From 45c8ec96df5b16e7d33a7f87d0b034efe3a88916 Mon Sep 17 00:00:00 2001 From: Napalys Date: Fri, 28 Mar 2025 15:02:03 +0100 Subject: [PATCH] Added test cases for `hana` db additional sources. --- .../XssWithAdditionalSources.expected | 56 +++++++++++ .../Security/CWE-079/DomBasedXss/hana.js | 93 +++++++++++++++++++ 2 files changed, 149 insertions(+) create mode 100644 javascript/ql/test/query-tests/Security/CWE-079/DomBasedXss/hana.js diff --git a/javascript/ql/test/query-tests/Security/CWE-079/DomBasedXss/XssWithAdditionalSources.expected b/javascript/ql/test/query-tests/Security/CWE-079/DomBasedXss/XssWithAdditionalSources.expected index eb961fc83db..ed2611a11e3 100644 --- a/javascript/ql/test/query-tests/Security/CWE-079/DomBasedXss/XssWithAdditionalSources.expected +++ b/javascript/ql/test/query-tests/Security/CWE-079/DomBasedXss/XssWithAdditionalSources.expected @@ -153,6 +153,34 @@ nodes | event-handler-receiver.js:2:31:2:83 | '

' | semmle.label | '

' | | event-handler-receiver.js:2:49:2:61 | location.href | semmle.label | location.href | | express.js:6:15:6:33 | req.param("wobble") | semmle.label | req.param("wobble") | +| hana.js:11:37:11:40 | rows | semmle.label | rows | +| hana.js:11:37:11:51 | rows[0].comment | semmle.label | rows[0].comment | +| hana.js:16:37:16:40 | rows | semmle.label | rows | +| hana.js:16:37:16:51 | rows[0].comment | semmle.label | rows[0].comment | +| hana.js:19:37:19:40 | rows | semmle.label | rows | +| hana.js:19:37:19:51 | rows[0].comment | semmle.label | rows[0].comment | +| hana.js:22:37:22:38 | rs | semmle.label | rs | +| hana.js:22:37:22:49 | rs[0].comment | semmle.label | rs[0].comment | +| hana.js:38:31:38:32 | rs | semmle.label | rs | +| hana.js:38:31:38:43 | rs[0].comment | semmle.label | rs[0].comment | +| hana.js:43:33:43:41 | dummyRows | semmle.label | dummyRows | +| hana.js:43:33:43:52 | dummyRows[0].comment | semmle.label | dummyRows[0].comment | +| hana.js:44:33:44:42 | tablesRows | semmle.label | tablesRows | +| hana.js:44:33:44:53 | tablesR ... comment | semmle.label | tablesR ... comment | +| hana.js:50:33:50:41 | dummyRows | semmle.label | dummyRows | +| hana.js:50:33:50:52 | dummyRows[0].comment | semmle.label | dummyRows[0].comment | +| hana.js:51:33:51:42 | tablesRows | semmle.label | tablesRows | +| hana.js:51:33:51:53 | tablesR ... comment | semmle.label | tablesR ... comment | +| hana.js:70:33:70:36 | rows | semmle.label | rows | +| hana.js:70:33:70:47 | rows[0].comment | semmle.label | rows[0].comment | +| hana.js:73:33:73:36 | rows | semmle.label | rows | +| hana.js:73:33:73:47 | rows[0].comment | semmle.label | rows[0].comment | +| hana.js:84:35:84:43 | dummyRows | semmle.label | dummyRows | +| hana.js:84:35:84:54 | dummyRows[0].comment | semmle.label | dummyRows[0].comment | +| hana.js:85:35:85:43 | tableRows | semmle.label | tableRows | +| hana.js:85:35:85:54 | tableRows[0].comment | semmle.label | tableRows[0].comment | +| hana.js:90:33:90:34 | rs | semmle.label | rs | +| hana.js:90:33:90:45 | rs[0].comment | semmle.label | rs[0].comment | | jquery.js:2:7:2:40 | tainted | semmle.label | tainted | | jquery.js:2:17:2:40 | documen ... .search | semmle.label | documen ... .search | | jquery.js:4:5:4:11 | tainted | semmle.label | tainted | @@ -791,6 +819,20 @@ edges | dragAndDrop.ts:71:27:71:61 | e.dataT ... /html') | dragAndDrop.ts:71:13:71:61 | droppedHtml | provenance | | | event-handler-receiver.js:2:49:2:61 | location.href | event-handler-receiver.js:2:31:2:83 | '

