hohn/codeql
1
0
Fork 0
mirror of https://github.com/github/codeql.git synced 2026-05-02 04:05:14 +02:00
Code Issues Packages Projects Releases Wiki Activity

Merge branch 'master' into js/format-string-taint-step

Browse Source
This commit is contained in:
Esben Sparre Andreasen
2018-08-21 15:47:31 +02:00
committed by GitHub
parent f522376217 6969466202
commit eb356d8d0b
99 changed files with 825 additions and 720 deletions
Download Patch File Download Diff File Expand all files Collapse all files

28
javascript/ql/src/semmle/javascript/dataflow/TaintTracking.qll
View File

@@ -608,14 +608,14 @@ module TaintTracking {
}
/** A check of the form `if(o.indexOf(x) != -1)`, which sanitizes `x` in its "then" branch. */
/** A check of the form `if(whitelist.indexOf(x) != -1)`, which sanitizes `x` in its "then" branch. */
class IndexOfSanitizer extends AdditionalSanitizerGuardNode, DataFlow::ValueNode {
MethodCallExpr indexOf;
override EqualityTest astNode;
IndexOfSanitizer() {
exists (Expr index | astNode.hasOperands(indexOf, index) |
// one operand is of the form `o.indexOf(x)`
// one operand is of the form `whitelist.indexOf(x)`
indexOf.getMethodName() = "indexOf" and
// and the other one is -1
index.getIntValue() = -1
@@ -633,6 +633,30 @@ module TaintTracking {
}
/**
* A check of the form `if(~whitelist.indexOf(x))`, which sanitizes `x` in its "then" branch.
*
* This sanitizer is equivalent to `if(whitelist.indexOf(x) != -1)`, since `~n = 0` iff `n = -1`.
*/
class BitwiseIndexOfSanitizer extends AdditionalSanitizerGuardNode, DataFlow::ValueNode {
MethodCallExpr indexOf;
override BitNotExpr astNode;
BitwiseIndexOfSanitizer() {
astNode.getOperand() = indexOf and
indexOf.getMethodName() = "indexOf"
}
override predicate sanitizes(boolean outcome, Expr e) {
outcome = true and
e = indexOf.getArgument(0)
}
override predicate appliesTo(Configuration cfg) {
any()
}
}
/** A check of the form `if(x == 'some-constant')`, which sanitizes `x` in its "then" branch. */
class ConstantComparison extends AdditionalSanitizerGuardNode, DataFlow::ValueNode {

2
javascript/ql/test/library-tests/TaintBarriers/SanitizingGuard.expected
View File

@@ -29,3 +29,5 @@
| tst.js:160:9:160:30 | v === " ... sted-1" | ExampleConfiguration | true | tst.js:160:9:160:9 | v |
| tst.js:160:35:160:56 | v === " ... sted-2" | ExampleConfiguration | true | tst.js:160:35:160:35 | v |
| tst.js:166:9:166:16 | v == !!0 | ExampleConfiguration | true | tst.js:166:9:166:9 | v |
| tst.js:184:9:184:21 | ~o.indexOf(v) | ExampleConfiguration | true | tst.js:184:20:184:20 | v |
| tst.js:190:10:190:22 | ~o.indexOf(v) | ExampleConfiguration | true | tst.js:190:21:190:21 | v |

3
javascript/ql/test/library-tests/TaintBarriers/TaintedSink.expected
View File

@@ -25,3 +25,6 @@
| tst.js:155:14:155:14 | v | tst.js:145:13:145:20 | SOURCE() |
| tst.js:163:14:163:14 | v | tst.js:145:13:145:20 | SOURCE() |
| tst.js:169:14:169:14 | v | tst.js:145:13:145:20 | SOURCE() |
| tst.js:182:10:182:10 | v | tst.js:181:13:181:20 | SOURCE() |
| tst.js:187:14:187:14 | v | tst.js:181:13:181:20 | SOURCE() |
| tst.js:191:14:191:14 | v | tst.js:181:13:181:20 | SOURCE() |

2
javascript/ql/test/library-tests/TaintBarriers/isBarrier.expected
View File

@@ -22,3 +22,5 @@
| tst.js:160:35:160:56 | v | ExampleConfiguration |
| tst.js:167:14:167:14 | v | ExampleConfiguration |
| tst.js:176:18:176:18 | v | ExampleConfiguration |
| tst.js:185:14:185:14 | v | ExampleConfiguration |
| tst.js:193:14:193:14 | v | ExampleConfiguration |

18
javascript/ql/test/library-tests/TaintBarriers/tst.js
View File

@@ -176,3 +176,21 @@ function customSanitizer() {
v = SANITIZE(v);
SINK(v);
}
function BitwiseIndexOfCheckSanitizer () {
var v = SOURCE();
SINK(v);
if (~o.indexOf(v)) {
SINK(v);
} else {
SINK(v);
}
if (!~o.indexOf(v)) {
SINK(v);
} else {
SINK(v);
}
}

24
javascript/ql/test/violation-tests/LanguageFeatures/SpuriousArguments/reflection.js
View File

@@ -1,24 +0,0 @@
function f0() {}
function f1(x) {}
f0.call();
f0.call(this);
f0.call(this, 1);
f0.call(this, 1, 2);
f1.call();
f1.call(this);
f1.call(this, 1);
f1.call(this, 1, 2);
f0.apply();
f0.apply(this);
f0.apply(this, []);
f0.apply(this, [1]);
f0.apply(this, [1, 2]);
f1.apply();
f1.apply(this);
f1.apply(this, []);
f1.apply(this, [1]);
f1.apply(this, [1, 2]);