Skip to content

Commit 3424650

Browse files
Sim4n6yoff
Sim4n6
authored and
yoff
committed
Add Unicode DoS (CWE-770)
1 parent 693c28a commit 3424650

File tree

7 files changed

+311
-0
lines changed

7 files changed

+311
-0
lines changed

‎python/ql/src/experimental/Security/CWE-770/UnicodeDoS.qhelp

Lines changed: 38 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,38 @@
1+
<!DOCTYPE qhelp PUBLIC
2+
"-//Semmle//qhelp//EN"
3+
"qhelp.dtd">
4+
<qhelp>
5+
6+
<overview>
7+
<p>When a remote user-controlled data can reach a costly Unicode normalization with either form, NFKC or NFKD, an attack such as the One Million Unicode Characters, could lead to a denial of service on Windows OS.</p>
8+
9+
<p>And, with the use of special Unicode characters, like U+2100 (℀) or U+2105 (℅), the payload size could be tripled after the compatibility normalization.
10+
11+
</overview>
12+
<recommendation>
13+
14+
<p>Ensure limiting the size of any incoming data that would go through a costly operations, including a Windows Unicode normalization with NFKC or NFKD. Such a recommandation would avoid a potential denial of service.</p>
15+
16+
</recommendation>
17+
18+
<example>
19+
<p>
20+
In this example a simple user-controlled data reaches a Unicode normalization with the form "NFKC".
21+
</p>
22+
23+
<sample src="bad.py" />
24+
25+
<p>To fix this vulnerability, we need restrain the size of the user input.</p>
26+
27+
<p>For example, we can use the <code>len()</code> builtin function to limit the size of the user input.</p>
28+
29+
<sample src="good.py" />
30+
31+
</example>
32+
<references>
33+
34+
<li>
35+
<a href="https://hackerone.com/reports/2258758">CVE-2023-46695: Potential denial of service vulnerability in Django UsernameField on Windows.</a>
36+
</li>
37+
</references>
38+
</qhelp>

