Merge pull request #889 from jcreedcmu/jcreed/tarslip

JavaScript: Add new query for ZipSlip (CWE-022).

javascript/ql/test/query-tests/Security/CWE-022/ZipSlip/ZipSlip.expected

@@ -0,0 +1,17 @@
+nodes
+| ZipSlipBad2.js:5:9:5:46 | fileName |
+| ZipSlipBad2.js:5:20:5:46 | 'output ... ry.path |
+| ZipSlipBad2.js:5:37:5:46 | entry.path |
+| ZipSlipBad2.js:6:22:6:29 | fileName |
+| ZipSlipBad.js:7:11:7:31 | fileName |
+| ZipSlipBad.js:7:22:7:31 | entry.path |
+| ZipSlipBad.js:8:37:8:44 | fileName |
+edges
+| ZipSlipBad2.js:5:9:5:46 | fileName | ZipSlipBad2.js:6:22:6:29 | fileName |
+| ZipSlipBad2.js:5:20:5:46 | 'output ... ry.path | ZipSlipBad2.js:5:9:5:46 | fileName |
+| ZipSlipBad2.js:5:37:5:46 | entry.path | ZipSlipBad2.js:5:20:5:46 | 'output ... ry.path |
+| ZipSlipBad.js:7:11:7:31 | fileName | ZipSlipBad.js:8:37:8:44 | fileName |
+| ZipSlipBad.js:7:22:7:31 | entry.path | ZipSlipBad.js:7:11:7:31 | fileName |
+#select
+| ZipSlipBad2.js:6:22:6:29 | fileName | ZipSlipBad2.js:5:37:5:46 | entry.path | ZipSlipBad2.js:6:22:6:29 | fileName | Unsanitized zip archive $@, which may contain '..', is used in a file system operation. | ZipSlipBad2.js:5:37:5:46 | entry.path | item path |
+| ZipSlipBad.js:8:37:8:44 | fileName | ZipSlipBad.js:7:22:7:31 | entry.path | ZipSlipBad.js:8:37:8:44 | fileName | Unsanitized zip archive $@, which may contain '..', is used in a file system operation. | ZipSlipBad.js:7:22:7:31 | entry.path | item path |

javascript/ql/test/query-tests/Security/CWE-022/ZipSlip/ZipSlip.qlref

@@ -0,0 +1 @@
+Security/CWE-022/ZipSlip.ql

javascript/ql/test/query-tests/Security/CWE-022/ZipSlip/ZipSlipBad.js

@@ -0,0 +1,9 @@
+const fs = require('fs');
+const unzip = require('unzip');
+
+fs.createReadStream('archive.zip')
+  .pipe(unzip.Parse())
+  .on('entry', entry => {
+    const fileName = entry.path;
+    entry.pipe(fs.createWriteStream(fileName));
+  });

javascript/ql/test/query-tests/Security/CWE-022/ZipSlip/ZipSlipBad2.js

@@ -0,0 +1,8 @@
+var fs = require('fs');
+var unzip = require('unzip');
+fs.readFile('path/to/archive.zip', function (err, zipContents) {
+  unzip.Parse(zipContents).on('entry', function (entry) {
+    var fileName = 'output/path/' + entry.path;
+    fs.writeFileSync(fileName, entry.contents);
+  });
+});

javascript/ql/test/query-tests/Security/CWE-022/ZipSlip/ZipSlipGood.js

@@ -0,0 +1,14 @@
+const fs = require('fs');
+const unzip = require('unzip');
+
+fs.createReadStream('archive.zip')
+  .pipe(unzip.Parse())
+  .on('entry', entry => {
+    const fileName = entry.path;
+    if (fileName.indexOf('..') == -1) {
+      entry.pipe(fs.createWriteStream(fileName));
+    }
+    else {
+      console.log('skipping bad path', fileName);
+    }
+  });

javascript/ql/test/query-tests/Security/CWE-022/ZipSlip/externs.js

@@ -0,0 +1,11 @@
+/**
+ * @externs
+ */
+var fs = {};
+
+/**
+ * @param {string} filename
+ * @param {*} data
+ * @return {void}
+ */
+fs.writeFileSync = function(filename, data) {};