Skip to content

Commit 07bc585

Browse files
erik-krogherik-krogh
committed
add the cwd option from read-pkg as sink for path-injection 
1 parent c47d680 commit 07bc585

File tree

4 files changed

+123
-0
lines changed

4 files changed

+123
-0
lines changed

‎javascript/change-notes/2021-07-12-read-pkg.md

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,4 @@
1+
lgtm,codescanning
2+
* The `cwd` option from the `read-pkg` library is recognized as a sink for `js/tainted-path`.
3+
Affected packages are
4+
[read-pkg](https://npmjs.com/package/read-pkg)

‎javascript/ql/src/semmle/javascript/security/dataflow/TaintedPathCustomizations.qll

Lines changed: 15 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -682,6 +682,21 @@ module TaintedPath {
682682
}
683683
}
684684

685+
/**
686+
* The `cwd` option for the `read-pkg` library.
687+
*/
688+
private class ReadPkgCwdSink extends TaintedPath::Sink {
689+
ReadPkgCwdSink() {
690+
this =
691+
API::moduleImport("read-pkg")
692+
.getMember(["readPackageAsync", "readPackageSync"])
693+
.getACall()
694+
.getParameter(0)
695+
.getMember("cwd")
696+
.getARhs()
697+
}
698+
}
699+
685700
/**
686701
* Holds if there is a step `src -> dst` mapping `srclabel` to `dstlabel` relevant for path traversal vulnerabilities.
687702
*/

‎javascript/ql/test/query-tests/Security/CWE-022/TaintedPath/TaintedPath.expected

