mirror of
https://github.com/github/codeql.git
synced 2025-12-21 19:26:31 +01:00
JS: Remove Portal-based flow summary implementation
This commit is contained in:
Asger F
@@ -1,9 +0,0 @@
|
||||
/**
|
||||
* Imports the standard library and any taint-tracking configuration classes for which
|
||||
* flow summarization should be enabled.
|
||||
*
|
||||
* To enable flow summarization for other queries, import their configuration classes here.
|
||||
*/
|
||||
|
||||
import javascript
|
||||
import semmle.javascript.security.dataflow.CodeInjection
|
||||
@@ -1,35 +0,0 @@
|
||||
/**
|
||||
* @name Extract flow step summaries
|
||||
* @description Extracts flow step summaries, that is, tuples `(p1, lbl1, p2, lbl2, cfg)`
|
||||
* representing the fact that data with flow label `lbl1` may flow from a
|
||||
* user-controlled exit node of portal `p1` to an escaping entry node of portal `p2`,
|
||||
* and have label `lbl2` at that point. Moreover, the path from `p1` to `p2` contains
|
||||
* no sanitizers specified by configuration `cfg`.
|
||||
* @kind table
|
||||
* @id js/step-summary-extraction
|
||||
*/
|
||||
|
||||
import Configurations
|
||||
import PortalExitSource
|
||||
import PortalEntrySink
|
||||
|
||||
from
|
||||
TaintTracking::Configuration cfg, DataFlow::SourcePathNode source, DataFlow::SinkPathNode sink,
|
||||
Portal p1, Portal p2, DataFlow::FlowLabel lbl1, DataFlow::FlowLabel lbl2,
|
||||
DataFlow::MidPathNode last
|
||||
where
|
||||
cfg = source.getConfiguration() and
|
||||
last = source.getASuccessor*() and
|
||||
sink = last.getASuccessor() and
|
||||
p1 = source.getNode().(PortalExitSource).getPortal() and
|
||||
p2 = sink.getNode().(PortalEntrySink).getPortal() and
|
||||
lbl1 = last.getPathSummary().getStartLabel() and
|
||||
lbl2 = last.getPathSummary().getEndLabel() and
|
||||
// avoid constructing infeasible paths
|
||||
last.getPathSummary().hasCall() = false and
|
||||
last.getPathSummary().hasReturn() = false and
|
||||
// restrict to steps flow function parameters to returns
|
||||
p1.(ParameterPortal).getBasePortal() = p2.(ReturnPortal).getBasePortal() and
|
||||
// restrict to data/taint flow
|
||||
lbl1 instanceof DataFlow::StandardFlowLabel
|
||||
select p1.toString(), lbl1.toString(), p2.toString(), lbl2.toString(), cfg.toString()
|
||||
@@ -1,24 +0,0 @@
|
||||
/**
|
||||
* @name Extract sink summaries
|
||||
* @description Extracts sink summaries, that is, tuples `(p, lbl, cfg)` representing the fact
|
||||
* that data with flow label `lbl` may flow from a user-controlled exit node of portal
|
||||
* `p` to a known sink for configuration `cfg`.
|
||||
* @kind table
|
||||
* @id js/sink-summary-extraction
|
||||
*/
|
||||
|
||||
import Configurations
|
||||
import PortalExitSource
|
||||
import SinkFromAnnotation
|
||||
|
||||
from
|
||||
DataFlow::Configuration cfg, DataFlow::SourcePathNode source, DataFlow::SinkPathNode sink,
|
||||
Portal p, DataFlow::MidPathNode last
|
||||
where
|
||||
cfg = source.getConfiguration() and
|
||||
last = source.getASuccessor*() and
|
||||
sink = last.getASuccessor() and
|
||||
p = source.getNode().(PortalExitSource).getPortal() and
|
||||
// avoid constructing infeasible paths
|
||||
last.getPathSummary().hasReturn() = false
|
||||
select p.toString(), last.getPathSummary().getStartLabel().toString(), cfg.toString()
|
||||
@@ -1,24 +0,0 @@
|
||||
/**
|
||||
* @name Extract source summaries
|
||||
* @description Extracts source summaries, that is, tuples `(p, lbl, cfg)` representing the fact
|
||||
* that data may flow from a known source for configuration `cfg` to an escaping entry
|
||||
* node of portal `p`, and have flow label `lbl` at that point.
