hohn/codeql
1
0
Fork 0
mirror of https://github.com/github/codeql.git synced 2026-04-25 08:45:14 +02:00
Code Issues Packages Projects Releases Wiki Activity

promote PropsTaintStep to a PreCallGraphStep

Browse Source
This commit is contained in:
erik-krogh
2024-01-04 10:45:22 +01:00
parent 5778720194
commit a9f2b3fad6
4 changed files with 67 additions and 4 deletions
Download Patch File Download Diff File Expand all files Collapse all files

8
javascript/ql/lib/semmle/javascript/frameworks/React.qll
View File

@@ -852,13 +852,13 @@ private class StateTaintStep extends TaintTracking::SharedTaintStep {
}
/**
* A taint propagating data flow edge for assignments of the form `c1.props.p = v`,
* A data propagating data flow edge for assignments of the form `c1.props.p = v`,
* where `c1` is an instance of React component `C`; in this case, we consider
* taint to flow from `v` to any read of `c2.props.p`, where `c2`
* data to flow from `v` to any read of `c2.props.p`, where `c2`
* also is an instance of `C`.
*/
private class PropsTaintStep extends TaintTracking::SharedTaintStep {
override predicate viewComponentStep(DataFlow::Node pred, DataFlow::Node succ) {
private class PropsTaintStep extends PreCallGraphStep {
override predicate step(DataFlow::Node pred, DataFlow::Node succ) {
exists(ReactComponent c, string name, DataFlow::PropRead prn |
prn = c.getAPropRead(name) or
prn = c.getAPreviousPropsSource().getAPropertyRead(name)

27
javascript/ql/test/query-tests/Security/CWE-079/DomBasedXss/Xss.expected
View File

@@ -706,6 +706,18 @@ nodes
| tooltip.jsx:11:25:11:30 | source |
| tooltip.jsx:11:25:11:30 | source |
| tooltip.jsx:11:25:11:30 | source |
| tooltip.jsx:18:51:18:59 | provide() |
| tooltip.jsx:18:51:18:59 | provide() |
| tooltip.jsx:18:51:18:59 | provide() |
| tooltip.jsx:18:51:18:59 | provide() |
| tooltip.jsx:18:51:18:59 | provide() |
| tooltip.jsx:22:11:22:30 | source |
| tooltip.jsx:22:11:22:30 | source |
| tooltip.jsx:22:20:22:30 | window.name |
| tooltip.jsx:22:20:22:30 | window.name |
| tooltip.jsx:22:20:22:30 | window.name |
| tooltip.jsx:23:38:23:43 | source |
| tooltip.jsx:23:38:23:43 | source |
| translate.js:6:7:6:39 | target |
| translate.js:6:16:6:39 | documen ... .search |
| translate.js:6:16:6:39 | documen ... .search |
@@ -1882,6 +1894,20 @@ edges
| tooltip.jsx:6:20:6:30 | window.name | tooltip.jsx:6:11:6:30 | source |
| tooltip.jsx:6:20:6:30 | window.name | tooltip.jsx:6:11:6:30 | source |
| tooltip.jsx:6:20:6:30 | window.name | tooltip.jsx:6:11:6:30 | source |
| tooltip.jsx:22:11:22:30 | source | tooltip.jsx:18:51:18:59 | provide() |
| tooltip.jsx:22:11:22:30 | source | tooltip.jsx:18:51:18:59 | provide() |
| tooltip.jsx:22:11:22:30 | source | tooltip.jsx:18:51:18:59 | provide() |
| tooltip.jsx:22:11:22:30 | source | tooltip.jsx:18:51:18:59 | provide() |
| tooltip.jsx:22:11:22:30 | source | tooltip.jsx:23:38:23:43 | source |
| tooltip.jsx:22:11:22:30 | source | tooltip.jsx:23:38:23:43 | source |
| tooltip.jsx:22:20:22:30 | window.name | tooltip.jsx:22:11:22:30 | source |
| tooltip.jsx:22:20:22:30 | window.name | tooltip.jsx:22:11:22:30 | source |
| tooltip.jsx:22:20:22:30 | window.name | tooltip.jsx:22:11:22:30 | source |
| tooltip.jsx:22:20:22:30 | window.name | tooltip.jsx:22:11:22:30 | source |
| tooltip.jsx:23:38:23:43 | source | tooltip.jsx:18:51:18:59 | provide() |
| tooltip.jsx:23:38:23:43 | source | tooltip.jsx:18:51:18:59 | provide() |
| tooltip.jsx:23:38:23:43 | source | tooltip.jsx:18:51:18:59 | provide() |
| tooltip.jsx:23:38:23:43 | source | tooltip.jsx:18:51:18:59 | provide() |
| translate.js:6:7:6:39 | target | translate.js:7:42:7:47 | target |
| translate.js:6:16:6:39 | documen ... .search | translate.js:6:7:6:39 | target |
| translate.js:6:16:6:39 | documen ... .search | translate.js:6:7:6:39 | target |
@@ -2486,6 +2512,7 @@ edges
| string-manipulations.js:10:16:10:45 | String( ... n.href) | string-manipulations.js:10:23:10:44 | documen ... on.href | string-manipulations.js:10:16:10:45 | String( ... n.href) | Cross-site scripting vulnerability due to $@. | string-manipulations.js:10:23:10:44 | documen ... on.href | user-provided value |
| tooltip.jsx:10:25:10:30 | source | tooltip.jsx:6:20:6:30 | window.name | tooltip.jsx:10:25:10:30 | source | Cross-site scripting vulnerability due to $@. | tooltip.jsx:6:20:6:30 | window.name | user-provided value |
| tooltip.jsx:11:25:11:30 | source | tooltip.jsx:6:20:6:30 | window.name | tooltip.jsx:11:25:11:30 | source | Cross-site scripting vulnerability due to $@. | tooltip.jsx:6:20:6:30 | window.name | user-provided value |
| tooltip.jsx:18:51:18:59 | provide() | tooltip.jsx:22:20:22:30 | window.name | tooltip.jsx:18:51:18:59 | provide() | Cross-site scripting vulnerability due to $@. | tooltip.jsx:22:20:22:30 | window.name | user-provided value |
| translate.js:9:27:9:50 | searchP ... 'term') | translate.js:6:16:6:39 | documen ... .search | translate.js:9:27:9:50 | searchP ... 'term') | Cross-site scripting vulnerability due to $@. | translate.js:6:16:6:39 | documen ... .search | user-provided value |
| trusted-types-lib.js:2:12:2:12 | x | trusted-types.js:13:20:13:30 | window.name | trusted-types-lib.js:2:12:2:12 | x | Cross-site scripting vulnerability due to $@. | trusted-types.js:13:20:13:30 | window.name | user-provided value |
| trusted-types.js:3:67:3:67 | x | trusted-types.js:4:20:4:30 | window.name | trusted-types.js:3:67:3:67 | x | Cross-site scripting vulnerability due to $@. | trusted-types.js:4:20:4:30 | window.name | user-provided value |

