hohn/codeql
1
0
Fork 0
mirror of https://github.com/github/codeql.git synced 2026-05-05 13:45:19 +02:00
Code Issues Packages Projects Releases Wiki Activity

add support for Object.hasOwn(obj, key)

Browse Source
This commit is contained in:
Erik Krogh Kristensen
2022-05-24 13:47:41 +02:00
parent 1717d17fb3
commit 2a97dd9f6f
11 changed files with 171 additions and 10 deletions
Download Patch File Download Diff File Expand all files Collapse all files

15
javascript/ql/test/query-tests/Security/CWE-601/ServerSideUrlRedirect/ServerSideUrlRedirect.expected
View File

@@ -50,6 +50,13 @@ nodes
| express.js:146:16:146:24 | query.foo |
| express.js:146:16:146:24 | query.foo |
| express.js:146:16:146:24 | query.foo |
| express.js:150:7:150:34 | target |
| express.js:150:16:150:34 | req.param("target") |
| express.js:150:16:150:34 | req.param("target") |
| express.js:155:18:155:23 | target |
| express.js:155:18:155:23 | target |
| express.js:160:18:160:23 | target |
| express.js:160:18:160:23 | target |
| koa.js:6:6:6:27 | url |
| koa.js:6:12:6:27 | ctx.query.target |
| koa.js:6:12:6:27 | ctx.query.target |
@@ -140,6 +147,12 @@ edges
| express.js:136:22:136:36 | req.params.user | express.js:136:16:136:36 | 'u' + r ... ms.user |
| express.js:143:16:143:28 | req.query.foo | express.js:143:16:143:28 | req.query.foo |
| express.js:146:16:146:24 | query.foo | express.js:146:16:146:24 | query.foo |
| express.js:150:7:150:34 | target | express.js:155:18:155:23 | target |
| express.js:150:7:150:34 | target | express.js:155:18:155:23 | target |
| express.js:150:7:150:34 | target | express.js:160:18:160:23 | target |
| express.js:150:7:150:34 | target | express.js:160:18:160:23 | target |
| express.js:150:16:150:34 | req.param("target") | express.js:150:7:150:34 | target |
| express.js:150:16:150:34 | req.param("target") | express.js:150:7:150:34 | target |
| koa.js:6:6:6:27 | url | koa.js:7:15:7:17 | url |
| koa.js:6:6:6:27 | url | koa.js:7:15:7:17 | url |
| koa.js:6:6:6:27 | url | koa.js:8:18:8:20 | url |
@@ -199,6 +212,8 @@ edges
| express.js:136:16:136:36 | 'u' + r ... ms.user | express.js:136:22:136:36 | req.params.user | express.js:136:16:136:36 | 'u' + r ... ms.user | Untrusted URL redirection due to $@. | express.js:136:22:136:36 | req.params.user | user-provided value |
| express.js:143:16:143:28 | req.query.foo | express.js:143:16:143:28 | req.query.foo | express.js:143:16:143:28 | req.query.foo | Untrusted URL redirection due to $@. | express.js:143:16:143:28 | req.query.foo | user-provided value |
| express.js:146:16:146:24 | query.foo | express.js:146:16:146:24 | query.foo | express.js:146:16:146:24 | query.foo | Untrusted URL redirection due to $@. | express.js:146:16:146:24 | query.foo | user-provided value |
| express.js:155:18:155:23 | target | express.js:150:16:150:34 | req.param("target") | express.js:155:18:155:23 | target | Untrusted URL redirection due to $@. | express.js:150:16:150:34 | req.param("target") | user-provided value |
| express.js:160:18:160:23 | target | express.js:150:16:150:34 | req.param("target") | express.js:160:18:160:23 | target | Untrusted URL redirection due to $@. | express.js:150:16:150:34 | req.param("target") | user-provided value |
| koa.js:7:15:7:17 | url | koa.js:6:12:6:27 | ctx.query.target | koa.js:7:15:7:17 | url | Untrusted URL redirection due to $@. | koa.js:6:12:6:27 | ctx.query.target | user-provided value |
| koa.js:8:15:8:26 | `${url}${x}` | koa.js:6:12:6:27 | ctx.query.target | koa.js:8:15:8:26 | `${url}${x}` | Untrusted URL redirection due to $@. | koa.js:6:12:6:27 | ctx.query.target | user-provided value |
| koa.js:14:16:14:18 | url | koa.js:6:12:6:27 | ctx.query.target | koa.js:14:16:14:18 | url | Untrusted URL redirection due to $@. | koa.js:6:12:6:27 | ctx.query.target | user-provided value |

