Merge pull request #623 from esben-semmle/js/incomplete-url-sanitization

Approved by mc-semmle

javascript/ql/src/Security/CWE-020/IncompleteUrlSubstringSanitization.qhelp

@@ -0,0 +1,88 @@
+<!DOCTYPE qhelp PUBLIC
+"-//Semmle//qhelp//EN"
+"qhelp.dtd">
+<qhelp>
+
+	<overview>
+		<p>
+
+			Sanitizing untrusted URLs is an important technique for
+			preventing attacks such as request forgeries and malicious
+			redirections. Usually, this is done by checking that the host of a URL
+			is in a set of allowed hosts.
+
+		</p>
+
+		<p>
+
+			However, it is notoriously error-prone to treat the URL as
+			a string and check if one of the allowed hosts is a substring of the
+			URL. Malicious URLs can bypass such security checks by embedding one
+			of the allowed hosts in an unexpected location.
+
+		</p>
+
+		<p>
+
+			Even if the substring check is not used in a
+			security-critical context, the incomplete check may still cause
+			undesirable behaviors when the check succeeds accidentally.
+
+		</p>
+	</overview>
+
+	<recommendation>
+		<p>
+
+			Parse a URL before performing a check on its host value,
+			and ensure that the check handles arbitrary subdomain sequences
+			correctly.
+
+		</p>
+	</recommendation>
+
+	<example>
+
+		<p>
+
+			The following example code checks that a URL redirection
+			will reach the <code>example.com</code> domain, or one of its
+			subdomains, and not some malicious site.
+
+		</p>
+
+		<sample src="examples/IncompleteUrlSubstringSanitization_BAD1.js"/>
+
+		<p>
+
+			The substring check is, however, easy to bypass. For example
+			by embedding <code>example.com</code> in the path component:
+			<code>http://evil-example.net/example.com</code>, or in the query
+			string component: <code>http://evil-example.net/?x=example.com</code>.
+
+			Address these shortcomings by checking the host of the parsed URL instead:
+
+		</p>
+
+		<sample src="examples/IncompleteUrlSubstringSanitization_BAD2.js"/>
+
+		<p>
+
+			This is still not a sufficient check as the
+			following URLs bypass it: <code>http://evil-example.com</code>
+			<code>http://example.com.evil-example.net</code>.
+
+			Instead, use an explicit whitelist of allowed hosts to
+			make the redirect secure:
+
+		</p>
+
+		<sample src="examples/IncompleteUrlSubstringSanitization_GOOD.js"/>
+
+	</example>
+
+	<references>
+		<li>OWASP: <a href="https://www.owasp.org/index.php/Server_Side_Request_Forgery">SSRF</a></li>
+		<li>OWASP: <a href="https://www.owasp.org/index.php/Unvalidated_Redirects_and_Forwards_Cheat_Sheet">XSS Unvalidated Redirects and Forwards Cheat Sheet</a>.</li>
+	</references>
+</qhelp>

javascript/ql/src/Security/CWE-020/IncompleteUrlSubstringSanitization.ql

@@ -0,0 +1,58 @@
+/**
+ * @name Incomplete URL substring sanitization
+ * @description Security checks on the substrings of an unparsed URL are often vulnerable to bypassing.
+ * @kind problem
+ * @problem.severity warning
+ * @precision high
+ * @id js/incomplete-url-substring-sanitization
+ * @tags correctness
+ *       security
+ *       external/cwe/cwe-20
+ */
+
+import javascript
+private import semmle.javascript.dataflow.InferredTypes
+
+from DataFlow::MethodCallNode call, string name, DataFlow::Node substring, string target
+where
+      (name = "indexOf" or name = "includes" or name = "startsWith" or name = "endsWith") and
+      call.getMethodName() = name and
+      substring = call.getArgument(0) and
+      substring.mayHaveStringValue(target) and
+      (
+        // target contains a domain on a common TLD, and perhaps some other URL components
+        target.regexpMatch("(?i)([a-z]*:?//)?\\.?([a-z0-9-]+\\.)+(com|org|edu|gov|uk|net)(:[0-9]+)?/?") or
+        // target is a HTTP URL to a domain on any TLD
+        target.regexpMatch("(?i)https?://([a-z0-9-]+\\.)+([a-z]+)(:[0-9]+)?/?")
+      ) and
+      // whitelist
+      not (
+        name = "indexOf" and
+        (
+          // arithmetic on the indexOf-result
+          any(ArithmeticExpr e).getAnOperand().getUnderlyingValue() = call.asExpr()
+          or
+          // non-trivial position check on the indexOf-result
+          exists(EqualityTest test, Expr n |
+            test.hasOperands(call.asExpr(), n) |
+            not n.getIntValue() = [-1..0]
+          )
+        )
+        or
+        // the leading dot in a subdomain sequence makes the suffix-check safe (if it is performed on the host of the url)
+        name = "endsWith" and
+        target.regexpMatch("(?i)\\.([a-z0-9-]+)(\\.[a-z0-9-]+)+")
+        or
+        // the trailing slash makes the prefix-check safe
+        (
+          name = "startsWith"
+          or
+          name = "indexOf" and
+          exists(EqualityTest test, Expr n |
+            test.hasOperands(call.asExpr(), n) and
+            n.getIntValue() = 0
+          )
+        ) and
+        target.regexpMatch(".*/")
+      )
+select call, "'$@' may be at an arbitrary position in the sanitized URL.", substring, target

javascript/ql/src/Security/CWE-020/examples/IncompleteUrlSubstringSanitization_BAD1.js

@@ -0,0 +1,7 @@
+app.get('/some/path', function(req, res) {
+    let url = req.param("url");
+    // BAD: the host of `url` may be controlled by an attacker
+    if (url.includes("example.com")) {
+        res.redirect(url);
+    }
+});

javascript/ql/src/Security/CWE-020/examples/IncompleteUrlSubstringSanitization_BAD2.js

@@ -0,0 +1,8 @@
+app.get('/some/path', function(req, res) {
+    let url = req.param("url"),
+        host = urlLib.parse(url).host;
+    // BAD: the host of `url` may be controlled by an attacker
+    if (host.includes("example.com")) {
+        res.redirect(url);
+    }
+});

javascript/ql/src/Security/CWE-020/examples/IncompleteUrlSubstringSanitization_GOOD.js

@@ -0,0 +1,13 @@
+app.get('/some/path', function(req, res) {
+    let url = req.param('url'),
+        host = urlLib.parse(url).host;
+    // GOOD: the host of `url` can not be controlled by an attacker
+    let allowedHosts = [
+        'example.com',
+        'beta.example.com',
+        'www.example.com'
+    ];
+    if (allowedHosts.includes(host)) {
+        res.redirect(url);
+    }
+});