hohn/codeql
1
0
Fork 0
mirror of https://github.com/github/codeql.git synced 2025-12-16 16:53:25 +01:00
Code Issues Packages Projects Releases Wiki Activity

JS: Add summary model for graphql's rootValue

Browse Source
This commit is contained in:
Napalys Klicius
2025-09-17 11:25:31 +02:00
parent a6d728a66d
commit 4282005e32
4 changed files with 35 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files

6
javascript/ql/lib/ext/graph-ql.model.yml Normal file
View File

@@ -0,0 +1,6 @@
extensions:
- addsTo:
pack: codeql/javascript-all
extensible: summaryModel
data:
- ["graphql", "Member[graphql]", "Argument[0].Member[source]", "Argument[0].Member[rootValue].AnyMember.Parameter[0].AnyMember", "taint"]

14
javascript/ql/test/query-tests/Security/CWE-094/CodeInjection/CodeInjection.expected
View File

@@ -61,6 +61,7 @@
| fastify.js:107:23:107:31 | userInput | fastify.js:106:21:106:38 | request.query.code | fastify.js:107:23:107:31 | userInput | This code execution depends on a $@. | fastify.js:106:21:106:38 | request.query.code | user-provided value | | fastify.js:107:23:107:31 | userInput | fastify.js:106:21:106:38 | request.query.code | fastify.js:107:23:107:31 | userInput | This code execution depends on a $@. | fastify.js:106:21:106:38 | request.query.code | user-provided value |
| fastify.js:108:28:108:50 | reply.l ... tedCode | fastify.js:94:29:94:41 | request.query | fastify.js:108:28:108:50 | reply.l ... tedCode | This code execution depends on a $@. | fastify.js:94:29:94:41 | request.query | user-provided value | | fastify.js:108:28:108:50 | reply.l ... tedCode | fastify.js:94:29:94:41 | request.query | fastify.js:108:28:108:50 | reply.l ... tedCode | This code execution depends on a $@. | fastify.js:94:29:94:41 | request.query | user-provided value |
| fastify.js:108:28:108:50 | reply.l ... tedCode | fastify.js:94:29:94:51 | request ... plyCode | fastify.js:108:28:108:50 | reply.l ... tedCode | This code execution depends on a $@. | fastify.js:94:29:94:51 | request ... plyCode | user-provided value | | fastify.js:108:28:108:50 | reply.l ... tedCode | fastify.js:94:29:94:51 | request ... plyCode | fastify.js:108:28:108:50 | reply.l ... tedCode | This code execution depends on a $@. | fastify.js:94:29:94:51 | request ... plyCode | user-provided value |
| graph-ql.js:20:19:20:22 | expr | graph-ql.js:28:32:28:39 | req.body | graph-ql.js:20:19:20:22 | expr | This code execution depends on a $@. | graph-ql.js:28:32:28:39 | req.body | user-provided value |
| module.js:9:16:9:29 | req.query.code | module.js:9:16:9:29 | req.query.code | module.js:9:16:9:29 | req.query.code | This code execution depends on a $@. | module.js:9:16:9:29 | req.query.code | user-provided value | | module.js:9:16:9:29 | req.query.code | module.js:9:16:9:29 | req.query.code | module.js:9:16:9:29 | req.query.code | This code execution depends on a $@. | module.js:9:16:9:29 | req.query.code | user-provided value |
| module.js:11:17:11:30 | req.query.code | module.js:11:17:11:30 | req.query.code | module.js:11:17:11:30 | req.query.code | This code execution depends on a $@. | module.js:11:17:11:30 | req.query.code | user-provided value | | module.js:11:17:11:30 | req.query.code | module.js:11:17:11:30 | req.query.code | module.js:11:17:11:30 | req.query.code | This code execution depends on a $@. | module.js:11:17:11:30 | req.query.code | user-provided value |
