hohn/codeql
1
0
Fork 0
mirror of https://github.com/github/codeql.git synced 2026-04-29 18:55:14 +02:00
Code Issues Packages Projects Releases Wiki Activity

JS: add sanitizer support for ~whitelist.indexOf(x)

Browse Source
This commit is contained in:
Esben Sparre Andreasen
2018-08-20 13:28:19 +02:00
parent 692f416143
commit be8a32bb18
6 changed files with 47 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

20
javascript/ql/src/semmle/javascript/dataflow/TaintTracking.qll
View File

@@ -612,6 +612,26 @@ module TaintTracking {
}
/** A check of the form `if(~o.indexOf(x))`, which sanitizes `x` in its "then" branch. */
class BitwiseIndexOfSanitizer extends AdditionalSanitizerGuardNode, DataFlow::ValueNode {
MethodCallExpr indexOf;
override BitNotExpr astNode;
BitwiseIndexOfSanitizer() {
astNode.getOperand() = indexOf and
indexOf.getMethodName() = "indexOf"
}
override predicate sanitizes(boolean outcome, Expr e) {
outcome = true and
e = indexOf.getArgument(0)
}
override predicate appliesTo(Configuration cfg) {
any()
}
}
/** A check of the form `if(x == 'some-constant')`, which sanitizes `x` in its "then" branch. */
class ConstantComparison extends AdditionalSanitizerGuardNode, DataFlow::ValueNode {

2
javascript/ql/test/library-tests/TaintBarriers/SanitizingGuard.expected
View File

@@ -29,3 +29,5 @@
| tst.js:160:9:160:30 | v === " ... sted-1" | ExampleConfiguration | true | tst.js:160:9:160:9 | v |
| tst.js:160:35:160:56 | v === " ... sted-2" | ExampleConfiguration | true | tst.js:160:35:160:35 | v |
| tst.js:166:9:166:16 | v == !!0 | ExampleConfiguration | true | tst.js:166:9:166:9 | v |
| tst.js:184:9:184:21 | ~o.indexOf(v) | ExampleConfiguration | true | tst.js:184:20:184:20 | v |
| tst.js:190:10:190:22 | ~o.indexOf(v) | ExampleConfiguration | true | tst.js:190:21:190:21 | v |

3
javascript/ql/test/library-tests/TaintBarriers/TaintedSink.expected
View File

@@ -25,3 +25,6 @@
| tst.js:155:14:155:14 | v | tst.js:145:13:145:20 | SOURCE() |
| tst.js:163:14:163:14 | v | tst.js:145:13:145:20 | SOURCE() |
| tst.js:169:14:169:14 | v | tst.js:145:13:145:20 | SOURCE() |
| tst.js:182:10:182:10 | v | tst.js:181:13:181:20 | SOURCE() |
| tst.js:187:14:187:14 | v | tst.js:181:13:181:20 | SOURCE() |
| tst.js:191:14:191:14 | v | tst.js:181:13:181:20 | SOURCE() |

2
javascript/ql/test/library-tests/TaintBarriers/isBarrier.expected
View File

@@ -22,3 +22,5 @@
| tst.js:160:35:160:56 | v | ExampleConfiguration |
| tst.js:167:14:167:14 | v | ExampleConfiguration |
| tst.js:176:18:176:18 | v | ExampleConfiguration |
| tst.js:185:14:185:14 | v | ExampleConfiguration |
| tst.js:193:14:193:14 | v | ExampleConfiguration |

18
javascript/ql/test/library-tests/TaintBarriers/tst.js
View File

@@ -176,3 +176,21 @@ function customSanitizer() {
v = SANITIZE(v);
SINK(v);
}
function BitwiseIndexOfCheckSanitizer () {
var v = SOURCE();
SINK(v);
if (~o.indexOf(v)) {
SINK(v);
} else {
SINK(v);
}
if (!~o.indexOf(v)) {
SINK(v);
} else {
SINK(v);
}
}