hohn/codeql
1
0
Fork 0
mirror of https://github.com/github/codeql.git synced 2026-03-21 15:06:46 +01:00
Code Issues Packages Projects Releases Wiki Activity

JavaScript: Select Nodes (instead of PathNodes) everywhere.

Browse Source
This commit is contained in:
Max Schaefer
2018-11-08 15:01:45 +00:00
parent e365b722ee
commit 52ae757279
30 changed files with 53 additions and 33 deletions
Download Patch File Download Diff File Expand all files Collapse all files

3
javascript/ql/src/Security/CWE-022/TaintedPath.ql
View File

@@ -20,4 +20,5 @@ import DataFlow::PathGraph
from Configuration cfg, DataFlow::PathNode source, DataFlow::PathNode sink
where cfg.hasPathFlow(source, sink)
select sink.getNode(), source, sink, "This path depends on $@.", source, "a user-provided value"
select sink.getNode(), source, sink, "This path depends on $@.",
source.getNode(), "a user-provided value"

3
javascript/ql/src/Security/CWE-078/CommandInjection.ql
View File

@@ -22,4 +22,5 @@ where cfg.hasPathFlow(source, sink) and
cfg.isSinkWithHighlight(sink.getNode(), highlight)
else
highlight = sink.getNode()
select highlight, source, sink, "This command depends on $@.", source, "a user-provided value"
select highlight, source, sink, "This command depends on $@.",
source.getNode(), "a user-provided value"

2
javascript/ql/src/Security/CWE-079/ReflectedXss.ql
View File

@@ -18,4 +18,4 @@ import DataFlow::PathGraph
from Configuration cfg, DataFlow::PathNode source, DataFlow::PathNode sink
where cfg.hasPathFlow(source, sink)
select sink.getNode(), source, sink, "Cross-site scripting vulnerability due to $@.",
source, "user-provided value"
source.getNode(), "user-provided value"

2
javascript/ql/src/Security/CWE-079/StoredXss.ql
View File

@@ -18,4 +18,4 @@ import DataFlow::PathGraph
from Configuration cfg, DataFlow::PathNode source, DataFlow::PathNode sink
where cfg.hasPathFlow(source, sink)
select sink.getNode(), source, sink, "Stored cross-site scripting vulnerability due to $@.",
source, "stored value"
source.getNode(), "stored value"

2
javascript/ql/src/Security/CWE-079/Xss.ql
View File

@@ -18,4 +18,4 @@ import DataFlow::PathGraph
from Configuration cfg, DataFlow::PathNode source, DataFlow::PathNode sink
where cfg.hasPathFlow(source, sink)
select sink.getNode(), source, sink, sink.getNode().(Sink).getVulnerabilityKind() + " vulnerability due to $@.",
source, "user-provided value"
source.getNode(), "user-provided value"

3
javascript/ql/src/Security/CWE-089/SqlInjection.ql
View File

@@ -19,4 +19,5 @@ from DataFlow::Configuration cfg, DataFlow::PathNode source, DataFlow::PathNode
where (cfg instanceof SqlInjection::Configuration or
cfg instanceof NosqlInjection::Configuration) and
cfg.hasPathFlow(source, sink)
select sink.getNode(), source, sink, "This query depends on $@.", source, "a user-provided value"
select sink.getNode(), source, sink, "This query depends on $@.",
source.getNode(), "a user-provided value"

3
javascript/ql/src/Security/CWE-094/CodeInjection.ql
View File

@@ -18,4 +18,5 @@ import DataFlow::PathGraph
from Configuration cfg, DataFlow::PathNode source, DataFlow::PathNode sink
where cfg.hasPathFlow(source, sink)
select sink.getNode(), source, sink, "$@ flows to here and is interpreted as code.", source, "User-provided value"
select sink.getNode(), source, sink, "$@ flows to here and is interpreted as code.",
source.getNode(), "User-provided value"

