Skip to content

Commit 5f4c1dd

Browse files
asgerfasgerf
committed
JS: Support regexp-based path traversal check
1 parent 83edcf5 commit 5f4c1dd

File tree

3 files changed

+18
-27
lines changed

3 files changed

+18
-27
lines changed

‎javascript/ql/lib/semmle/javascript/security/dataflow/TaintedPathCustomizations.qll

Lines changed: 18 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -460,6 +460,24 @@ module TaintedPath {
460460
}
461461
}
462462

463+
/**
464+
* An expression of form `x.matches(/\.\./)` or similar.
465+
*/
466+
class ContainsDotDotRegExpSanitizer extends BarrierGuardNode {
467+
StringOps::RegExpTest test;
468+
469+
ContainsDotDotRegExpSanitizer() {
470+
this = test and
471+
test.getRegExp().getConstantValue() = [".", "..", "../"]
472+
}
473+
474+
override predicate blocks(boolean outcome, Expr e, DataFlow::FlowLabel label) {
475+
e = test.getStringOperand().asExpr() and
476+
outcome = test.getPolarity().booleanNot() and
477+
label.(Label::PosixPath).canContainDotDotSlash() // can still be bypassed by normalized absolute path
478+
}
479+
}
480+
463481
/**
464482
* A sanitizer that recognizes the following pattern:
465483
* ```

‎javascript/ql/test/query-tests/Security/CWE-022/TaintedPath/Consistency.expected

Lines changed: 0 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -1,3 +0,0 @@
1-
| query-tests/Security/CWE-022/TaintedPath/normalizedPaths.js:390 | did not expect an alert, but found an alert for TaintedPath | OK | |
2-
| query-tests/Security/CWE-022/TaintedPath/normalizedPaths.js:393 | did not expect an alert, but found an alert for TaintedPath | OK | |
3-
| query-tests/Security/CWE-022/TaintedPath/normalizedPaths.js:396 | did not expect an alert, but found an alert for TaintedPath | OK | |

‎javascript/ql/test/query-tests/Security/CWE-022/TaintedPath/TaintedPath.expected

Lines changed: 0 additions & 24 deletions
Original file line numberDiff line numberDiff line change
@@ -2126,15 +2126,6 @@ nodes
21262126
| normalizedPaths.js:388:19:388:22 | path |
21272127
| normalizedPaths.js:388:19:388:22 | path |
21282128
| normalizedPaths.js:388:19:388:22 | path |
2129-
| normalizedPaths.js:390:21:390:24 | path |
2130-
| normalizedPaths.js:390:21:390:24 | path |
2131-
| normalizedPaths.js:390:21:390:24 | path |
2132-
| normalizedPaths.js:393:21:393:24 | path |
2133-
| normalizedPaths.js:393:21:393:24 | path |
2134-
| normalizedPaths.js:393:21:393:24 | path |
2135-
| normalizedPaths.js:396:21:396:24 | path |
2136-
| normalizedPaths.js:396:21:396:24 | path |
2137-
| normalizedPaths.js:396:21:396:24 | path |
21382129
| normalizedPaths.js:399:21:399:24 | path |
21392130
| normalizedPaths.js:399:21:399:24 | path |
21402131
| normalizedPaths.js:399:21:399:24 | path |
@@ -7024,18 +7015,6 @@ edges
70247015
| normalizedPaths.js:385:7:385:46 | path | normalizedPaths.js:388:19:388:22 | path |
70257016
| normalizedPaths.js:385:7:385:46 | path | normalizedPaths.js:388:19:388:22 | path |
70267017
| normalizedPaths.js:385:7:385:46 | path | normalizedPaths.js:388:19:388:22 | path |
7027-
| normalizedPaths.js:385:7:385:46 | path | normalizedPaths.js:390:21:390:24 | path |
7028-
| normalizedPaths.js:385:7:385:46 | path | normalizedPaths.js:390:21:390:24 | path |
7029-
| normalizedPaths.js:385:7:385:46 | path | normalizedPaths.js:390:21:390:24 | path |
7030-
