Skip to content

Commit 3c372be

Browse files
NapalysNapalys
committed
JS: Fixed path query not flagging new RegExp with DotRemovingReplaceCall
1 parent 0c937cd commit 3c372be

File tree

4 files changed

+114
-5
lines changed

4 files changed

+114
-5
lines changed

‎javascript/ql/lib/semmle/javascript/security/dataflow/TaintedPathCustomizations.qll‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -305,9 +305,9 @@ module TaintedPath {
305305
input = this.getReceiver() and
306306
output = this and
307307
this.isGlobal() and
308-
exists(RegExpLiteral literal, RegExpTerm term |
309-
this.getRegExp().asExpr() = literal and
310-
literal.getRoot() = term and
308+
exists(DataFlow::RegExpCreationNode regexp, RegExpTerm term |
309+
this.getRegExp() = regexp and
310+
regexp.getRoot() = term and
311311
not term.getAMatchedString() = "/"
312312
|
313313
term.getAMatchedString() = "." or

‎javascript/ql/test/query-tests/Security/CWE-022/TaintedPath/Consistency.expected‎

Lines changed: 0 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1 +0,0 @@
1-
| TaintedPath.js:213 | expected an alert, but found none | NOT OK (can be absolute) | |

‎javascript/ql/test/query-tests/Security/CWE-022/TaintedPath/TaintedPath.expected‎