‎python/ql/src/experimental/Security/CWE-770/UnicodeDoS.ql

Lines changed: 104 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,104 @@
1+
/**
2+
* @name Denial of Service using Unicode Characters
3+
* @description A remote user-controlled data can reach a costly Unicode normalization with either form NFKC or NFKD. On Windows OS, with an attack such as the One Million Unicode Characters, this could lead to a denial of service. And, with the use of special Unicode characters, like U+2100 (℀) or U+2105 (℅), the payload size could be tripled.
4+
* @kind path-problem
5+
* @id py/unicode-dos
6+
* @precision high
7+
* @problem.severity error
8+
* @tags security
9+
* experimental
10+
* external/cwe/cwe-770
11+
*/
12+
13+
import python
14+
import semmle.python.ApiGraphs
15+
import semmle.python.Concepts
16+
import semmle.python.dataflow.new.TaintTracking
17+
import semmle.python.dataflow.new.internal.DataFlowPublic
18+
import semmle.python.dataflow.new.RemoteFlowSources
19+
20+
class UnicodeCompatibilityNormalize extends API::CallNode {
21+
int argIdx;
22+
23+
UnicodeCompatibilityNormalize() {
24+
exists(API::CallNode cn, DataFlow::Node form |
25+
cn = API::moduleImport("unicodedata").getMember("normalize").getACall() and
26+
form.asExpr().(StrConst).getS() in ["NFKC", "NFKD"] and
27+
TaintTracking::localTaint(form, cn.getArg(0)) and
28+
this = cn and
29+
argIdx = 1
30+
)
31+
or
32+
exists(API::CallNode cn |
33+
cn = API::moduleImport("unidecode").getMember("unidecode").getACall() and
34+
this = cn and
35+
argIdx = 0
36+
)
37+
or
38+
exists(API::CallNode cn |
39+
cn = API::moduleImport("pyunormalize").getMember(["NFKC", "NFKD"]).getACall() and
40+
this = cn and
41+
argIdx = 0
42+
)
43+
or
44+
exists(API::CallNode cn, DataFlow::Node form |
45+
cn = API::moduleImport("pyunormalize").getMember("normalize").getACall() and
46+
form.asExpr().(StrConst).getS() in ["NFKC", "NFKD"] and
47+
TaintTracking::localTaint(form, cn.getArg(0)) and
48+
this = cn and
49+
argIdx = 1
50+
)
51+
or
52+
exists(API::CallNode cn, DataFlow::Node form |
53+
cn = API::moduleImport("textnorm").getMember("normalize_unicode").getACall() and
54+
form.asExpr().(StrConst).getS() in ["NFKC", "NFKD"] and
55+
TaintTracking::localTaint(form, cn.getArg(1)) and
56+
this = cn and
57+
argIdx = 0
58+
)
59+
}
60+
61+
DataFlow::Node getPathArg() { result = this.getArg(argIdx) }
62+
}
63+
64+
predicate underAValue(DataFlow::GuardNode g, ControlFlowNode node, boolean branch) {
65+
exists(CompareNode cn | cn = g |
66+
exists(API::CallNode lenCall, Cmpop op_gt, Cmpop op_lt, Node n |
67+
lenCall = n.getALocalSource() and
68+
(
69+
(op_lt = any(LtE lte) or op_lt = any(Lt lt)) and
70+
branch = true and
71+
cn.operands(n.asCfgNode(), op_lt, _)
72+
or
73+
(op_gt = any(GtE gte) or op_gt = any(Gt gt)) and
74+
branch = true and
75+
cn.operands(_, op_gt, n.asCfgNode())
76+
)
77+
|
78+
lenCall = API::builtin("len").getACall() and
79+
node = lenCall.getArg(0).asCfgNode()
80+
) //and
81+
//not cn.getLocation().getFile().inStdlib()
82+
)
83+
}
84+
85+
class Configuration extends TaintTracking::Configuration {
86+
Configuration() { this = "RemoteSourcesReachUnicodeCharacters" }
87+
88+
override predicate isSource(DataFlow::Node source) { source instanceof RemoteFlowSource }
89+
90+
override predicate isSanitizer(DataFlow::Node sanitizer) {
91+
sanitizer = DataFlow::BarrierGuard<underAValue/3>::getABarrierNode()
92+
}
93+
94+
override predicate isSink(DataFlow::Node sink) {
95+
sink = any(UnicodeCompatibilityNormalize ucn).getPathArg()
96+
}
97+
}
98+
99+
import DataFlow::PathGraph
100+
101+
from Configuration config, DataFlow::PathNode source, DataFlow::PathNode sink
102+
where config.hasFlowPath(source, sink)
103+
select sink.getNode(), source, sink, "This $@ can reach a $@.", source.getNode(),
104+
"user-provided value", sink.getNode(), "costly Unicode normalization operation"

‎python/ql/src/experimental/Security/CWE-770/bad.py

Lines changed: 17 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,17 @@
1+
from flask import Flask, jsonify, request
2+
import unicodedata
3+
4+
app = Flask(__name__)
5+
6+
7+
@app.route("/bad_1")
8+
def bad_1():
9+
# User controlled data
10+
file_path = request.args.get("file_path", "")
11+
12+
# Normalize the file path using NFKC Unicode normalization
13+
return (
14+
unicodedata.normalize("NFKC", file_path),
15+
200,
16+
{"Content-Type": "application/octet-stream"},
17+
)

‎python/ql/src/experimental/Security/CWE-770/good.py

Lines changed: 16 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,16 @@
1+
from flask import Flask, jsonify, request
2+
import unicodedata
3+
4+
app = Flask(__name__)
5+
6+
7+
@app.route("/good_1")
8+
def good_1():
9+
r = request.args.get("r", "")
10+
11+
if len(r) <= 1_000:
12+
# Normalize the r using NFKD Unicode normalization
13+
r = unicodedata.normalize("NFKD", r)
14+
return r, 200, {"Content-Type": "application/octet-stream"}
15+
else:
16+
return jsonify({"error": "File not found"}), 404