Lines changed: 100 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -2339,6 +2339,40 @@ nodes
23392339
| other-fs-libraries.js:59:39:59:42 | path |
23402340
| other-fs-libraries.js:59:39:59:42 | path |
23412341
| other-fs-libraries.js:59:39:59:42 | path |
2342+
| other-fs-libraries.js:62:43:62:46 | path |
2343+
| other-fs-libraries.js:62:43:62:46 | path |
2344+
| other-fs-libraries.js:62:43:62:46 | path |
2345+
| other-fs-libraries.js:62:43:62:46 | path |
2346+
| other-fs-libraries.js:62:43:62:46 | path |
2347+
| other-fs-libraries.js:62:43:62:46 | path |
2348+
| other-fs-libraries.js:62:43:62:46 | path |
2349+
| other-fs-libraries.js:62:43:62:46 | path |
2350+
| other-fs-libraries.js:62:43:62:46 | path |
2351+
| other-fs-libraries.js:62:43:62:46 | path |
2352+
| other-fs-libraries.js:62:43:62:46 | path |
2353+
| other-fs-libraries.js:62:43:62:46 | path |
2354+
| other-fs-libraries.js:62:43:62:46 | path |
2355+
| other-fs-libraries.js:62:43:62:46 | path |
2356+
| other-fs-libraries.js:62:43:62:46 | path |
2357+
| other-fs-libraries.js:62:43:62:46 | path |
2358+
| other-fs-libraries.js:62:43:62:46 | path |
2359+
| other-fs-libraries.js:63:51:63:54 | path |
2360+
| other-fs-libraries.js:63:51:63:54 | path |
2361+
| other-fs-libraries.js:63:51:63:54 | path |
2362+
| other-fs-libraries.js:63:51:63:54 | path |
2363+
| other-fs-libraries.js:63:51:63:54 | path |
2364+
| other-fs-libraries.js:63:51:63:54 | path |
2365+
| other-fs-libraries.js:63:51:63:54 | path |
2366+
| other-fs-libraries.js:63:51:63:54 | path |
2367+
| other-fs-libraries.js:63:51:63:54 | path |
2368+
| other-fs-libraries.js:63:51:63:54 | path |
2369+
| other-fs-libraries.js:63:51:63:54 | path |
2370+
| other-fs-libraries.js:63:51:63:54 | path |
2371+
| other-fs-libraries.js:63:51:63:54 | path |
2372+
| other-fs-libraries.js:63:51:63:54 | path |
2373+
| other-fs-libraries.js:63:51:63:54 | path |
2374+
| other-fs-libraries.js:63:51:63:54 | path |
2375+
| other-fs-libraries.js:63:51:63:54 | path |
23422376
| prettier.js:6:11:6:28 | p |
23432377
| prettier.js:6:11:6:28 | p |
23442378
| prettier.js:6:11:6:28 | p |
@@ -6815,6 +6849,70 @@ edges
68156849
| other-fs-libraries.js:49:7:49:48 | path | other-fs-libraries.js:59:39:59:42 | path |
68166850
| other-fs-libraries.js:49:7:49:48 | path | other-fs-libraries.js:59:39:59:42 | path |
68176851
| other-fs-libraries.js:49:7:49:48 | path | other-fs-libraries.js:59:39:59:42 | path |
6852+
| other-fs-libraries.js:49:7:49:48 | path | other-fs-libraries.js:62:43:62:46 | path |
6853+
| other-fs-libraries.js:49:7:49:48 | path | other-fs-libraries.js:62:43:62:46 | path |
6854+
| other-fs-libraries.js:49:7:49:48 | path | other-fs-libraries.js:62:43:62:46 | path |
6855+
| other-fs-libraries.js:49:7:49:48 | path | other-fs-libraries.js:62:43:62:46 | path |
6856+
| other-fs-libraries.js:49:7:49:48 | path | other-fs-libraries.js:62:43:62:46 | path |
6857+
| other-fs-libraries.js:49:7:49:48 | path | other-fs-libraries.js:62:43:62:46 | path |
6858+
| other-fs-libraries.js:49:7:49:48 | path | other-fs-libraries.js:62:43:62:46 | path |
6859+
| other-fs-libraries.js:49:7:49:48 | path | other-fs-libraries.js:62:43:62:46 | path |
6860+
| other-fs-libraries.js:49:7:49:48 | path | other-fs-libraries.js:62:43:62:46 | path |
6861+
| other-fs-libraries.js:49:7:49:48 | path | other-fs-libraries.js:62:43:62:46 | path |
6862+
| other-fs-libraries.js:49:7:49:48 | path | other-fs-libraries.js:62:43:62:46 | path |
6863+
| other-fs-libraries.js:49:7:49:48 | path | other-fs-libraries.js:62:43:62:46 | path |
6864+
| other-fs-libraries.js:49:7:49:48 | path | other-fs-libraries.js:62:43:62:46 | path |
6865+
| other-fs-libraries.js:49:7:49:48 | path | other-fs-libraries.js:62:43:62:46 | path |
