hohn/codeql
1
0
Fork 0
mirror of https://github.com/github/codeql.git synced 2025-12-18 01:33:15 +01:00
Code Issues Packages Projects Releases Wiki Activity

add xss sink for react-tooltip

Browse Source
This commit is contained in:
Erik Krogh Kristensen
2021-07-14 20:03:50 +02:00
parent fb57c5f6f0
commit 22dfe84ee8
5 changed files with 60 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

14
javascript/ql/src/semmle/javascript/security/dataflow/Xss.qll
View File

@@ -318,6 +318,20 @@ module DomBasedXss {
}
}
/**
* A React tooltip where the `data-html` attribute is set to `true`.
*/
class TooltipSink extends Sink {
TooltipSink() {
exists(JSXElement el |
el.getAttributeByName("data-html").getStringValue() = "true" or
el.getAttributeByName("data-html").getValue().mayHaveBooleanValue(true)
|
this = el.getAttributeByName("data-tip").getValue().flow()
)
}
}
/**
* The HTML body of an email, viewed as an XSS sink.
*/

15
javascript/ql/test/query-tests/Security/CWE-079/DomBasedXss/Xss.expected
View File

@@ -374,6 +374,13 @@ nodes
| string-manipulations.js:10:16:10:45 | String( ... n.href) |
| string-manipulations.js:10:23:10:44 | documen ... on.href |
| string-manipulations.js:10:23:10:44 | documen ... on.href |
| tooltip.jsx:6:11:6:30 | source |
| tooltip.jsx:6:20:6:30 | window.name |
| tooltip.jsx:6:20:6:30 | window.name |
| tooltip.jsx:10:25:10:30 | source |
| tooltip.jsx:10:25:10:30 | source |
| tooltip.jsx:11:25:11:30 | source |
| tooltip.jsx:11:25:11:30 | source |
| translate.js:6:7:6:39 | target |
| translate.js:6:16:6:39 | documen ... .search |
| translate.js:6:16:6:39 | documen ... .search |
@@ -1077,6 +1084,12 @@ edges
| string-manipulations.js:10:23:10:44 | documen ... on.href | string-manipulations.js:10:16:10:45 | String( ... n.href) |
| string-manipulations.js:10:23:10:44 | documen ... on.href | string-manipulations.js:10:16:10:45 | String( ... n.href) |
| string-manipulations.js:10:23:10:44 | documen ... on.href | string-manipulations.js:10:16:10:45 | String( ... n.href) |
| tooltip.jsx:6:11:6:30 | source | tooltip.jsx:10:25:10:30 | source |
| tooltip.jsx:6:11:6:30 | source | tooltip.jsx:10:25:10:30 | source |
| tooltip.jsx:6:11:6:30 | source | tooltip.jsx:11:25:11:30 | source |
| tooltip.jsx:6:11:6:30 | source | tooltip.jsx:11:25:11:30 | source |
| tooltip.jsx:6:20:6:30 | window.name | tooltip.jsx:6:11:6:30 | source |
| tooltip.jsx:6:20:6:30 | window.name | tooltip.jsx:6:11:6:30 | source |
| translate.js:6:7:6:39 | target | translate.js:7:42:7:47 | target |
| translate.js:6:16:6:39 | documen ... .search | translate.js:6:7:6:39 | target |
| translate.js:6:16:6:39 | documen ... .search | translate.js:6:7:6:39 | target |
@@ -1483,6 +1496,8 @@ edges
| string-manipulations.js:8:16:8:48 | documen ... mLeft() | string-manipulations.js:8:16:8:37 | documen ... on.href | string-manipulations.js:8:16:8:48 | documen ... mLeft() | Cross-site scripting vulnerability due to $@. | string-manipulations.js:8:16:8:37 | documen ... on.href | user-provided value |
| string-manipulations.js:9:16:9:58 | String. ... n.href) | string-manipulations.js:9:36:9:57 | documen ... on.href | string-manipulations.js:9:16:9:58 | String. ... n.href) | Cross-site scripting vulnerability due to $@. | string-manipulations.js:9:36:9:57 | documen ... on.href | user-provided value |
| string-manipulations.js:10:16:10:45 | String( ... n.href) | string-manipulations.js:10:23:10:44 | documen ... on.href | string-manipulations.js:10:16:10:45 | String( ... n.href) | Cross-site scripting vulnerability due to $@. | string-manipulations.js:10:23:10:44 | documen ... on.href | user-provided value |
| tooltip.jsx:10:25:10:30 | source | tooltip.jsx:6:20:6:30 | window.name | tooltip.jsx:10:25:10:30 | source | Cross-site scripting vulnerability due to $@. | tooltip.jsx:6:20:6:30 | window.name | user-provided value |
| tooltip.jsx:11:25:11:30 | source | tooltip.jsx:6:20:6:30 | window.name | tooltip.jsx:11:25:11:30 | source | Cross-site scripting vulnerability due to $@. | tooltip.jsx:6:20:6:30 | window.name | user-provided value |
| translate.js:9:27:9:50 | searchP ... 'term') | translate.js:6:16:6:39 | documen ... .search | translate.js:9:27:9:50 | searchP ... 'term') | Cross-site scripting vulnerability due to $@. | translate.js:6:16:6:39 | documen ... .search | user-provided value |
| tst3.js:4:25:4:32 | data.src | tst3.js:2:42:2:63 | window. ... .search | tst3.js:4:25:4:32 | data.src | Cross-site scripting vulnerability due to $@. | tst3.js:2:42:2:63 | window. ... .search | user-provided value |
| tst3.js:5:26:5:31 | data.p | tst3.js:2:42:2:63 | window. ... .search | tst3.js:5:26:5:31 | data.p | Cross-site scripting vulnerability due to $@. | tst3.js:2:42:2:63 | window. ... .search | user-provided value |

