, state2)
}
}