Lines changed: 110 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1627,6 +1627,15 @@ nodes
16271627
| TaintedPath.js:211:7:211:48 | path |
16281628
| TaintedPath.js:211:7:211:48 | path |
16291629
| TaintedPath.js:211:7:211:48 | path |
1630+
| TaintedPath.js:211:7:211:48 | path |
1631+
| TaintedPath.js:211:7:211:48 | path |
1632+
| TaintedPath.js:211:7:211:48 | path |
1633+
| TaintedPath.js:211:7:211:48 | path |
1634+
| TaintedPath.js:211:7:211:48 | path |
1635+
| TaintedPath.js:211:7:211:48 | path |
1636+
| TaintedPath.js:211:7:211:48 | path |
1637+
| TaintedPath.js:211:7:211:48 | path |
1638+
| TaintedPath.js:211:14:211:37 | url.par ... , true) |
16301639
| TaintedPath.js:211:14:211:37 | url.par ... , true) |
16311640
| TaintedPath.js:211:14:211:37 | url.par ... , true) |
16321641
| TaintedPath.js:211:14:211:37 | url.par ... , true) |
@@ -1635,6 +1644,15 @@ nodes
16351644
| TaintedPath.js:211:14:211:37 | url.par ... , true) |
16361645
| TaintedPath.js:211:14:211:37 | url.par ... , true) |
16371646
| TaintedPath.js:211:14:211:37 | url.par ... , true) |
1647+
| TaintedPath.js:211:14:211:37 | url.par ... , true) |
1648+
| TaintedPath.js:211:14:211:37 | url.par ... , true) |
1649+
| TaintedPath.js:211:14:211:37 | url.par ... , true) |
1650+
| TaintedPath.js:211:14:211:37 | url.par ... , true) |
1651+
| TaintedPath.js:211:14:211:37 | url.par ... , true) |
1652+
| TaintedPath.js:211:14:211:37 | url.par ... , true) |
1653+
| TaintedPath.js:211:14:211:37 | url.par ... , true) |
1654+
| TaintedPath.js:211:14:211:43 | url.par ... ).query |
1655+
| TaintedPath.js:211:14:211:43 | url.par ... ).query |
16381656
| TaintedPath.js:211:14:211:43 | url.par ... ).query |
16391657
| TaintedPath.js:211:14:211:43 | url.par ... ).query |
16401658
| TaintedPath.js:211:14:211:43 | url.par ... ).query |
@@ -1643,6 +1661,20 @@ nodes
16431661
| TaintedPath.js:211:14:211:43 | url.par ... ).query |
16441662
| TaintedPath.js:211:14:211:43 | url.par ... ).query |
16451663
| TaintedPath.js:211:14:211:43 | url.par ... ).query |
1664+
| TaintedPath.js:211:14:211:43 | url.par ... ).query |
1665+
| TaintedPath.js:211:14:211:43 | url.par ... ).query |
1666+
| TaintedPath.js:211:14:211:43 | url.par ... ).query |
1667+
| TaintedPath.js:211:14:211:43 | url.par ... ).query |
1668+
| TaintedPath.js:211:14:211:43 | url.par ... ).query |
1669+
| TaintedPath.js:211:14:211:43 | url.par ... ).query |
1670+
| TaintedPath.js:211:14:211:48 | url.par ... ry.path |
1671+
| TaintedPath.js:211:14:211:48 | url.par ... ry.path |
1672+
| TaintedPath.js:211:14:211:48 | url.par ... ry.path |
1673+
| TaintedPath.js:211:14:211:48 | url.par ... ry.path |
1674+
| TaintedPath.js:211:14:211:48 | url.par ... ry.path |
1675+
| TaintedPath.js:211:14:211:48 | url.par ... ry.path |
1676+
| TaintedPath.js:211:14:211:48 | url.par ... ry.path |
1677+
| TaintedPath.js:211:14:211:48 | url.par ... ry.path |
16461678
| TaintedPath.js:211:14:211:48 | url.par ... ry.path |
16471679
| TaintedPath.js:211:14:211:48 | url.par ... ry.path |
16481680
| TaintedPath.js:211:14:211:48 | url.par ... ry.path |
@@ -1656,6 +1688,19 @@ nodes
16561688
| TaintedPath.js:211:24:211:30 | req.url |
16571689
| TaintedPath.js:211:24:211:30 | req.url |
16581690
| TaintedPath.js:211:24:211:30 | req.url |
1691+
| TaintedPath.js:213:29:213:32 | path |
1692+
| TaintedPath.js:213:29:213:32 | path |
1693+
| TaintedPath.js:213:29:213:32 | path |
1694+
| TaintedPath.js:213:29:213:32 | path |
1695+
| TaintedPath.js:213:29:213:32 | path |
1696+
| TaintedPath.js:213:29:213:32 | path |
1697+
| TaintedPath.js:213:29:213:32 | path |
1698+
| TaintedPath.js:213:29:213:32 | path |
1699+
| TaintedPath.js:213:29:213:68 | path.re ... '), '') |
1700+
| TaintedPath.js:213:29:213:68 | path.re ... '), '') |
1701+
| TaintedPath.js:213:29:213:68 | path.re ... '), '') |
1702+
| TaintedPath.js:213:29:213:68 | path.re ... '), '') |
1703+
| TaintedPath.js:213:29:213:68 | path.re ... '), '') |
16591704
| TaintedPath.js:216:31:216:34 | path |
16601705
| TaintedPath.js:216:31:216:34 | path |
16611706
| TaintedPath.js:216:31:216:34 | path |
