hohn/codeql
1
0
Fork 0
mirror of https://github.com/github/codeql.git synced 2026-07-07 20:45:28 +02:00
Code Issues Packages Projects Releases Wiki Activity

Do not flag strings that have dots escaped in IncompleteHostnameRegExp.

Browse Source
This commit is contained in:
Max Schaefer
2023-10-17 16:05:23 +01:00
parent 6685ed328a
commit 35ce1ff582
2 changed files with 18 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files

14
javascript/ql/lib/semmle/javascript/security/regexp/HostnameRegexp.qll
View File

@@ -12,7 +12,19 @@ private import codeql.regex.HostnameRegexp as Shared
module Impl implements Shared::HostnameRegexpSig<TreeImpl> {
class DataFlowNode = JS::DataFlow::Node;
class RegExpPatternSource = RegExp::RegExpPatternSource;
class RegExpPatternSource extends JS::DataFlow::Node instanceof RegExp::RegExpPatternSource {
RegExpPatternSource() {
not super.escapes(_)
}
RegExp::RegExpTerm getRegExpTerm() {
result = super.getRegExpTerm()
}
JS::DataFlow::Node getAParse() {
result = super.getAParse()
}
}
}
import Shared::Make<TreeImpl, Impl>

5
javascript/ql/test/query-tests/Security/CWE-020/IncompleteHostnameRegExp/tst-IncompleteHostnameRegExp.js
View File

@@ -57,4 +57,9 @@
/^http:\/\/(..|...)\.example\.com\/index\.html/; // OK, wildcards are intentional
/^http:\/\/.\.example\.com\/index\.html/; // OK, the wildcard is intentional
/^(foo.example\.com|whatever)$/; // kinda OK - one disjunction doesn't even look like a hostname
function makeHostnameRegExp(hostname) {
return new RegExp(`^https://${hostname.replace(/[\.\\]/g, '\\$&')}$`);
}
makeHostnameRegExp('test.example.com'); // OK
});