|
||||
* @kind table
|
||||
* @id js/source-summary-extraction
|
||||
*/
|
||||
|
||||
import Configurations
|
||||
import PortalEntrySink
|
||||
import SourceFromAnnotation
|
||||
|
||||
from
|
||||
DataFlow::Configuration cfg, DataFlow::SourcePathNode source, DataFlow::SinkPathNode sink,
|
||||
Portal p, DataFlow::MidPathNode last
|
||||
where
|
||||
cfg = source.getConfiguration() and
|
||||
last = source.getASuccessor*() and
|
||||
sink = last.getASuccessor() and
|
||||
p = sink.getNode().(PortalEntrySink).getPortal() and
|
||||
// avoid constructing infeasible paths
|
||||
last.getPathSummary().hasCall() = false
|
||||
select p.toString(), last.getPathSummary().getEndLabel().toString(), cfg.toString()
|
||||
@@ -1,163 +0,0 @@
|
||||
/**
|
||||
* Provides classes for importing source, sink and flow step summaries
|
||||
* from external CSV data added at snapshot build time.
|
||||
*/
|
||||
|
||||
import javascript
|
||||
import semmle.javascript.dataflow.Portals
|
||||
import external.ExternalArtifact
|
||||
private import Shared
|
||||
|
||||
/**
|
||||
* An additional source specified in an `additional-sources.csv` file.
|
||||
*/
|
||||
class AdditionalSourceSpec extends ExternalData {
|
||||
AdditionalSourceSpec() { this.getDataPath() = "additional-sources.csv" }
|
||||
|
||||
/**
|
||||
* Gets the portal of this additional source.
|
||||
*/
|
||||
Portal getPortal() { result.toString() = this.getField(0) }
|
||||
|
||||
/**
|
||||
* Gets the flow label of this source.
|
||||
*/
|
||||
DataFlow::FlowLabel getFlowLabel() { sourceFlowLabelSpec(result, this.getField(1)) }
|
||||
|
||||
/**
|
||||
* Gets the configuration for which this is a source, or any
|
||||
* configuration if this source does not specify a configuration.
|
||||
*/
|
||||
DataFlow::Configuration getConfiguration() { configSpec(result, this.getField(2)) }
|
||||
|
||||
override string toString() {
|
||||
exists(string config |
|
||||
if this.getField(2) = ""
|
||||
then config = "any configuration"
|
||||
else config = this.getConfiguration()
|
||||
|
|
||||
result = this.getPortal() + " as " + this.getFlowLabel() + " source for " + config
|
||||
)
|
||||
}
|
||||
}
|
||||
|
||||
private class AdditionalSourceFromSpec extends DataFlow::AdditionalSource {
|
||||
AdditionalSourceSpec spec;
|
||||
|
||||
AdditionalSourceFromSpec() { this = spec.getPortal().getAnExitNode(_) }
|
||||
|
||||
override predicate isSourceFor(DataFlow::Configuration cfg, DataFlow::FlowLabel lbl) {
|
||||
cfg = spec.getConfiguration() and lbl = spec.getFlowLabel()
|
||||
}
|
||||
}
|
||||
|
||||
/**
|
||||
* An additional sink specified in an `additional-sinks.csv` file.
|
||||
*/
|
||||
class AdditionalSinkSpec extends ExternalData {
|
||||
AdditionalSinkSpec() { this.getDataPath() = "additional-sinks.csv" }
|
||||
|
||||
/**
|
||||
* Gets the portal specification of this additional sink.
|
||||
*/
|
||||
Portal getPortal() { result.toString() = this.getField(0) }
|
||||
|
||||
/**
|
||||
* Gets the flow label of this sink, or any standard flow label if this sink
|
||||
* does not specify a flow label.
|
||||
*/
|
||||
DataFlow::FlowLabel getFlowLabel() { sinkFlowLabelSpec(result, this.getField(1)) }
|
||||
|
||||
/**
|
||||
* Gets the configuration for which this is a sink, or any configuration if
|
||||
* this sink does not specify a configuration.
