hohn/codeql
1
0
Fork 0
mirror of https://github.com/github/codeql.git synced 2026-04-26 17:25:19 +02:00
Code Issues Packages Projects Releases Wiki Activity

JS: Fixed path query not flagging new RegExp with DotRemovingReplaceCall

Browse Source
This commit is contained in:
Napalys
2024-11-27 08:55:21 +01:00
parent aa557cf950
commit 875478c1c6
4 changed files with 114 additions and 5 deletions
Download Patch File Download Diff File Expand all files Collapse all files

6
javascript/ql/lib/semmle/javascript/security/dataflow/TaintedPathCustomizations.qll
View File

@@ -305,9 +305,9 @@ module TaintedPath {
input = this.getReceiver() and
output = this and
this.isGlobal() and
exists(RegExpLiteral literal, RegExpTerm term |
this.getRegExp().asExpr() = literal and
literal.getRoot() = term and
exists(DataFlow::RegExpCreationNode regexp, RegExpTerm term |
this.getRegExp() = regexp and
regexp.getRoot() = term and
not term.getAMatchedString() = "/"
|
term.getAMatchedString() = "." or

1
javascript/ql/test/query-tests/Security/CWE-022/TaintedPath/Consistency.expected
View File

@@ -1 +0,0 @@
| TaintedPath.js:213 | expected an alert, but found none | NOT OK (can be absolute) | |

110
javascript/ql/test/query-tests/Security/CWE-022/TaintedPath/TaintedPath.expected
View File