| react-native.js:8:32:8:38 | tainted | react-native.js:7:17:7:33 | req.param("code") | react-native.js:8:32:8:38 | tainted | This code execution depends on a $@. | react-native.js:7:17:7:33 | req.param("code") | user-provided value | | react-native.js:8:32:8:38 | tainted | react-native.js:7:17:7:33 | req.param("code") | react-native.js:8:32:8:38 | tainted | This code execution depends on a $@. | react-native.js:7:17:7:33 | req.param("code") | user-provided value |
@@ -154,6 +155,12 @@ edges
| fastify.js:106:9:106:17 | userInput | fastify.js:107:23:107:31 | userInput | provenance | | | fastify.js:106:9:106:17 | userInput | fastify.js:107:23:107:31 | userInput | provenance | |
| fastify.js:106:21:106:33 | request.query | fastify.js:106:9:106:17 | userInput | provenance | | | fastify.js:106:21:106:33 | request.query | fastify.js:106:9:106:17 | userInput | provenance | |
| fastify.js:106:21:106:38 | request.query.code | fastify.js:106:9:106:17 | userInput | provenance | | | fastify.js:106:21:106:38 | request.query.code | fastify.js:106:9:106:17 | userInput | provenance | |
| graph-ql.js:18:12:18:15 | expr | graph-ql.js:18:12:18:15 | expr | provenance | |
| graph-ql.js:18:12:18:15 | expr | graph-ql.js:20:19:20:22 | expr | provenance | |
| graph-ql.js:28:9:28:28 | { query, variables } | graph-ql.js:28:11:28:15 | query | provenance | |
| graph-ql.js:28:11:28:15 | query | graph-ql.js:31:13:31:17 | query | provenance | |
| graph-ql.js:28:32:28:39 | req.body | graph-ql.js:28:9:28:28 | { query, variables } | provenance | |
| graph-ql.js:31:13:31:17 | query | graph-ql.js:18:12:18:15 | expr | provenance | |
| react-native.js:7:7:7:13 | tainted | react-native.js:8:32:8:38 | tainted | provenance | | | react-native.js:7:7:7:13 | tainted | react-native.js:8:32:8:38 | tainted | provenance | |
| react-native.js:7:7:7:13 | tainted | react-native.js:10:23:10:29 | tainted | provenance | | | react-native.js:7:7:7:13 | tainted | react-native.js:10:23:10:29 | tainted | provenance | |
| react-native.js:7:17:7:33 | req.param("code") | react-native.js:7:7:7:13 | tainted | provenance | | | react-native.js:7:17:7:33 | req.param("code") | react-native.js:7:7:7:13 | tainted | provenance | |
@@ -288,6 +295,13 @@ nodes
| fastify.js:106:21:106:38 | request.query.code | semmle.label | request.query.code | | fastify.js:106:21:106:38 | request.query.code | semmle.label | request.query.code |
| fastify.js:107:23:107:31 | userInput | semmle.label | userInput | | fastify.js:107:23:107:31 | userInput | semmle.label | userInput |
| fastify.js:108:28:108:50 | reply.l ... tedCode | semmle.label | reply.l ... tedCode | | fastify.js:108:28:108:50 | reply.l ... tedCode | semmle.label | reply.l ... tedCode |
| graph-ql.js:18:12:18:15 | expr | semmle.label | expr |
| graph-ql.js:18:12:18:15 | expr | semmle.label | expr |
| graph-ql.js:20:19:20:22 | expr | semmle.label | expr |
| graph-ql.js:28:9:28:28 | { query, variables } | semmle.label | { query, variables } |
| graph-ql.js:28:11:28:15 | query | semmle.label | query |
| graph-ql.js:28:32:28:39 | req.body | semmle.label | req.body |
| graph-ql.js:31:13:31:17 | query | semmle.label | query |
| module.js:9:16:9:29 | req.query.code | semmle.label | req.query.code | | module.js:9:16:9:29 | req.query.code | semmle.label | req.query.code |
| module.js:11:17:11:30 | req.query.code | semmle.label | req.query.code | | module.js:11:17:11:30 | req.query.code | semmle.label | req.query.code |
| react-native.js:7:7:7:13 | tainted | semmle.label | tainted | | react-native.js:7:7:7:13 | tainted | semmle.label | tainted |

13
javascript/ql/test/query-tests/Security/CWE-094/CodeInjection/HeuristicSourceCodeInjection.expected
View File

