hohn/codeql
1
0
Fork 0
mirror of https://github.com/github/codeql.git synced 2026-05-02 20:25:13 +02:00
Code Issues Packages Projects Releases Wiki Activity

JS: add a taint step for property projection

Browse Source
This commit is contained in:
Esben Sparre Andreasen
2018-08-28 14:55:17 +02:00
parent df97132519
commit 90b3902244
5 changed files with 61 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

18
javascript/ql/src/semmle/javascript/frameworks/PropertyProjection.qll
View File

@@ -134,4 +134,22 @@ private class SimplePropertyProjection extends CustomPropertyProjection {
override predicate isSingletonProjection() { singleton = true }
}
/**
* A taint step for a property projection.
*/
private class PropertyProjectionTaintStep extends TaintTracking::AdditionalTaintStep {
PropertyProjection projection;
PropertyProjectionTaintStep() {
projection = this
}
override predicate step(DataFlow::Node pred, DataFlow::Node succ) {
// reading from a tainted object yields a tainted result
this = succ and
pred = projection.getObject()
}
}

3
javascript/ql/test/library-tests/frameworks/PropertyProjection/PropertyInjectionTaint.expected Normal file
View File

@@ -0,0 +1,3 @@
| tst.js:25:10:25:15 | source |
| tst.js:32:10:32:27 | _.pick(tainted, s) |
| tst.js:33:10:33:26 | _.get(tainted, s) |

22
javascript/ql/test/library-tests/frameworks/PropertyProjection/PropertyInjectionTaint.ql Normal file
View File

@@ -0,0 +1,22 @@
import javascript
class ExampleConfiguration extends TaintTracking::Configuration {
ExampleConfiguration() { this = "ExampleConfiguration" }
override predicate isSource(DataFlow::Node source) {
source.asExpr().(CallExpr).getCalleeName() = "SOURCE"
}
override predicate isSink(DataFlow::Node sink) {
exists (CallExpr callExpr |
callExpr.getCalleeName() = "SINK" and
DataFlow::valueNode(callExpr.getArgument(0)) = sink
)
}
}
from ExampleConfiguration cfg, DataFlow::Node source, DataFlow::Node sink
where cfg.hasFlow(source, sink)
select sink

4
javascript/ql/test/library-tests/frameworks/PropertyProjection/PropertyProjection.expected
View File

@@ -9,3 +9,7 @@
| tst.js:17:1:17:16 | dottie.get(o, s) | tst.js:17:12:17:12 | o | tst.js:17:15:17:15 | s | true |
| tst.js:19:1:19:15 | dotty.get(o, s) | tst.js:19:11:19:11 | o | tst.js:19:14:19:14 | s | true |
| tst.js:20:1:20:18 | dotty.search(o, s) | tst.js:20:14:20:14 | o | tst.js:20:17:20:17 | s | false |
| tst.js:27:10:27:30 | _.pick( ... ted, s) | tst.js:27:17:27:26 | notTainted | tst.js:27:29:27:29 | s | false |
| tst.js:28:10:28:29 | _.get(notTainted, s) | tst.js:28:16:28:25 | notTainted | tst.js:28:28:28:28 | s | true |
| tst.js:32:10:32:27 | _.pick(tainted, s) | tst.js:32:17:32:23 | tainted | tst.js:32:26:32:26 | s | false |
| tst.js:33:10:33:26 | _.get(tainted, s) | tst.js:33:16:33:22 | tainted | tst.js:33:25:33:25 | s | true |

14
javascript/ql/test/library-tests/frameworks/PropertyProjection/tst.js
View File

@@ -18,3 +18,17 @@ dottie.get(o, s);
dotty.get(o, s);
dotty.search(o, s);
(function(){
var source = SOURCE();
SINK(source);
SINK(_.pick(notTainted, s));
SINK(_.get(notTainted, s));
var tainted = {};
tainted[x] = source;
SINK(_.pick(tainted, s));
SINK(_.get(tainted, s));
});