@@ -1627,6 +1627,22 @@ nodes
| TaintedPath.js:211:7:211:48 | path |
| TaintedPath.js:211:7:211:48 | path |
| TaintedPath.js:211:7:211:48 | path |
| TaintedPath.js:211:7:211:48 | path |
| TaintedPath.js:211:7:211:48 | path |
| TaintedPath.js:211:7:211:48 | path |
| TaintedPath.js:211:7:211:48 | path |
| TaintedPath.js:211:7:211:48 | path |
| TaintedPath.js:211:7:211:48 | path |
| TaintedPath.js:211:7:211:48 | path |
| TaintedPath.js:211:7:211:48 | path |
| TaintedPath.js:211:14:211:37 | url.par ... , true) |
| TaintedPath.js:211:14:211:37 | url.par ... , true) |
| TaintedPath.js:211:14:211:37 | url.par ... , true) |
| TaintedPath.js:211:14:211:37 | url.par ... , true) |
| TaintedPath.js:211:14:211:37 | url.par ... , true) |
| TaintedPath.js:211:14:211:37 | url.par ... , true) |
| TaintedPath.js:211:14:211:37 | url.par ... , true) |
| TaintedPath.js:211:14:211:37 | url.par ... , true) |
| TaintedPath.js:211:14:211:37 | url.par ... , true) |
| TaintedPath.js:211:14:211:37 | url.par ... , true) |
| TaintedPath.js:211:14:211:37 | url.par ... , true) |
@@ -1643,6 +1659,22 @@ nodes
| TaintedPath.js:211:14:211:43 | url.par ... ).query |
| TaintedPath.js:211:14:211:43 | url.par ... ).query |
| TaintedPath.js:211:14:211:43 | url.par ... ).query |
| TaintedPath.js:211:14:211:43 | url.par ... ).query |
| TaintedPath.js:211:14:211:43 | url.par ... ).query |
| TaintedPath.js:211:14:211:43 | url.par ... ).query |
| TaintedPath.js:211:14:211:43 | url.par ... ).query |
| TaintedPath.js:211:14:211:43 | url.par ... ).query |
| TaintedPath.js:211:14:211:43 | url.par ... ).query |
| TaintedPath.js:211:14:211:43 | url.par ... ).query |
| TaintedPath.js:211:14:211:43 | url.par ... ).query |
| TaintedPath.js:211:14:211:48 | url.par ... ry.path |
| TaintedPath.js:211:14:211:48 | url.par ... ry.path |
| TaintedPath.js:211:14:211:48 | url.par ... ry.path |
| TaintedPath.js:211:14:211:48 | url.par ... ry.path |
| TaintedPath.js:211:14:211:48 | url.par ... ry.path |
| TaintedPath.js:211:14:211:48 | url.par ... ry.path |
| TaintedPath.js:211:14:211:48 | url.par ... ry.path |
| TaintedPath.js:211:14:211:48 | url.par ... ry.path |
| TaintedPath.js:211:14:211:48 | url.par ... ry.path |
| TaintedPath.js:211:14:211:48 | url.par ... ry.path |
| TaintedPath.js:211:14:211:48 | url.par ... ry.path |
@@ -1656,6 +1688,19 @@ nodes
| TaintedPath.js:211:24:211:30 | req.url |
| TaintedPath.js:211:24:211:30 | req.url |
| TaintedPath.js:211:24:211:30 | req.url |
| TaintedPath.js:213:29:213:32 | path |
| TaintedPath.js:213:29:213:32 | path |
| TaintedPath.js:213:29:213:32 | path |
| TaintedPath.js:213:29:213:32 | path |
| TaintedPath.js:213:29:213:32 | path |
| TaintedPath.js:213:29:213:32 | path |
| TaintedPath.js:213:29:213:32 | path |
| TaintedPath.js:213:29:213:32 | path |
| TaintedPath.js:213:29:213:68 | path.re ... '), '') |
| TaintedPath.js:213:29:213:68 | path.re ... '), '') |
| TaintedPath.js:213:29:213:68 | path.re ... '), '') |
| TaintedPath.js:213:29:213:68 | path.re ... '), '') |
| TaintedPath.js:213:29:213:68 | path.re ... '), '') |
| TaintedPath.js:216:31:216:34 | path |
| TaintedPath.js:216:31:216:34 | path |
| TaintedPath.js:216:31:216:34 | path |
@@ -6964,6 +7009,14 @@ edges
| TaintedPath.js:206:29:206:32 | path | TaintedPath.js:206:29:206:85 | path.re ... '), '') |
| TaintedPath.js:206:29:206:32 | path | TaintedPath.js:206:29:206:85 | path.re ... '), '') |
| TaintedPath.js:206:29:206:32 | path | TaintedPath.js:206:29:206:85 | path.re ... '), '') |
