Skip to content

Commit e1bf054

Browse files
NapalysNapalys
committed
Added support for lutimes, opendir, and statfs functions from fs-extra.
1 parent 55c74b2 commit e1bf054

File tree

3 files changed

+54
-12
lines changed

3 files changed

+54
-12
lines changed

‎javascript/ql/lib/semmle/javascript/frameworks/NodeJSLib.qll

Lines changed: 10 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -453,7 +453,10 @@ module NodeJSLib {
453453
methodName = ["remove", "removeSync", "rmSync", "rm", "rmdir", "rmdirSync"] and i = 0
454454
or
455455
methodName =
456-
["outputJSON", "outputJson", "writeJSON", "writeJson", "writeJSONSync", "writeJsonSync"] and
456+
[
457+
"outputJSON", "outputJson", "writeJSON", "writeJson", "writeJSONSync", "writeJsonSync",
458+
"outputJSONSync", "outputJsonSync"
459+
] and
457460
i = 0
458461
or
459462
methodName = ["ensureFile", "ensureFileSync"] and i = 0
@@ -465,6 +468,12 @@ module NodeJSLib {
465468
methodName = ["emptyDir", "emptyDirSync", "emptydir", "emptydirSync"] and i = 0
466469
or
467470
methodName = ["pathExists", "pathExistsSync"] and i = 0
471+
or
472+
methodName = ["lutimes", "lutimesSync"] and i = 0
473+
or
474+
methodName =
475+
["opendir", "opendirSync", "openAsBlob", "statfs", "statfsSync", "open", "openSync"] and
476+
i = 0
468477
}
469478

470479
/**

‎javascript/ql/test/query-tests/Security/CWE-022/TaintedPath/TaintedPath.expected

