hohn/codeql
1
0
Fork 0
mirror of https://github.com/github/codeql.git synced 2026-04-29 02:35:15 +02:00
Code Issues Packages Projects Releases Wiki Activity

update TaintedPath to use new consistency checking

Browse Source
This commit is contained in:
Erik Krogh Kristensen
2020-06-04 11:00:15 +02:00
parent 68ca8e23c0
commit 60320a9d78
5 changed files with 9 additions and 40 deletions
Download Patch File Download Diff File Expand all files Collapse all files

6
javascript/ql/test/query-tests/Security/CWE-022/TaintedPath/Consistency.expected
View File

@@ -1,4 +1,2 @@
| normalizedPaths.js:208:38:208:63 | // OK - ... anyway | Spurious alert |
| tainted-string-steps.js:25:43:25:74 | // NOT ... flagged | Missing alert |
| tainted-string-steps.js:26:49:26:74 | // OK - ... flagged | Spurious alert |
| tainted-string-steps.js:28:39:28:70 | // NOT ... flagged | Missing alert |
| query-tests/Security/CWE-022/TaintedPath/tainted-array-steps.js:10 | expected an alert, but found none | BAD: taint is preserved |
| query-tests/Security/CWE-022/TaintedPath/tainted-array-steps.js:14 | expected an alert, but found none | BAD: taint is preserved |

31
javascript/ql/test/query-tests/Security/CWE-022/TaintedPath/Consistency.ql
View File

@@ -1,32 +1,3 @@
import javascript
import semmle.javascript.security.dataflow.TaintedPath::TaintedPath
class Assertion extends LineComment {
boolean shouldHaveAlert;
Assertion() {
if getText().matches("%NOT OK%")
then shouldHaveAlert = true
else (
getText().matches("%OK%") and shouldHaveAlert = false
)
}
predicate shouldHaveAlert() { shouldHaveAlert = true }
predicate hasAlert() {
exists(Configuration cfg, DataFlow::Node src, DataFlow::Node sink, Location loc |
cfg.hasFlow(src, sink) and
loc = sink.getAstNode().getLocation() and
loc.getFile() = getFile() and
loc.getEndLine() = getLocation().getEndLine()
)
}
}
from Assertion assertion, string message
where
assertion.shouldHaveAlert() and not assertion.hasAlert() and message = "Missing alert"
or
not assertion.shouldHaveAlert() and assertion.hasAlert() and message = "Spurious alert"
select assertion, message
import testUtilities.ConsistencyChecking

2
javascript/ql/test/query-tests/Security/CWE-022/TaintedPath/normalizedPaths.js
View File

@@ -205,7 +205,7 @@ app.get('/join-regression', (req, res) => {
fs.readFileSync(normalizedPath); // NOT OK
if (normalizedPath.startsWith('/home/user/www') || normalizedPath.startsWith('/home/user/public'))
fs.readFileSync(normalizedPath); // OK - but flagged anyway
fs.readFileSync(normalizedPath); // OK - but flagged anyway [INCONSISTENCY]
else
fs.readFileSync(normalizedPath); // NOT OK
});

4
javascript/ql/test/query-tests/Security/CWE-022/TaintedPath/tainted-array-steps.js
View File

@@ -7,11 +7,11 @@ var fs = require('fs'),
var server = http.createServer(function(req, res) {
let path = url.parse(req.url, true).query.path;
res.write(fs.readFileSync(['public', path].join('/'))); // BAD: taint is preserved [INCONSISTENCY]
res.write(fs.readFileSync(['public', path].join('/'))); // BAD: taint is preserved
let parts = ['public', path];
parts = parts.map(x => x.toLowerCase());
res.write(fs.readFileSync(parts.join('/'))); // BAD: taint is preserved [INCONSISTENCY]
res.write(fs.readFileSync(parts.join('/'))); // BAD: taint is preserved
});
server.listen();

6
javascript/ql/test/query-tests/Security/CWE-022/TaintedPath/tainted-string-steps.js
View File

@@ -22,10 +22,10 @@ var server = http.createServer(function(req, res) {
fs.readFileSync(path.split('/')[i]); // NOT OK
fs.readFileSync(path.split(/\//)[i]); // NOT OK
fs.readFileSync(path.split("?")[0]); // NOT OK
fs.readFileSync(path.split(unknown)[i]); // NOT OK -- but not yet flagged
fs.readFileSync(path.split(unknown).whatever); // OK -- but still flagged
fs.readFileSync(path.split(unknown)[i]); // NOT OK -- but not yet flagged [INCONSISTENCY]
fs.readFileSync(path.split(unknown).whatever); // OK -- but still flagged [INCONSISTENCY]
fs.readFileSync(path.split(unknown)); // NOT OK
fs.readFileSync(path.split("?")[i]); // NOT OK -- but not yet flagged
fs.readFileSync(path.split("?")[i]); // NOT OK -- but not yet flagged [INCONSISTENCY]
});
server.listen();