‎python/ql/test/experimental/query-tests/Security/CWE-770/UnicodeDoS.expected

Lines changed: 55 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,55 @@
1+
WARNING: Module PathGraph has been deprecated and may be removed in future (C:/Users/ab/Desktop/GhSec/Pull-Requests/codeql-PUN/python/ql/src/experimental/Security/CWE-770/UnicodeDoS.ql:99,8-27)
2+
WARNING: Type Configuration has been deprecated and may be removed in future (C:/Users/ab/Desktop/GhSec/Pull-Requests/codeql-PUN/python/ql/src/experimental/Security/CWE-770/UnicodeDoS.ql:85,29-57)
3+
WARNING: Type PathNode has been deprecated and may be removed in future (C:/Users/ab/Desktop/GhSec/Pull-Requests/codeql-PUN/python/ql/src/experimental/Security/CWE-770/UnicodeDoS.ql:101,28-46)
4+
WARNING: Type PathNode has been deprecated and may be removed in future (C:/Users/ab/Desktop/GhSec/Pull-Requests/codeql-PUN/python/ql/src/experimental/Security/CWE-770/UnicodeDoS.ql:101,55-73)
5+
edges
6+
| tests.py:1:35:1:41 | ControlFlowNode for ImportMember | tests.py:1:35:1:41 | ControlFlowNode for request |
7+
| tests.py:1:35:1:41 | ControlFlowNode for request | tests.py:12:17:12:23 | ControlFlowNode for request |
8+
| tests.py:1:35:1:41 | ControlFlowNode for request | tests.py:24:9:24:15 | ControlFlowNode for request |
9+
| tests.py:1:35:1:41 | ControlFlowNode for request | tests.py:36:9:36:15 | ControlFlowNode for request |
10+
| tests.py:1:35:1:41 | ControlFlowNode for request | tests.py:48:9:48:15 | ControlFlowNode for request |
11+
| tests.py:12:5:12:13 | ControlFlowNode for file_path | tests.py:16:39:16:47 | ControlFlowNode for file_path |
12+
| tests.py:12:17:12:23 | ControlFlowNode for request | tests.py:12:17:12:28 | ControlFlowNode for Attribute |
13+
| tests.py:12:17:12:28 | ControlFlowNode for Attribute | tests.py:12:17:12:49 | ControlFlowNode for Attribute() |
14+
| tests.py:12:17:12:49 | ControlFlowNode for Attribute() | tests.py:12:5:12:13 | ControlFlowNode for file_path |
15+
| tests.py:24:5:24:5 | ControlFlowNode for r | tests.py:28:43:28:43 | ControlFlowNode for r |
16+
| tests.py:24:9:24:15 | ControlFlowNode for request | tests.py:24:9:24:20 | ControlFlowNode for Attribute |
17+
| tests.py:24:9:24:20 | ControlFlowNode for Attribute | tests.py:24:9:24:33 | ControlFlowNode for Attribute() |
18+
| tests.py:24:9:24:33 | ControlFlowNode for Attribute() | tests.py:24:5:24:5 | ControlFlowNode for r |
19+
| tests.py:36:5:36:5 | ControlFlowNode for r | tests.py:40:43:40:43 | ControlFlowNode for r |
20+
| tests.py:36:9:36:15 | ControlFlowNode for request | tests.py:36:9:36:20 | ControlFlowNode for Attribute |
21+
| tests.py:36:9:36:20 | ControlFlowNode for Attribute | tests.py:36:9:36:33 | ControlFlowNode for Attribute() |
22+
| tests.py:36:9:36:33 | ControlFlowNode for Attribute() | tests.py:36:5:36:5 | ControlFlowNode for r |
23+
| tests.py:48:5:48:5 | ControlFlowNode for r | tests.py:52:43:52:43 | ControlFlowNode for r |
24+
| tests.py:48:9:48:15 | ControlFlowNode for request | tests.py:48:9:48:20 | ControlFlowNode for Attribute |
25+
| tests.py:48:9:48:20 | ControlFlowNode for Attribute | tests.py:48:9:48:33 | ControlFlowNode for Attribute() |
26+
| tests.py:48:9:48:33 | ControlFlowNode for Attribute() | tests.py:48:5:48:5 | ControlFlowNode for r |
27+
nodes
28+
| tests.py:1:35:1:41 | ControlFlowNode for ImportMember | semmle.label | ControlFlowNode for ImportMember |
29+
| tests.py:1:35:1:41 | ControlFlowNode for request | semmle.label | ControlFlowNode for request |
