hohn/codeql
1
0
Fork 0
mirror of https://github.com/github/codeql.git synced 2025-12-16 16:53:25 +01:00
Code Issues Packages Projects Releases Wiki Activity

Added modeling of client-s3 v2 and v3

Browse Source
This commit is contained in:
Napalys Klicius
2025-07-29 09:52:49 +02:00
parent 5e6118ef3f
commit ee1af432fe
3 changed files with 69 additions and 5 deletions
Download Patch File Download Diff File Expand all files Collapse all files

20
javascript/ql/lib/ext/client-s3.model.yml Normal file
View File

@@ -0,0 +1,20 @@
extensions:
- addsTo:
pack: codeql/javascript-all
extensible: sinkModel
data:
- ["S3ClientV3", "ReturnValue.Member[send].Argument[0]", "sql-injection"]
- ["S3ClientV2", "ReturnValue.Member[selectObjectContent].Argument[0].Member[Expression]", "sql-injection"]
- addsTo:
pack: codeql/javascript-all
extensible: summaryModel
data:
- ["@aws-sdk/client-s3", "Member[SelectObjectContentCommand]", "Argument[0].Member[Expression]", "ReturnValue", "taint"]
- addsTo:
pack: codeql/javascript-all
extensible: typeModel
data:
- ["S3ClientV3", "@aws-sdk/client-s3", "Member[S3Client]"]
- ["S3ClientV2", "aws-sdk", "Member[S3]"]

44
javascript/ql/test/query-tests/Security/CWE-089/untyped/SqlInjection.expected
View File