3
javascript/ql/src/Security/CWE-134/TaintedFormatString.ql
View File

@@ -15,4 +15,5 @@ import DataFlow::PathGraph
from Configuration cfg, DataFlow::PathNode source, DataFlow::PathNode sink
where cfg.hasPathFlow(source, sink)
select sink.getNode(), source, sink, "$@ flows here and is used in a format string.", source, "User-provided value"
select sink.getNode(), source, sink, "$@ flows here and is used in a format string.",
source.getNode(), "User-provided value"

3
javascript/ql/src/Security/CWE-200/FileAccessToHttp.ql
View File

@@ -14,4 +14,5 @@ import DataFlow::PathGraph
from Configuration cfg, DataFlow::PathNode source, DataFlow::PathNode sink
where cfg.hasPathFlow(source, sink)
select sink.getNode(), source, sink, "$@ flows directly to outbound network request", source, "File data"
select sink.getNode(), source, sink, "$@ flows directly to outbound network request",
source.getNode(), "File data"

2
javascript/ql/src/Security/CWE-209/StackTraceExposure.ql
View File

@@ -18,4 +18,4 @@ import DataFlow::PathGraph
from Configuration cfg, DataFlow::PathNode source, DataFlow::PathNode sink
where cfg.hasPathFlow(source, sink)
select sink.getNode(), source, sink, "Stack trace information from $@ may be exposed to an external user here.",
source, "here"
source.getNode(), "here"

3
javascript/ql/src/Security/CWE-312/CleartextLogging.ql
View File

@@ -36,4 +36,5 @@ from Configuration cfg, DataFlow::PathNode source, DataFlow::PathNode sink
where cfg.hasPathFlow(source, sink) and
// ignore logging to the browser console (even though it is not a good practice)
not inBrowserEnvironment(sink.getNode().asExpr().getTopLevel())
select sink.getNode(), source, sink, "Sensitive data returned by $@ is logged here.", source, source.getNode().(Source).describe()
select sink.getNode(), source, sink, "Sensitive data returned by $@ is logged here.",
source.getNode(), source.getNode().(Source).describe()

3
javascript/ql/src/Security/CWE-312/CleartextStorage.ql
View File

@@ -18,4 +18,5 @@ import DataFlow::PathGraph
from Configuration cfg, DataFlow::PathNode source, DataFlow::PathNode sink
where cfg.hasPathFlow(source, sink)
select sink.getNode(), source, sink, "Sensitive data returned by $@ is stored here.", source, source.getNode().(Source).describe()
select sink.getNode(), source, sink, "Sensitive data returned by $@ is stored here.",
source.getNode(), source.getNode().(Source).describe()

5
javascript/ql/src/Security/CWE-327/BrokenCryptoAlgorithm.ql
View File

@@ -16,5 +16,6 @@ import DataFlow::PathGraph
from Configuration cfg, DataFlow::PathNode source, DataFlow::PathNode sink
where cfg.hasPathFlow(source, sink) and
not source.asExpr() instanceof CleartextPasswordExpr // flagged by js/insufficient-password-hash
select sink.getNode(), source, sink, "Sensitive data from $@ is used in a broken or weak cryptographic algorithm.", source , source.(Source).describe()
not source.getNode().asExpr() instanceof CleartextPasswordExpr // flagged by js/insufficient-password-hash
select sink.getNode(), source, sink, "Sensitive data from $@ is used in a broken or weak cryptographic algorithm.",
source.getNode(), source.getNode().(Source).describe()

3
javascript/ql/src/Security/CWE-338/InsecureRandomness.ql
View File

@@ -16,4 +16,5 @@ import DataFlow::PathGraph
from Configuration cfg, DataFlow::PathNode source, DataFlow::PathNode sink
where cfg.hasPathFlow(source, sink)
select sink.getNode(), source, sink, "Cryptographically insecure $@ in a security context.", source, "random value"
select sink.getNode(), source, sink, "Cryptographically insecure $@ in a security context.",
source.getNode(), "random value"

4
javascript/ql/src/Security/CWE-346/CorsMisconfigurationForCredentials.ql
View File