' | provenance | | | event-handler-receiver.js:2:49:2:61 | location.href | event-handler-receiver.js:2:31:2:83 | '

' | provenance | Config | +| hana.js:11:37:11:40 | rows | hana.js:11:37:11:51 | rows[0].comment | provenance | | +| hana.js:16:37:16:40 | rows | hana.js:16:37:16:51 | rows[0].comment | provenance | | +| hana.js:19:37:19:40 | rows | hana.js:19:37:19:51 | rows[0].comment | provenance | | +| hana.js:22:37:22:38 | rs | hana.js:22:37:22:49 | rs[0].comment | provenance | | +| hana.js:38:31:38:32 | rs | hana.js:38:31:38:43 | rs[0].comment | provenance | | +| hana.js:43:33:43:41 | dummyRows | hana.js:43:33:43:52 | dummyRows[0].comment | provenance | | +| hana.js:44:33:44:42 | tablesRows | hana.js:44:33:44:53 | tablesR ... comment | provenance | | +| hana.js:50:33:50:41 | dummyRows | hana.js:50:33:50:52 | dummyRows[0].comment | provenance | | +| hana.js:51:33:51:42 | tablesRows | hana.js:51:33:51:53 | tablesR ... comment | provenance | | +| hana.js:70:33:70:36 | rows | hana.js:70:33:70:47 | rows[0].comment | provenance | | +| hana.js:73:33:73:36 | rows | hana.js:73:33:73:47 | rows[0].comment | provenance | | +| hana.js:84:35:84:43 | dummyRows | hana.js:84:35:84:54 | dummyRows[0].comment | provenance | | +| hana.js:85:35:85:43 | tableRows | hana.js:85:35:85:54 | tableRows[0].comment | provenance | | +| hana.js:90:33:90:34 | rs | hana.js:90:33:90:45 | rs[0].comment | provenance | | | jquery.js:2:7:2:40 | tainted | jquery.js:4:5:4:11 | tainted | provenance | | | jquery.js:2:7:2:40 | tainted | jquery.js:5:13:5:19 | tainted | provenance | | | jquery.js:2:7:2:40 | tainted | jquery.js:6:11:6:17 | tainted | provenance | | @@ -1274,6 +1316,20 @@ subpaths | various-concat-obfuscations.js:21:17:21:46 | documen ... h.attrs | various-concat-obfuscations.js:17:24:17:28 | attrs | various-concat-obfuscations.js:18:10:18:105 | '
') | various-concat-obfuscations.js:21:4:21:47 | indirec ... .attrs) | | various-concat-obfuscations.js:21:17:21:46 | documen ... h.attrs | various-concat-obfuscations.js:17:24:17:28 | attrs | various-concat-obfuscations.js:18:10:18:105 | '
') [ArrayElement] | various-concat-obfuscations.js:21:4:21:47 | indirec ... .attrs) | #select +| hana.js:11:37:11:51 | rows[0].comment | hana.js:11:37:11:40 | rows | hana.js:11:37:11:51 | rows[0].comment | Cross-site scripting vulnerability due to $@. | hana.js:11:37:11:40 | rows | user-provided value | +| hana.js:16:37:16:51 | rows[0].comment | hana.js:16:37:16:40 | rows | hana.js:16:37:16:51 | rows[0].comment | Cross-site scripting vulnerability due to $@. | hana.js:16:37:16:40 | rows | user-provided value | +| hana.js:19:37:19:51 | rows[0].comment | hana.js:19:37:19:40 | rows | hana.js:19:37:19:51 | rows[0].comment | Cross-site scripting vulnerability due to $@. | hana.js:19:37:19:40 | rows | user-provided value | +| hana.js:22:37:22:49 | rs[0].comment | hana.js:22:37:22:38 | rs | hana.js:22:37:22:49 | rs[0].comment | Cross-site scripting vulnerability due to $@. | hana.js:22:37:22:38 | rs | user-provided value | +| hana.js:38:31:38:43 | rs[0].comment | hana.js:38:31:38:32 | rs | hana.js:38:31:38:43 | rs[0].comment | Cross-site scripting vulnerability due to $@. | hana.js:38:31:38:32 | rs | user-provided value | +| hana.js:43:33:43:52 | dummyRows[0].comment | hana.js:43:33:43:41 | dummyRows | hana.js:43:33:43:52 | dummyRows[0].comment | Cross-site scripting vulnerability due to $@. | hana.js:43:33:43:41 | dummyRows | user-provided value | +| hana.js:44:33:44:53 | tablesR ... comment | hana.js:44:33:44:42 | tablesRows | hana.js:44:33:44:53 | tablesR ... comment | Cross-site scripting vulnerability due to $@. | hana.js:44:33:44:42 | tablesRows | user-provided value | +| hana.js:50:33:50:52 | dummyRows[0].comment | hana.js:50:33:50:41 | dummyRows | hana.js:50:33:50:52 | dummyRows[0].comment | Cross-site scripting vulnerability due to $@. | hana.js:50:33:50:41 | dummyRows | user-provided value | +| hana.js:51:33:51:53 | tablesR ... comment | hana.js:51:33:51:42 | tablesRows | hana.js:51:33:51:53 | tablesR ... comment | Cross-site scripting vulnerability due to $@. | hana.js:51:33:51:42 | tablesRows | user-provided value | +| hana.js:70:33:70:47 | rows[0].comment | hana.js:70:33:70:36 | rows | hana.js:70:33:70:47 | rows[0].comment | Cross-site scripting vulnerability due to $@. | hana.js:70:33:70:36 | rows | user-provided value | +| hana.js:73:33:73:47 | rows[0].comment | hana.js:73:33:73:36 | rows | hana.js:73:33:73:47 | rows[0].comment | Cross-site scripting vulnerability due to $@. | hana.js:73:33:73:36 | rows | user-provided value | +| hana.js:84:35:84:54 | dummyRows[0].comment | hana.js:84:35:84:43 | dummyRows | hana.js:84:35:84:54 | dummyRows[0].comment | Cross-site scripting vulnerability due to $@. | hana.js:84:35:84:43 | dummyRows | user-provided value | +| hana.js:85:35:85:54 | tableRows[0].comment | hana.js:85:35:85:43 | tableRows | hana.js:85:35:85:54 | tableRows[0].comment | Cross-site scripting vulnerability due to $@. | hana.js:85:35:85:43 | tableRows | user-provided value | +| hana.js:90:33:90:45 | rs[0].comment | hana.js:90:33:90:34 | rs | hana.js:90:33:90:45 | rs[0].comment | Cross-site scripting vulnerability due to $@. | hana.js:90:33:90:34 | rs | user-provided value | | jwt.js:6:14:6:20 | decoded | jwt.js:4:36:4:39 | data | jwt.js:6:14:6:20 | decoded | Cross-site scripting vulnerability due to $@. | jwt.js:4:36:4:39 | data | user-provided value | | typeahead.js:10:16:10:18 | loc | typeahead.js:9:28:9:30 | loc | typeahead.js:10:16:10:18 | loc | Cross-site scripting vulnerability due to $@. | typeahead.js:9:28:9:30 | loc | user-provided value | | xmlRequest.js:9:28:9:39 | json.message | xmlRequest.js:8:31:8:46 | xhr.responseText | xmlRequest.js:9:28:9:39 | json.message | Cross-site scripting vulnerability due to $@. | xmlRequest.js:8:31:8:46 | xhr.responseText | user-provided value | diff --git a/javascript/ql/test/query-tests/Security/CWE-079/DomBasedXss/hana.js b/javascript/ql/test/query-tests/Security/CWE-079/DomBasedXss/hana.js new file mode 100644 index 00000000000..ef7c9cd71eb --- /dev/null +++ b/javascript/ql/test/query-tests/Security/CWE-079/DomBasedXss/hana.js @@ -0,0 +1,93 @@ +const hana = require('@sap/hana-client'); +const express = require('express'); + +const