16
javascript/ql/test/query-tests/Security/CWE-601/ServerSideUrlRedirect/express.js
View File

@@ -144,4 +144,18 @@ app.get("foo", (req, res) => {
});
app.get("bar", ({query}, res) => {
res.redirect(query.foo); // NOT OK
})
})
app.get('/some/path', function(req, res) {
let target = req.param("target");
if (SAFE_TARGETS.hasOwnProperty(target))
res.redirect(target); // OK: request parameter is checked against whitelist
else
res.redirect(target); // NOT OK
if (Object.hasOwn(SAFE_TARGETS, target))
res.redirect(target); // OK: request parameter is checked against whitelist
else
res.redirect(target); // NOT OK
});

57
javascript/ql/test/query-tests/Security/CWE-915/PrototypePollutingFunction/PrototypePollutingFunction.expected
View File

@@ -1478,6 +1478,31 @@ nodes
| tests.js:547:24:547:28 | value |
| tests.js:547:24:547:28 | value |
| tests.js:547:24:547:28 | value |
| tests.js:552:35:552:37 | src |
| tests.js:552:35:552:37 | src |
| tests.js:553:14:553:16 | key |
| tests.js:553:14:553:16 | key |
| tests.js:553:14:553:16 | key |
| tests.js:557:43:557:45 | src |
| tests.js:557:43:557:45 | src |
| tests.js:557:43:557:50 | src[key] |
| tests.js:557:43:557:50 | src[key] |
| tests.js:557:43:557:50 | src[key] |
| tests.js:557:43:557:50 | src[key] |
| tests.js:557:43:557:50 | src[key] |
| tests.js:559:17:559:19 | key |
| tests.js:559:17:559:19 | key |
| tests.js:559:17:559:19 | key |
| tests.js:559:24:559:26 | src |
| tests.js:559:24:559:26 | src |
| tests.js:559:24:559:31 | src[key] |
| tests.js:559:24:559:31 | src[key] |
| tests.js:559:24:559:31 | src[key] |
| tests.js:559:24:559:31 | src[key] |
| tests.js:559:24:559:31 | src[key] |
| tests.js:559:24:559:31 | src[key] |
| tests.js:559:28:559:30 | key |
| tests.js:559:28:559:30 | key |
edges
| examples/PrototypePollutingFunction.js:1:16:1:18 | dst | examples/PrototypePollutingFunction.js:5:19:5:21 | dst |
| examples/PrototypePollutingFunction.js:1:16:1:18 | dst | examples/PrototypePollutingFunction.js:5:19:5:21 | dst |
@@ -3347,6 +3372,38 @@ edges
| tests.js:545:43:545:47 | value | tests.js:542:35:542:37 | src |
| tests.js:545:43:545:47 | value | tests.js:542:35:542:37 | src |
| tests.js:545:43:545:47 | value | tests.js:542:35:542:37 | src |
| tests.js:552:35:552:37 | src | tests.js:557:43:557:45 | src |
| tests.js:552:35:552:37 | src | tests.js:557:43:557:45 | src |
| tests.js:552:35:552:37 | src | tests.js:559:24:559:26 | src |
| tests.js:552:35:552:37 | src | tests.js:559:24:559:26 | src |
| tests.js:553:14:553:16 | key | tests.js:559:17:559:19 | key |
| tests.js:553:14:553:16 | key | tests.js:559:17:559:19 | key |
| tests.js:553:14:553:16 | key | tests.js:559:17:559:19 | key |
| tests.js:553:14:553:16 | key | tests.js:559:17:559:19 | key |
| tests.js:553:14:553:16 | key | tests.js:559:17:559:19 | key |
