hohn/codeql
1
0
Fork 0
mirror of https://github.com/github/codeql.git synced 2026-05-03 04:39:29 +02:00
Code Issues Packages Projects Releases Wiki Activity

JS: recognize Express headers as RequestInputAccess

Browse Source
This commit is contained in:
Asger F
2018-09-21 18:37:03 +01:00
parent 7f56be6fe2
commit ce11b5330d
3 changed files with 20 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

11
javascript/ql/src/semmle/javascript/frameworks/Express.qll
View File

@@ -479,6 +479,17 @@ module Express {
methodName = "header"
)
or
exists (DataFlow::PropRead headers |
// `req.headers.name`
kind = "header" and
headers.accesses(request, "headers") and
this = headers.getAPropertyRead(_))
or
exists (string propName | propName = "host" or propName = "hostname" |
// `req.host` and `req.hostname` are derived from headers
kind = "header" and
this.(DataFlow::PropRead).accesses(request, propName))
or
// `req.cookies`
kind = "cookie" and
this.(DataFlow::PropRef).accesses(request, "cookies")

3
javascript/ql/test/library-tests/frameworks/Express/RequestInputAccess.expected
View File

@@ -12,3 +12,6 @@
| src/express.js:28:3:28:16 | req.get("foo") | header | src/express.js:22:30:32:1 | functio ... ar');\\n} |
| src/express.js:29:3:29:19 | req.header("bar") | header | src/express.js:22:30:32:1 | functio ... ar');\\n} |
| src/express.js:30:3:30:13 | req.cookies | cookie | src/express.js:22:30:32:1 | functio ... ar');\\n} |
| src/express.js:47:3:47:17 | req.headers.baz | header | src/express.js:46:22:50:1 | functio ... name;\\n} |
| src/express.js:48:3:48:10 | req.host | header | src/express.js:46:22:50:1 | functio ... name;\\n} |
| src/express.js:49:3:49:14 | req.hostname | header | src/express.js:46:22:50:1 | functio ... name;\\n} |

6
javascript/ql/test/library-tests/frameworks/Express/src/express.js
View File

@@ -42,3 +42,9 @@ function getArrowHandler() {
return (req, res) => f();
}
app.use(getArrowHandler());
app.post('/headers', function(req, res) {
req.headers.baz;
req.host;
req.hostname;
});