30+
| tests.py:12:5:12:13 | ControlFlowNode for file_path | semmle.label | ControlFlowNode for file_path |
31+
| tests.py:12:17:12:23 | ControlFlowNode for request | semmle.label | ControlFlowNode for request |
32+
| tests.py:12:17:12:28 | ControlFlowNode for Attribute | semmle.label | ControlFlowNode for Attribute |
33+
| tests.py:12:17:12:49 | ControlFlowNode for Attribute() | semmle.label | ControlFlowNode for Attribute() |
34+
| tests.py:16:39:16:47 | ControlFlowNode for file_path | semmle.label | ControlFlowNode for file_path |
35+
| tests.py:24:5:24:5 | ControlFlowNode for r | semmle.label | ControlFlowNode for r |
36+
| tests.py:24:9:24:15 | ControlFlowNode for request | semmle.label | ControlFlowNode for request |
37+
| tests.py:24:9:24:20 | ControlFlowNode for Attribute | semmle.label | ControlFlowNode for Attribute |
38+
| tests.py:24:9:24:33 | ControlFlowNode for Attribute() | semmle.label | ControlFlowNode for Attribute() |
39+
| tests.py:28:43:28:43 | ControlFlowNode for r | semmle.label | ControlFlowNode for r |
40+
| tests.py:36:5:36:5 | ControlFlowNode for r | semmle.label | ControlFlowNode for r |
41+
| tests.py:36:9:36:15 | ControlFlowNode for request | semmle.label | ControlFlowNode for request |
42+
| tests.py:36:9:36:20 | ControlFlowNode for Attribute | semmle.label | ControlFlowNode for Attribute |
43+
| tests.py:36:9:36:33 | ControlFlowNode for Attribute() | semmle.label | ControlFlowNode for Attribute() |
44+
| tests.py:40:43:40:43 | ControlFlowNode for r | semmle.label | ControlFlowNode for r |
45+
| tests.py:48:5:48:5 | ControlFlowNode for r | semmle.label | ControlFlowNode for r |
46+
| tests.py:48:9:48:15 | ControlFlowNode for request | semmle.label | ControlFlowNode for request |
47+
| tests.py:48:9:48:20 | ControlFlowNode for Attribute | semmle.label | ControlFlowNode for Attribute |
48+
| tests.py:48:9:48:33 | ControlFlowNode for Attribute() | semmle.label | ControlFlowNode for Attribute() |
49+
| tests.py:52:43:52:43 | ControlFlowNode for r | semmle.label | ControlFlowNode for r |
50+
subpaths
51+
#select
52+
| tests.py:16:39:16:47 | ControlFlowNode for file_path | tests.py:1:35:1:41 | ControlFlowNode for ImportMember | tests.py:16:39:16:47 | ControlFlowNode for file_path | This $@ can reach a $@. | tests.py:1:35:1:41 | ControlFlowNode for ImportMember | user-provided value | tests.py:16:39:16:47 | ControlFlowNode for file_path | costly Unicode normalization operation |
53+
| tests.py:28:43:28:43 | ControlFlowNode for r | tests.py:1:35:1:41 | ControlFlowNode for ImportMember | tests.py:28:43:28:43 | ControlFlowNode for r | This $@ can reach a $@. | tests.py:1:35:1:41 | ControlFlowNode for ImportMember | user-provided value | tests.py:28:43:28:43 | ControlFlowNode for r | costly Unicode normalization operation |
54+
| tests.py:40:43:40:43 | ControlFlowNode for r | tests.py:1:35:1:41 | ControlFlowNode for ImportMember | tests.py:40:43:40:43 | ControlFlowNode for r | This $@ can reach a $@. | tests.py:1:35:1:41 | ControlFlowNode for ImportMember | user-provided value | tests.py:40:43:40:43 | ControlFlowNode for r | costly Unicode normalization operation |
55+
| tests.py:52:43:52:43 | ControlFlowNode for r | tests.py:1:35:1:41 | ControlFlowNode for ImportMember | tests.py:52:43:52:43 | ControlFlowNode for r | This $@ can reach a $@. | tests.py:1:35:1:41 | ControlFlowNode for ImportMember | user-provided value | tests.py:52:43:52:43 | ControlFlowNode for r | costly Unicode normalization operation |

