hohn/codeql
1
0
Fork 0
mirror of https://github.com/github/codeql.git synced 2026-04-27 17:55:19 +02:00
Code Issues Packages Projects Releases Wiki Activity

JS: Actually don't propagate into array element 0

Browse Source 
Preserving tainted-url-suffix into array element 0 seemed like a good idea, but didn't work out so well.
This commit is contained in:
Asger F
2024-09-12 13:16:52 +02:00
parent 0e4e0f4fdd
commit 1df69ec1d2
5 changed files with 34 additions and 216 deletions
Download Patch File Download Diff File Expand all files Collapse all files

12
javascript/ql/lib/semmle/javascript/security/TaintedUrlSuffix.qll
View File

@@ -53,14 +53,18 @@ module TaintedUrlSuffix {
* This handles steps through string operations, promises, URL parsers, and URL accessors.
*/
predicate step(Node src, Node dst, FlowLabel srclbl, FlowLabel dstlbl) {
// Transition from tainted-url-suffix to general taint when entering the second array element
// of a split('#') or split('?') array.
//
// x [tainted-url-suffix] --> x.split('#') [array element 1] [taint]
//
// Technically we should also preverse tainted-url-suffix when entering the first array element of such
// a split, but this mostly leads to FPs since we currently don't track if the taint has been through URI-decoding.
// (The query/fragment parts are often URI-decoded in practice, but not the other URL parts are not)
srclbl = label() and
dstlbl.isTaint() and
DataFlowPrivate::optionalStep(src, "split-url-suffix-post", dst)
or
srclbl = label() and
dstlbl = label() and
DataFlowPrivate::optionalStep(src, "split-url-suffix-pre", dst)
or
// Transition from URL suffix to full taint when extracting the query/fragment part.
srclbl = label() and
dstlbl.isTaint() and