@@ -18,5 +18,5 @@ import DataFlow::PathGraph
from Configuration cfg, DataFlow::PathNode source, DataFlow::PathNode sink
where cfg.hasPathFlow(source, sink)
select sink.getNode(), source, sink, "$@ leak vulnerability due to $@.",
sink.(Sink).getCredentialsHeader(), "Credential",
source, "a misconfigured CORS header value"
sink.getNode().(Sink).getCredentialsHeader(), "Credential",
source.getNode(), "a misconfigured CORS header value"

4
javascript/ql/src/Security/CWE-400/RemotePropertyInjection.ql
View File

@@ -18,5 +18,5 @@ import DataFlow::PathGraph
from Configuration cfg, DataFlow::PathNode source, DataFlow::PathNode sink
where cfg.hasPathFlow(source, sink)
select sink.getNode(), source, sink, "A $@ is used as" + sink.(Sink).getMessage(),
source, "user-provided value"
select sink.getNode(), source, sink, "A $@ is used as" + sink.getNode().(Sink).getMessage(),
source.getNode(), "user-provided value"

3
javascript/ql/src/Security/CWE-502/UnsafeDeserialization.ql
View File

@@ -16,4 +16,5 @@ import DataFlow::PathGraph
from Configuration cfg, DataFlow::PathNode source, DataFlow::PathNode sink
where cfg.hasPathFlow(source, sink)
select sink.getNode(), source, sink, "Unsafe deserialization of $@.", source, "user input"
select sink.getNode(), source, sink, "Unsafe deserialization of $@.",
source.getNode(), "user input"

3
javascript/ql/src/Security/CWE-601/ClientSideUrlRedirect.ql
View File

@@ -18,4 +18,5 @@ import DataFlow::PathGraph
from Configuration cfg, DataFlow::PathNode source, DataFlow::PathNode sink
where cfg.hasPathFlow(source, sink)
select sink.getNode(), source, sink, "Untrusted URL redirection due to $@.", source, "user-provided value"
select sink.getNode(), source, sink, "Untrusted URL redirection due to $@.",
source.getNode(), "user-provided value"

3
javascript/ql/src/Security/CWE-601/ServerSideUrlRedirect.ql
View File

@@ -16,4 +16,5 @@ import DataFlow::PathGraph
from Configuration cfg, DataFlow::PathNode source, DataFlow::PathNode sink
where cfg.hasPathFlow(source, sink)
select sink.getNode(), source, sink, "Untrusted URL redirection due to $@.", source, "user-provided value"
select sink.getNode(), source, sink, "Untrusted URL redirection due to $@.",
source.getNode(), "user-provided value"

2
javascript/ql/src/Security/CWE-611/Xxe.ql
View File

@@ -18,4 +18,4 @@ import DataFlow::PathGraph
from Configuration cfg, DataFlow::PathNode source, DataFlow::PathNode sink
where cfg.hasPathFlow(source, sink)
select sink.getNode(), source, sink, "A $@ is parsed as XML without guarding against external entity expansion.",
source, "user-provided value"
source.getNode(), "user-provided value"

3
javascript/ql/src/Security/CWE-640/HostHeaderPoisoningInEmailGeneration.ql
View File

@@ -16,4 +16,5 @@ import DataFlow::PathGraph
from Configuration cfg, DataFlow::PathNode source, DataFlow::PathNode sink
where cfg.hasPathFlow(source, sink)
select sink.getNode(), source, sink, "Links in this email can be hijacked by poisoning the HTTP host header $@.", source, "here"
select sink.getNode(), source, sink, "Links in this email can be hijacked by poisoning the HTTP host header $@.",
source.getNode(), "here"

3
javascript/ql/src/Security/CWE-643/XpathInjection.ql
View File

@@ -16,4 +16,5 @@ import DataFlow::PathGraph
from Configuration cfg, DataFlow::PathNode source, DataFlow::PathNode sink
where cfg.hasPathFlow(source, sink)
select sink.getNode(), source, sink, "$@ flows here and is used in an XPath expression.", source, "User-provided value"
select sink.getNode(), source, sink, "$@ flows here and is used in an XPath expression.",
source.getNode(), "User-provided value"

