hohn/codeql
1
0
Fork 0
mirror of https://github.com/github/codeql.git synced 2026-03-16 20:46:49 +01:00
Code Issues Packages Projects Releases Wiki Activity

move the TextEncoder and Buffer jose.base64url taint steps to a local query taint step

Browse Source
This commit is contained in:
am0o0
2024-07-01 12:01:49 +02:00
parent 60aa711005
commit fa8c457015
2 changed files with 20 additions and 40 deletions
Download Patch File Download Diff File Expand all files Collapse all files

40
javascript/ql/lib/semmle/javascript/frameworks/JWT.qll
View File

@@ -56,20 +56,6 @@ private module JsonWebToken {
* Provides classes and predicates modeling the `jose` library.
*/
private module Jose {
/**
* A taint-step for `succ = jose.base64url.encode(pred)` or `succ = jose.base64url.decode(pred)`.
*/
private class Base64urlStep extends TaintTracking::SharedTaintStep, DataFlow::SharedFlowStep {
override predicate step(DataFlow::Node pred, DataFlow::Node succ) {
exists(API::Node n |
n = API::moduleImport("jose").getMember("base64url").getMember(["decode", "encode"])
|
pred = n.getACall().getArgument(0) and
succ = n.getACall()
)
}
}
/**
* The asymmetric key or symmetric secret for verifying a JWT as a `CredentialsNode`.
*/
@@ -162,29 +148,3 @@ private module PassportJwt {
override string getCredentialsKind() { result = "key" }
}
}
/**
* A taint-step for `succ = new TextEncoder().encode(pred)`.
*/
private class TextEncoderStep extends TaintTracking::SharedTaintStep, DataFlow::SharedFlowStep {
override predicate step(DataFlow::Node pred, DataFlow::Node succ) {
exists(DataFlow::CallNode n | n = DataFlow::globalVarRef("TextEncoder").getAnInstantiation().getAMemberCall("encode") |
pred = n.getArgument(0) and
succ = n and
n.getLocation().getFile().getRelativePath().matches("%HardcodedCredentials.js%")
)
}
}
/**
* A taint-step for `succ = Buffer.from(pred, "base64")`.
*/
private class BufferFromStep extends TaintTracking::SharedTaintStep, DataFlow::SharedFlowStep {
override predicate step(DataFlow::Node pred, DataFlow::Node succ) {
exists(DataFlow::CallNode n | n = DataFlow::globalVarRef("Buffer").getAMemberCall("from") |
pred = n.getArgument(0) and
succ = [n, n.getAChainedMethodCall(["toString", "toJSON"])]
)
}
}