|
||||
*/
|
||||
DataFlow::Configuration getConfiguration() { configSpec(result, this.getField(2)) }
|
||||
|
||||
override string toString() {
|
||||
exists(string labels, string config |
|
||||
labels = strictconcat(this.getFlowLabel(), " or ") and
|
||||
if this.getField(2) = ""
|
||||
then config = "any configuration"
|
||||
else config = this.getConfiguration()
|
||||
|
|
||||
result = this.getPortal() + " as " + labels + " sink for " + config
|
||||
)
|
||||
}
|
||||
}
|
||||
|
||||
private class AdditionalSinkFromSpec extends DataFlow::AdditionalSink {
|
||||
AdditionalSinkSpec spec;
|
||||
|
||||
AdditionalSinkFromSpec() { this = spec.getPortal().getAnEntryNode(_) }
|
||||
|
||||
override predicate isSinkFor(DataFlow::Configuration cfg, DataFlow::FlowLabel lbl) {
|
||||
cfg = spec.getConfiguration() and lbl = spec.getFlowLabel()
|
||||
}
|
||||
}
|
||||
|
||||
/**
|
||||
* An additional flow step specified in an `additional-steps.csv` file.
|
||||
*/
|
||||
class AdditionalStepSpec extends ExternalData {
|
||||
AdditionalStepSpec() { this.getDataPath() = "additional-steps.csv" }
|
||||
|
||||
/**
|
||||
* Gets the start portal of this additional step.
|
||||
*/
|
||||
Portal getStartPortal() { result.toString() = this.getField(0) }
|
||||
|
||||
/**
|
||||
* Gets the start flow label of this additional step.
|
||||
*/
|
||||
DataFlow::FlowLabel getStartFlowLabel() { result.toString() = this.getField(1) }
|
||||
|
||||
/**
|
||||
* Gets the end portal of this additional step.
|
||||
*/
|
||||
Portal getEndPortal() { result.toString() = this.getField(2) }
|
||||
|
||||
/**
|
||||
* Gets the end flow label of this additional step.
|
||||
*/
|
||||
DataFlow::FlowLabel getEndFlowLabel() { result.toString() = this.getField(3) }
|
||||
|
||||
/**
|
||||
* Gets the configuration to which this step should be added.
|
||||
*/
|
||||
DataFlow::Configuration getConfiguration() { configSpec(result, this.getField(4)) }
|
||||
|
||||
override string toString() {
|
||||
exists(string config |
|
||||
if this.getField(4) = ""
|
||||
then config = "any configuration"
|
||||
else config = this.getConfiguration()
|
||||
|
|
||||
result =
|
||||
"edge from " + this.getStartPortal() + " to " + this.getEndPortal() + ", transforming " +
|
||||
this.getStartFlowLabel() + " into " + this.getEndFlowLabel() + " for " + config
|
||||
)
|
||||
}
|
||||
}
|
||||
|
||||
private class AdditionalFlowStepFromSpec extends DataFlow::Configuration {
|
||||
AdditionalStepSpec spec;
|
||||
DataFlow::Node entry;
|
||||
DataFlow::Node exit;
|
||||
|
||||
AdditionalFlowStepFromSpec() {
|
||||
this = spec.getConfiguration() and
|
||||
entry = spec.getStartPortal().getAnEntryNode(_) and
|
||||
exit = spec.getEndPortal().getAnExitNode(_)
|
||||
}
|
||||
|
||||
override predicate isAdditionalFlowStep(
|
||||
DataFlow::Node pred, DataFlow::Node succ, DataFlow::FlowLabel predlbl,
|
||||
DataFlow::FlowLabel succlbl
|
||||
) {
|
||||
pred = entry and
|
||||
succ = exit and
|
||||
predlbl = spec.getStartFlowLabel() and
|
||||
succlbl = spec.getEndFlowLabel()
|
||||
}
|
||||
}
|
||||
@@ -1,100 +0,0 @@
|
||||
/**
|
||||
* Provides classes for importing source, sink and flow step summaries
|
||||
* through external predicates.
