Skip to content

Commit 8ab3f39

Browse files
asgerfasgerf
authored
Merge pull request github#12423 from asgerf/js/trusted-types-global-flow
JS: Track trusted types policy callbacks
2 parents 5ff7a89 + 856b507 commit 8ab3f39

File tree

5 files changed

+81
-43
lines changed

5 files changed

+81
-43
lines changed

‎javascript/ql/lib/semmle/javascript/frameworks/TrustedTypes.qll

Lines changed: 1 addition & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -25,8 +25,7 @@ module TrustedTypes {
2525

2626
/** Gets the function passed as the given option. */
2727
DataFlow::FunctionNode getPolicyCallback(string method) {
28-
// Require local callback to avoid potential call/return mismatch in the uses below
29-
result = getOptionArgument(1, method).getALocalSource()
28+
result = getParameter(1).getMember(method).getAValueReachingSink()
3029
}
3130
}
3231

‎javascript/ql/test/query-tests/Security/CWE-079/DomBasedXss/Xss.expected

Lines changed: 34 additions & 17 deletions
Original file line numberDiff line numberDiff line change
@@ -689,14 +689,22 @@ nodes
689689
| translate.js:9:27:9:50 | searchP ... 'term') |
690690
| translate.js:9:27:9:50 | searchP ... 'term') |
691691
| translate.js:9:27:9:50 | searchP ... 'term') |
692-
| trusted-types.js:2:66:2:66 | x |
693-
| trusted-types.js:2:66:2:66 | x |
694-
| trusted-types.js:2:71:2:71 | x |
695-
| trusted-types.js:2:71:2:71 | x |
696-
| trusted-types.js:2:71:2:71 | x |
697-
| trusted-types.js:3:24:3:34 | window.name |
698-
| trusted-types.js:3:24:3:34 | window.name |
699-
| trusted-types.js:3:24:3:34 | window.name |
692+
| trusted-types-lib.js:1:28:1:28 | x |
693+
| trusted-types-lib.js:1:28:1:28 | x |
694+
| trusted-types-lib.js:2:12:2:12 | x |
695+
| trusted-types-lib.js:2:12:2:12 | x |
696+
| trusted-types-lib.js:2:12:2:12 | x |
697+
| trusted-types.js:3:62:3:62 | x |
698+
| trusted-types.js:3:62:3:62 | x |
699+
| trusted-types.js:3:67:3:67 | x |
700+
| trusted-types.js:3:67:3:67 | x |
701+
| trusted-types.js:3:67:3:67 | x |
702+
| trusted-types.js:4:20:4:30 | window.name |
703+
| trusted-types.js:4:20:4:30 | window.name |
704+
| trusted-types.js:4:20:4:30 | window.name |
705+
| trusted-types.js:13:20:13:30 | window.name |
706+
| trusted-types.js:13:20:13:30 | window.name |
707+
| trusted-types.js:13:20:13:30 | window.name |
700708
| tst3.js:2:12:2:75 | JSON.pa ... tr(1))) |
701709
| tst3.js:2:23:2:74 | decodeU ... str(1)) |
702710
| tst3.js:2:42:2:63 | window. ... .search |
@@ -1818,14 +1826,22 @@ edges
18181826
| translate.js:9:27:9:38 | searchParams | translate.js:9:27:9:50 | searchP ... 'term') |
18191827
| translate.js:9:27:9:38 | searchParams | translate.js:9:27:9:50 | searchP ... 'term') |
18201828
| translate.js:9:27:9:38 | searchParams | translate.js:9:27:9:50 | searchP ... 'term') |
1821-
| trusted-types.js:2:66:2:66 | x | trusted-types.js:2:71:2:71 | x |
1822-
| trusted-types.js:2:66:2:66 | x | trusted-types.js:2:71:2:71 | x |
1823-
| trusted-types.js:2:66:2:66 | x | trusted-types.js:2:71:2:71 | x |
1824-
| trusted-types.js:2:66:2:66 | x | trusted-types.js:2:71:2:71 | x |
1825-
| trusted-types.js:3:24:3:34 | window.name | trusted-types.js:2:66:2:66 | x |
1826-
| trusted-types.js:3:24:3:34 | window.name | trusted-types.js:2:66:2:66 | x |
1827-
| trusted-types.js:3:24:3:34 | window.name | trusted-types.js:2:66:2:66 | x |
1828-
| trusted-types.js:3:24:3:34 | window.name | trusted-types.js:2:66:2:66 | x |
1829+
| trusted-types-lib.js:1:28:1:28 | x | trusted-types-lib.js:2:12:2:12 | x |
1830+
| trusted-types-lib.js:1:28:1:28 | x | trusted-types-lib.js:2:12:2:12 | x |
