Skip to content

Commit 7baa22e

Browse files
author
Alvaro Muñoz
authored
Merge pull request #14 from GitHubSecurityLab/javascript_packs
Add Javascript packs
2 parents ecebc67 + d9eb525 commit 7baa22e

File tree

83 files changed

+1254
-3
lines changed

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

83 files changed

+1254
-3
lines changed

‎.github/workflows/build.yml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -12,7 +12,7 @@ jobs:
1212
strategy:
1313
fail-fast: false
1414
matrix:
15-
language: [ 'cpp', 'csharp', 'go', 'java', 'python', 'ruby' ]
15+
language: [ 'cpp', 'csharp', 'go', 'java', 'javascript', 'python', 'ruby' ]
1616

1717
steps:
1818
- uses: actions/checkout@v3

‎.github/workflows/publish.yml‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -17,7 +17,7 @@ jobs:
1717
strategy:
1818
fail-fast: false
1919
matrix:
20-
language: ["cpp", "csharp", "go", "java", "python", "ruby"]
20+
language: ["cpp", "csharp", "go", "java", "javascript", "python", "ruby"]
2121

2222
steps:
2323
- uses: actions/checkout@v3
@@ -54,7 +54,7 @@ jobs:
5454
strategy:
5555
fail-fast: false
5656
matrix:
57-
language: ["cpp", "csharp", "go", "java", "python", "ruby"]
57+
language: ["cpp", "csharp", "go", "java", "javascript", "python", "ruby"]
5858

5959
steps:
6060
- uses: actions/checkout@v3

‎codeql-workspace.yml‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -3,6 +3,7 @@ provide:
33
- csharp/**/qlpack.yml
44
- go/**/qlpack.yml
55
- java/**/qlpack.yml
6+
- javascript/**/qlpack.yml
67
- python/**/qlpack.yml
78
- ruby/**/qlpack.yml
89

‎javascript/lib/ResearchMode.qll‎

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,7 @@
1+
//import semmle.javascript.heuristics.all
2+
import semmle.javascript.heuristics.AdditionalFrameworks
3+
import semmle.javascript.heuristics.AdditionalPromises
4+
import semmle.javascript.heuristics.AdditionalRouteHandlers
5+
import semmle.javascript.heuristics.AdditionalSources
6+
//import semmle.javascript.heuristics.AdditionalSinks
7+
import semmle.javascript.heuristics.AdditionalTaintSteps

‎javascript/lib/applications/.gitkeep‎

Whitespace-only changes.

‎javascript/lib/codeql-pack.lock.yml‎

Lines changed: 16 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,16 @@
1+
---
2+
lockVersion: 1.0.0
3+
dependencies:
4+
codeql/javascript-all:
5+
version: 0.7.4
6+
codeql/mad:
7+
version: 0.1.4
8+
codeql/regex:
9+
version: 0.1.4
10+
codeql/tutorial:
11+
version: 0.1.4
12+
codeql/util:
13+
version: 0.1.4
14+
codeql/yaml:
15+
version: 0.1.4
16+
compiled: false

‎javascript/lib/frameworks/.gitkeep‎

Whitespace-only changes.

‎javascript/lib/github/CommandLine.qll‎

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,7 @@
1+
import semmle.javascript.dataflow.DataFlow
2+
3+
class CommandLineArgument extends DataFlow::Node {
4+
CommandLineArgument() {
5+
this = DataFlow::globalVarRef("process").getAPropertyRead("argv").getAPropertyReference()
6+
}
7+
}

