mirror of
https://github.com/github/codeql.git
synced 2026-03-21 06:57:09 +01:00
51 lines
1.4 KiB
Plaintext
51 lines
1.4 KiB
Plaintext
/**
|
|
* @name Extension of standard query: Stored XSS (with TrackedNode)
|
|
* @description Extends the standard Stored XSS query with an additional source,
|
|
* using TrackedNode to track MySQL connections globally.
|
|
* @kind path-problem
|
|
* @tags security
|
|
* @id js/examples/stored-xss-trackednode
|
|
*/
|
|
|
|
import javascript
|
|
import DataFlow
|
|
import semmle.javascript.security.dataflow.StoredXss
|
|
import DataFlow::PathGraph
|
|
|
|
/**
|
|
* An instance of `mysql.createConnection()`, tracked globally.
|
|
*/
|
|
class MysqlConnection extends TrackedNode {
|
|
MysqlConnection() { this = moduleImport("mysql").getAMemberCall("createConnection") }
|
|
|
|
/**
|
|
* Gets a call to the `query` method on this connection object.
|
|
*/
|
|
MethodCallNode getAQueryCall() {
|
|
this.flowsTo(result.getReceiver()) and
|
|
result.getMethodName() = "query"
|
|
}
|
|
}
|
|
|
|
/**
|
|
* Data returned from a MySQL query.
|
|
*
|
|
* For example:
|
|
* ```
|
|
* let mysql = require('mysql');
|
|
*
|
|
* getData(mysql.createConnection());
|
|
*
|
|
* function getData(c) {
|
|
* c.query(..., (e, data) => { ... });
|
|
* }
|
|
* ```
|
|
*/
|
|
class MysqlSource extends StoredXss::Source {
|
|
MysqlSource() { this = any(MysqlConnection con).getAQueryCall().getCallback(1).getParameter(1) }
|
|
}
|
|
|
|
from StoredXss::Configuration cfg, PathNode source, PathNode sink
|
|
where cfg.hasFlowPath(source, sink)
|
|
select sink.getNode(), source, sink, "Stored XSS from $@.", source.getNode(), "database value."
|