|
||||
*/
|
||||
|
||||
import javascript
|
||||
import semmle.javascript.dataflow.Portals
|
||||
import external.ExternalArtifact
|
||||
import Shared
|
||||
|
||||
/**
|
||||
* An external predicate providing information about additional sources.
|
||||
*
|
||||
* This predicate can be populated from the output of the `ExtractSourceSummaries` query.
|
||||
*/
|
||||
external predicate additionalSources(string portal, string flowLabel, string config);
|
||||
|
||||
/**
|
||||
* An external predicate providing information about additional sinks.
|
||||
*
|
||||
* This predicate can be populated from the output of the `ExtractSinkSummaries` query.
|
||||
*/
|
||||
external predicate additionalSinks(string portal, string flowLabel, string config);
|
||||
|
||||
/**
|
||||
* An external predicate providing information about additional flow steps.
|
||||
*
|
||||
* This predicate can be populated from the output of the `ExtractFlowStepSummaries` query.
|
||||
*/
|
||||
external predicate additionalSteps(
|
||||
string startPortal, string startFlowLabel, string endPortal, string endFlowLabel, string config
|
||||
);
|
||||
|
||||
/**
|
||||
* An additional source specified through the `additionalSources` predicate.
|
||||
*/
|
||||
private class AdditionalSourceFromSpec extends DataFlow::AdditionalSource {
|
||||
string flowLabel;
|
||||
string config;
|
||||
|
||||
AdditionalSourceFromSpec() {
|
||||
exists(Portal portal |
|
||||
additionalSources(portal.toString(), flowLabel, config) and
|
||||
this = portal.getAnExitNode(_)
|
||||
)
|
||||
}
|
||||
|
||||
override predicate isSourceFor(DataFlow::Configuration cfg, DataFlow::FlowLabel lbl) {
|
||||
configSpec(cfg, config) and sourceFlowLabelSpec(lbl, flowLabel)
|
||||
}
|
||||
}
|
||||
|
||||
/**
|
||||
* An additional sink specified through the `additionalSinks` predicate.
|
||||
*/
|
||||
private class AdditionalSinkFromSpec extends DataFlow::AdditionalSink {
|
||||
string flowLabel;
|
||||
string config;
|
||||
|
||||
AdditionalSinkFromSpec() {
|
||||
exists(Portal portal |
|
||||
additionalSinks(portal.toString(), flowLabel, config) and
|
||||
this = portal.getAnEntryNode(_)
|
||||
)
|
||||
}
|
||||
|
||||
override predicate isSinkFor(DataFlow::Configuration cfg, DataFlow::FlowLabel lbl) {
|
||||
configSpec(cfg, config) and sinkFlowLabelSpec(lbl, flowLabel)
|
||||
}
|
||||
}
|
||||
|
||||
/**
|
||||
* An additional flow step specified through the `additionalSteps` predicate.
|
||||
*/
|
||||
private class AdditionalFlowStepFromSpec extends DataFlow::Configuration {
|
||||
DataFlow::Node entry;
|
||||
string startFlowLabel;
|
||||
DataFlow::Node exit;
|
||||
string endFlowLabel;
|
||||
|
||||
AdditionalFlowStepFromSpec() {
|
||||
exists(Portal startPortal, Portal endPortal, string config |
|
||||
additionalSteps(startPortal.toString(), startFlowLabel, endPortal.toString(), endFlowLabel,
|
||||
config) and
|
||||
configSpec(this, config) and
|
||||
entry = startPortal.getAnEntryNode(_) and
|
||||
exit = endPortal.getAnExitNode(_)
|
||||
)
|
||||
}
|
||||
|
||||
override predicate isAdditionalFlowStep(
|
||||
DataFlow::Node pred, DataFlow::Node succ, DataFlow::FlowLabel predlbl,
|
||||
DataFlow::FlowLabel succlbl
|
||||
) {
|
||||
pred = entry and
|
||||
succ = exit and
|
||||
predlbl = startFlowLabel and
|
||||
succlbl = endFlowLabel
|
||||
}
|
||||
}
|
||||
@@ -1,17 +0,0 @@
|
||||
import javascript
|
||||
import semmle.javascript.dataflow.Portals
|
||||
|
||||
/**
|
||||
* An escaping entry node of a portal, viewed as an additional sink node for any flow
|
||||
* configuration currently in scope.