6866+
| other-fs-libraries.js:49:7:49:48 | path | other-fs-libraries.js:62:43:62:46 | path |
6867+
| other-fs-libraries.js:49:7:49:48 | path | other-fs-libraries.js:62:43:62:46 | path |
6868+
| other-fs-libraries.js:49:7:49:48 | path | other-fs-libraries.js:62:43:62:46 | path |
6869+
| other-fs-libraries.js:49:7:49:48 | path | other-fs-libraries.js:62:43:62:46 | path |
6870+
| other-fs-libraries.js:49:7:49:48 | path | other-fs-libraries.js:62:43:62:46 | path |
6871+
| other-fs-libraries.js:49:7:49:48 | path | other-fs-libraries.js:62:43:62:46 | path |
6872+
| other-fs-libraries.js:49:7:49:48 | path | other-fs-libraries.js:62:43:62:46 | path |
6873+
| other-fs-libraries.js:49:7:49:48 | path | other-fs-libraries.js:62:43:62:46 | path |
6874+
| other-fs-libraries.js:49:7:49:48 | path | other-fs-libraries.js:62:43:62:46 | path |
6875+
| other-fs-libraries.js:49:7:49:48 | path | other-fs-libraries.js:62:43:62:46 | path |
6876+
| other-fs-libraries.js:49:7:49:48 | path | other-fs-libraries.js:62:43:62:46 | path |
6877+
| other-fs-libraries.js:49:7:49:48 | path | other-fs-libraries.js:62:43:62:46 | path |
6878+
| other-fs-libraries.js:49:7:49:48 | path | other-fs-libraries.js:62:43:62:46 | path |
6879+
| other-fs-libraries.js:49:7:49:48 | path | other-fs-libraries.js:62:43:62:46 | path |
6880+
| other-fs-libraries.js:49:7:49:48 | path | other-fs-libraries.js:62:43:62:46 | path |
6881+
| other-fs-libraries.js:49:7:49:48 | path | other-fs-libraries.js:62:43:62:46 | path |
6882+
| other-fs-libraries.js:49:7:49:48 | path | other-fs-libraries.js:62:43:62:46 | path |
6883+
| other-fs-libraries.js:49:7:49:48 | path | other-fs-libraries.js:62:43:62:46 | path |
6884+
| other-fs-libraries.js:49:7:49:48 | path | other-fs-libraries.js:63:51:63:54 | path |
6885+
| other-fs-libraries.js:49:7:49:48 | path | other-fs-libraries.js:63:51:63:54 | path |
6886+
| other-fs-libraries.js:49:7:49:48 | path | other-fs-libraries.js:63:51:63:54 | path |
6887+
| other-fs-libraries.js:49:7:49:48 | path | other-fs-libraries.js:63:51:63:54 | path |
6888+
| other-fs-libraries.js:49:7:49:48 | path | other-fs-libraries.js:63:51:63:54 | path |
6889+
| other-fs-libraries.js:49:7:49:48 | path | other-fs-libraries.js:63:51:63:54 | path |
6890+
| other-fs-libraries.js:49:7:49:48 | path | other-fs-libraries.js:63:51:63:54 | path |
6891+
| other-fs-libraries.js:49:7:49:48 | path | other-fs-libraries.js:63:51:63:54 | path |
6892+
| other-fs-libraries.js:49:7:49:48 | path | other-fs-libraries.js:63:51:63:54 | path |
6893+
| other-fs-libraries.js:49:7:49:48 | path | other-fs-libraries.js:63:51:63:54 | path |
6894+
| other-fs-libraries.js:49:7:49:48 | path | other-fs-libraries.js:63:51:63:54 | path |
6895+
| other-fs-libraries.js:49:7:49:48 | path | other-fs-libraries.js:63:51:63:54 | path |
6896+
| other-fs-libraries.js:49:7:49:48 | path | other-fs-libraries.js:63:51:63:54 | path |
6897+
| other-fs-libraries.js:49:7:49:48 | path | other-fs-libraries.js:63:51:63:54 | path |
6898+
| other-fs-libraries.js:49:7:49:48 | path | other-fs-libraries.js:63:51:63:54 | path |
6899+
| other-fs-libraries.js:49:7:49:48 | path | other-fs-libraries.js:63:51:63:54 | path |
6900+
| other-fs-libraries.js:49:7:49:48 | path | other-fs-libraries.js:63:51:63:54 | path |
6901+
| other-fs-libraries.js:49:7:49:48 | path | other-fs-libraries.js:63:51:63:54 | path |
6902+
| other-fs-libraries.js:49:7:49:48 | path | other-fs-libraries.js:63:51:63:54 | path |
6903+
| other-fs-libraries.js:49:7:49:48 | path | other-fs-libraries.js:63:51:63:54 | path |
6904+
| other-fs-libraries.js:49:7:49:48 | path | other-fs-libraries.js:63:51:63:54 | path |
6905+
