diff --git a/javascript/ql/lib/semmle/javascript/frameworks/UriLibraries.qll b/javascript/ql/lib/semmle/javascript/frameworks/UriLibraries.qll index 0a262d154b2..90dcc886ed4 100644 --- a/javascript/ql/lib/semmle/javascript/frameworks/UriLibraries.qll +++ b/javascript/ql/lib/semmle/javascript/frameworks/UriLibraries.qll @@ -421,3 +421,22 @@ private module ClosureLibraryUri { } } } + +private class QueryStringStringification extends DataFlow::SummarizedCallable { + QueryStringStringification() { this = "query-string stringification" } + + override DataFlow::InvokeNode getACall() { + result = + API::moduleImport(["querystring", "query-string", "querystringify", "qs"]) + .getMember("stringify") + .getACall() or + result = API::moduleImport("url-parse").getMember("qs").getMember("stringify").getACall() or + result = API::moduleImport("parseqs").getMember("encode").getACall() + } + + override predicate propagatesFlow(string input, string output, boolean preservesValue) { + preservesValue = false and + input = ["Argument[0]", "Argument[0].AnyMemberDeep"] and + output = "ReturnValue" + } +} diff --git a/javascript/ql/test/query-tests/Security/CWE-200/googlecompiler.js b/javascript/ql/test/query-tests/Security/CWE-200/googlecompiler.js index f7e3a43a087..21f88a6d7ee 100644 --- a/javascript/ql/test/query-tests/Security/CWE-200/googlecompiler.js +++ b/javascript/ql/test/query-tests/Security/CWE-200/googlecompiler.js @@ -34,7 +34,7 @@ function PostCode(codestring) { }); }); - post_req.write(post_data); // $ MISSING: Alert - post the data from file to request body + post_req.write(post_data); // $ Alert - post the data from file to request body post_req.end(); } @@ -58,4 +58,4 @@ fs.readFile('LinkedList.js', 'utf-8', function (err, data) { console.log("No data to post"); process.exit(-1); } -}); \ No newline at end of file +});