@@ -55,6 +55,12 @@ edges
| fastify.js:106:9:106:17 | userInput | fastify.js:107:23:107:31 | userInput | provenance | | | fastify.js:106:9:106:17 | userInput | fastify.js:107:23:107:31 | userInput | provenance | |
| fastify.js:106:21:106:33 | request.query | fastify.js:106:9:106:17 | userInput | provenance | | | fastify.js:106:21:106:33 | request.query | fastify.js:106:9:106:17 | userInput | provenance | |
| fastify.js:106:21:106:38 | request.query.code | fastify.js:106:9:106:17 | userInput | provenance | | | fastify.js:106:21:106:38 | request.query.code | fastify.js:106:9:106:17 | userInput | provenance | |
| graph-ql.js:18:12:18:15 | expr | graph-ql.js:18:12:18:15 | expr | provenance | |
| graph-ql.js:18:12:18:15 | expr | graph-ql.js:20:19:20:22 | expr | provenance | |
| graph-ql.js:28:9:28:28 | { query, variables } | graph-ql.js:28:11:28:15 | query | provenance | |
| graph-ql.js:28:11:28:15 | query | graph-ql.js:31:13:31:17 | query | provenance | |
| graph-ql.js:28:32:28:39 | req.body | graph-ql.js:28:9:28:28 | { query, variables } | provenance | |
| graph-ql.js:31:13:31:17 | query | graph-ql.js:18:12:18:15 | expr | provenance | |
| react-native.js:7:7:7:13 | tainted | react-native.js:8:32:8:38 | tainted | provenance | | | react-native.js:7:7:7:13 | tainted | react-native.js:8:32:8:38 | tainted | provenance | |
| react-native.js:7:7:7:13 | tainted | react-native.js:10:23:10:29 | tainted | provenance | | | react-native.js:7:7:7:13 | tainted | react-native.js:10:23:10:29 | tainted | provenance | |
| react-native.js:7:17:7:33 | req.param("code") | react-native.js:7:7:7:13 | tainted | provenance | | | react-native.js:7:17:7:33 | req.param("code") | react-native.js:7:7:7:13 | tainted | provenance | |
@@ -191,6 +197,13 @@ nodes
| fastify.js:106:21:106:38 | request.query.code | semmle.label | request.query.code | | fastify.js:106:21:106:38 | request.query.code | semmle.label | request.query.code |
| fastify.js:107:23:107:31 | userInput | semmle.label | userInput | | fastify.js:107:23:107:31 | userInput | semmle.label | userInput |
| fastify.js:108:28:108:50 | reply.l ... tedCode | semmle.label | reply.l ... tedCode | | fastify.js:108:28:108:50 | reply.l ... tedCode | semmle.label | reply.l ... tedCode |
| graph-ql.js:18:12:18:15 | expr | semmle.label | expr |
| graph-ql.js:18:12:18:15 | expr | semmle.label | expr |
| graph-ql.js:20:19:20:22 | expr | semmle.label | expr |
| graph-ql.js:28:9:28:28 | { query, variables } | semmle.label | { query, variables } |
| graph-ql.js:28:11:28:15 | query | semmle.label | query |
| graph-ql.js:28:32:28:39 | req.body | semmle.label | req.body |
| graph-ql.js:31:13:31:17 | query | semmle.label | query |
| module.js:9:16:9:29 | req.query.code | semmle.label | req.query.code | | module.js:9:16:9:29 | req.query.code | semmle.label | req.query.code |
| module.js:11:17:11:30 | req.query.code | semmle.label | req.query.code | | module.js:11:17:11:30 | req.query.code | semmle.label | req.query.code |
| react-native.js:7:7:7:13 | tainted | semmle.label | tainted | | react-native.js:7:7:7:13 | tainted | semmle.label | tainted |

4
javascript/ql/test/query-tests/Security/CWE-094/CodeInjection/graph-ql.js
View File

@@ -17,7 +17,7 @@ const root = {
}, },
calc: ({ expr }) => { calc: ({ expr }) => {
try { try {
return eval(expr).toString(); // $ MISSING: Alert[js/code-injection] return eval(expr).toString(); // $ Alert[js/code-injection]
} catch (e) { } catch (e) {
return `Error: ${e.message}`; return `Error: ${e.message}`;
} }
@@ -25,7 +25,7 @@ const root = {
}; };
app.post('/graphql', async (req, res) => { app.post('/graphql', async (req, res) => {
const { query, variables } = req.body; // $ MISSING: Source[js/code-injection] const { query, variables } = req.body; // $ Source[js/code-injection]
const result = await graphql({ const result = await graphql({
schema, schema,
source: query, source: query,