1831+
| trusted-types-lib.js:1:28:1:28 | x | trusted-types-lib.js:2:12:2:12 | x |
1832+
| trusted-types-lib.js:1:28:1:28 | x | trusted-types-lib.js:2:12:2:12 | x |
1833+
| trusted-types.js:3:62:3:62 | x | trusted-types.js:3:67:3:67 | x |
1834+
| trusted-types.js:3:62:3:62 | x | trusted-types.js:3:67:3:67 | x |
1835+
| trusted-types.js:3:62:3:62 | x | trusted-types.js:3:67:3:67 | x |
1836+
| trusted-types.js:3:62:3:62 | x | trusted-types.js:3:67:3:67 | x |
1837+
| trusted-types.js:4:20:4:30 | window.name | trusted-types.js:3:62:3:62 | x |
1838+
| trusted-types.js:4:20:4:30 | window.name | trusted-types.js:3:62:3:62 | x |
1839+
| trusted-types.js:4:20:4:30 | window.name | trusted-types.js:3:62:3:62 | x |
1840+
| trusted-types.js:4:20:4:30 | window.name | trusted-types.js:3:62:3:62 | x |
1841+
| trusted-types.js:13:20:13:30 | window.name | trusted-types-lib.js:1:28:1:28 | x |
1842+
| trusted-types.js:13:20:13:30 | window.name | trusted-types-lib.js:1:28:1:28 | x |
1843+
| trusted-types.js:13:20:13:30 | window.name | trusted-types-lib.js:1:28:1:28 | x |
1844+
| trusted-types.js:13:20:13:30 | window.name | trusted-types-lib.js:1:28:1:28 | x |
18291845
| tst3.js:2:12:2:75 | JSON.pa ... tr(1))) | tst3.js:4:25:4:28 | data |
18301846
| tst3.js:2:12:2:75 | JSON.pa ... tr(1))) | tst3.js:5:26:5:29 | data |
18311847
| tst3.js:2:12:2:75 | JSON.pa ... tr(1))) | tst3.js:7:32:7:35 | data |
@@ -2382,7 +2398,8 @@ edges
23822398
| tooltip.jsx:10:25:10:30 | source | tooltip.jsx:6:20:6:30 | window.name | tooltip.jsx:10:25:10:30 | source | Cross-site scripting vulnerability due to $@. | tooltip.jsx:6:20:6:30 | window.name | user-provided value |
23832399
| tooltip.jsx:11:25:11:30 | source | tooltip.jsx:6:20:6:30 | window.name | tooltip.jsx:11:25:11:30 | source | Cross-site scripting vulnerability due to $@. | tooltip.jsx:6:20:6:30 | window.name | user-provided value |
23842400
| translate.js:9:27:9:50 | searchP ... 'term') | translate.js:6:16:6:39 | documen ... .search | translate.js:9:27:9:50 | searchP ... 'term') | Cross-site scripting vulnerability due to $@. | translate.js:6:16:6:39 | documen ... .search | user-provided value |
2385-
| trusted-types.js:2:71:2:71 | x | trusted-types.js:3:24:3:34 | window.name | trusted-types.js:2:71:2:71 | x | Cross-site scripting vulnerability due to $@. | trusted-types.js:3:24:3:34 | window.name | user-provided value |
2401+
| trusted-types-lib.js:2:12:2:12 | x | trusted-types.js:13:20:13:30 | window.name | trusted-types-lib.js:2:12:2:12 | x | Cross-site scripting vulnerability due to $@. | trusted-types.js:13:20:13:30 | window.name | user-provided value |
2402+
| trusted-types.js:3:67:3:67 | x | trusted-types.js:4:20:4:30 | window.name | trusted-types.js:3:67:3:67 | x | Cross-site scripting vulnerability due to $@. | trusted-types.js:4:20:4:30 | window.name | user-provided value |
23862403
| tst3.js:4:25:4:32 | data.src | tst3.js:2:42:2:63 | window. ... .search | tst3.js:4:25:4:32 | data.src | Cross-site scripting vulnerability due to $@. | tst3.js:2:42:2:63 | window. ... .search | user-provided value |
23872404
| tst3.js:5:26:5:31 | data.p | tst3.js:2:42:2:63 | window. ... .search | tst3.js:5:26:5:31 | data.p | Cross-site scripting vulnerability due to $@. | tst3.js:2:42:2:63 | window. ... .search | user-provided value |
23882405
| tst3.js:7:32:7:37 | data.p | tst3.js:2:42:2:63 | window. ... .search | tst3.js:7:32:7:37 | data.p | Cross-site scripting vulnerability due to $@. | tst3.js:2:42:2:63 | window. ... .search | user-provided value |

