hohn/codeql
1
0
Fork 0
mirror of https://github.com/github/codeql.git synced 2026-04-25 16:55:19 +02:00
Code Issues Packages Projects Releases Wiki Activity

upgrade additional steps

Browse Source
This commit is contained in:
amammad
2023-08-30 05:03:19 +10:00
parent 369bc50709
commit d06444e639
2 changed files with 50 additions and 24 deletions
Download Patch File Download Diff File Expand all files Collapse all files

4
javascript/ql/src/experimental/Security/CWE-522-DecompressionBombs/DecompressionBombs.ql
View File

@@ -140,6 +140,10 @@ class BombConfiguration extends TaintTracking::Configuration {
//node-tar
readablePipeAdditionalTaintStep(pred, succ)
or
streamPipelineAdditionalTaintStep(pred, succ)
or
promisesFileHandlePipeAdditionalTaintStep(pred, succ)
or
exists(FileSystemReadAccess cn | pred = cn.getADataNode() and succ = cn.getAPathArgument())
or
exists(DataFlow::Node sinkhelper, AstNode an |

70
javascript/ql/src/experimental/Security/CWE-522-DecompressionBombs/ReadableAdditionalStep.qll
View File

@@ -2,53 +2,75 @@ import javascript
import API
predicate readablePipeAdditionalTaintStep(DataFlow::Node pred, DataFlow::Node succ) {
// this step connect the first pipe parameter to the last pipe parameter
exists(API::Node cn |
cn =
exists(API::Node receiver |
receiver =
[
API::moduleImport("fs").getMember("createReadStream"),
API::moduleImport("stream").getMember("Readable")
]
|
pred = cn.getParameter(0).asSink() and
succ = cn.getASuccessor*().getMember("pipe").getParameter(0).asSink()
genaralStreamPipeAdditionalTaintStep(receiver, pred, succ)
)
}
predicate promisesFileHandlePipeAdditionalTaintStep(DataFlow::Node pred, DataFlow::Node succ) {
exists(API::Node receiver |
receiver =
nodeJsPromisesFileSystem()
.getMember("open")
.getASuccessor*()
.getMember(["createReadStream", "createWriteStream"])
.getReturn()
|
genaralStreamPipeAdditionalTaintStep(receiver, pred, succ)
)
}
// git receiver which we'll have receiver(pred).pipe(succ) and other succerssor pipe methods
predicate genaralStreamPipeAdditionalTaintStep(
API::Node receiver, DataFlow::Node pred, DataFlow::Node succ
) {
// this step connect the first pipe parameter to the last pipe parameter
pred = [receiver.getParameter(0).asSink(), receiver.asSource()] and
succ = receiver.getASuccessor*().getMember("pipe").getParameter(0).asSink()
or
// this step connect the a pipe parameter to the next pipe parameter
exists(API::Node cn |
cn =
[
API::moduleImport("fs").getMember("createReadStream"),
API::moduleImport("stream").getMember("Readable")
].getASuccessor*()
|
exists(API::Node cn | cn = receiver.getASuccessor*() |
pred = cn.getParameter(0).asSink() and
succ = cn.getReturn().getMember("pipe").getParameter(0).asSink()
)
or
}
predicate streamPipelineAdditionalTaintStep(DataFlow::Node pred, DataFlow::Node succ) {
// this step connect the a pipe parameter to the next parameter
exists(API::Node cn, int i |
i in [0 .. 10] and
cn =
[
API::moduleImport("stream/promises").getMember("pipeline"),
API::moduleImport("stream").getMember("pipeline")
]
cn = nodeJsStream().getMember("pipeline")
|
pred = cn.getParameter(i).asSink() and
succ = cn.getParameter(i + 1).asSink()
)
or
// this step connect the first pipe parameter to all of the next parameters
// this step connect the first pipe parameter to the next parameter
exists(API::Node cn, int i |
i in [1 .. 10] and
cn =
[
API::moduleImport("stream/promises").getMember("pipeline"),
API::moduleImport("stream").getMember("pipeline")
]
cn = nodeJsStream().getMember("pipeline")
|
pred = cn.getParameter(0).asSink() and
succ = cn.getParameter(i).asSink()
)
}
/**
* Promises API
*/
API::Node nodeJsPromisesFileSystem() {
result = [API::moduleImport("fs").getMember("promises"), API::moduleImport("fs/promises")]
}
/**
* Stream Promises API
*/
API::Node nodeJsStream() {
result = [API::moduleImport("stream/promises"), API::moduleImport("stream").getMember("promises")]
}