Merge branch 'main' into codeql-ci/atm/release-0.4.8

javascript/ql/experimental/adaptivethreatmodeling/src/NosqlInjectionATM.ql

@@ -17,11 +17,8 @@ import ATM::ResultsInfo
 import DataFlow::PathGraph
 import experimental.adaptivethreatmodeling.NosqlInjectionATM
 
-from DataFlow::Configuration cfg, DataFlow::PathNode source, DataFlow::PathNode sink, float score
-where
-  cfg.hasFlowPath(source, sink) and
-  not isFlowLikelyInBaseQuery(source.getNode(), sink.getNode()) and
-  score = getScoreForFlow(source.getNode(), sink.getNode())
+from AtmConfig cfg, DataFlow::PathNode source, DataFlow::PathNode sink, float score
+where cfg.hasBoostedFlowPath(source, sink, score)
 select sink.getNode(), source, sink,
   "(Experimental) This may be a database query that depends on $@. Identified using machine learning.",
   source.getNode(), "a user-provided value", score

javascript/ql/experimental/adaptivethreatmodeling/src/ShellCommandInjectionFromEnvironmentATM.md

@@ -0,0 +1,75 @@
+
+# Shell command built from environment values (experimental)
+
+Dynamically constructing a shell command with values from the
+local environment, such as file paths, may inadvertently
+change the meaning of the shell command.
+
+Such changes can occur when an environment value contains
+characters that the shell interprets in a special way, for instance
+quotes and spaces.
+
+This can result in the shell command misbehaving, or even
+allowing a malicious user to execute arbitrary commands on the system.
+
+Note: This CodeQL query is an experimental query. Experimental queries generate alerts using machine learning. They might include more false positives but they will improve over time.
+
+## Recommendation
+
+If possible, use hard-coded string literals to specify the
+shell command to run, and provide the dynamic arguments to the shell
+command separately to avoid interpretation by the shell.
+
+Alternatively, if the shell command must be constructed
+dynamically, then add code to ensure that special characters in
+environment values do not alter the shell command unexpectedly.
+
+## Example
+
+The following example shows a dynamically constructed shell
+command that recursively removes a temporary directory that is located
+next to the currently executing JavaScript file. Such utilities are
+often found in custom build scripts.
+
+```javascript
+var cp = require("child_process"),
+  path = require("path");
+function cleanupTemp() {
+  let cmd = "rm -rf " + path.join(__dirname, "temp");
+  cp.execSync(cmd); // BAD
+}
+```
+
+The shell command will, however, fail to work as intended if the
+absolute path of the script's directory contains spaces. In that
+case, the shell command will interpret the absolute path as multiple
+paths, instead of a single path.
+
+For instance, if the absolute path of
+the temporary directory is "`/home/username/important project/temp`", then the shell command will recursively delete
+`"/home/username/important"` and `"project/temp"`,
+where the latter path gets resolved relative to the working directory
+of the JavaScript process.
+
+Even worse, although less likely, a malicious user could
+provide the path `"/home/username/; cat /etc/passwd #/important
+project/temp"` in order to execute the command `"cat
+/etc/passwd"`.
+
+To avoid such potentially catastrophic behaviors, provide the
+directory as an argument that does not get interpreted by a
+shell:
+
+```javascript
+var cp = require("child_process"),
+  path = require("path");
+function cleanupTemp() {
+  let cmd = "rm",
+    args = ["-rf", path.join(__dirname, "temp")];
+  cp.execFileSync(cmd, args); // GOOD
+}
+```
+
+
+## References
+* OWASP: [Command Injection](https://www.owasp.org/index.php/Command_Injection)

javascript/ql/experimental/adaptivethreatmodeling/src/ShellCommandInjectionFromEnvironmentATM.ql

