hohn/codeql
1
0
Fork 0
mirror of https://github.com/github/codeql.git synced 2026-04-26 01:05:15 +02:00
Code Issues Packages Projects Releases Wiki Activity

JS: Migrate NoSqlInjection

Browse Source
This commit is contained in:
Asger F
2024-12-12 13:19:00 +01:00
parent 8e8de5cf23
commit c38e3a23eb
2 changed files with 17 additions and 14 deletions
Download Patch File Download Diff File Expand all files Collapse all files

7
javascript/ql/lib/semmle/javascript/security/dataflow/NosqlInjectionCustomizations.qll
View File

@@ -8,6 +8,8 @@ import javascript
import semmle.javascript.security.TaintedObject
module NosqlInjection {
import semmle.javascript.security.CommonFlowState
/**
* A data flow source for NoSQL injection vulnerabilities.
*/
@@ -22,7 +24,10 @@ module NosqlInjection {
*
* Defaults to deeply tainted objects only.
*/
DataFlow::FlowLabel getAFlowLabel() { result = TaintedObject::label() }
FlowState getAFlowState() { result.isTaintedObject() }
/** DEPRECATED. Use `getAFlowState()` instead. */
deprecated DataFlow::FlowLabel getAFlowLabel() { result = this.getAFlowState().toFlowLabel() }
}
/**

24
javascript/ql/lib/semmle/javascript/security/dataflow/NosqlInjectionQuery.qll
View File

@@ -15,19 +15,17 @@ import NosqlInjectionCustomizations::NosqlInjection
* A taint-tracking configuration for reasoning about SQL-injection vulnerabilities.
*/
module NosqlInjectionConfig implements DataFlow::StateConfigSig {
class FlowState = DataFlow::FlowLabel;
import semmle.javascript.security.CommonFlowState
predicate isSource(DataFlow::Node source, DataFlow::FlowLabel state) {
predicate isSource(DataFlow::Node source, FlowState state) {
source instanceof Source and state.isTaint()
or
TaintedObject::isSource(source, state)
source instanceof TaintedObject::Source and state.isTaintedObject()
}
predicate isSink(DataFlow::Node sink, DataFlow::FlowLabel state) {
sink.(Sink).getAFlowLabel() = state
}
predicate isSink(DataFlow::Node sink, FlowState state) { sink.(Sink).getAFlowState() = state }
predicate isBarrier(DataFlow::Node node, DataFlow::FlowLabel state) {
predicate isBarrier(DataFlow::Node node, FlowState state) {
node instanceof Sanitizer and state.isTaint()
or
TaintTracking::defaultSanitizer(node) and state.isTaint()
@@ -36,14 +34,13 @@ module NosqlInjectionConfig implements DataFlow::StateConfigSig {
}
predicate isAdditionalFlowStep(
DataFlow::Node node1, DataFlow::FlowLabel state1, DataFlow::Node node2,
DataFlow::FlowLabel state2
DataFlow::Node node1, FlowState state1, DataFlow::Node node2, FlowState state2
) {
TaintedObject::step(node1, node2, state1, state2)
TaintedObject::isAdditionalFlowStep(node1, state1, node2, state2)
or
// additional flow step to track taint through NoSQL query objects
state1 = TaintedObject::label() and
state2 = TaintedObject::label() and
state1.isTaintedObject() and
state2.isTaintedObject() and
exists(NoSql::Query query, DataFlow::SourceNode queryObj |
queryObj.flowsTo(query) and
queryObj.flowsTo(node2) and
@@ -90,6 +87,7 @@ deprecated class Configuration extends TaintTracking::Configuration {
DataFlow::Node node1, DataFlow::Node node2, DataFlow::FlowLabel state1,
DataFlow::FlowLabel state2
) {
NosqlInjectionConfig::isAdditionalFlowStep(node1, state1, node2, state2)
NosqlInjectionConfig::isAdditionalFlowStep(node1, FlowState::fromFlowLabel(state1), node2,
FlowState::fromFlowLabel(state2))
}
}