| normalizedPaths.js:385:7:385:46 | path | normalizedPaths.js:390:21:390:24 | path |
7031-
| normalizedPaths.js:385:7:385:46 | path | normalizedPaths.js:393:21:393:24 | path |
7032-
| normalizedPaths.js:385:7:385:46 | path | normalizedPaths.js:393:21:393:24 | path |
7033-
| normalizedPaths.js:385:7:385:46 | path | normalizedPaths.js:393:21:393:24 | path |
7034-
| normalizedPaths.js:385:7:385:46 | path | normalizedPaths.js:393:21:393:24 | path |
7035-
| normalizedPaths.js:385:7:385:46 | path | normalizedPaths.js:396:21:396:24 | path |
7036-
| normalizedPaths.js:385:7:385:46 | path | normalizedPaths.js:396:21:396:24 | path |
7037-
| normalizedPaths.js:385:7:385:46 | path | normalizedPaths.js:396:21:396:24 | path |
7038-
| normalizedPaths.js:385:7:385:46 | path | normalizedPaths.js:396:21:396:24 | path |
70397018
| normalizedPaths.js:385:7:385:46 | path | normalizedPaths.js:399:21:399:24 | path |
70407019
| normalizedPaths.js:385:7:385:46 | path | normalizedPaths.js:399:21:399:24 | path |
70417020
| normalizedPaths.js:385:7:385:46 | path | normalizedPaths.js:399:21:399:24 | path |
@@ -9719,9 +9698,6 @@ edges
97199698
| normalizedPaths.js:379:19:379:22 | path | normalizedPaths.js:377:14:377:27 | req.query.path | normalizedPaths.js:379:19:379:22 | path | This path depends on $@. | normalizedPaths.js:377:14:377:27 | req.query.path | a user-provided value |
97209699
| normalizedPaths.js:381:19:381:29 | slash(path) | normalizedPaths.js:377:14:377:27 | req.query.path | normalizedPaths.js:381:19:381:29 | slash(path) | This path depends on $@. | normalizedPaths.js:377:14:377:27 | req.query.path | a user-provided value |
97219700
| normalizedPaths.js:388:19:388:22 | path | normalizedPaths.js:385:35:385:45 | req.query.x | normalizedPaths.js:388:19:388:22 | path | This path depends on $@. | normalizedPaths.js:385:35:385:45 | req.query.x | a user-provided value |
9722-
| normalizedPaths.js:390:21:390:24 | path | normalizedPaths.js:385:35:385:45 | req.query.x | normalizedPaths.js:390:21:390:24 | path | This path depends on $@. | normalizedPaths.js:385:35:385:45 | req.query.x | a user-provided value |
9723-
| normalizedPaths.js:393:21:393:24 | path | normalizedPaths.js:385:35:385:45 | req.query.x | normalizedPaths.js:393:21:393:24 | path | This path depends on $@. | normalizedPaths.js:385:35:385:45 | req.query.x | a user-provided value |
9724-
| normalizedPaths.js:396:21:396:24 | path | normalizedPaths.js:385:35:385:45 | req.query.x | normalizedPaths.js:396:21:396:24 | path | This path depends on $@. | normalizedPaths.js:385:35:385:45 | req.query.x | a user-provided value |
97259701
| normalizedPaths.js:399:21:399:24 | path | normalizedPaths.js:385:35:385:45 | req.query.x | normalizedPaths.js:399:21:399:24 | path | This path depends on $@. | normalizedPaths.js:385:35:385:45 | req.query.x | a user-provided value |
97269702
| other-fs-libraries.js:11:19:11:22 | path | other-fs-libraries.js:9:24:9:30 | req.url | other-fs-libraries.js:11:19:11:22 | path | This path depends on $@. | other-fs-libraries.js:9:24:9:30 | req.url | a user-provided value |
97279703
| other-fs-libraries.js:12:27:12:30 | path | other-fs-libraries.js:9:24:9:30 | req.url | other-fs-libraries.js:12:27:12:30 | path | This path depends on $@. | other-fs-libraries.js:9:24:9:30 | req.url | a user-provided value |

0 commit comments

Comments
 (0)