3
javascript/ql/src/Security/CWE-730/RegExpInjection.ql
View File

@@ -18,4 +18,5 @@ import DataFlow::PathGraph
from Configuration cfg, DataFlow::PathNode source, DataFlow::PathNode sink
where cfg.hasPathFlow(source, sink)
select sink.getNode(), source, sink, "This regular expression is constructed from a $@.", source, "user-provided value"
select sink.getNode(), source, sink, "This regular expression is constructed from a $@.",
source.getNode(), "user-provided value"

2
javascript/ql/src/Security/CWE-776/XmlBomb.ql
View File

@@ -18,4 +18,4 @@ import DataFlow::PathGraph
from Configuration cfg, DataFlow::PathNode source, DataFlow::PathNode sink
where cfg.hasPathFlow(source, sink)
select sink.getNode(), source, sink, "A $@ is parsed as XML without guarding against uncontrolled entity expansion.",
source, "user-provided value"
source.getNode(), "user-provided value"

3
javascript/ql/src/Security/CWE-798/HardcodedCredentials.ql
View File

@@ -23,4 +23,5 @@ where cfg.hasPathFlow(source, sink) and
value = "The hard-coded value \"" + source.getNode().asExpr().(ConstantString).getStringValue() + "\""
else
value = "This hard-coded value"
select source.getNode(), source, sink, value + " is used as $@.", sink, sink.getNode().(Sink).getKind()
select source.getNode(), source, sink, value + " is used as $@.",
sink.getNode(), sink.getNode().(Sink).getKind()

2
javascript/ql/src/Security/CWE-807/ConditionalBypass.ql
View File

@@ -114,4 +114,4 @@ where isTaintedGuardForSensitiveAction(sink, source, action) and
not isEarlyAbortGuard(sink, action)
select sink.getNode(), source, sink, "This condition guards a sensitive $@, but $@ controls it.",
action, "action",
source, "a user-provided value"
source.getNode(), "a user-provided value"

3
javascript/ql/src/Security/CWE-843/TypeConfusionThroughParameterTampering.ql
View File

@@ -15,4 +15,5 @@ import DataFlow::PathGraph
from Configuration cfg, DataFlow::PathNode source, DataFlow::PathNode sink
where cfg.hasPathFlow(source, sink)
select sink.getNode(), source, sink, "Potential type confusion for $@.", source, "HTTP request parameter"
select sink.getNode(), source, sink, "Potential type confusion for $@.",
source.getNode(), "HTTP request parameter"

2
javascript/ql/src/Security/CWE-912/HttpToFileAccess.ql
View File

@@ -14,4 +14,4 @@ import DataFlow::PathGraph
from Configuration cfg, DataFlow::PathNode source, DataFlow::PathNode sink
where cfg.hasPathFlow(source, sink)
select sink.getNode(), source, sink, "$@ flows to file system", source, "Untrusted data"
select sink.getNode(), source, sink, "$@ flows to file system", source.getNode(), "Untrusted data"

3
javascript/ql/src/Security/CWE-916/InsufficientPasswordHash.ql
View File

@@ -15,4 +15,5 @@ import DataFlow::PathGraph
from Configuration cfg, DataFlow::PathNode source, DataFlow::PathNode sink
where cfg.hasPathFlow(source, sink)
select sink.getNode(), source, sink, "Password from $@ is hashed insecurely.", source , source.(Source).describe()
select sink.getNode(), source, sink, "Password from $@ is hashed insecurely.",
source.getNode(), source.getNode().(Source).describe()

3
javascript/ql/src/Security/CWE-918/RequestForgery.ql
View File

@@ -16,4 +16,5 @@ import DataFlow::PathGraph
from Configuration cfg, DataFlow::PathNode source, DataFlow::PathNode sink, DataFlow::Node request
where cfg.hasPathFlow(source, sink) and
request = sink.getNode().(Sink).getARequest()
select request, source, sink, "The $@ of this request depends on $@.", sink, sink.getNode().(Sink).getKind(), source, "a user-provided value"
select request, source, sink, "The $@ of this request depends on $@.",
sink.getNode(), sink.getNode().(Sink).getKind(), source, "a user-provided value"