hohn/codeql
1
0
Fork 0
mirror of https://github.com/github/codeql.git synced 2026-04-27 17:55:19 +02:00
Code Issues Packages Projects Releases Wiki Activity

model serve-handler in js/exposure-of-private-files

Browse Source
This commit is contained in:
Erik Krogh Kristensen
2021-06-06 23:50:35 +02:00
parent e276e2684e
commit 1ad08677c2
4 changed files with 38 additions and 5 deletions
Download Patch File Download Diff File Expand all files Collapse all files

27
javascript/ql/src/Security/CWE-200/PrivateFileExposure.ql
View File

@@ -126,8 +126,27 @@ DataFlow::CallNode servesAPrivateFolder(string description) {
result.getArgument(0) = getAPrivateFolderPath(description)
}
from Express::RouteSetup setup, string path
/**
* Gets an [`express`](https://npmjs.com/package/express) route-setup
* that exposes a private folder described by `path`.
*/
Express::RouteSetup getAnExposingExpressSetup(string path) {
result.isUseCall() and
result.getArgument([0 .. 1]) = servesAPrivateFolder(path).getEnclosingExpr()
}
/**
* Gets a call to [`serve-handler`](https://npmjs.com/package/serve-handler)
* that exposes a private folder described by `path`.
*/
DataFlow::CallNode getAnExposingServeSetup(string path) {
result = DataFlow::moduleImport("serve-handler").getACall() and
result.getOptionArgument(2, "public") = getAPrivateFolderPath(path)
}
from DataFlow::Node node, string path
where
setup.isUseCall() and
setup.getArgument([0 .. 1]) = servesAPrivateFolder(path).getEnclosingExpr()
select setup, "Serves " + path + ", which can contain private information."
node = getAnExposingExpressSetup(path).flow()
or
node = getAnExposingServeSetup(path)
select node, "Serves " + path + ", which can contain private information."