Merge pull request #696 from esben-semmle/js/host-request-forgery

Approved by asger-semmle

javascript/ql/src/semmle/javascript/frameworks/ClientRequests.qll

@@ -21,6 +21,11 @@ abstract class CustomClientRequest extends DataFlow::InvokeNode {
    */
   abstract DataFlow::Node getUrl();
 
+  /**
+   * Gets the host of the request.
+   */
+  abstract DataFlow::Node getHost();
+
   /**
    * Gets a node that contributes to the data-part this request.
    */
@@ -50,6 +55,13 @@ class ClientRequest extends DataFlow::InvokeNode {
     result = custom.getUrl()
   }
 
+  /**
+   * Gets the host of the request.
+   */
+  DataFlow::Node getHost() {
+    result = custom.getHost()
+  }
+
   /**
    * Gets a node that contributes to the data-part this request.
    */
@@ -67,7 +79,7 @@ private string httpMethodName() {
 }
 
 /**
- * Gets the name of a property that likely contains a  URL value.
+ * Gets the name of a property that likely contains a URL value.
  */
 private string urlPropertyName() {
   result = "uri" or
@@ -93,16 +105,17 @@ private class RequestUrlRequest extends CustomClientRequest {
       (
         callee = DataFlow::moduleImport(moduleName) or
         callee = DataFlow::moduleMember(moduleName, httpMethodName())
-      ) and
-      (
-        url = getArgument(0) or
-        url = getOptionArgument(0, urlPropertyName())
       )
     )
   }
 
   override DataFlow::Node getUrl() {
-    result = url
+    result = getArgument(0) or
+    result = getOptionArgument(0, urlPropertyName())
+  }
+
+  override DataFlow::Node getHost() {
+    none()
   }
 
   override DataFlow::Node getADataNode() {
@@ -129,10 +142,18 @@ private class AxiosUrlRequest extends CustomClientRequest {
     )
   }
 
+  private DataFlow::Node getOptionArgument(string name) {
+    // depends on the method name and the call arity, over-approximating slightly in the name of simplicity
+    result = getOptionArgument([0..2], name)
+  }
+
   override DataFlow::Node getUrl() {
     result = getArgument(0) or
-    // depends on the method name and the call arity, over-approximating slightly in the name of simplicity
-    result = getOptionArgument([0..2], urlPropertyName())
+    result = getOptionArgument(urlPropertyName())
+  }
+
+  override DataFlow::Node getHost() {
+    result = getOptionArgument("host")
   }
 
   override DataFlow::Node getADataNode() {
@@ -179,6 +200,8 @@ private class FetchUrlRequest extends CustomClientRequest {
     result = url
   }
 
+  override DataFlow::Node getHost() { none() }
+
   override DataFlow::Node getADataNode() {
     exists (string name |
       name = "headers" or name = "body" |
@@ -209,6 +232,14 @@ private class GotUrlRequest extends CustomClientRequest {
     not exists (getOptionArgument(1, "baseUrl"))
   }
 
+  override DataFlow::Node getHost() {
+    exists (string name |
+      name = "host" or
+      name = "hostname" |
+      result = getOptionArgument(1, name)
+    )
+  }
+
   override DataFlow::Node getADataNode() {
     exists (string name |
       name = "headers" or name = "body" or name = "query" |
@@ -238,6 +269,8 @@ private class SuperAgentUrlRequest extends CustomClientRequest {
     result = url
   }
 
+  override DataFlow::Node getHost() { none() }
+
   override DataFlow::Node getADataNode() {
     exists (string name |
       name = "set" or name = "send" or name = "query" |
@@ -255,5 +288,6 @@ private class XMLHttpRequest extends CustomClientRequest {
 
   override DataFlow::Node getUrl() { result = getAMethodCall("open").getArgument(1) }
 
+  override DataFlow::Node getHost() { none() }
   override DataFlow::Node getADataNode() { result = getAMethodCall("send").getArgument(0) }
 }

javascript/ql/src/semmle/javascript/frameworks/Electron.qll

@@ -64,6 +64,14 @@ module Electron {
       result = getOptionArgument(0, "url")
     }
 
+    override DataFlow::Node getHost() {
+      exists (string name |
+        name = "host" or
+        name = "hostname" |
+        result = getOptionArgument(0, name)
+      )
+    }
+
     override DataFlow::Node getADataNode() {
       exists (string name |
         name = "write" or name = "end" |

javascript/ql/src/semmle/javascript/frameworks/NodeJSLib.qll

@@ -737,6 +737,14 @@ module NodeJSLib {
       result = url
     }
 
+    override DataFlow::Node getHost() {
+      exists (string name |
+        name = "host" or
+        name = "hostname" |
+        result = getOptionArgument(1, name)
+      )
+    }
+
     override DataFlow::Node getADataNode() {
       exists (string name |
         name = "write" or name = "end" |

javascript/ql/src/semmle/javascript/frameworks/jQuery.qll

@@ -359,5 +359,7 @@ private class JQueryClientRequest extends CustomClientRequest {
     result = getOptionArgument([0 .. 1], "url")
   }
 
+  override DataFlow::Node getHost() { none() }
+
   override DataFlow::Node getADataNode() { result = getOptionArgument([0 .. 1], "data") }
 }

javascript/ql/src/semmle/javascript/security/dataflow/RequestForgery.qll

@@ -72,8 +72,11 @@ module RequestForgery {
 
     ClientRequest request;
 
+    string kind;
+
     ClientRequestUrlAsSink() {
-      this = request.getUrl()
+      this = request.getUrl() and kind = "URL" or
+      this = request.getHost() and kind = "host"
     }
 
     override DataFlow::Node getARequest() {
@@ -81,7 +84,8 @@ module RequestForgery {
     }
 
     override string getKind() {
-      result = "URL"
+      result = kind
     }
+
   }
 }