13
javascript/ql/test/query-tests/Security/CWE-079/DomBasedXss/XssWithAdditionalSources.expected
View File

@@ -381,6 +381,13 @@ nodes
| string-manipulations.js:10:16:10:45 | String( ... n.href) |
| string-manipulations.js:10:23:10:44 | documen ... on.href |
| string-manipulations.js:10:23:10:44 | documen ... on.href |
| tooltip.jsx:6:11:6:30 | source |
| tooltip.jsx:6:20:6:30 | window.name |
| tooltip.jsx:6:20:6:30 | window.name |
| tooltip.jsx:10:25:10:30 | source |
| tooltip.jsx:10:25:10:30 | source |
| tooltip.jsx:11:25:11:30 | source |
| tooltip.jsx:11:25:11:30 | source |
| translate.js:6:7:6:39 | target |
| translate.js:6:16:6:39 | documen ... .search |
| translate.js:6:16:6:39 | documen ... .search |
@@ -1101,6 +1108,12 @@ edges
| string-manipulations.js:10:23:10:44 | documen ... on.href | string-manipulations.js:10:16:10:45 | String( ... n.href) |
| string-manipulations.js:10:23:10:44 | documen ... on.href | string-manipulations.js:10:16:10:45 | String( ... n.href) |
| string-manipulations.js:10:23:10:44 | documen ... on.href | string-manipulations.js:10:16:10:45 | String( ... n.href) |
| tooltip.jsx:6:11:6:30 | source | tooltip.jsx:10:25:10:30 | source |
| tooltip.jsx:6:11:6:30 | source | tooltip.jsx:10:25:10:30 | source |
| tooltip.jsx:6:11:6:30 | source | tooltip.jsx:11:25:11:30 | source |
| tooltip.jsx:6:11:6:30 | source | tooltip.jsx:11:25:11:30 | source |
| tooltip.jsx:6:20:6:30 | window.name | tooltip.jsx:6:11:6:30 | source |
| tooltip.jsx:6:20:6:30 | window.name | tooltip.jsx:6:11:6:30 | source |
| translate.js:6:7:6:39 | target | translate.js:7:42:7:47 | target |
| translate.js:6:16:6:39 | documen ... .search | translate.js:6:7:6:39 | target |
| translate.js:6:16:6:39 | documen ... .search | translate.js:6:7:6:39 | target |

14
javascript/ql/test/query-tests/Security/CWE-079/DomBasedXss/tooltip.jsx Normal file
View File

@@ -0,0 +1,14 @@
import React from 'react';
import ReactDOM from 'react-dom';
import ReactTooltip from 'react-tooltip';
function tooltips() {
const source = window.name;
return <span>
<span data-tip={source}/> // OK
<span data-tip={source} data-html={false} /> // OK
<span data-tip={source} data-html="true" /> // NOT OK
<span data-tip={source} data-html={true} /> // NOT OK
<ReactTooltip />
</span>
}