hohn/codeql
1
0
Fork 0
mirror of https://github.com/github/codeql.git synced 2026-04-28 10:15:14 +02:00
Code Issues Packages Projects Releases Wiki Activity

JS: add "host" as a sink for js/request-forgery

Browse Source
This commit is contained in:
Esben Sparre Andreasen
2018-12-17 10:06:15 +01:00
parent 60fe0176ed
commit c6b4e29b93
3 changed files with 11 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files

8
javascript/ql/src/semmle/javascript/security/dataflow/RequestForgery.qll
View File

@@ -72,8 +72,11 @@ module RequestForgery {
ClientRequest request;
string kind;
ClientRequestUrlAsSink() {
this = request.getUrl()
this = request.getUrl() and kind = "URL" or
this = request.getHost() and kind = "host"
}
override DataFlow::Node getARequest() {
@@ -81,7 +84,8 @@ module RequestForgery {
}
override string getKind() {
result = "URL"
result = kind
}
}
}

3
javascript/ql/test/query-tests/Security/CWE-918/RequestForgery.expected
View File

@@ -13,6 +13,7 @@ nodes
| tst.js:26:36:26:42 | tainted |
| tst.js:28:13:28:43 | "http:/ ... tainted |
| tst.js:28:37:28:43 | tainted |
| tst.js:32:34:32:40 | tainted |
edges
| tst.js:12:9:12:52 | tainted | tst.js:16:13:16:19 | tainted |
| tst.js:12:9:12:52 | tainted | tst.js:18:17:18:23 | tainted |
@@ -20,6 +21,7 @@ edges
| tst.js:12:9:12:52 | tainted | tst.js:24:25:24:31 | tainted |
| tst.js:12:9:12:52 | tainted | tst.js:26:36:26:42 | tainted |
| tst.js:12:9:12:52 | tainted | tst.js:28:37:28:43 | tainted |
| tst.js:12:9:12:52 | tainted | tst.js:32:34:32:40 | tainted |
| tst.js:12:19:12:42 | url.par ... , true) | tst.js:12:19:12:48 | url.par ... ).query |
| tst.js:12:19:12:48 | url.par ... ).query | tst.js:12:19:12:52 | url.par ... ery.url |
| tst.js:12:19:12:52 | url.par ... ery.url | tst.js:12:9:12:52 | tainted |
@@ -34,3 +36,4 @@ edges
| tst.js:24:5:24:32 | request ... ainted) | tst.js:12:29:12:35 | req.url | tst.js:24:13:24:31 | "http://" + tainted | The $@ of this request depends on $@. | tst.js:24:13:24:31 | "http://" + tainted | URL | tst.js:12:29:12:35 | req.url | a user-provided value |
| tst.js:26:5:26:43 | request ... ainted) | tst.js:12:29:12:35 | req.url | tst.js:26:13:26:42 | "http:/ ... tainted | The $@ of this request depends on $@. | tst.js:26:13:26:42 | "http:/ ... tainted | URL | tst.js:12:29:12:35 | req.url | a user-provided value |
| tst.js:28:5:28:44 | request ... ainted) | tst.js:12:29:12:35 | req.url | tst.js:28:13:28:43 | "http:/ ... tainted | The $@ of this request depends on $@. | tst.js:28:13:28:43 | "http:/ ... tainted | URL | tst.js:12:29:12:35 | req.url | a user-provided value |
| tst.js:32:5:32:42 | http.ge ... inted}) | tst.js:12:29:12:35 | req.url | tst.js:32:34:32:40 | tainted | The $@ of this request depends on $@. | tst.js:32:34:32:40 | tainted | host | tst.js:12:29:12:35 | req.url | a user-provided value |

2
javascript/ql/test/query-tests/Security/CWE-918/tst.js
View File

@@ -28,4 +28,6 @@ var server = http.createServer(function(req, res) {
request("http://example.com/" + tainted); // NOT OK
request("http://example.com/?" + tainted); // OK
http.get(relativeUrl, {host: tainted}); // NOT OK
})