@@ -0,0 +1,29 @@
+/**
+ * For internal use only.
+ *
+ * @name Shell command built from environment values
+ * @description Building a shell command string with values from the enclosing
+ *              environment may cause subtle bugs or vulnerabilities.
+ * @kind path-problem
+ * @scored
+ * @problem.severity warning
+ * @security-severity 6.3
+ * @precision high
+ * @id js/ml-powered/shell-command-injection-from-environment
+ * @tags experimental security
+ *       correctness
+ *       security
+ *       external/cwe/cwe-078
+ *       external/cwe/cwe-088
+ */
+
+import javascript
+import experimental.adaptivethreatmodeling.ShellCommandInjectionFromEnvironmentATM
+import ATM::ResultsInfo
+import DataFlow::PathGraph
+
+from AtmConfig cfg, DataFlow::PathNode source, DataFlow::PathNode sink, float score
+where cfg.hasBoostedFlowPath(source, sink, score)
+select sink.getNode(), source, sink,
+  "(Experimental) This shell command depends on $@. Identified using machine learning.",
+  source.getNode(), "an uncontrolled value", score

javascript/ql/experimental/adaptivethreatmodeling/src/SqlInjectionATM.ql

@@ -17,11 +17,8 @@ import experimental.adaptivethreatmodeling.SqlInjectionATM
 import ATM::ResultsInfo
 import DataFlow::PathGraph
 
-from DataFlow::Configuration cfg, DataFlow::PathNode source, DataFlow::PathNode sink, float score
-where
-  cfg.hasFlowPath(source, sink) and
-  not isFlowLikelyInBaseQuery(source.getNode(), sink.getNode()) and
-  score = getScoreForFlow(source.getNode(), sink.getNode())
+from AtmConfig cfg, DataFlow::PathNode source, DataFlow::PathNode sink, float score
+where cfg.hasBoostedFlowPath(source, sink, score)
 select sink.getNode(), source, sink,
   "(Experimental) This may be a database query that depends on $@. Identified using machine learning.",
   source.getNode(), "a user-provided value", score

javascript/ql/experimental/adaptivethreatmodeling/src/TaintedPathATM.ql

@@ -21,11 +21,8 @@ import ATM::ResultsInfo
 import DataFlow::PathGraph
 import experimental.adaptivethreatmodeling.TaintedPathATM
 
-from DataFlow::Configuration cfg, DataFlow::PathNode source, DataFlow::PathNode sink, float score
-where
-  cfg.hasFlowPath(source, sink) and
-  not isFlowLikelyInBaseQuery(source.getNode(), sink.getNode()) and
-  score = getScoreForFlow(source.getNode(), sink.getNode())
+from AtmConfig cfg, DataFlow::PathNode source, DataFlow::PathNode sink, float score
+where cfg.hasBoostedFlowPath(source, sink, score)
 select sink.getNode(), source, sink,
   "(Experimental) This may be a path that depends on $@. Identified using machine learning.",
   source.getNode(), "a user-provided value", score

javascript/ql/experimental/adaptivethreatmodeling/src/XssATM.ql

@@ -18,11 +18,8 @@ import ATM::ResultsInfo
 import DataFlow::PathGraph
 import experimental.adaptivethreatmodeling.XssATM
 
-from DataFlow::Configuration cfg, DataFlow::PathNode source, DataFlow::PathNode sink, float score
-where
-  cfg.hasFlowPath(source, sink) and
-  not isFlowLikelyInBaseQuery(source.getNode(), sink.getNode()) and
-  score = getScoreForFlow(source.getNode(), sink.getNode())
+from AtmConfig cfg, DataFlow::PathNode source, DataFlow::PathNode sink, float score
+where cfg.hasBoostedFlowPath(source, sink, score)
 select sink.getNode(), source, sink,
   "(Experimental) This may be a cross-site scripting vulnerability due to $@. Identified using machine learning.",
   source.getNode(), "a user-provided value", score

