backtrack string-concatenations from shell-execution sinks

2026-04-29 02:35:15 +02:00 · 2021-04-07 15:33:06 +02:00
parent 073a43ce74
commit 365b4d722d
3 changed files with 21 additions and 0 deletions
--- a/javascript/ql/src/semmle/javascript/security/dataflow/UnsafeShellCommandConstructionCustomizations.qll
+++ b/javascript/ql/src/semmle/javascript/security/dataflow/UnsafeShellCommandConstructionCustomizations.qll
@@ -70,6 +70,12 @@ module UnsafeShellCommandConstruction {
    exists(DataFlow::TypeBackTracker t2 |
      t2 = t.smallstep(result, isExecutedAsShellCommand(t2, sys))
    )
+    or
+    exists(DataFlow::TypeBackTracker t2, StringOps::ConcatenationRoot prev |
+      t = t2.continue() and
+      isExecutedAsShellCommand(t2, sys) = prev and
+      result = prev.getALeaf()
+    )
  }

  /**