|
||||
*/
|
||||
class PortalEntrySink extends DataFlow::AdditionalSink {
|
||||
Portal p;
|
||||
|
||||
PortalEntrySink() { this = p.getAnEntryNode(true) }
|
||||
|
||||
override predicate isSinkFor(DataFlow::Configuration cfg, DataFlow::FlowLabel lbl) { any() }
|
||||
|
||||
/** Gets the portal of which this is an entry node. */
|
||||
Portal getPortal() { result = p }
|
||||
}
|
||||
@@ -1,17 +0,0 @@
|
||||
import javascript
|
||||
import semmle.javascript.dataflow.Portals
|
||||
|
||||
/**
|
||||
* A remote exit node of a portal, viewed as an additional source node for any flow
|
||||
* configuration currently in scope.
|
||||
*/
|
||||
class PortalExitSource extends DataFlow::AdditionalSource {
|
||||
Portal p;
|
||||
|
||||
PortalExitSource() { this = p.getAnExitNode(true) }
|
||||
|
||||
override predicate isSourceFor(DataFlow::Configuration cfg, DataFlow::FlowLabel lbl) { any() }
|
||||
|
||||
/** Gets the portal of which this is an exit node. */
|
||||
Portal getPortal() { result = p }
|
||||
}
|
||||
@@ -1,91 +0,0 @@
|
||||
/**
|
||||
* Provides utility predicates for working with flow summary specifications.
|
||||
*/
|
||||
|
||||
import javascript
|
||||
|
||||
/**
|
||||
* Holds if `config` matches `spec`, that is, either `spec` is the ID of `config`
|
||||
* or `spec` is the empty string and `config` is an arbitrary configuration.
|
||||
*/
|
||||
predicate configSpec(DataFlow::Configuration config, string spec) {
|
||||
config.getId() = spec
|
||||
or
|
||||
spec = ""
|
||||
}
|
||||
|
||||
/**
|
||||
* Holds if `lbl` matches `spec`, that is, either `spec` is the name of `config`
|
||||
* or `spec` is the empty string and `lbl` is the built-in flow label `data`.
|
||||
*/
|
||||
predicate sourceFlowLabelSpec(DataFlow::FlowLabel lbl, string spec) {
|
||||
lbl.toString() = spec
|
||||
or
|
||||
spec = "" and
|
||||
lbl.isData()
|
||||
}
|
||||
|
||||
/**
|
||||
* Holds if `lbl` matches `spec`, that is, either `spec` is the name of `config`
|
||||
* or `spec` is the empty string and `lbl` is an arbitrary standard flow label.
|
||||
*/
|
||||
predicate sinkFlowLabelSpec(DataFlow::FlowLabel lbl, string spec) {
|
||||
lbl.toString() = spec
|
||||
or
|
||||
spec = "" and
|
||||
lbl.isDataOrTaint()
|
||||
}
|
||||
|
||||
/**
|
||||
* A comment that annotates data flow nodes as sources/sinks.
|
||||
*
|
||||
* Such a comment starts with "Semmle:", possibly preceded by whitespace, and
|
||||
* may contain specifications of the form "source: label,config" and "sink: label, config"
|
||||
* where again whitespace is not significant and the ",config" part may be missing.
|
||||
*
|
||||
* It applies to any data flow node that ends on the line where the comment starts,
|
||||
* and annotates the node as being a source/sink with the given flow label(s) for
|
||||
* the given configuration (or any configuration if omitted).
|
||||
*/
|
||||
class AnnotationComment extends Comment {
|
||||
string ann;
|
||||
|
||||
AnnotationComment() { ann = getText().regexpCapture("(?s)\\s*Semmle:(.*)", 1) }
|
||||
|
||||
/**
|
||||
* Holds if this comment applies to `nd`, that is, it starts on the same line on
|
||||
* which `nd` ends.
|
||||
*/
|
||||
predicate appliesTo(DataFlow::Node nd) {
|
||||
exists(string file, int line |
|
||||
getLocation().hasLocationInfo(file, line, _, _, _) and
|
||||
nd.hasLocationInfo(file, _, _, line, _)
|
||||
)
|
||||
}
|
||||
|
||||
/**
|
||||
* Holds if this comment contains an annotation of the form `source: label, config`
|
||||
* or `source: label` (modulo whitespace). In the latter case, `config` may be
|
||||
* any configuration.