‎javascript/ql/test/query-tests/Security/CWE-079/DomBasedXss/XssWithAdditionalSources.expected

Lines changed: 32 additions & 16 deletions
Original file line numberDiff line numberDiff line change
@@ -701,14 +701,22 @@ nodes
701701
| translate.js:9:27:9:50 | searchP ... 'term') |
702702
| translate.js:9:27:9:50 | searchP ... 'term') |
703703
| translate.js:9:27:9:50 | searchP ... 'term') |
704-
| trusted-types.js:2:66:2:66 | x |
705-
| trusted-types.js:2:66:2:66 | x |
706-
| trusted-types.js:2:71:2:71 | x |
707-
| trusted-types.js:2:71:2:71 | x |
708-
| trusted-types.js:2:71:2:71 | x |
709-
| trusted-types.js:3:24:3:34 | window.name |
710-
| trusted-types.js:3:24:3:34 | window.name |
711-
| trusted-types.js:3:24:3:34 | window.name |
704+
| trusted-types-lib.js:1:28:1:28 | x |
705+
| trusted-types-lib.js:1:28:1:28 | x |
706+
| trusted-types-lib.js:2:12:2:12 | x |
707+
| trusted-types-lib.js:2:12:2:12 | x |
708+
| trusted-types-lib.js:2:12:2:12 | x |
709+
| trusted-types.js:3:62:3:62 | x |
710+
| trusted-types.js:3:62:3:62 | x |
711+
| trusted-types.js:3:67:3:67 | x |
712+
| trusted-types.js:3:67:3:67 | x |
713+
| trusted-types.js:3:67:3:67 | x |
714+
| trusted-types.js:4:20:4:30 | window.name |
715+
| trusted-types.js:4:20:4:30 | window.name |
716+
| trusted-types.js:4:20:4:30 | window.name |
717+
| trusted-types.js:13:20:13:30 | window.name |
718+
| trusted-types.js:13:20:13:30 | window.name |
719+
| trusted-types.js:13:20:13:30 | window.name |
712720
| tst3.js:2:12:2:75 | JSON.pa ... tr(1))) |
713721
| tst3.js:2:23:2:74 | decodeU ... str(1)) |
714722
| tst3.js:2:42:2:63 | window. ... .search |
@@ -1880,14 +1888,22 @@ edges
18801888
| translate.js:9:27:9:38 | searchParams | translate.js:9:27:9:50 | searchP ... 'term') |
18811889
| translate.js:9:27:9:38 | searchParams | translate.js:9:27:9:50 | searchP ... 'term') |
18821890
| translate.js:9:27:9:38 | searchParams | translate.js:9:27:9:50 | searchP ... 'term') |
1883-
| trusted-types.js:2:66:2:66 | x | trusted-types.js:2:71:2:71 | x |
1884-
| trusted-types.js:2:66:2:66 | x | trusted-types.js:2:71:2:71 | x |
1885-
| trusted-types.js:2:66:2:66 | x | trusted-types.js:2:71:2:71 | x |
1886-
| trusted-types.js:2:66:2:66 | x | trusted-types.js:2:71:2:71 | x |
1887-
| trusted-types.js:3:24:3:34 | window.name | trusted-types.js:2:66:2:66 | x |
1888-
| trusted-types.js:3:24:3:34 | window.name | trusted-types.js:2:66:2:66 | x |
1889-
| trusted-types.js:3:24:3:34 | window.name | trusted-types.js:2:66:2:66 | x |
1890-
| trusted-types.js:3:24:3:34 | window.name | trusted-types.js:2:66:2:66 | x |
1891+
| trusted-types-lib.js:1:28:1:28 | x | trusted-types-lib.js:2:12:2:12 | x |
1892+
| trusted-types-lib.js:1:28:1:28 | x | trusted-types-lib.js:2:12:2:12 | x |
1893+
| trusted-types-lib.js:1:28:1:28 | x | trusted-types-lib.js:2:12:2:12 | x |
1894+
| trusted-types-lib.js:1:28:1:28 | x | trusted-types-lib.js:2:12:2:12 | x |
1895+
| trusted-types.js:3:62:3:62 | x | trusted-types.js:3:67:3:67 | x |
1896+
| trusted-types.js:3:62:3:62 | x | trusted-types.js:3:67:3:67 | x |
1897+
| trusted-types.js:3:62:3:62 | x | trusted-types.js:3:67:3:67 | x |
1898+
| trusted-types.js:3:62:3:62 | x | trusted-types.js:3:67:3:67 | x |
1899+
| trusted-types.js:4:20:4:30 | window.name | trusted-types.js:3:62:3:62 | x |
1900+
| trusted-types.js:4:20:4:30 | window.name | trusted-types.js:3:62:3:62 | x |
1901+
| trusted-types.js:4:20:4:30 | window.name | trusted-types.js:3:62:3:62 | x |
1902+
| trusted-types.js:4:20:4:30 | window.name | trusted-types.js:3:62:3:62 | x |
1903+
| trusted-types.js:13:20:13:30 | window.name | trusted-types-lib.js:1:28:1:28 | x |
1904+
| trusted-types.js:13:20:13:30 | window.name | trusted-types-lib.js:1:28:1:28 | x |
1905+
| trusted-types.js:13:20:13:30 | window.name | trusted-types-lib.js:1:28:1:28 | x |
1906+
| trusted-types.js:13:20:13:30 | window.name | trusted-types-lib.js:1:28:1:28 | x |
18911907
| tst3.js:2:12:2:75 | JSON.pa ... tr(1))) | tst3.js:4:25:4:28 | data |
18921908
| tst3.js:2:12:2:75 | JSON.pa ... tr(1))) | tst3.js:5:26:5:29 | data |
18931909
| tst3.js:2:12:2:75 | JSON.pa ... tr(1))) | tst3.js:7:32:7:35 | data |