‎python/ql/test/experimental/query-tests/Security/CWE-770/UnicodeDoS.qlref

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1 @@
1+
experimental/Security/CWE-770/UnicodeDoS.ql

‎python/ql/test/experimental/query-tests/Security/CWE-770/tests.py

Lines changed: 80 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,80 @@
1+
from flask import Flask, jsonify, request
2+
import unicodedata
3+
4+
app = Flask(__name__)
5+
6+
STATIC_DIR = "/home/unknown/"
7+
8+
9+
@app.route("/bad_1")
10+
def bad_1():
11+
# User controlled data
12+
file_path = request.args.get("file_path", "")
13+
14+
# Normalize the file path using NFKC Unicode normalization
15+
return (
16+
unicodedata.normalize("NFKC", file_path),
17+
200,
18+
{"Content-Type": "application/octet-stream"},
19+
)
20+
21+
22+
@app.route("/bad_2")
23+
def bad_2():
24+
r = request.args.get("r", "")
25+
26+
if len(r) >= 10:
27+
# Normalize the r using NFKD Unicode normalization
28+
r = unicodedata.normalize("NFKD", r)
29+
return r, 200, {"Content-Type": "application/octet-stream"}
30+
else:
31+
return jsonify({"error": "File not found"}), 404
32+
33+
34+
@app.route("/bad_3")
35+
def bad_3():
36+
r = request.args.get("r", "")
37+
length = len(r)
38+
if length >= 1_000:
39+
# Normalize the r using NFKD Unicode normalization
40+
r = unicodedata.normalize("NFKD", r)
41+
return r, 200, {"Content-Type": "application/octet-stream"}
42+
else:
43+
return jsonify({"error": "File not found"}), 404
44+
45+
46+
@app.route("/bad_4")
47+
def bad_4():
48+
r = request.args.get("r", "")
49+
length = len(r)
50+
if 1_000 <= length:
51+
# Normalize the r using NFKD Unicode normalization
52+
r = unicodedata.normalize("NFKD", r)
53+
return r, 200, {"Content-Type": "application/octet-stream"}
54+
else:
55+
return jsonify({"error": "File not found"}), 404
56+
57+
58+
@app.route("/good_1")
59+
def good_1():
60+
r = request.args.get("r", "")
61+
62+
if len(r) <= 1_000:
63+
# Normalize the r using NFKD Unicode normalization
64+
r = unicodedata.normalize("NFKD", r)
65+
return r, 200, {"Content-Type": "application/octet-stream"}
66+
else:
67+
return jsonify({"error": "File not found"}), 404
68+
69+
70+
@app.route("/good_2")
71+
def good_2():
72+
r = request.args.get("r", "")
73+
MAX_LENGTH = 1_000
74+
length = len(r)
75+
if length <= MAX_LENGTH:
76+
# Normalize the r using NFKD Unicode normalization
77+
r = unicodedata.normalize("NFKD", r)
78+
return r, 200, {"Content-Type": "application/octet-stream"}
79+
else:
80+
return jsonify({"error": "File not found"}), 404

0 commit comments

Comments
 (0)