|
||||
*/
|
||||
predicate specifiesSource(DataFlow::FlowLabel label, DataFlow::Configuration config) {
|
||||
exists(string spec |
|
||||
spec = ann.regexpFind("(?<=\\bsource:)\\s*[^\\s,]+(\\s*,\\s*[^\\s,])?", _, _) and
|
||||
sourceFlowLabelSpec(label, spec.splitAt(",", 0).trim()) and
|
||||
configSpec(config, spec.splitAt(",", 1).trim())
|
||||
)
|
||||
}
|
||||
|
||||
/**
|
||||
* Holds if this comment contains an annotation of the form `sink: label, config`
|
||||
* or `sink: label` (modulo whitespace). In the latter case, `config` may be
|
||||
* any configuration.
|
||||
*/
|
||||
predicate specifiesSink(string label, string config) {
|
||||
exists(string spec |
|
||||
spec = ann.regexpFind("(?<=\\bsink:)\\s*[^\\s,]+(\\s*,\\s*[^\\s,]+)?", _, _) and
|
||||
sinkFlowLabelSpec(label, spec.splitAt(",", 0).trim()) and
|
||||
configSpec(config, spec.splitAt(",", 1).trim())
|
||||
)
|
||||
}
|
||||
}
|
||||
@@ -1,18 +0,0 @@
|
||||
import javascript
|
||||
import Shared
|
||||
|
||||
/**
|
||||
* A data flow node that is annotated as a sink.
|
||||
*/
|
||||
class SinkFromAnnotation extends DataFlow::AdditionalSink {
|
||||
AnnotationComment c;
|
||||
|
||||
SinkFromAnnotation() {
|
||||
c.appliesTo(this) and
|
||||
c.specifiesSink(_, _)
|
||||
}
|
||||
|
||||
override predicate isSinkFor(DataFlow::Configuration cfg, DataFlow::FlowLabel lbl) {
|
||||
c.specifiesSink(lbl, cfg)
|
||||
}
|
||||
}
|
||||
@@ -1,18 +0,0 @@
|
||||
import javascript
|
||||
import Shared
|
||||
|
||||
/**
|
||||
* A data flow node that is annotated as a source.
|
||||
*/
|
||||
class SourceFromAnnotation extends DataFlow::AdditionalSource {
|
||||
AnnotationComment c;
|
||||
|
||||
SourceFromAnnotation() {
|
||||
c.appliesTo(this) and
|
||||
c.specifiesSource(_, _)
|
||||
}
|
||||
|
||||
override predicate isSourceFor(DataFlow::Configuration cfg, DataFlow::FlowLabel lbl) {
|
||||
c.specifiesSource(lbl, cfg)
|
||||
}
|
||||
}
|
||||
@@ -1,6 +0,0 @@
|
||||
| (parameter 0 (member h (root https://www.npmjs.com/package/infer-sources))) | data | (return (member h (root https://www.npmjs.com/package/infer-sources))) | data | CodeInjection |
|
||||
| (parameter 0 (member h (root https://www.npmjs.com/package/infer-sources))) | taint | (return (member h (root https://www.npmjs.com/package/infer-sources))) | taint | CodeInjection |
|
||||
| (parameter 0 (member notASink (root https://www.npmjs.com/package/infer-sources))) | data | (return (member notASink (root https://www.npmjs.com/package/infer-sources))) | data | CodeInjection |
|
||||
| (parameter 0 (member notASink (root https://www.npmjs.com/package/infer-sources))) | taint | (return (member notASink (root https://www.npmjs.com/package/infer-sources))) | taint | CodeInjection |
|
||||
| (parameter 0 (member notATaintedSource (root https://www.npmjs.com/package/infer-sources))) | data | (return (member notATaintedSource (root https://www.npmjs.com/package/infer-sources))) | data | CodeInjection |
|
||||
| (parameter 0 (member notATaintedSource (root https://www.npmjs.com/package/infer-sources))) | taint | (return (member notATaintedSource (root https://www.npmjs.com/package/infer-sources))) | taint | CodeInjection |
|
||||
@@ -1 +0,0 @@
|
||||
