Skip to content

Commit dc26223

Browse files
NapalysNapalys
committed
Enhance taint tracking by including escape and unescape in TaintedPath customizations.
1 parent c4b717b commit dc26223

File tree

3 files changed

+34
-4
lines changed

3 files changed

+34
-4
lines changed

‎javascript/ql/lib/semmle/javascript/security/dataflow/TaintedPathCustomizations.qll

Lines changed: 4 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -892,7 +892,10 @@ module TaintedPath {
892892
TaintTracking::uriStep(node1, node2)
893893
or
894894
exists(DataFlow::CallNode decode |
895-
decode.getCalleeName() = "decodeURIComponent" or decode.getCalleeName() = "decodeURI"
895+
decode.getCalleeName() = "decodeURIComponent" or
896+
decode.getCalleeName() = "decodeURI" or
897+
decode.getCalleeName() = "escape" or
898+
decode.getCalleeName() = "unescape"
896899
|
897900
node1 = decode.getArgument(0) and
898901
node2 = decode

‎javascript/ql/test/query-tests/Security/CWE-022/TaintedPath/TaintedPath.expected

Lines changed: 27 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -45,6 +45,8 @@
4545
| TaintedPath.js:195:29:195:85 | path.re ... '), '') | TaintedPath.js:191:24:191:30 | req.url | TaintedPath.js:195:29:195:85 | path.re ... '), '') | This path depends on a $@. | TaintedPath.js:191:24:191:30 | req.url | user-provided value |
4646
| TaintedPath.js:202:29:202:68 | path.re ... '), '') | TaintedPath.js:200:24:200:30 | req.url | TaintedPath.js:202:29:202:68 | path.re ... '), '') | This path depends on a $@. | TaintedPath.js:200:24:200:30 | req.url | user-provided value |
4747
| TaintedPath.js:205:31:205:69 | path.re ... '), '') | TaintedPath.js:200:24:200:30 | req.url | TaintedPath.js:205:31:205:69 | path.re ... '), '') | This path depends on a $@. | TaintedPath.js:200:24:200:30 | req.url | user-provided value |
48+
| TaintedPath.js:214:29:214:42 | improperEscape | TaintedPath.js:212:24:212:30 | req.url | TaintedPath.js:214:29:214:42 | improperEscape | This path depends on a $@. | TaintedPath.js:212:24:212:30 | req.url | user-provided value |
49+
| TaintedPath.js:216:29:216:43 | improperEscape2 | TaintedPath.js:212:24:212:30 | req.url | TaintedPath.js:216:29:216:43 | improperEscape2 | This path depends on a $@. | TaintedPath.js:212:24:212:30 | req.url | user-provided value |
4850
| examples/TaintedPath.js:10:29:10:43 | ROOT + filePath | examples/TaintedPath.js:8:28:8:34 | req.url | examples/TaintedPath.js:10:29:10:43 | ROOT + filePath | This path depends on a $@. | examples/TaintedPath.js:8:28:8:34 | req.url | user-provided value |
4951
| express.js:8:20:8:32 | req.query.bar | express.js:8:20:8:32 | req.query.bar | express.js:8:20:8:32 | req.query.bar | This path depends on a $@. | express.js:8:20:8:32 | req.query.bar | user-provided value |
5052
| handlebars.js:11:32:11:39 | filePath | handlebars.js:29:46:29:60 | req.params.path | handlebars.js:11:32:11:39 | filePath | This path depends on a $@. | handlebars.js:29:46:29:60 | req.params.path | user-provided value |
@@ -320,6 +322,18 @@ edges
320322
| TaintedPath.js:200:24:200:30 | req.url | TaintedPath.js:200:14:200:37 | url.par ... , true) | provenance | Config |
321323
| TaintedPath.js:202:29:202:32 | path | TaintedPath.js:202:29:202:68 | path.re ... '), '') | provenance | Config |
322324
| TaintedPath.js:205:31:205:34 | path | TaintedPath.js:205:31:205:69 | path.re ... '), '') | provenance | Config |
325+
| TaintedPath.js:212:7:212:48 | path | TaintedPath.js:213:33:213:36 | path | provenance | |
326+
| TaintedPath.js:212:7:212:48 | path | TaintedPath.js:215:36:215:39 | path | provenance | |
327+
| TaintedPath.js:212:14:212:37 | url.par ... , true) | TaintedPath.js:212:14:212:43 | url.par ... ).query | provenance | Config |
328+
| TaintedPath.js:212:14:212:43 | url.par ... ).query | TaintedPath.js:212:14:212:48 | url.par ... ry.path | provenance | Config |
