hohn/codeql
1
0
Fork 0
mirror of https://github.com/github/codeql.git synced 2026-04-25 08:45:14 +02:00
Code Issues Packages Projects Releases Wiki Activity

JS: Port experimental DecompressionBombs to ConfigSig

Browse Source
This commit is contained in:
Asger F
2024-11-28 11:49:27 +01:00
parent 871bc3b84a
commit 834d35bc42
3 changed files with 220 additions and 361 deletions
Download Patch File Download Diff File Expand all files Collapse all files

19
javascript/ql/src/experimental/Security/CWE-522-DecompressionBombs/DecompressionBombs.ql
View File

@@ -12,24 +12,25 @@
*/
import javascript
import DataFlow::PathGraph
import DecompressionBombs
class BombConfiguration extends TaintTracking::Configuration {
BombConfiguration() { this = "DecompressionBombs" }
module DecompressionBombConfig implements DataFlow::ConfigSig {
predicate isSource(DataFlow::Node source) { source instanceof RemoteFlowSource }
override predicate isSource(DataFlow::Node source) { source instanceof RemoteFlowSource }
predicate isSink(DataFlow::Node sink) { sink instanceof DecompressionBomb::Sink }
override predicate isSink(DataFlow::Node sink) { sink instanceof DecompressionBomb::Sink }
override predicate isAdditionalTaintStep(DataFlow::Node pred, DataFlow::Node succ) {
predicate isAdditionalFlowStep(DataFlow::Node pred, DataFlow::Node succ) {
exists(DecompressionBomb::AdditionalTaintStep addstep |
addstep.isAdditionalTaintStep(pred, succ)
)
}
}
from BombConfiguration cfg, DataFlow::PathNode source, DataFlow::PathNode sink
where cfg.hasFlowPath(source, sink)
module DecompressionBombFlow = TaintTracking::Global<DecompressionBombConfig>;
import DecompressionBombFlow::PathGraph
from DecompressionBombFlow::PathNode source, DecompressionBombFlow::PathNode sink
where DecompressionBombFlow::flowPath(source, sink)
select sink.getNode(), source, sink, "This Decompression depends on a $@.", source.getNode(),
"potentially untrusted source"

1
javascript/ql/src/experimental/Security/CWE-522-DecompressionBombs/DecompressionBombs.qll
View File

@@ -1,7 +1,6 @@
import javascript
import experimental.semmle.javascript.FormParsers
import experimental.semmle.javascript.ReadableStream
import DataFlow::PathGraph
module DecompressionBomb {
/**