javascript/ql/experimental/adaptivethreatmodeling/src/XssThroughDomATM.md

@@ -0,0 +1,48 @@
+# DOM text reinterpreted as HTML (experimental)
+
+Extracting text from a DOM node and interpreting it as HTML can lead to a cross-site scripting vulnerability.
+
+A webpage with this vulnerability reads text from the DOM, and afterwards adds the text as HTML to the DOM. Using text from the DOM as HTML effectively unescapes the text, and thereby invalidates any escaping done on the text. If an attacker is able to control the safe sanitized text, then this vulnerability can be exploited to perform a cross-site scripting attack. 
+
+Note: This CodeQL query is an experimental query. Experimental queries generate alerts using machine learning. They might include more false positives but they will improve over time.
+
+## Recommendation
+
+To guard against cross-site scripting, consider using contextual output encoding/escaping before writing text to the page, or one of the other solutions that are mentioned in the References section below.
+
+## Example
+
+The following example shows a webpage using a `data-target` attribute 
+to select and manipulate a DOM element using the JQuery library. In the example, the 
+`data-target` attribute is read into the `target` variable, and the 
+`$` function is then supposed to use the `target` variable as a CSS 
+selector to determine which element should be manipulated.
+
+```javascript
+$("button").click(function () {
+    var target = $(this).attr("data-target");
+    $(target).hide();
+});
+```
+
+However, if an attacker can control the `data-target` attribute, 
+then the value of `target` can be used to cause the `$` function
+to execute arbitrary JavaScript. 
+
+The above vulnerability can be fixed by using `$.find` instead of `$`. 
+The `$.find` function will only interpret `target` as a CSS selector 
+and never as HTML, thereby preventing an XSS attack. 
+
+```javascript
+$("button").click(function () {
+    var target = $(this).attr("data-target");
+	$.find(target).hide();
+});
+```
+
+## References
+* OWASP: [DOM based XSS Prevention Cheat Sheet](https://cheatsheetseries.owasp.org/cheatsheets/DOM_based_XSS_Prevention_Cheat_Sheet.html)
+* OWASP: [(Cross Site Scripting) Prevention Cheat Sheet](https://cheatsheetseries.owasp.org/cheatsheets/Cross_Site_Scripting_Prevention_Cheat_Sheet.html)
+* OWASP [DOM Based XSS](https://owasp.org/www-community/attacks/DOM_Based_XSS)
+* OWASP [Types of Cross-Site Scripting](https://owasp.org/www-community/Types_of_Cross-Site_Scripting)
+* Wikipedia: [Cross-site scripting](http://en.wikipedia.org/wiki/Cross-site_scripting)

javascript/ql/experimental/adaptivethreatmodeling/src/XssThroughDomATM.ql

@@ -0,0 +1,25 @@
+/**
+ * For internal use only.
+ *
+ * @name DOM text reinterpreted as HTML (experimental)
+ * @description Reinterpreting text from the DOM as HTML can lead
+ *              to a cross-site scripting vulnerability.
+ * @kind path-problem
+ * @scored
+ * @problem.severity error
+ * @security-severity 6.1
+ * @id js/ml-powered/xss-through-dom
+ * @tags experimental security
+ *       external/cwe/cwe-079 external/cwe/cwe-116
+ */
+
+import javascript
+import ATM::ResultsInfo
+import DataFlow::PathGraph
+import experimental.adaptivethreatmodeling.XssThroughDomATM
+
+from AtmConfig cfg, DataFlow::PathNode source, DataFlow::PathNode sink, float score
+where cfg.hasBoostedFlowPath(source, sink, score)
+select sink.getNode(), source, sink,
+  "(Experimental) $@ may be reinterpreted as HTML without escaping meta-characters. Identified using machine learning.",
+  source.getNode(), "DOM text", score

javascript/ql/experimental/adaptivethreatmodeling/src/qlpack.yml

@@ -1,4 +1,5 @@
 name: codeql/javascript-experimental-atm-queries
+description: Experimental ML-powered queries for JavaScript
 language: javascript
 version: 0.4.9
 suites: codeql-suites