| other-fs-libraries.js:49:7:49:48 | path | other-fs-libraries.js:63:51:63:54 | path |
6906+
| other-fs-libraries.js:49:7:49:48 | path | other-fs-libraries.js:63:51:63:54 | path |
6907+
| other-fs-libraries.js:49:7:49:48 | path | other-fs-libraries.js:63:51:63:54 | path |
6908+
| other-fs-libraries.js:49:7:49:48 | path | other-fs-libraries.js:63:51:63:54 | path |
6909+
| other-fs-libraries.js:49:7:49:48 | path | other-fs-libraries.js:63:51:63:54 | path |
6910+
| other-fs-libraries.js:49:7:49:48 | path | other-fs-libraries.js:63:51:63:54 | path |
6911+
| other-fs-libraries.js:49:7:49:48 | path | other-fs-libraries.js:63:51:63:54 | path |
6912+
| other-fs-libraries.js:49:7:49:48 | path | other-fs-libraries.js:63:51:63:54 | path |
6913+
| other-fs-libraries.js:49:7:49:48 | path | other-fs-libraries.js:63:51:63:54 | path |
6914+
| other-fs-libraries.js:49:7:49:48 | path | other-fs-libraries.js:63:51:63:54 | path |
6915+
| other-fs-libraries.js:49:7:49:48 | path | other-fs-libraries.js:63:51:63:54 | path |
68186916
| other-fs-libraries.js:49:14:49:37 | url.par ... , true) | other-fs-libraries.js:49:14:49:43 | url.par ... ).query |
68196917
| other-fs-libraries.js:49:14:49:37 | url.par ... , true) | other-fs-libraries.js:49:14:49:43 | url.par ... ).query |
68206918
| other-fs-libraries.js:49:14:49:37 | url.par ... , true) | other-fs-libraries.js:49:14:49:43 | url.par ... ).query |
@@ -8552,6 +8650,8 @@ edges
85528650
| other-fs-libraries.js:55:36:55:39 | path | other-fs-libraries.js:49:24:49:30 | req.url | other-fs-libraries.js:55:36:55:39 | path | This path depends on $@. | other-fs-libraries.js:49:24:49:30 | req.url | a user-provided value |
85538651
| other-fs-libraries.js:57:46:57:49 | path | other-fs-libraries.js:49:24:49:30 | req.url | other-fs-libraries.js:57:46:57:49 | path | This path depends on $@. | other-fs-libraries.js:49:24:49:30 | req.url | a user-provided value |
85548652
| other-fs-libraries.js:59:39:59:42 | path | other-fs-libraries.js:49:24:49:30 | req.url | other-fs-libraries.js:59:39:59:42 | path | This path depends on $@. | other-fs-libraries.js:49:24:49:30 | req.url | a user-provided value |
8653+
| other-fs-libraries.js:62:43:62:46 | path | other-fs-libraries.js:49:24:49:30 | req.url | other-fs-libraries.js:62:43:62:46 | path | This path depends on $@. | other-fs-libraries.js:49:24:49:30 | req.url | a user-provided value |
8654+
| other-fs-libraries.js:63:51:63:54 | path | other-fs-libraries.js:49:24:49:30 | req.url | other-fs-libraries.js:63:51:63:54 | path | This path depends on $@. | other-fs-libraries.js:49:24:49:30 | req.url | a user-provided value |
85558655
| prettier.js:7:28:7:28 | p | prettier.js:6:13:6:13 | p | prettier.js:7:28:7:28 | p | This path depends on $@. | prettier.js:6:13:6:13 | p | a user-provided value |
85568656
| prettier.js:11:44:11:44 | p | prettier.js:6:13:6:13 | p | prettier.js:11:44:11:44 | p | This path depends on $@. | prettier.js:6:13:6:13 | p | a user-provided value |
85578657
| pupeteer.js:9:28:9:34 | tainted | pupeteer.js:5:28:5:53 | parseTo ... t).name | pupeteer.js:9:28:9:34 | tainted | This path depends on $@. | pupeteer.js:5:28:5:53 | parseTo ... t).name | a user-provided value |

‎javascript/ql/test/query-tests/Security/CWE-022/TaintedPath/other-fs-libraries.js

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -57,4 +57,8 @@ http.createServer(function(req, res) {
5757
require('util.promisify')(fs.readFileSync)(path); // NOT OK
5858

5959
require("thenify")(fs.readFileSync)(path); // NOT OK
60+
61+
const readPkg = require('read-pkg');
62+
var pkg = readPkg.readPackageSync({cwd: path}); // NOT OK
63+
var pkgPromise = readPkg.readPackageAsync({cwd: path}); // NOT OK
6064
});

0 commit comments

Comments
 (0)