26
javascript/ql/test/query-tests/Security/CWE-079/DomBasedXss/XssWithAdditionalSources.expected
View File

@@ -718,6 +718,18 @@ nodes
| tooltip.jsx:11:25:11:30 | source |
| tooltip.jsx:11:25:11:30 | source |
| tooltip.jsx:11:25:11:30 | source |
| tooltip.jsx:18:51:18:59 | provide() |
| tooltip.jsx:18:51:18:59 | provide() |
| tooltip.jsx:18:51:18:59 | provide() |
| tooltip.jsx:18:51:18:59 | provide() |
| tooltip.jsx:18:51:18:59 | provide() |
| tooltip.jsx:22:11:22:30 | source |
| tooltip.jsx:22:11:22:30 | source |
| tooltip.jsx:22:20:22:30 | window.name |
| tooltip.jsx:22:20:22:30 | window.name |
| tooltip.jsx:22:20:22:30 | window.name |
| tooltip.jsx:23:38:23:43 | source |
| tooltip.jsx:23:38:23:43 | source |
| translate.js:6:7:6:39 | target |
| translate.js:6:16:6:39 | documen ... .search |
| translate.js:6:16:6:39 | documen ... .search |
@@ -1944,6 +1956,20 @@ edges
| tooltip.jsx:6:20:6:30 | window.name | tooltip.jsx:6:11:6:30 | source |
| tooltip.jsx:6:20:6:30 | window.name | tooltip.jsx:6:11:6:30 | source |
| tooltip.jsx:6:20:6:30 | window.name | tooltip.jsx:6:11:6:30 | source |
| tooltip.jsx:22:11:22:30 | source | tooltip.jsx:18:51:18:59 | provide() |
| tooltip.jsx:22:11:22:30 | source | tooltip.jsx:18:51:18:59 | provide() |
| tooltip.jsx:22:11:22:30 | source | tooltip.jsx:18:51:18:59 | provide() |
| tooltip.jsx:22:11:22:30 | source | tooltip.jsx:18:51:18:59 | provide() |
| tooltip.jsx:22:11:22:30 | source | tooltip.jsx:23:38:23:43 | source |
| tooltip.jsx:22:11:22:30 | source | tooltip.jsx:23:38:23:43 | source |
| tooltip.jsx:22:20:22:30 | window.name | tooltip.jsx:22:11:22:30 | source |
| tooltip.jsx:22:20:22:30 | window.name | tooltip.jsx:22:11:22:30 | source |
| tooltip.jsx:22:20:22:30 | window.name | tooltip.jsx:22:11:22:30 | source |
| tooltip.jsx:22:20:22:30 | window.name | tooltip.jsx:22:11:22:30 | source |
| tooltip.jsx:23:38:23:43 | source | tooltip.jsx:18:51:18:59 | provide() |
| tooltip.jsx:23:38:23:43 | source | tooltip.jsx:18:51:18:59 | provide() |
| tooltip.jsx:23:38:23:43 | source | tooltip.jsx:18:51:18:59 | provide() |
| tooltip.jsx:23:38:23:43 | source | tooltip.jsx:18:51:18:59 | provide() |
| translate.js:6:7:6:39 | target | translate.js:7:42:7:47 | target |
| translate.js:6:16:6:39 | documen ... .search | translate.js:6:7:6:39 | target |
| translate.js:6:16:6:39 | documen ... .search | translate.js:6:7:6:39 | target |

10
javascript/ql/test/query-tests/Security/CWE-079/DomBasedXss/tooltip.jsx
View File

@@ -11,4 +11,14 @@ function tooltips() {
<span data-tip={source} data-html={true} /> // NOT OK
<ReactTooltip />
</span>
}
function MyElement(props) {
const provide = props.provide;
return <div dangerouslySetInnerHTML={{__html: provide()}} />; // NOT OK
}
function useMyElement() {
const source = window.name;
return <MyElement provide={() => source} />;
}