@@ -6964,6 +7009,14 @@ edges
69647009
| TaintedPath.js:206:29:206:32 | path | TaintedPath.js:206:29:206:85 | path.re ... '), '') |
69657010
| TaintedPath.js:206:29:206:32 | path | TaintedPath.js:206:29:206:85 | path.re ... '), '') |
69667011
| TaintedPath.js:206:29:206:32 | path | TaintedPath.js:206:29:206:85 | path.re ... '), '') |
7012+
| TaintedPath.js:211:7:211:48 | path | TaintedPath.js:213:29:213:32 | path |
7013+
| TaintedPath.js:211:7:211:48 | path | TaintedPath.js:213:29:213:32 | path |
7014+
| TaintedPath.js:211:7:211:48 | path | TaintedPath.js:213:29:213:32 | path |
7015+
| TaintedPath.js:211:7:211:48 | path | TaintedPath.js:213:29:213:32 | path |
7016+
| TaintedPath.js:211:7:211:48 | path | TaintedPath.js:213:29:213:32 | path |
7017+
| TaintedPath.js:211:7:211:48 | path | TaintedPath.js:213:29:213:32 | path |
7018+
| TaintedPath.js:211:7:211:48 | path | TaintedPath.js:213:29:213:32 | path |
7019+
| TaintedPath.js:211:7:211:48 | path | TaintedPath.js:213:29:213:32 | path |
69677020
| TaintedPath.js:211:7:211:48 | path | TaintedPath.js:216:31:216:34 | path |
69687021
| TaintedPath.js:211:7:211:48 | path | TaintedPath.js:216:31:216:34 | path |
69697022
| TaintedPath.js:211:7:211:48 | path | TaintedPath.js:216:31:216:34 | path |
@@ -6980,6 +7033,19 @@ edges
69807033
| TaintedPath.js:211:14:211:37 | url.par ... , true) | TaintedPath.js:211:14:211:43 | url.par ... ).query |
69817034
| TaintedPath.js:211:14:211:37 | url.par ... , true) | TaintedPath.js:211:14:211:43 | url.par ... ).query |
69827035
| TaintedPath.js:211:14:211:37 | url.par ... , true) | TaintedPath.js:211:14:211:43 | url.par ... ).query |
7036+
| TaintedPath.js:211:14:211:37 | url.par ... , true) | TaintedPath.js:211:14:211:43 | url.par ... ).query |
7037+
| TaintedPath.js:211:14:211:37 | url.par ... , true) | TaintedPath.js:211:14:211:43 | url.par ... ).query |
7038+
| TaintedPath.js:211:14:211:37 | url.par ... , true) | TaintedPath.js:211:14:211:43 | url.par ... ).query |
7039+
| TaintedPath.js:211:14:211:37 | url.par ... , true) | TaintedPath.js:211:14:211:43 | url.par ... ).query |
7040+
| TaintedPath.js:211:14:211:37 | url.par ... , true) | TaintedPath.js:211:14:211:43 | url.par ... ).query |
7041+
| TaintedPath.js:211:14:211:37 | url.par ... , true) | TaintedPath.js:211:14:211:43 | url.par ... ).query |
7042+
| TaintedPath.js:211:14:211:37 | url.par ... , true) | TaintedPath.js:211:14:211:43 | url.par ... ).query |
7043+
| TaintedPath.js:211:14:211:37 | url.par ... , true) | TaintedPath.js:211:14:211:43 | url.par ... ).query |
7044+
| TaintedPath.js:211:14:211:43 | url.par ... ).query | TaintedPath.js:211:14:211:48 | url.par ... ry.path |
7045+
| TaintedPath.js:211:14:211:43 | url.par ... ).query | TaintedPath.js:211:14:211:48 | url.par ... ry.path |
7046+
| TaintedPath.js:211:14:211:43 | url.par ... ).query | TaintedPath.js:211:14:211:48 | url.par ... ry.path |
7047+
| TaintedPath.js:211:14:211:43 | url.par ... ).query | TaintedPath.js:211:14:211:48 | url.par ... ry.path |
7048+
| TaintedPath.js:211:14:211:43 | url.par ... ).query | TaintedPath.js:211:14:211:48 | url.par ... ry.path |
69837049
| TaintedPath.js:211:14:211:43 | url.par ... ).query | TaintedPath.js:211:14:211:48 | url.par ... ry.path |
69847050
| TaintedPath.js:211:14:211:43 | url.par ... ).query | TaintedPath.js:211:14:211:48 | url.par ... ry.path |
69857051
| TaintedPath.js:211:14:211:43 | url.par ... ).query | TaintedPath.js:211:14:211:48 | url.par ... ry.path |
@@ -6988,6 +7054,15 @@ edges
69887054
| TaintedPath.js:211:14:211:43 | url.par ... ).query | TaintedPath.js:211:14:211:48 | url.par ... ry.path |
69897055
| TaintedPath.js:211:14:211:43 | url.par ... ).query | TaintedPath.js:211:14:211:48 | url.par ... ry.path |
69907056
| TaintedPath.js:211:14:211:43 | url.par ... ).query | TaintedPath.js:211:14:211:48 | url.par ... ry.path |
7057+
| TaintedPath.js:211:14:211:43 | url.par ... ).query | TaintedPath.js:211:14:211:48 | url.par ... ry.path |
7058+
| TaintedPath.js:211:14:211:43 | url.par ... ).query | TaintedPath.js:211:14:211:48 | url.par ... ry.path |
7059+