app = express(); +const connectionParams = {}; +const query = ``; +app.post('/documents/find', (req, res) => { + const conn = hana.createConnection(); + conn.connect(connectionParams, (err) => { + conn.exec(query, (err, rows) => { + document.body.innerHTML = rows[0].comment; // $ Alert[js/xss-additional-sources-dom-test] + }); + + const stmt = conn.prepare(query); + stmt.exec([0], (err, rows) => { + document.body.innerHTML = rows[0].comment; // $ Alert[js/xss-additional-sources-dom-test] + }); + stmt.execBatch([[1, "a"], [2, "b"]], function(err, rows) { + document.body.innerHTML = rows[0].comment; // $ Alert[js/xss-additional-sources-dom-test] + }); + stmt.execQuery([100, "a"], function(err, rs) { + document.body.innerHTML = rs[0].comment; // $ Alert[js/xss-additional-sources-dom-test] + }); + }); +}); + +var hdbext = require('@sap/hdbext'); +var express = require('express'); +var dbStream = require('@sap/hana-client/extension/Stream'); + +var app1 = express(); +const hanaConfig = {}; +app1.use(hdbext.middleware(hanaConfig)); + +app1.get('/execute-query', function (req, res) { + var client = req.db; + client.exec(query, function (err, rs) { + document.body.innerHTML = rs[0].comment; // $ Alert[js/xss-additional-sources-dom-test] + }); + + dbStream.createProcStatement(client, query, function (err, stmt) { + stmt.exec({ A: 1, B: 4 }, function (err, params, dummyRows, tablesRows) { + document.body.innerHTML = dummyRows[0].comment; // $ Alert[js/xss-additional-sources-dom-test] + document.body.innerHTML = tablesRows[0].comment; // $ Alert[js/xss-additional-sources-dom-test] + }); + }); + + hdbext.loadProcedure(client, null, query, function(err, sp) { + sp(3, maliciousInput, function(err, parameters, dummyRows, tablesRows) { + document.body.innerHTML = dummyRows[0].comment; // $ Alert[js/xss-additional-sources-dom-test] + document.body.innerHTML = tablesRows[0].comment; // $ Alert[js/xss-additional-sources-dom-test] + }); + }); +}); + + +var hdb = require('hdb'); +const async = require('async'); +const { q } = require('underscore.string'); + +const options = {}; +const app2 = express(); + +app2.post('/documents/find', (req, res) => { + var client = hdb.createClient(options); + + client.connect(function onconnect(err) { + + client.exec(query, function (err, rows) { + document.body.innerHTML = rows[0].comment; // $ Alert[js/xss-additional-sources-dom-test] + }); + client.exec(query, options, function(err, rows) { + document.body.innerHTML = rows[0].comment; // $ Alert[js/xss-additional-sources-dom-test] + }); + + client.prepare(query, function (err, statement){ + statement.exec([1], function (err, rows) { + document.body.innerHTML = rows[0].comment; // $ Alert[js/xss-additional-sources-dom-test] + }); + }); + + client.prepare(query, function(err, statement){ + statement.exec({A: 3, B: 1}, function(err, parameters, dummyRows, tableRows) { + document.body.innerHTML = dummyRows[0].comment; // $ Alert[js/xss-additional-sources-dom-test] + document.body.innerHTML = tableRows[0].comment; // $ Alert[js/xss-additional-sources-dom-test] + }); + }); + + client.execute(query, function(err, rs) { + document.body.innerHTML = rs[0].comment; // $ Alert[js/xss-additional-sources-dom-test] + }); + }); +});