‎javascript/lib/github/InsecureIV.qll‎

Lines changed: 113 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,113 @@
1+
import semmle.javascript.dataflow.TaintTracking
2+
3+
import github.CommandLine
4+
5+
class RandomTaintsSourceConfiguration extends TaintTracking::Configuration {
6+
RandomTaintsSourceConfiguration() { this = "RandomTaintsSourceConfiguration" }
7+
8+
override predicate isSource(DataFlow::Node source) {
9+
isSecureRandom(source)
10+
}
11+
12+
override predicate isSink(DataFlow::Node sink) {
13+
not isSecureRandom(sink)
14+
}
15+
}
16+
17+
class InsecureIVConfiguration extends TaintTracking::Configuration {
18+
InsecureIVConfiguration() { this = "InsecureIVConfiguration" }
19+
20+
override predicate isSource(DataFlow::Node source) {
21+
exists(Literal literal|literal.flow() = source)
22+
or
23+
source instanceof DataFlow::ArrayLiteralNode
24+
or
25+
source instanceof RemoteFlowSource
26+
or
27+
source instanceof FileSystemReadAccess
28+
or
29+
source instanceof DatabaseAccess
30+
or
31+
source instanceof CommandLineArgument
32+
or
33+
// an external function that is not a known source of randomness
34+
(
35+
source instanceof ExternalCallWithOutput
36+
and not source instanceof CreateIVArgument
37+
and not source instanceof SecureRandomSource
38+
)
39+
}
40+
41+
override predicate isSink(DataFlow::Node sink) {
42+
sink instanceof CreateIVArgument
43+
}
44+
}
45+
46+
class ExternalCallWithOutput extends DataFlow::Node {
47+
CallExpr call;
48+
49+
ExternalCallWithOutput() {
50+
not exists(MethodCallExpr method_call, ThisExpr this_expr| method_call = call and method_call.getReceiver() = this_expr )
51+
and
52+
this = call.flow()
53+
}
54+
}
55+
56+
class SecureRandomSource extends DataFlow::Node {
57+
SecureRandomSource() {
58+
isSecureRandom(this)
59+
}
60+
}
61+
62+
predicate isSecureRandom(DataFlow::Node node) {
63+
exists(string name|
64+
name in ["randomBytes", "getRandomValues"] and
65+
DataFlow::moduleMember("crypto", name).getACall() = node
66+
)
67+
or
68+
exists(string name|
69+
name in ["randomFill", "randomFillSync"] and
70+
DataFlow::moduleMember("crypto", name).getACall().getArgument(0) = node
71+
)
72+
or
73+
exists(string name|
74+
name in ["randomKey", "randomString"] and
75+
DataFlow::moduleMember("crypto-extra", name).getACall() = node
76+
)
77+
or
78+
exists(string name|
79+
name in ["cryptoRandomString", "cryptoRandomStringAsync"] and
80+
DataFlow::moduleMember("crypto-random-string", name).getACall() = node
81+
)
82+
or
83+
exists(string name|
84+
name in ["secureRandom", "randomArray", "randomUint8Array", "randomBuffer"] and
85+
DataFlow::moduleMember("secure-random", name).getACall() = node
86+
)
87+
}
88+
89+
class CreateIVArgument extends DataFlow::Node {
90+
CreateIVArgument() {
91+
isCreateIV(this)
92+
}
93+
}
94+
95+
predicate isCreateIV(DataFlow::Node node) {
96+
exists(string name|
97+
name = "createCipheriv" and
98+
DataFlow::moduleMember("crypto", name).getACall().getArgument(2) = node
99+
)
100+
}
101+
102+
predicate knownCryptTest(DataFlow::Node sink) {
103+
sink.getFile().getRelativePath().matches(
104+
[
105+
"%/des.js/test/%",
106+
"test/common/tls.js",
107+
"test/%/test-crypto-%.js",
108+
"%/browserify-aes/populateFixtures.js",
109+
"%/evp_bytestokey%/test.js",
110+
"%/sshpk/lib/formats/ssh-private.js"
111+
]
112+
)
113+
}

‎javascript/lib/qlpack.yml‎

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,5 @@
1+
library: true
2+
name: githubsecuritylab/codeql-javascript-libs
3+
version: 0.0.1
4+
dependencies:
5+
codeql/javascript-all: '*'

0 commit comments

Comments
 (0)