experimental/Summaries/ExtractFlowStepSummaries.ql
|
||||
@@ -1,6 +0,0 @@
|
||||
| (parameter 0 (member codeInjection (root https://www.npmjs.com/package/infer-sources))) | data | CodeInjection |
|
||||
| (parameter 0 (member codeInjection (root https://www.npmjs.com/package/infer-sources))) | taint | CodeInjection |
|
||||
| (parameter 0 (member hashPass (root https://www.npmjs.com/package/infer-sources))) | data | CodeInjection |
|
||||
| (parameter 0 (member hashPass (root https://www.npmjs.com/package/infer-sources))) | taint | CodeInjection |
|
||||
| (parameter 0 (member multiple (root https://www.npmjs.com/package/infer-sources))) | data | CodeInjection |
|
||||
| (parameter 0 (member multiple (root https://www.npmjs.com/package/infer-sources))) | taint | CodeInjection |
|
||||
@@ -1 +0,0 @@
|
||||
experimental/Summaries/ExtractSinkSummaries.ql
|
||||
@@ -1,2 +0,0 @@
|
||||
| (parameter 0 (parameter 0 (member listen (root https://www.npmjs.com/package/infer-sources)))) | taint | CodeInjection |
|
||||
| (return (member taintedSource (root https://www.npmjs.com/package/infer-sources))) | taint | CodeInjection |
|
||||
@@ -1 +0,0 @@
|
||||
experimental/Summaries/ExtractSourceSummaries.ql
|
||||
@@ -1,192 +0,0 @@
|
||||
var http = require('http'),
|
||||
url = require('url');
|
||||
|
||||
function listenForHeaders(cb) {
|
||||
http.createServer(function (req, res) {
|
||||
let cmd = url.parse(req.url, true).query.path;
|
||||
cb(cmd); // sink
|
||||
res.write('Hello World!');
|
||||
res.end();
|
||||
}).listen(8080);
|
||||
};
|
||||
|
||||
function codeInjection(input) {
|
||||
eval("url[" + input + "]");
|
||||
}
|
||||
|
||||
function commandInjection(input) {
|
||||
require("child_process").exec("ls " + input);
|
||||
}
|
||||
|
||||
function multiple(input) {
|
||||
codeInjection(input);
|
||||
commandInjection(input);
|
||||
}
|
||||
|
||||
function taintedPath(input) {
|
||||
require("/tmp/" + input);
|
||||
}
|
||||
|
||||
function regexpInj(data) {
|
||||
new RegExp("^"+ data.name + "$", "i");
|
||||
}
|
||||
|
||||
function xpathInj(userName) {
|
||||
const xpath = require('xpath');
|
||||
let badXPathExpr = xpath.parse("//users/user[login/text()='" + userName + "']/home_dir/text()");
|
||||
badXPathExpr.select({
|
||||
node: root
|
||||
});
|
||||
}
|
||||
|
||||
function xxe(input) {
|
||||
const expat = require('node-expat');
|
||||
var parser = new expat.Parser();
|
||||
parser.write(input);
|
||||
}
|
||||
|
||||
|
||||
function xmlBomb(input) {
|
||||
const libxmljs = require('libxmljs');
|
||||
libxmljs.parseXml(input, { noent: true });
|
||||
|
||||
}
|
||||
|
||||
function hashPass(input) {
|
||||
require('crypto').createCipher('aes192').write(input);
|
||||
codeInjection(input)
|
||||
}
|
||||
|
||||
function unsafeDes(input) {
|
||||
const jsyaml = require("js-yaml");
|
||||
let data;
|
||||
return jsyaml.load(input);
|
||||
}
|
||||
|
||||
function remoteProp(input1, input2, input3) {
|
||||
var obj = url[input1];
|
||||
obj[input2] = input3;
|
||||
}
|
||||
|
||||
function reflected(userID) {
|
||||
var express = require('express');
|
||||
|
||||
var app = express();
|
||||
|
||||
app.get('/user/:id', function(req, res) {
|
||||
