hohn/codeql
1
0
Fork 0
mirror of https://github.com/github/codeql.git synced 2026-04-28 10:15:14 +02:00
Code Issues Packages Projects Releases Wiki Activity

Merge pull request #7139 from erik-krogh/gotGet

Browse Source 
JS: improve the got model
This commit is contained in:
Erik Krogh Kristensen
2021-11-15 22:42:03 +01:00
committed by GitHub
parent f01b9005b1 12c24c07df
commit 1a98079100
3 changed files with 35 additions and 8 deletions
Download Patch File Download Diff File Expand all files Collapse all files

9
javascript/ql/lib/semmle/javascript/frameworks/ClientRequests.qll
View File

@@ -406,12 +406,9 @@ module ClientRequest {
*/
class GotUrlRequest extends ClientRequest::Range {
GotUrlRequest() {
exists(string moduleName, DataFlow::SourceNode callee | this = callee.getACall() |
moduleName = "got" and
(
callee = DataFlow::moduleImport(moduleName) or
callee = DataFlow::moduleMember(moduleName, "stream")
)
exists(API::Node callee, API::Node got | this = callee.getACall() |
got = [API::moduleImport("got"), API::moduleImport("got").getMember("extend").getReturn()] and
callee = [got, got.getMember(["stream", "get", "post", "put", "patch", "head", "delete"])]
)
}

22
javascript/ql/test/query-tests/Security/CWE-079/DomBasedXss/XssWithAdditionalSources.expected
View File

@@ -825,6 +825,17 @@ nodes
| xmlRequest.js:9:28:9:31 | json |
| xmlRequest.js:9:28:9:39 | json.message |
| xmlRequest.js:9:28:9:39 | json.message |
| xmlRequest.js:20:11:20:48 | resp |
| xmlRequest.js:20:18:20:48 | await g ... rl }}") |
| xmlRequest.js:20:24:20:48 | got.get ... rl }}") |
| xmlRequest.js:20:24:20:48 | got.get ... rl }}") |
| xmlRequest.js:21:11:21:38 | json |
| xmlRequest.js:21:18:21:38 | JSON.pa ... p.body) |
| xmlRequest.js:21:29:21:32 | resp |
| xmlRequest.js:21:29:21:37 | resp.body |
| xmlRequest.js:22:24:22:27 | json |
| xmlRequest.js:22:24:22:35 | json.message |
| xmlRequest.js:22:24:22:35 | json.message |
edges
| addEventListener.js:1:43:1:47 | event | addEventListener.js:2:20:2:24 | event |
| addEventListener.js:1:43:1:47 | event | addEventListener.js:2:20:2:24 | event |
@@ -1545,7 +1556,18 @@ edges
| xmlRequest.js:8:31:8:46 | xhr.responseText | xmlRequest.js:8:20:8:47 | JSON.pa ... seText) |
| xmlRequest.js:9:28:9:31 | json | xmlRequest.js:9:28:9:39 | json.message |
| xmlRequest.js:9:28:9:31 | json | xmlRequest.js:9:28:9:39 | json.message |
| xmlRequest.js:20:11:20:48 | resp | xmlRequest.js:21:29:21:32 | resp |
| xmlRequest.js:20:18:20:48 | await g ... rl }}") | xmlRequest.js:20:11:20:48 | resp |
| xmlRequest.js:20:24:20:48 | got.get ... rl }}") | xmlRequest.js:20:18:20:48 | await g ... rl }}") |
| xmlRequest.js:20:24:20:48 | got.get ... rl }}") | xmlRequest.js:20:18:20:48 | await g ... rl }}") |
| xmlRequest.js:21:11:21:38 | json | xmlRequest.js:22:24:22:27 | json |
| xmlRequest.js:21:18:21:38 | JSON.pa ... p.body) | xmlRequest.js:21:11:21:38 | json |
| xmlRequest.js:21:29:21:32 | resp | xmlRequest.js:21:29:21:37 | resp.body |
| xmlRequest.js:21:29:21:37 | resp.body | xmlRequest.js:21:18:21:38 | JSON.pa ... p.body) |
| xmlRequest.js:22:24:22:27 | json | xmlRequest.js:22:24:22:35 | json.message |
| xmlRequest.js:22:24:22:27 | json | xmlRequest.js:22:24:22:35 | json.message |
#select
| jwt.js:6:14:6:20 | decoded | jwt.js:4:36:4:39 | data | jwt.js:6:14:6:20 | decoded | Cross-site scripting vulnerability due to $@. | jwt.js:4:36:4:39 | data | user-provided value |
| typeahead.js:10:16:10:18 | loc | typeahead.js:9:28:9:30 | loc | typeahead.js:10:16:10:18 | loc | Cross-site scripting vulnerability due to $@. | typeahead.js:9:28:9:30 | loc | user-provided value |
| xmlRequest.js:9:28:9:39 | json.message | xmlRequest.js:8:31:8:46 | xhr.responseText | xmlRequest.js:9:28:9:39 | json.message | Cross-site scripting vulnerability due to $@. | xmlRequest.js:8:31:8:46 | xhr.responseText | user-provided value |
| xmlRequest.js:22:24:22:35 | json.message | xmlRequest.js:20:24:20:48 | got.get ... rl }}") | xmlRequest.js:22:24:22:35 | json.message | Cross-site scripting vulnerability due to $@. | xmlRequest.js:20:24:20:48 | got.get ... rl }}") | user-provided value |

12
javascript/ql/test/query-tests/Security/CWE-079/DomBasedXss/xmlRequest.js
View File

@@ -6,11 +6,19 @@ $(document).ready(function () {
xhr.onreadystatechange = function () {
if (xhr.readyState !== 4) { return }
var json = JSON.parse(xhr.responseText)
$("#myThing").html(json.message);
$("#myThing").html(json.message); // caught with additional sources
}
try {
xhr.send()
} catch (error) {
console.log(error)
}
})
});
$(document).ready(async function () {
const got = require('got');
const resp = await got.get("{{ some_url }}");
const json = JSON.parse(resp.body);
$("#myThing").html(json.message); // caught with additional sources
});