@@ -1,4 +1,7 @@
#select
| clients3.js:18:23:18:60 | new Sel ... params) | clients3.js:10:26:10:33 | req.body | clients3.js:18:23:18:60 | new Sel ... params) | This query string depends on a $@. | clients3.js:10:26:10:33 | req.body | user-provided value |
| clients3.js:29:21:29:68 | "SELECT ... usInput | clients3.js:23:26:23:33 | req.body | clients3.js:29:21:29:68 | "SELECT ... usInput | This query string depends on a $@. | clients3.js:23:26:23:33 | req.body | user-provided value |
| clients3.js:38:21:38:68 | "SELECT ... usInput | clients3.js:23:26:23:33 | req.body | clients3.js:38:21:38:68 | "SELECT ... usInput | This query string depends on a $@. | clients3.js:23:26:23:33 | req.body | user-provided value |
| dynamodb.js:15:23:15:29 | command | dynamodb.js:9:26:9:33 | req.body | dynamodb.js:15:23:15:29 | command | This query string depends on a $@. | dynamodb.js:9:26:9:33 | req.body | user-provided value |
| dynamodb.js:21:23:21:35 | updateCommand | dynamodb.js:9:26:9:33 | req.body | dynamodb.js:21:23:21:35 | updateCommand | This query string depends on a $@. | dynamodb.js:9:26:9:33 | req.body | user-provided value |
| dynamodb.js:47:24:47:30 | command | dynamodb.js:9:26:9:33 | req.body | dynamodb.js:47:24:47:30 | command | This query string depends on a $@. | dynamodb.js:9:26:9:33 | req.body | user-provided value |
@@ -143,6 +146,7 @@
| tst4.js:8:10:8:66 | 'SELECT ... d + '"' | tst4.js:8:46:8:60 | $routeParams.id | tst4.js:8:10:8:66 | 'SELECT ... d + '"' | This query string depends on a $@. | tst4.js:8:46:8:60 | $routeParams.id | user-provided value |
| tst.js:10:10:10:64 | 'SELECT ... d + '"' | tst.js:10:46:10:58 | req.params.id | tst.js:10:10:10:64 | 'SELECT ... d + '"' | This query string depends on a $@. | tst.js:10:46:10:58 | req.params.id | user-provided value |
edges
<<<<<<< HEAD
| dynamodb.js:9:9:9:22 | maliciousInput | dynamodb.js:11:64:11:77 | maliciousInput | provenance | |
| dynamodb.js:9:9:9:22 | maliciousInput | dynamodb.js:17:80:17:93 | maliciousInput | provenance | |
| dynamodb.js:9:26:9:33 | req.body | dynamodb.js:9:9:9:22 | maliciousInput | provenance | |
@@ -151,6 +155,28 @@ edges
| dynamodb.js:12:11:12:17 | command | dynamodb.js:15:23:15:29 | command | provenance | |
| dynamodb.js:12:11:12:17 | command | dynamodb.js:47:24:47:30 | command | provenance | |
| dynamodb.js:12:21:14:6 | new Exe ... \\n }) | dynamodb.js:12:11:12:17 | command | provenance | |
=======
| clients3.js:10:9:10:40 | maliciousInput | clients3.js:16:55:16:68 | maliciousInput | provenance | |
| clients3.js:10:26:10:33 | req.body | clients3.js:10:9:10:40 | maliciousInput | provenance | |
| clients3.js:12:11:17:5 | params [Expression] | clients3.js:18:54:18:59 | params [Expression] | provenance | |
| clients3.js:12:20:17:5 | {\\n ... ,\\n } [Expression] | clients3.js:12:11:17:5 | params [Expression] | provenance | |
| clients3.js:16:21:16:68 | "SELECT ... usInput | clients3.js:12:20:17:5 | {\\n ... ,\\n } [Expression] | provenance | |
| clients3.js:16:55:16:68 | maliciousInput | clients3.js:16:21:16:68 | "SELECT ... usInput | provenance | |
| clients3.js:18:54:18:59 | params [Expression] | clients3.js:18:23:18:60 | new Sel ... params) | provenance | |
| clients3.js:23:9:23:40 | maliciousInput | clients3.js:29:55:29:68 | maliciousInput | provenance | |
| clients3.js:23:9:23:40 | maliciousInput | clients3.js:38:55:38:68 | maliciousInput | provenance | |
| clients3.js:23:26:23:33 | req.body | clients3.js:23:9:23:40 | maliciousInput | provenance | |
| clients3.js:29:55:29:68 | maliciousInput | clients3.js:29:21:29:68 | "SELECT ... usInput | provenance | |
| clients3.js:38:55:38:68 | maliciousInput | clients3.js:38:21:38:68 | "SELECT ... usInput | provenance | |
| dynamodb.js:9:9:9:38 | maliciousInput | dynamodb.js:11:64:11:77 | maliciousInput | provenance | |
| dynamodb.js:9:9:9:38 | maliciousInput | dynamodb.js:17:80:17:93 | maliciousInput | provenance | |
| dynamodb.js:9:26:9:33 | req.body | dynamodb.js:9:9:9:38 | maliciousInput | provenance | |
| dynamodb.js:11:11:11:80 | statement | dynamodb.js:13:20:13:28 | statement | provenance | |
| dynamodb.js:11:64:11:77 | maliciousInput | dynamodb.js:11:11:11:80 | statement | provenance | |
| dynamodb.js:12:11:14:6 | command | dynamodb.js:15:23:15:29 | command | provenance | |
| dynamodb.js:12:11:14:6 | command | dynamodb.js:47:24:47:30 | command | provenance | |
| dynamodb.js:12:21:14:6 | new Exe ... \\n }) | dynamodb.js:12:11:14:6 | command | provenance | |
>>>>>>> 1af289cd7d4 (Added modeling of client-s3 v2 and v3)
| dynamodb.js:12:49:14:5 | {\\n ... t\\n } [Statement] | dynamodb.js:12:21:14:6 | new Exe ... \\n }) | provenance | |
| dynamodb.js:13:20:13:28 | statement | dynamodb.js:12:49:14:5 | {\\n ... t\\n } [Statement] | provenance | |
| dynamodb.js:17:11:17:25 | updateStatement | dynamodb.js:19:20:19:34 | updateStatement | provenance | |
@@ -547,7 +573,25 @@ edges
| tst4.js:8:46:8:60 | $routeParams.id | tst4.js:8:10:8:66 | 'SELECT ... d + '"' | provenance | |
| tst.js:10:46:10:58 | req.params.id | tst.js:10:10:10:64 | 'SELECT ... d + '"' | provenance | |
nodes
<<<<<<< HEAD
| dynamodb.js:9:9:9:22 | maliciousInput | semmle.label | maliciousInput |
=======
| clients3.js:10:9:10:40 | maliciousInput | semmle.label | maliciousInput |
| clients3.js:10:26:10:33 | req.body | semmle.label | req.body |
| clients3.js:12:11:17:5 | params [Expression] | semmle.label | params [Expression] |
| clients3.js:12:20:17:5 | {\\n ... ,\\n } [Expression] | semmle.label | {\\n ... ,\\n } [Expression] |
| clients3.js:16:21:16:68 | "SELECT ... usInput | semmle.label | "SELECT ... usInput |
| clients3.js:16:55:16:68 | maliciousInput | semmle.label | maliciousInput |
| clients3.js:18:23:18:60 | new Sel ... params) | semmle.label | new Sel ... params) |
| clients3.js:18:54:18:59 | params [Expression] | semmle.label | params [Expression] |
| clients3.js:23:9:23:40 | maliciousInput | semmle.label | maliciousInput |
| clients3.js:23:26:23:33 | req.body | semmle.label | req.body |
| clients3.js:29:21:29:68 | "SELECT ... usInput | semmle.label | "SELECT ... usInput |
| clients3.js:29:55:29:68 | maliciousInput | semmle.label | maliciousInput |
| clients3.js:38:21:38:68 | "SELECT ... usInput | semmle.label | "SELECT ... usInput |
| clients3.js:38:55:38:68 | maliciousInput | semmle.label | maliciousInput |
| dynamodb.js:9:9:9:38 | maliciousInput | semmle.label | maliciousInput |
>>>>>>> 1af289cd7d4 (Added modeling of client-s3 v2 and v3)
| dynamodb.js:9:26:9:33 | req.body | semmle.label | req.body |
| dynamodb.js:11:11:11:19 | statement | semmle.label | statement |
| dynamodb.js:11:64:11:77 | maliciousInput | semmle.label | maliciousInput |