| TaintedPath.js:211:7:211:48 | path | TaintedPath.js:213:29:213:32 | path |
| TaintedPath.js:211:7:211:48 | path | TaintedPath.js:213:29:213:32 | path |
| TaintedPath.js:211:7:211:48 | path | TaintedPath.js:213:29:213:32 | path |
| TaintedPath.js:211:7:211:48 | path | TaintedPath.js:213:29:213:32 | path |
| TaintedPath.js:211:7:211:48 | path | TaintedPath.js:213:29:213:32 | path |
| TaintedPath.js:211:7:211:48 | path | TaintedPath.js:213:29:213:32 | path |
| TaintedPath.js:211:7:211:48 | path | TaintedPath.js:213:29:213:32 | path |
| TaintedPath.js:211:7:211:48 | path | TaintedPath.js:213:29:213:32 | path |
| TaintedPath.js:211:7:211:48 | path | TaintedPath.js:216:31:216:34 | path |
| TaintedPath.js:211:7:211:48 | path | TaintedPath.js:216:31:216:34 | path |
| TaintedPath.js:211:7:211:48 | path | TaintedPath.js:216:31:216:34 | path |
@@ -6980,6 +7033,14 @@ edges
| TaintedPath.js:211:14:211:37 | url.par ... , true) | TaintedPath.js:211:14:211:43 | url.par ... ).query |
| TaintedPath.js:211:14:211:37 | url.par ... , true) | TaintedPath.js:211:14:211:43 | url.par ... ).query |
| TaintedPath.js:211:14:211:37 | url.par ... , true) | TaintedPath.js:211:14:211:43 | url.par ... ).query |
| TaintedPath.js:211:14:211:37 | url.par ... , true) | TaintedPath.js:211:14:211:43 | url.par ... ).query |
| TaintedPath.js:211:14:211:37 | url.par ... , true) | TaintedPath.js:211:14:211:43 | url.par ... ).query |
| TaintedPath.js:211:14:211:37 | url.par ... , true) | TaintedPath.js:211:14:211:43 | url.par ... ).query |
| TaintedPath.js:211:14:211:37 | url.par ... , true) | TaintedPath.js:211:14:211:43 | url.par ... ).query |
| TaintedPath.js:211:14:211:37 | url.par ... , true) | TaintedPath.js:211:14:211:43 | url.par ... ).query |
| TaintedPath.js:211:14:211:37 | url.par ... , true) | TaintedPath.js:211:14:211:43 | url.par ... ).query |
| TaintedPath.js:211:14:211:37 | url.par ... , true) | TaintedPath.js:211:14:211:43 | url.par ... ).query |
| TaintedPath.js:211:14:211:37 | url.par ... , true) | TaintedPath.js:211:14:211:43 | url.par ... ).query |
| TaintedPath.js:211:14:211:43 | url.par ... ).query | TaintedPath.js:211:14:211:48 | url.par ... ry.path |
| TaintedPath.js:211:14:211:43 | url.par ... ).query | TaintedPath.js:211:14:211:48 | url.par ... ry.path |
| TaintedPath.js:211:14:211:43 | url.par ... ).query | TaintedPath.js:211:14:211:48 | url.par ... ry.path |
@@ -6988,6 +7049,22 @@ edges
| TaintedPath.js:211:14:211:43 | url.par ... ).query | TaintedPath.js:211:14:211:48 | url.par ... ry.path |
| TaintedPath.js:211:14:211:43 | url.par ... ).query | TaintedPath.js:211:14:211:48 | url.par ... ry.path |
| TaintedPath.js:211:14:211:43 | url.par ... ).query | TaintedPath.js:211:14:211:48 | url.par ... ry.path |
| TaintedPath.js:211:14:211:43 | url.par ... ).query | TaintedPath.js:211:14:211:48 | url.par ... ry.path |
| TaintedPath.js:211:14:211:43 | url.par ... ).query | TaintedPath.js:211:14:211:48 | url.par ... ry.path |
| TaintedPath.js:211:14:211:43 | url.par ... ).query | TaintedPath.js:211:14:211:48 | url.par ... ry.path |
| TaintedPath.js:211:14:211:43 | url.par ... ).query | TaintedPath.js:211:14:211:48 | url.par ... ry.path |
| TaintedPath.js:211:14:211:43 | url.par ... ).query | TaintedPath.js:211:14:211:48 | url.par ... ry.path |
| TaintedPath.js:211:14:211:43 | url.par ... ).query | TaintedPath.js:211:14:211:48 | url.par ... ry.path |
| TaintedPath.js:211:14:211:43 | url.par ... ).query | TaintedPath.js:211:14:211:48 | url.par ... ry.path |