‎javascript/ql/test/query-tests/Security/CWE-079/DomBasedXss/trusted-types-lib.js

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,3 @@
1+
export function createHtml(x) {
2+
return x;
3+
}

‎javascript/ql/test/query-tests/Security/CWE-079/DomBasedXss/trusted-types.js

Lines changed: 11 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -1,10 +1,13 @@
1-
(function() {
2-
const policy1 = trustedTypes.createPolicy('x', { createHTML: x => x }); // NOT OK
3-
policy1.createHTML(window.name);
1+
import * as lib from './trusted-types-lib';
42

5-
const policy2 = trustedTypes.createPolicy('x', { createHTML: x => 'safe' }); // OK
6-
policy2.createHTML(window.name);
3+
const policy1 = trustedTypes.createPolicy('x', { createHTML: x => x }); // NOT OK
4+
policy1.createHTML(window.name);
75

8-
const policy3 = trustedTypes.createPolicy('x', { createHTML: x => x }); // OK
9-
policy3.createHTML('safe');
10-
})();
6+
const policy2 = trustedTypes.createPolicy('x', { createHTML: x => 'safe' }); // OK
7+
policy2.createHTML(window.name);
8+
9+
const policy3 = trustedTypes.createPolicy('x', { createHTML: x => x }); // OK
10+
policy3.createHTML('safe');
11+
12+
const policy4 = trustedTypes.createPolicy('x', { createHTML: lib.createHtml });
13+
policy4.createHTML(window.name);

0 commit comments

Comments
 (0)