10
javascript/ql/test/query-tests/Security/CWE-089/untyped/clients3.js
View File

@@ -7,7 +7,7 @@ const app = express();
app.use(bodyParser.json());
app.post('/client/v3/execute', async (req, res) => {
let maliciousInput = req.body.filter; // $ MISSING: Source
let maliciousInput = req.body.filter; // $ Source
const client = new S3Client({ region: "us-east-1" });
const params = {
Bucket: "my-bucket",
@@ -15,18 +15,18 @@ app.post('/client/v3/execute', async (req, res) => {
ExpressionType: "SQL",
Expression: "SELECT * FROM S3Object WHERE " + maliciousInput,
};
await client.send(new SelectObjectContentCommand(params)); // $ MISSING: Alert
await client.send(new SelectObjectContentCommand(params)); // $ Alert
res.end();
});
app.post('/client/v2/execute', async (req, res) => {
let maliciousInput = req.body.filter; // $ MISSING: Source
let maliciousInput = req.body.filter; // $ Source
const s3 = new AWS.S3({ region: "us-east-1" });
const params = {
Bucket: "my-bucket",
Key: "data.csv",
ExpressionType: "SQL",
Expression: "SELECT * FROM S3Object WHERE " + maliciousInput, // $ MISSING: Alert
Expression: "SELECT * FROM S3Object WHERE " + maliciousInput, // $ Alert
};
await s3.selectObjectContent(params).promise();
res.end();
@@ -35,7 +35,7 @@ app.post('/client/v2/execute', async (req, res) => {
Bucket: "my-bucket",
Key: "data.csv",
ExpressionType: "SQL",
Expression: "SELECT * FROM S3Object WHERE " + maliciousInput, // $ MISSING: Alert
Expression: "SELECT * FROM S3Object WHERE " + maliciousInput, // $ Alert
};
s3.selectObjectContent(params1, (err, data) => {