| TaintedPath.js:211:14:211:43 | url.par ... ).query | TaintedPath.js:211:14:211:48 | url.par ... ry.path |
| TaintedPath.js:211:14:211:48 | url.par ... ry.path | TaintedPath.js:211:7:211:48 | path |
| TaintedPath.js:211:14:211:48 | url.par ... ry.path | TaintedPath.js:211:7:211:48 | path |
| TaintedPath.js:211:14:211:48 | url.par ... ry.path | TaintedPath.js:211:7:211:48 | path |
| TaintedPath.js:211:14:211:48 | url.par ... ry.path | TaintedPath.js:211:7:211:48 | path |
| TaintedPath.js:211:14:211:48 | url.par ... ry.path | TaintedPath.js:211:7:211:48 | path |
| TaintedPath.js:211:14:211:48 | url.par ... ry.path | TaintedPath.js:211:7:211:48 | path |
| TaintedPath.js:211:14:211:48 | url.par ... ry.path | TaintedPath.js:211:7:211:48 | path |
| TaintedPath.js:211:14:211:48 | url.par ... ry.path | TaintedPath.js:211:7:211:48 | path |
| TaintedPath.js:211:14:211:48 | url.par ... ry.path | TaintedPath.js:211:7:211:48 | path |
| TaintedPath.js:211:14:211:48 | url.par ... ry.path | TaintedPath.js:211:7:211:48 | path |
| TaintedPath.js:211:14:211:48 | url.par ... ry.path | TaintedPath.js:211:7:211:48 | path |
@@ -7012,6 +7089,38 @@ edges
| TaintedPath.js:211:24:211:30 | req.url | TaintedPath.js:211:14:211:37 | url.par ... , true) |
| TaintedPath.js:211:24:211:30 | req.url | TaintedPath.js:211:14:211:37 | url.par ... , true) |
| TaintedPath.js:211:24:211:30 | req.url | TaintedPath.js:211:14:211:37 | url.par ... , true) |
| TaintedPath.js:211:24:211:30 | req.url | TaintedPath.js:211:14:211:37 | url.par ... , true) |
| TaintedPath.js:211:24:211:30 | req.url | TaintedPath.js:211:14:211:37 | url.par ... , true) |
| TaintedPath.js:211:24:211:30 | req.url | TaintedPath.js:211:14:211:37 | url.par ... , true) |
| TaintedPath.js:211:24:211:30 | req.url | TaintedPath.js:211:14:211:37 | url.par ... , true) |
| TaintedPath.js:211:24:211:30 | req.url | TaintedPath.js:211:14:211:37 | url.par ... , true) |
| TaintedPath.js:211:24:211:30 | req.url | TaintedPath.js:211:14:211:37 | url.par ... , true) |
| TaintedPath.js:211:24:211:30 | req.url | TaintedPath.js:211:14:211:37 | url.par ... , true) |
| TaintedPath.js:211:24:211:30 | req.url | TaintedPath.js:211:14:211:37 | url.par ... , true) |
| TaintedPath.js:211:24:211:30 | req.url | TaintedPath.js:211:14:211:37 | url.par ... , true) |
| TaintedPath.js:211:24:211:30 | req.url | TaintedPath.js:211:14:211:37 | url.par ... , true) |
| TaintedPath.js:211:24:211:30 | req.url | TaintedPath.js:211:14:211:37 | url.par ... , true) |
| TaintedPath.js:211:24:211:30 | req.url | TaintedPath.js:211:14:211:37 | url.par ... , true) |
| TaintedPath.js:211:24:211:30 | req.url | TaintedPath.js:211:14:211:37 | url.par ... , true) |
| TaintedPath.js:211:24:211:30 | req.url | TaintedPath.js:211:14:211:37 | url.par ... , true) |
| TaintedPath.js:211:24:211:30 | req.url | TaintedPath.js:211:14:211:37 | url.par ... , true) |
| TaintedPath.js:211:24:211:30 | req.url | TaintedPath.js:211:14:211:37 | url.par ... , true) |
| TaintedPath.js:213:29:213:32 | path | TaintedPath.js:213:29:213:68 | path.re ... '), '') |
| TaintedPath.js:213:29:213:32 | path | TaintedPath.js:213:29:213:68 | path.re ... '), '') |
| TaintedPath.js:213:29:213:32 | path | TaintedPath.js:213:29:213:68 | path.re ... '), '') |
| TaintedPath.js:213:29:213:32 | path | TaintedPath.js:213:29:213:68 | path.re ... '), '') |
| TaintedPath.js:213:29:213:32 | path | TaintedPath.js:213:29:213:68 | path.re ... '), '') |
| TaintedPath.js:213:29:213:32 | path | TaintedPath.js:213:29:213:68 | path.re ... '), '') |