| TaintedPath.js:211:14:211:43 | url.par ... ).query | TaintedPath.js:211:14:211:48 | url.par ... ry.path |
7060+
| TaintedPath.js:211:14:211:48 | url.par ... ry.path | TaintedPath.js:211:7:211:48 | path |
7061+
| TaintedPath.js:211:14:211:48 | url.par ... ry.path | TaintedPath.js:211:7:211:48 | path |
7062+
| TaintedPath.js:211:14:211:48 | url.par ... ry.path | TaintedPath.js:211:7:211:48 | path |
7063+
| TaintedPath.js:211:14:211:48 | url.par ... ry.path | TaintedPath.js:211:7:211:48 | path |
7064+
| TaintedPath.js:211:14:211:48 | url.par ... ry.path | TaintedPath.js:211:7:211:48 | path |
7065+
| TaintedPath.js:211:14:211:48 | url.par ... ry.path | TaintedPath.js:211:7:211:48 | path |
69917066
| TaintedPath.js:211:14:211:48 | url.par ... ry.path | TaintedPath.js:211:7:211:48 | path |
69927067
| TaintedPath.js:211:14:211:48 | url.par ... ry.path | TaintedPath.js:211:7:211:48 | path |
69937068
| TaintedPath.js:211:14:211:48 | url.par ... ry.path | TaintedPath.js:211:7:211:48 | path |
@@ -6996,6 +7071,24 @@ edges
69967071
| TaintedPath.js:211:14:211:48 | url.par ... ry.path | TaintedPath.js:211:7:211:48 | path |
69977072
| TaintedPath.js:211:14:211:48 | url.par ... ry.path | TaintedPath.js:211:7:211:48 | path |
69987073
| TaintedPath.js:211:14:211:48 | url.par ... ry.path | TaintedPath.js:211:7:211:48 | path |
7074+
| TaintedPath.js:211:14:211:48 | url.par ... ry.path | TaintedPath.js:211:7:211:48 | path |
7075+
| TaintedPath.js:211:14:211:48 | url.par ... ry.path | TaintedPath.js:211:7:211:48 | path |
7076+
| TaintedPath.js:211:24:211:30 | req.url | TaintedPath.js:211:14:211:37 | url.par ... , true) |
7077+
| TaintedPath.js:211:24:211:30 | req.url | TaintedPath.js:211:14:211:37 | url.par ... , true) |
7078+
| TaintedPath.js:211:24:211:30 | req.url | TaintedPath.js:211:14:211:37 | url.par ... , true) |
7079+
| TaintedPath.js:211:24:211:30 | req.url | TaintedPath.js:211:14:211:37 | url.par ... , true) |
7080+
| TaintedPath.js:211:24:211:30 | req.url | TaintedPath.js:211:14:211:37 | url.par ... , true) |
7081+
| TaintedPath.js:211:24:211:30 | req.url | TaintedPath.js:211:14:211:37 | url.par ... , true) |
7082+
| TaintedPath.js:211:24:211:30 | req.url | TaintedPath.js:211:14:211:37 | url.par ... , true) |
7083+
| TaintedPath.js:211:24:211:30 | req.url | TaintedPath.js:211:14:211:37 | url.par ... , true) |
7084+
| TaintedPath.js:211:24:211:30 | req.url | TaintedPath.js:211:14:211:37 | url.par ... , true) |
7085+
| TaintedPath.js:211:24:211:30 | req.url | TaintedPath.js:211:14:211:37 | url.par ... , true) |
7086+
| TaintedPath.js:211:24:211:30 | req.url | TaintedPath.js:211:14:211:37 | url.par ... , true) |
7087+
| TaintedPath.js:211:24:211:30 | req.url | TaintedPath.js:211:14:211:37 | url.par ... , true) |
7088+
| TaintedPath.js:211:24:211:30 | req.url | TaintedPath.js:211:14:211:37 | url.par ... , true) |
7089+
| TaintedPath.js:211:24:211:30 | req.url | TaintedPath.js:211:14:211:37 | url.par ... , true) |
7090+
| TaintedPath.js:211:24:211:30 | req.url | TaintedPath.js:211:14:211:37 | url.par ... , true) |
7091+
| TaintedPath.js:211:24:211:30 | req.url | TaintedPath.js:211:14:211:37 | url.par ... , true) |
69997092
| TaintedPath.js:211:24:211:30 | req.url | TaintedPath.js:211:14:211:37 | url.par ... , true) |
70007093
| TaintedPath.js:211:24:211:30 | req.url | TaintedPath.js:211:14:211:37 | url.par ... , true) |
70017094
| TaintedPath.js:211:24:211:30 | req.url | TaintedPath.js:211:14:211:37 | url.par ... , true) |
@@ -7012,6 +7105,22 @@ edges
70127105
| TaintedPath.js:211:24:211:30 | req.url | TaintedPath.js:211:14:211:37 | url.par ... , true) |
70137106
| TaintedPath.js:211:24:211:30 | req.url | TaintedPath.js:211:14:211:37 | url.par ... , true) |
70147107
| TaintedPath.js:211:24:211:30 | req.url | TaintedPath.js:211:14:211:37 | url.par ... , true) |
7108+
| TaintedPath.js:213:29:213:32 | path | TaintedPath.js:213:29:213:68 | path.re ... '), '') |
7109+
| TaintedPath.js:213:29:213:32 | path | TaintedPath.js:213:29:213:68 | path.re ... '), '') |
7110+
| TaintedPath.js:213:29:213:32 | path | TaintedPath.js:213:29:213:68 | path.re ... '), '') |
