From 3e7ea34054369ccc33c772b4d93747bbf2bae781 Mon Sep 17 00:00:00 2001 From: Chris Smowton Date: Fri, 25 Jun 2021 14:40:18 +0100 Subject: [PATCH] XSS: expose extension point for defining barrier sinks --- java/ql/src/Security/CWE/CWE-079/XSS.ql | 2 ++ java/ql/src/semmle/code/java/security/XSS.qll | 6 ++++++ 2 files changed, 8 insertions(+) diff --git a/java/ql/src/Security/CWE/CWE-079/XSS.ql b/java/ql/src/Security/CWE/CWE-079/XSS.ql index f1f8a5afa9b..885a6f7a47b 100644 --- a/java/ql/src/Security/CWE/CWE-079/XSS.ql +++ b/java/ql/src/Security/CWE/CWE-079/XSS.ql @@ -25,6 +25,8 @@ class XSSConfig extends TaintTracking::Configuration { override predicate isSanitizer(DataFlow::Node node) { node instanceof XssSanitizer } + override predicate isSanitizerOut(DataFlow::Node node) { node instanceof XssSinkBarrier } + override predicate isAdditionalTaintStep(DataFlow::Node node1, DataFlow::Node node2) { any(XssAdditionalTaintStep s).step(node1, node2) } diff --git a/java/ql/src/semmle/code/java/security/XSS.qll b/java/ql/src/semmle/code/java/security/XSS.qll index 14f10cad9c8..1f2a57b3c27 100644 --- a/java/ql/src/semmle/code/java/security/XSS.qll +++ b/java/ql/src/semmle/code/java/security/XSS.qll @@ -15,6 +15,12 @@ abstract class XssSink extends DataFlow::Node { } /** A sanitizer that neutralizes dangerous characters that can be used to perform a XSS attack. */ abstract class XssSanitizer extends DataFlow::Node { } +/** + * A sink that represent a method that outputs data without applying contextual output encoding, + * and which should truncate flow paths such that downstream sinks are not flagged as well. + */ +abstract class XssSinkBarrier extends XssSink { } + /** * A unit class for adding additional taint steps. *