Lines changed: 33 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -64,6 +64,17 @@
6464
| more-fs-extra.js:19:25:19:32 | filename | more-fs-extra.js:8:26:8:33 | req.body | more-fs-extra.js:19:25:19:32 | filename | This path depends on a $@. | more-fs-extra.js:8:26:8:33 | req.body | user-provided value |
6565
| more-fs-extra.js:20:21:20:28 | filename | more-fs-extra.js:8:26:8:33 | req.body | more-fs-extra.js:20:21:20:28 | filename | This path depends on a $@. | more-fs-extra.js:8:26:8:33 | req.body | user-provided value |
6666
| more-fs-extra.js:21:17:21:24 | filename | more-fs-extra.js:8:26:8:33 | req.body | more-fs-extra.js:21:17:21:24 | filename | This path depends on a $@. | more-fs-extra.js:8:26:8:33 | req.body | user-provided value |
67+
| more-fs-extra.js:22:16:22:23 | filename | more-fs-extra.js:8:26:8:33 | req.body | more-fs-extra.js:22:16:22:23 | filename | This path depends on a $@. | more-fs-extra.js:8:26:8:33 | req.body | user-provided value |
68+
| more-fs-extra.js:23:20:23:27 | filename | more-fs-extra.js:8:26:8:33 | req.body | more-fs-extra.js:23:20:23:27 | filename | This path depends on a $@. | more-fs-extra.js:8:26:8:33 | req.body | user-provided value |
69+
| more-fs-extra.js:24:19:24:26 | filename | more-fs-extra.js:8:26:8:33 | req.body | more-fs-extra.js:24:19:24:26 | filename | This path depends on a $@. | more-fs-extra.js:8:26:8:33 | req.body | user-provided value |
70+
| more-fs-extra.js:25:15:25:22 | filename | more-fs-extra.js:8:26:8:33 | req.body | more-fs-extra.js:25:15:25:22 | filename | This path depends on a $@. | more-fs-extra.js:8:26:8:33 | req.body | user-provided value |
71+
| more-fs-extra.js:26:19:26:26 | filename | more-fs-extra.js:8:26:8:33 | req.body | more-fs-extra.js:26:19:26:26 | filename | This path depends on a $@. | more-fs-extra.js:8:26:8:33 | req.body | user-provided value |
72+
| more-fs-extra.js:27:13:27:20 | filename | more-fs-extra.js:8:26:8:33 | req.body | more-fs-extra.js:27:13:27:20 | filename | This path depends on a $@. | more-fs-extra.js:8:26:8:33 | req.body | user-provided value |
73+
| more-fs-extra.js:28:17:28:24 | filename | more-fs-extra.js:8:26:8:33 | req.body | more-fs-extra.js:28:17:28:24 | filename | This path depends on a $@. | more-fs-extra.js:8:26:8:33 | req.body | user-provided value |
74+
| more-fs-extra.js:29:23:29:30 | filename | more-fs-extra.js:8:26:8:33 | req.body | more-fs-extra.js:29:23:29:30 | filename | This path depends on a $@. | more-fs-extra.js:8:26:8:33 | req.body | user-provided value |
75+
| more-fs-extra.js:30:16:30:23 | filename | more-fs-extra.js:8:26:8:33 | req.body | more-fs-extra.js:30:16:30:23 | filename | This path depends on a $@. | more-fs-extra.js:8:26:8:33 | req.body | user-provided value |
76+
| more-fs-extra.js:31:20:31:27 | filename | more-fs-extra.js:8:26:8:33 | req.body | more-fs-extra.js:31:20:31:27 | filename | This path depends on a $@. | more-fs-extra.js:8:26:8:33 | req.body | user-provided value |
77+
| more-fs-extra.js:32:23:32:30 | filename | more-fs-extra.js:8:26:8:33 | req.body | more-fs-extra.js:32:23:32:30 | filename | This path depends on a $@. | more-fs-extra.js:8:26:8:33 | req.body | user-provided value |
6778
| normalizedPaths.js:13:19:13:22 | path | normalizedPaths.js:11:14:11:27 | req.query.path | normalizedPaths.js:13:19:13:22 | path | This path depends on a $@. | normalizedPaths.js:11:14:11:27 | req.query.path | user-provided value |
6879
| normalizedPaths.js:14:19:14:29 | './' + path | normalizedPaths.js:11:14:11:27 | req.query.path | normalizedPaths.js:14:19:14:29 | './' + path | This path depends on a $@. | normalizedPaths.js:11:14:11:27 | req.query.path | user-provided value |
6980
| normalizedPaths.js:15:19:15:38 | path + '/index.html' | normalizedPaths.js:11:14:11:27 | req.query.path | normalizedPaths.js:15:19:15:38 | path + '/index.html' | This path depends on a $@. | normalizedPaths.js:11:14:11:27 | req.query.path | user-provided value |
@@ -372,6 +383,17 @@ edges
372383
| more-fs-extra.js:8:11:8:33 | filename | more-fs-extra.js:19:25:19:32 | filename | provenance | |
373384
| more-fs-extra.js:8:11:8:33 | filename | more-fs-extra.js:20:21:20:28 | filename | provenance | |
374385
| more-fs-extra.js:8:11:8:33 | filename | more-fs-extra.js:21:17:21:24 | filename | provenance | |
386+
| more-fs-extra.js:8:11:8:33 | filename | more-fs-extra.js:22:16:22:23 | filename | provenance | |
387+
| more-fs-extra.js:8:11:8:33 | filename | more-fs-extra.js:23:20:23:27 | filename | provenance | |
388+
| more-fs-extra.js:8:11:8:33 | filename | more-fs-extra.js:24:19:24:26 | filename | provenance | |
389+
| more-fs-extra.js:8:11:8:33 | filename | more-fs-extra.js:25:15:25:22 | filename | provenance | |
390+
| more-fs-extra.js:8:11:8:33 | filename | more-fs-extra.js:26:19:26:26 | filename | provenance | |
391+
| more-fs-extra.js:8:11:8:33 | filename | more-fs-extra.js:27:13:27:20 | filename | provenance | |
392+
| more-fs-extra.js:8:11:8:33 | filename | more-fs-extra.js:28:17:28:24 | filename | provenance | |
393+
| more-fs-extra.js:8:11:8:33 | filename | more-fs-extra.js:29:23:29:30 | filename | provenance | |
394+
| more-fs-extra.js:8:11:8:33 | filename | more-fs-extra.js:30:16:30:23 | filename | provenance | |
395+
| more-fs-extra.js:8:11:8:33 | filename | more-fs-extra.js:31:20:31:27 | filename | provenance | |
396+
| more-fs-extra.js:8:11:8:33 | filename | more-fs-extra.js:32:23:32:30 | filename | provenance | |
375397
| more-fs-extra.js:8:13:8:20 | filename | more-fs-extra.js:8:11:8:33 | filename | provenance | |
376398
| more-fs-extra.js:8:26:8:33 | req.body | more-fs-extra.js:8:11:8:22 | { filename } | provenance | |
377399
| normalizedPaths.js:11:7:11:27 | path | normalizedPaths.js:13:19:13:22 | path | provenance | |
@@ -870,6 +892,17 @@ nodes
870892
| more-fs-extra.js:19:25:19:32 | filename | semmle.label | filename |
871893
| more-fs-extra.js:20:21:20:28 | filename | semmle.label | filename |
872894
| more-fs-extra.js:21:17:21:24 | filename | semmle.label | filename |
895+
| more-fs-extra.js:22:16:22:23 | filename | semmle.label | filename |
896+
| more-fs-extra.js:23:20:23:27 | filename | semmle.label | filename |
897+
| more-fs-extra.js:24:19:24:26 | filename | semmle.label | filename |
898+
| more-fs-extra.js:25:15:25:22 | filename | semmle.label | filename |
899+
| more-fs-extra.js:26:19:26:26 | filename | semmle.label | filename |
900+
| more-fs-extra.js:27:13:27:20 | filename | semmle.label | filename |
901+
| more-fs-extra.js:28:17:28:24 | filename | semmle.label | filename |
902+
| more-fs-extra.js:29:23:29:30 | filename | semmle.label | filename |
903+
| more-fs-extra.js:30:16:30:23 | filename | semmle.label | filename |
904+
| more-fs-extra.js:31:20:31:27 | filename | semmle.label | filename |
905+
| more-fs-extra.js:32:23:32:30 | filename | semmle.label | filename |
873906
| normalizedPaths.js:11:7:11:27 | path | semmle.label | path |
874907
| normalizedPaths.js:11:14:11:27 | req.query.path | semmle.label | req.query.path |
875908
| normalizedPaths.js:13:19:13:22 | path | semmle.label | path |