| tests.js:553:14:553:16 | key | tests.js:559:17:559:19 | key |
| tests.js:553:14:553:16 | key | tests.js:559:17:559:19 | key |
| tests.js:553:14:553:16 | key | tests.js:559:28:559:30 | key |
| tests.js:553:14:553:16 | key | tests.js:559:28:559:30 | key |
| tests.js:553:14:553:16 | key | tests.js:559:28:559:30 | key |
| tests.js:553:14:553:16 | key | tests.js:559:28:559:30 | key |
| tests.js:557:43:557:45 | src | tests.js:557:43:557:50 | src[key] |
| tests.js:557:43:557:45 | src | tests.js:557:43:557:50 | src[key] |
| tests.js:557:43:557:50 | src[key] | tests.js:552:35:552:37 | src |
| tests.js:557:43:557:50 | src[key] | tests.js:552:35:552:37 | src |
| tests.js:557:43:557:50 | src[key] | tests.js:552:35:552:37 | src |
| tests.js:557:43:557:50 | src[key] | tests.js:552:35:552:37 | src |
| tests.js:557:43:557:50 | src[key] | tests.js:552:35:552:37 | src |
| tests.js:557:43:557:50 | src[key] | tests.js:552:35:552:37 | src |
| tests.js:559:24:559:26 | src | tests.js:559:24:559:31 | src[key] |
| tests.js:559:24:559:26 | src | tests.js:559:24:559:31 | src[key] |
| tests.js:559:24:559:26 | src | tests.js:559:24:559:31 | src[key] |
| tests.js:559:24:559:26 | src | tests.js:559:24:559:31 | src[key] |
| tests.js:559:24:559:31 | src[key] | tests.js:559:24:559:31 | src[key] |
| tests.js:559:28:559:30 | key | tests.js:559:24:559:31 | src[key] |
| tests.js:559:28:559:30 | key | tests.js:559:24:559:31 | src[key] |
| tests.js:559:28:559:30 | key | tests.js:559:24:559:31 | src[key] |
| tests.js:559:28:559:30 | key | tests.js:559:24:559:31 | src[key] |
#select
| examples/PrototypePollutingFunction.js:7:13:7:15 | dst | examples/PrototypePollutingFunction.js:2:14:2:16 | key | examples/PrototypePollutingFunction.js:7:13:7:15 | dst | Properties are copied from $@ to $@ without guarding against prototype pollution. | examples/PrototypePollutingFunction.js:2:21:2:23 | src | src | examples/PrototypePollutingFunction.js:7:13:7:15 | dst | dst |
| path-assignment.js:15:13:15:18 | target | path-assignment.js:8:19:8:25 | keys[i] | path-assignment.js:15:13:15:18 | target | The property chain $@ is recursively assigned to $@ without guarding against prototype pollution. | path-assignment.js:8:19:8:25 | keys[i] | here | path-assignment.js:15:13:15:18 | target | target |

12
javascript/ql/test/query-tests/Security/CWE-915/PrototypePollutingFunction/tests.js
View File

@@ -548,3 +548,15 @@ function mergeUsingCallback3(dst, src) {
}
});
}
function copyHasOwnProperty2(dst, src) {
for (let key in src) {
// Guarding the recursive case by dst.hasOwnProperty (or Object.hasOwn) is safe,
// since '__proto__' and 'constructor' are not own properties of the destination object.
if (Object.hasOwn(dst, key)) {
copyHasOwnProperty2(dst[key], src[key]);
} else {
dst[key] = src[key]; // OK
}
}
}