| TaintedPath.js:213:29:213:32 | path | TaintedPath.js:213:29:213:68 | path.re ... '), '') |
| TaintedPath.js:213:29:213:32 | path | TaintedPath.js:213:29:213:68 | path.re ... '), '') |
| TaintedPath.js:213:29:213:32 | path | TaintedPath.js:213:29:213:68 | path.re ... '), '') |
| TaintedPath.js:213:29:213:32 | path | TaintedPath.js:213:29:213:68 | path.re ... '), '') |
| TaintedPath.js:213:29:213:32 | path | TaintedPath.js:213:29:213:68 | path.re ... '), '') |
| TaintedPath.js:213:29:213:32 | path | TaintedPath.js:213:29:213:68 | path.re ... '), '') |
| TaintedPath.js:213:29:213:32 | path | TaintedPath.js:213:29:213:68 | path.re ... '), '') |
| TaintedPath.js:213:29:213:32 | path | TaintedPath.js:213:29:213:68 | path.re ... '), '') |
| TaintedPath.js:213:29:213:32 | path | TaintedPath.js:213:29:213:68 | path.re ... '), '') |
| TaintedPath.js:213:29:213:32 | path | TaintedPath.js:213:29:213:68 | path.re ... '), '') |
| TaintedPath.js:216:31:216:34 | path | TaintedPath.js:216:31:216:69 | path.re ... '), '') |
| TaintedPath.js:216:31:216:34 | path | TaintedPath.js:216:31:216:69 | path.re ... '), '') |
| TaintedPath.js:216:31:216:34 | path | TaintedPath.js:216:31:216:69 | path.re ... '), '') |
@@ -10848,6 +10957,7 @@ edges
| TaintedPath.js:197:45:197:48 | path | TaintedPath.js:195:24:195:30 | req.url | TaintedPath.js:197:45:197:48 | path | This path depends on a $@. | TaintedPath.js:195:24:195:30 | req.url | user-provided value |
| TaintedPath.js:198:35:198:38 | path | TaintedPath.js:195:24:195:30 | req.url | TaintedPath.js:198:35:198:38 | path | This path depends on a $@. | TaintedPath.js:195:24:195:30 | req.url | user-provided value |
| TaintedPath.js:206:29:206:85 | path.re ... '), '') | TaintedPath.js:202:24:202:30 | req.url | TaintedPath.js:206:29:206:85 | path.re ... '), '') | This path depends on a $@. | TaintedPath.js:202:24:202:30 | req.url | user-provided value |
| TaintedPath.js:213:29:213:68 | path.re ... '), '') | TaintedPath.js:211:24:211:30 | req.url | TaintedPath.js:213:29:213:68 | path.re ... '), '') | This path depends on a $@. | TaintedPath.js:211:24:211:30 | req.url | user-provided value |
| TaintedPath.js:216:31:216:69 | path.re ... '), '') | TaintedPath.js:211:24:211:30 | req.url | TaintedPath.js:216:31:216:69 | path.re ... '), '') | This path depends on a $@. | TaintedPath.js:211:24:211:30 | req.url | user-provided value |
| examples/TaintedPath.js:11:29:11:43 | ROOT + filePath | examples/TaintedPath.js:8:28:8:34 | req.url | examples/TaintedPath.js:11:29:11:43 | ROOT + filePath | This path depends on a $@. | examples/TaintedPath.js:8:28:8:34 | req.url | user-provided value |
| express.js:8:20:8:32 | req.query.bar | express.js:8:20:8:32 | req.query.bar | express.js:8:20:8:32 | req.query.bar | This path depends on a $@. | express.js:8:20:8:32 | req.query.bar | user-provided value |

2
javascript/ql/test/query-tests/Security/CWE-022/TaintedPath/TaintedPath.js
View File

@@ -210,7 +210,7 @@ var server = http.createServer(function(req, res) {
var server = http.createServer(function(req, res) {
let path = url.parse(req.url, true).query.path;
res.write(fs.readFileSync(path.replace(new RegExp("[.]", 'g'), ''))); // NOT OK (can be absolute) -- Currently not flagged because it is not a literal
res.write(fs.readFileSync(path.replace(new RegExp("[.]", 'g'), ''))); // NOT OK (can be absolute)
if (!pathModule.isAbsolute(path)) {
res.write(fs.readFileSync(path.replace(new RegExp("[.]", ''), ''))); // NOT OK