7111+
| TaintedPath.js:213:29:213:32 | path | TaintedPath.js:213:29:213:68 | path.re ... '), '') |
7112+
| TaintedPath.js:213:29:213:32 | path | TaintedPath.js:213:29:213:68 | path.re ... '), '') |
7113+
| TaintedPath.js:213:29:213:32 | path | TaintedPath.js:213:29:213:68 | path.re ... '), '') |
7114+
| TaintedPath.js:213:29:213:32 | path | TaintedPath.js:213:29:213:68 | path.re ... '), '') |
7115+
| TaintedPath.js:213:29:213:32 | path | TaintedPath.js:213:29:213:68 | path.re ... '), '') |
7116+
| TaintedPath.js:213:29:213:32 | path | TaintedPath.js:213:29:213:68 | path.re ... '), '') |
7117+
| TaintedPath.js:213:29:213:32 | path | TaintedPath.js:213:29:213:68 | path.re ... '), '') |
7118+
| TaintedPath.js:213:29:213:32 | path | TaintedPath.js:213:29:213:68 | path.re ... '), '') |
7119+
| TaintedPath.js:213:29:213:32 | path | TaintedPath.js:213:29:213:68 | path.re ... '), '') |
7120+
| TaintedPath.js:213:29:213:32 | path | TaintedPath.js:213:29:213:68 | path.re ... '), '') |
7121+
| TaintedPath.js:213:29:213:32 | path | TaintedPath.js:213:29:213:68 | path.re ... '), '') |
7122+
| TaintedPath.js:213:29:213:32 | path | TaintedPath.js:213:29:213:68 | path.re ... '), '') |
7123+
| TaintedPath.js:213:29:213:32 | path | TaintedPath.js:213:29:213:68 | path.re ... '), '') |
70157124
| TaintedPath.js:216:31:216:34 | path | TaintedPath.js:216:31:216:69 | path.re ... '), '') |
70167125
| TaintedPath.js:216:31:216:34 | path | TaintedPath.js:216:31:216:69 | path.re ... '), '') |
70177126
| TaintedPath.js:216:31:216:34 | path | TaintedPath.js:216:31:216:69 | path.re ... '), '') |
@@ -10848,6 +10957,7 @@ edges
1084810957
| TaintedPath.js:197:45:197:48 | path | TaintedPath.js:195:24:195:30 | req.url | TaintedPath.js:197:45:197:48 | path | This path depends on a $@. | TaintedPath.js:195:24:195:30 | req.url | user-provided value |
1084910958
| TaintedPath.js:198:35:198:38 | path | TaintedPath.js:195:24:195:30 | req.url | TaintedPath.js:198:35:198:38 | path | This path depends on a $@. | TaintedPath.js:195:24:195:30 | req.url | user-provided value |
1085010959
| TaintedPath.js:206:29:206:85 | path.re ... '), '') | TaintedPath.js:202:24:202:30 | req.url | TaintedPath.js:206:29:206:85 | path.re ... '), '') | This path depends on a $@. | TaintedPath.js:202:24:202:30 | req.url | user-provided value |
10960+
| TaintedPath.js:213:29:213:68 | path.re ... '), '') | TaintedPath.js:211:24:211:30 | req.url | TaintedPath.js:213:29:213:68 | path.re ... '), '') | This path depends on a $@. | TaintedPath.js:211:24:211:30 | req.url | user-provided value |
1085110961
| TaintedPath.js:216:31:216:69 | path.re ... '), '') | TaintedPath.js:211:24:211:30 | req.url | TaintedPath.js:216:31:216:69 | path.re ... '), '') | This path depends on a $@. | TaintedPath.js:211:24:211:30 | req.url | user-provided value |
1085210962
| examples/TaintedPath.js:11:29:11:43 | ROOT + filePath | examples/TaintedPath.js:8:28:8:34 | req.url | examples/TaintedPath.js:11:29:11:43 | ROOT + filePath | This path depends on a $@. | examples/TaintedPath.js:8:28:8:34 | req.url | user-provided value |
1085310963
| express.js:8:20:8:32 | req.query.bar | express.js:8:20:8:32 | req.query.bar | express.js:8:20:8:32 | req.query.bar | This path depends on a $@. | express.js:8:20:8:32 | req.query.bar | user-provided value |

‎javascript/ql/test/query-tests/Security/CWE-022/TaintedPath/TaintedPath.js‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -210,7 +210,7 @@ var server = http.createServer(function(req, res) {
210210
var server = http.createServer(function(req, res) {
211211
let path = url.parse(req.url, true).query.path;
212212

213-
res.write(fs.readFileSync(path.replace(new RegExp("[.]", 'g'), ''))); // NOT OK (can be absolute) -- Currently not flagged because it is not a literal
213+
res.write(fs.readFileSync(path.replace(new RegExp("[.]", 'g'), ''))); // NOT OK (can be absolute)
214214

215215
if (!pathModule.isAbsolute(path)) {
216216
res.write(fs.readFileSync(path.replace(new RegExp("[.]", ''), ''))); // NOT OK

0 commit comments

Comments
 (0)