hohn/codeql
1
0
Fork 0
mirror of https://github.com/github/codeql.git synced 2026-04-30 11:15:13 +02:00
Code Issues Packages Projects Releases Wiki Activity

JavaScript: Add WebView-related taint sinks for CodeInjection, DomBasedXss and ServerSideUrlRedirect.

Browse Source
This commit is contained in:
Max Schaefer
2018-08-10 13:11:42 +01:00
parent 3ce82aff02
commit 199990feea
10 changed files with 74 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

1
javascript/ql/src/javascript.qll
View File

@@ -62,6 +62,7 @@ import semmle.javascript.frameworks.HttpFrameworks
import semmle.javascript.frameworks.NoSQL
import semmle.javascript.frameworks.PkgCloud
import semmle.javascript.frameworks.React
import semmle.javascript.frameworks.ReactNative
import semmle.javascript.frameworks.Request
import semmle.javascript.frameworks.SQL
import semmle.javascript.frameworks.UriLibraries

15
javascript/ql/src/semmle/javascript/security/dataflow/CodeInjection.qll
View File

@@ -115,6 +115,21 @@ module CodeInjection {
)
}
}
/**
* An expression which is injected as JavaScript into a React Native `WebView`.
*/
class WebViewInjectedJavaScriptSink extends Sink {
WebViewInjectedJavaScriptSink() {
exists (ReactNative::WebViewElement webView |
// `injectedJavaScript` property of React Native `WebView`
this = webView.getAPropertyWrite("injectedJavaScript").getRhs()
or
// argument to `injectJavascript` method of React Native `WebView`
this = webView.getAMethodCall("injectJavaScript").getArgument(0)
)
}
}
}
/** DEPRECATED: Use `CodeInjection::Source` instead. */

7
javascript/ql/src/semmle/javascript/security/dataflow/DomBasedXss.qll
View File

@@ -117,6 +117,13 @@ module DomBasedXss {
pw.interpretsValueAsHTML() and
this = DataFlow::valueNode(pw.getRhs())
)
or
// `html` or `source.html` properties of React Native `WebView`
exists (ReactNative::WebViewElement webView, DataFlow::SourceNode source |
source = webView or
source = webView.getAPropertyWrite("source").getRhs().getALocalSource() |
this = source.getAPropertyWrite("html").getRhs()
)
}
}

14
javascript/ql/src/semmle/javascript/security/dataflow/ServerSideUrlRedirect.qll
View File

@@ -140,6 +140,20 @@ module ServerSideUrlRedirect {
outcome = true
}
}
/**
* A URL attribute for a React Native `WebView`.
*/
class WebViewUrlSink extends Sink {
WebViewUrlSink() {
// `url` or `source.uri` properties of React Native `WebView`
exists (ReactNative::WebViewElement webView, DataFlow::SourceNode source, string prop |
source = webView and prop = "url" or
source = webView.getAPropertyWrite("source").getRhs().getALocalSource() and prop = "uri" |
this = source.getAPropertyWrite(prop).getRhs()
)
}
}
}
/** DEPRECATED: Use `ServerSideUrlRedirect::Source` instead. */