329+
| TaintedPath.js:212:14:212:48 | url.par ... ry.path | TaintedPath.js:212:7:212:48 | path | provenance | |
330+
| TaintedPath.js:212:24:212:30 | req.url | TaintedPath.js:212:14:212:37 | url.par ... , true) | provenance | Config |
331+
| TaintedPath.js:213:9:213:37 | improperEscape | TaintedPath.js:214:29:214:42 | improperEscape | provenance | |
332+
| TaintedPath.js:213:26:213:37 | escape(path) | TaintedPath.js:213:9:213:37 | improperEscape | provenance | |
333+
| TaintedPath.js:213:33:213:36 | path | TaintedPath.js:213:26:213:37 | escape(path) | provenance | Config |
334+
| TaintedPath.js:215:9:215:40 | improperEscape2 | TaintedPath.js:216:29:216:43 | improperEscape2 | provenance | |
335+
| TaintedPath.js:215:27:215:40 | unescape(path) | TaintedPath.js:215:9:215:40 | improperEscape2 | provenance | |
336+
| TaintedPath.js:215:36:215:39 | path | TaintedPath.js:215:27:215:40 | unescape(path) | provenance | Config |
323337
| examples/TaintedPath.js:8:7:8:52 | filePath | examples/TaintedPath.js:10:36:10:43 | filePath | provenance | |
324338
| examples/TaintedPath.js:8:18:8:41 | url.par ... , true) | examples/TaintedPath.js:8:18:8:47 | url.par ... ).query | provenance | Config |
325339
| examples/TaintedPath.js:8:18:8:47 | url.par ... ).query | examples/TaintedPath.js:8:18:8:52 | url.par ... ry.path | provenance | Config |
@@ -780,6 +794,19 @@ nodes
780794
| TaintedPath.js:202:29:202:68 | path.re ... '), '') | semmle.label | path.re ... '), '') |
781795
| TaintedPath.js:205:31:205:34 | path | semmle.label | path |
782796
| TaintedPath.js:205:31:205:69 | path.re ... '), '') | semmle.label | path.re ... '), '') |
797+
| TaintedPath.js:212:7:212:48 | path | semmle.label | path |
798+
| TaintedPath.js:212:14:212:37 | url.par ... , true) | semmle.label | url.par ... , true) |
799+
| TaintedPath.js:212:14:212:43 | url.par ... ).query | semmle.label | url.par ... ).query |
800+
| TaintedPath.js:212:14:212:48 | url.par ... ry.path | semmle.label | url.par ... ry.path |
801+
| TaintedPath.js:212:24:212:30 | req.url | semmle.label | req.url |
802+
| TaintedPath.js:213:9:213:37 | improperEscape | semmle.label | improperEscape |
803+
| TaintedPath.js:213:26:213:37 | escape(path) | semmle.label | escape(path) |
804+
| TaintedPath.js:213:33:213:36 | path | semmle.label | path |
805+
| TaintedPath.js:214:29:214:42 | improperEscape | semmle.label | improperEscape |
806+
| TaintedPath.js:215:9:215:40 | improperEscape2 | semmle.label | improperEscape2 |
807+
| TaintedPath.js:215:27:215:40 | unescape(path) | semmle.label | unescape(path) |
808+
| TaintedPath.js:215:36:215:39 | path | semmle.label | path |
809+
| TaintedPath.js:216:29:216:43 | improperEscape2 | semmle.label | improperEscape2 |
783810
| examples/TaintedPath.js:8:7:8:52 | filePath | semmle.label | filePath |
784811
| examples/TaintedPath.js:8:18:8:41 | url.par ... , true) | semmle.label | url.par ... , true) |
785812
| examples/TaintedPath.js:8:18:8:47 | url.par ... ).query | semmle.label | url.par ... ).query |

‎javascript/ql/test/query-tests/Security/CWE-022/TaintedPath/TaintedPath.js

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -209,9 +209,9 @@ var server = http.createServer(function(req, res) {
209209
});
210210

211211
var srv = http.createServer(function(req, res) {
212-
let path = url.parse(req.url, true).query.path; // $ MISSING: Source
212+
let path = url.parse(req.url, true).query.path; // $ Source
213213
const improperEscape = escape(path);
214-
res.write(fs.readFileSync(improperEscape)); // $ MISSING: Alert
214+
res.write(fs.readFileSync(improperEscape)); // $ Alert
215215
const improperEscape2 = unescape(path);
216-
res.write(fs.readFileSync(improperEscape2)); // $ MISSING: Alert
216+
res.write(fs.readFileSync(improperEscape2)); // $ Alert
217217
});

0 commit comments

Comments
 (0)