hohn/codeql
1
0
Fork 0
mirror of https://github.com/github/codeql.git synced 2026-04-26 09:15:12 +02:00
Code Issues Packages Projects Releases Wiki Activity

JS: Migrate ClientSideUrlRedirect to flow state

Browse Source
This commit is contained in:
Asger F
2024-12-11 10:04:44 +01:00
parent cca980298f
commit 3cf14d8506
2 changed files with 22 additions and 17 deletions
Download Patch File Download Diff File Expand all files Collapse all files

17
javascript/ql/lib/semmle/javascript/security/dataflow/ClientSideUrlRedirectCustomizations.qll
View File

@@ -8,12 +8,19 @@ import javascript
private import semmle.javascript.security.TaintedUrlSuffixCustomizations
module ClientSideUrlRedirect {
class FlowState = TaintedUrlSuffix::FlowState;
module FlowState = TaintedUrlSuffix::FlowState;
/**
* A data flow source for unvalidated URL redirect vulnerabilities.
*/
abstract class Source extends DataFlow::Node {
/** Gets a flow label to associate with this source. */
DataFlow::FlowLabel getAFlowLabel() { result.isTaint() }
/** Gets a flow state to associate with this source. */
FlowState getAFlowState() { result.isTaint() }
/** DEPRECATED. Use `getAFlowState()` instead. */
deprecated DataFlow::FlowLabel getAFlowLabel() { result = this.getAFlowState().toFlowLabel() }
}
/**
@@ -50,10 +57,8 @@ module ClientSideUrlRedirect {
private class ActiveThreatModelSourceAsSource extends Source instanceof ActiveThreatModelSource {
ActiveThreatModelSourceAsSource() { not this.(ClientSideRemoteFlowSource).getKind().isPath() }
override DataFlow::FlowLabel getAFlowLabel() {
if this = TaintedUrlSuffix::source()
then result = TaintedUrlSuffix::label()
else result.isTaint()
override FlowState getAFlowState() {
if this = TaintedUrlSuffix::source() then result.isTaintedUrlSuffix() else result.isTaint()
}
}

22
javascript/ql/lib/semmle/javascript/security/dataflow/ClientSideUrlRedirectQuery.qll
View File

@@ -21,13 +21,13 @@ deprecated private class ConcreteDocumentUrl extends DocumentUrl {
* A taint-tracking configuration for reasoning about unvalidated URL redirections.
*/
module ClientSideUrlRedirectConfig implements DataFlow::StateConfigSig {
class FlowState = DataFlow::FlowLabel;
class FlowState = TaintedUrlSuffix::FlowState;
predicate isSource(DataFlow::Node source, DataFlow::FlowLabel state) {
source.(Source).getAFlowLabel() = state
predicate isSource(DataFlow::Node source, FlowState state) {
source.(Source).getAFlowState() = state
}
predicate isSink(DataFlow::Node sink, DataFlow::FlowLabel state) {
predicate isSink(DataFlow::Node sink, FlowState state) {
sink instanceof Sink and state.isTaint()
}
@@ -35,19 +35,18 @@ module ClientSideUrlRedirectConfig implements DataFlow::StateConfigSig {
node instanceof Sanitizer or node = HostnameSanitizerGuard::getABarrierNode()
}
predicate isBarrier(DataFlow::Node node, DataFlow::FlowLabel state) {
TaintedUrlSuffix::isBarrier(node, state)
predicate isBarrier(DataFlow::Node node, FlowState state) {
TaintedUrlSuffix::isStateBarrier(node, state)
}
predicate isBarrierOut(DataFlow::Node node) { hostnameSanitizingPrefixEdge(node, _) }
predicate isBarrierOut(DataFlow::Node node, DataFlow::FlowLabel label) { isSink(node, label) }
predicate isBarrierOut(DataFlow::Node node, FlowState label) { isSink(node, label) }
predicate isAdditionalFlowStep(
DataFlow::Node node1, DataFlow::FlowLabel state1, DataFlow::Node node2,
DataFlow::FlowLabel state2
DataFlow::Node node1, FlowState state1, DataFlow::Node node2, FlowState state2
) {
TaintedUrlSuffix::step(node1, node2, state1, state2)
TaintedUrlSuffix::isAdditionalFlowStep(node1, state1, node2, state2)
or
exists(HtmlSanitizerCall call |
node1 = call.getInput() and
@@ -85,7 +84,8 @@ deprecated class Configuration extends TaintTracking::Configuration {
DataFlow::Node node1, DataFlow::Node node2, DataFlow::FlowLabel state1,
DataFlow::FlowLabel state2
) {
ClientSideUrlRedirectConfig::isAdditionalFlowStep(node1, state1, node2, state2)
ClientSideUrlRedirectConfig::isAdditionalFlowStep(node1, FlowState::fromFlowLabel(state1),
node2, FlowState::fromFlowLabel(state2))
or
// Preserve document.url label in step from `location` to `location.href` or `location.toString()`
state1 instanceof DocumentUrl and