hohn/codeql
1
0
Fork 0
mirror of https://github.com/github/codeql.git synced 2026-05-05 21:55:19 +02:00
Code Issues Packages Projects Releases Wiki Activity

Merge pull request #8724 from erik-krogh/postMessage

Browse Source 
JS: promote the `js/missing-origin-verification` query
This commit is contained in:
Erik Krogh Kristensen
2022-05-09 12:28:58 +02:00
committed by GitHub
parent fe1e47bc17 58db9226dc
commit 53b26eba17
40 changed files with 231 additions and 139 deletions
Download Patch File Download Diff File Expand all files Collapse all files

18
javascript/ql/lib/semmle/javascript/dataflow/TaintTracking.qll
View File

@@ -1225,19 +1225,25 @@ module TaintTracking {
* An equality test on `e.origin` or `e.source` where `e` is a `postMessage` event object,
* considered as a sanitizer for `e`.
*/
private class PostMessageEventSanitizer extends AdditionalSanitizerGuardNode, DataFlow::ValueNode {
private class PostMessageEventSanitizer extends AdditionalSanitizerGuardNode {
VarAccess event;
override EqualityTest astNode;
boolean polarity;
PostMessageEventSanitizer() {
exists(string prop | prop = "origin" or prop = "source" |
astNode.getAnOperand().(PropAccess).accesses(event, prop) and
event.mayReferToParameter(any(PostMessageEventHandler h).getEventParameter())
event.mayReferToParameter(any(PostMessageEventHandler h).getEventParameter()) and
exists(DataFlow::PropRead read | read.accesses(event.flow(), ["origin", "source"]) |
exists(EqualityTest test | polarity = test.getPolarity() and this.getAstNode() = test |
test.getAnOperand().flow() = read
)
or
exists(InclusionTest test | polarity = test.getPolarity() and this = test |
test.getContainedNode() = read
)
)
}
override predicate sanitizes(boolean outcome, Expr e) {
outcome = astNode.getPolarity() and
outcome = polarity and
e = event
}