res.send("Unknown user: " + userID);
|
||||
});
|
||||
}
|
||||
|
||||
function redirect(input) {
|
||||
var https = require('https');
|
||||
var url = require('url');
|
||||
|
||||
var server = https.createServer(function(req, res) {
|
||||
res.writeHead(302, { Location: '/' + input});
|
||||
}).listen(8080)
|
||||
|
||||
}
|
||||
|
||||
function sqlInj(input) {
|
||||
var mysql = require('mysql');
|
||||
var connection = mysql.createConnection({
|
||||
host : 'localhost',
|
||||
user : 'me',
|
||||
password : 'secret',
|
||||
database : 'my_db'
|
||||
});
|
||||
connection.connect();
|
||||
connection.query('SELECT ' + input + ' AS solution', function (error, results, fields) {
|
||||
if (error) throw error;
|
||||
console.log('The solution is: ', results[0].solution);
|
||||
});
|
||||
}
|
||||
|
||||
function createError () {
|
||||
var err, status;
|
||||
for (i = 0; i < 1000; i++) {
|
||||
err = {};
|
||||
status = err.a || err.b || err.c || err.d || err;
|
||||
}
|
||||
|
||||
err.a = err.b = status
|
||||
|
||||
return err;
|
||||
}
|
||||
|
||||
function forLoop(input) {
|
||||
var intObj = {};
|
||||
var res = 0;
|
||||
for (var i = 0; i < input.x.length; i++) {
|
||||
res += intObj.x + input.x[i];
|
||||
}
|
||||
if (res < 1000) {
|
||||
intObj.res = res;
|
||||
return intObj;
|
||||
} else
|
||||
return res;
|
||||
}
|
||||
|
||||
function notASink(foo) {
|
||||
return foo;
|
||||
}
|
||||
|
||||
// this call should not make parameter `foo` a command injection sink
|
||||
eval(notASink(42));
|
||||
|
||||
function taintedSource() {
|
||||
return location.search;
|
||||
}
|
||||
|
||||
function notATaintedSource(x) {
|
||||
return x;
|
||||
}
|
||||
|
||||
// this call should not make the return value of `notATaintedSource` a remote flow source
|
||||
notATaintedSource(location.search);
|
||||
|
||||
function invoke(cb, x) {
|
||||
cb(x);
|
||||
}
|
||||
|
||||
// this call should not make the first argument to `cb` above a remote flow source
|
||||
invoke((x)=>x, location.search);
|
||||
|
||||
function g(x) {
|
||||
h(x);
|
||||
}
|
||||
|
||||
function h(y) {
|
||||
return y;
|
||||
}
|
||||
|
||||
function mkdirp(path) {
|
||||
path /* Semmle: sink: taint, TaintedPath */
|
||||
}
|
||||
|
||||
module.exports = {
|
||||
codeInjection: codeInjection,
|
||||
commandInjection: commandInjection,
|
||||
remotePropeInjection: remoteProp,
|
||||
multiple: multiple,
|
||||
taintedPath: taintedPath,
|
||||
sqlInj: sqlInj,
|
||||
listen: listenForHeaders,
|
||||
createError: createError,
|
||||
regexpInj: regexpInj,
|
||||
xpathInj: xpathInj,
|
||||
xmlBomb: xmlBomb,
|
||||
hashPass: hashPass,
|
||||
xxe: xxe,
|
||||
unsafeDes: unsafeDes,
|
||||
redirect: redirect,
|
||||
reflected: reflected,
|
||||
notASink: notASink,
|
||||
taintedSource: taintedSource,
|
||||
notATaintedSource: notATaintedSource,
|
||||
invoke: invoke,
|
||||
g: g,
|
||||
h: h,
|
||||
mkdirp: mkdirp
|
||||
}
|
||||
@@ -1,10 +0,0 @@
|
||||
{
|
||||
"name": "infer-sources",
|
||||
"version": "0.0.1",
|
||||
"dependencies": {
|
||||
"mysql": "2.15.0",
|
||||
"xpath": "0.0.27",
|
||||
"libxmljs": "0.19.1"
|
||||
},
|
||||
"main": "index.js"
|
||||
}
|
||||
Reference in New Issue
Block a user