‎javascript/ql/test/query-tests/Security/CWE-022/TaintedPath/more-fs-extra.js

Lines changed: 11 additions & 11 deletions
Original file line numberDiff line numberDiff line change
@@ -19,15 +19,15 @@ app.post('/rmsync', (req, res) => {
1919
fs.cpSync("source", filename); // $ Alert
2020
fs.emptydirSync(filename); // $ Alert
2121
fs.emptydir(filename); // $ Alert
22-
fs.opendir(filename); // $ MISSING: Alert
23-
fs.opendirSync(filename); // $ MISSING: Alert
24-
fs.openAsBlob(filename); // $ MISSING: Alert
25-
fs.statfs(filename); // $ MISSING: Alert
26-
fs.statfsSync(filename); // $ MISSING: Alert
27-
fs.open(filename, 'r'); // $ MISSING: Alert
28-
fs.openSync(filename, 'r'); // $ MISSING: Alert
29-
fs.outputJSONSync(filename, req.body.data, { spaces: 2 }); // $ MISSING: Alert
30-
fs.lutimes(filename, new Date(req.body.atime), new Date(req.body.mtime)); // MISSING: $ Alert
31-
fs.lutimesSync(filename, new Date(req.body.atime), new Date(req.body.mtime)); // MISSING: $ Alert
32-
fs.outputJsonSync(filename, { timestamp: new Date().toISOString(), action: req.body.action, user: req.body.user}, { spaces: 2 }); // $ MISSING: Alert
22+
fs.opendir(filename); // $ Alert
23+
fs.opendirSync(filename); // $ Alert
24+
fs.openAsBlob(filename); // $ Alert
25+
fs.statfs(filename); // $ Alert
26+
fs.statfsSync(filename); // $ Alert
27+
fs.open(filename, 'r'); // $ Alert
28+
fs.openSync(filename, 'r'); // $ Alert
29+
fs.outputJSONSync(filename, req.body.data, { spaces: 2 }); // $ Alert
30+
fs.lutimes(filename, new Date(req.body.atime), new Date(req.body.mtime)); // $ Alert
31+
fs.lutimesSync(filename, new Date(req.body.atime), new Date(req.body.mtime)); // $ Alert
32+
fs.outputJsonSync(filename, { timestamp: new Date().toISOString(), action: req.body.action, user: req.body.user}, { spaces: 2 }); // $ Alert
3333
});

0 commit comments

Comments
 (0)