Skip to content

Commit 12b1bbe

Browse files
codeql-cicodeql-ci
authored
Merge pull request github#5897 from erik-krogh/uid
Approved by RasmusWL, esbena
2 parents d706d7b + 9d60ec0 commit 12b1bbe

File tree

4 files changed

+65
-3
lines changed

4 files changed

+65
-3
lines changed

‎javascript/ql/src/semmle/javascript/security/internal/SensitiveDataHeuristics.qll

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -58,7 +58,8 @@ module HeuristicNames {
5858
*/
5959
string maybeAccountInfo() {
6060
result = "(?is).*acc(ou)?nt.*" or
61-
result = "(?is).*(puid|username|userid).*"
61+
result = "(?is).*(puid|username|userid).*" or
62+
result = "(?s).*([uU]|^|_|[a-z](?=U))([uU][iI][dD]).*"
6263
}
6364

6465
/**

‎javascript/ql/test/query-tests/Security/CWE-338/InsecureRandomness.expected

Lines changed: 50 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -66,6 +66,32 @@ nodes
6666
| tst.js:95:33:95:45 | Math.random() |
6767
| tst.js:95:33:95:45 | Math.random() |
6868
| tst.js:95:33:95:45 | Math.random() |
69+
| tst.js:115:16:115:56 | Math.fl ... 00_000) |
70+
| tst.js:115:16:115:56 | Math.fl ... 00_000) |
71+
| tst.js:115:27:115:39 | Math.random() |
72+
| tst.js:115:27:115:39 | Math.random() |
73+
| tst.js:115:27:115:55 | Math.ra ... 000_000 |
74+
| tst.js:116:22:116:62 | Math.fl ... 00_000) |
75+
| tst.js:116:22:116:62 | Math.fl ... 00_000) |
76+
| tst.js:116:33:116:45 | Math.random() |
77+
| tst.js:116:33:116:45 | Math.random() |
78+
| tst.js:116:33:116:61 | Math.ra ... 000_000 |
79+
| tst.js:117:15:117:55 | Math.fl ... 00_000) |
80+
| tst.js:117:15:117:55 | Math.fl ... 00_000) |
81+
| tst.js:117:26:117:38 | Math.random() |
82+
| tst.js:117:26:117:38 | Math.random() |
83+
| tst.js:117:26:117:54 | Math.ra ... 000_000 |
84+
| tst.js:118:23:118:63 | Math.fl ... 00_000) |
85+
| tst.js:118:23:118:63 | Math.fl ... 00_000) |
86+
| tst.js:118:34:118:46 | Math.random() |
87+
| tst.js:118:34:118:46 | Math.random() |
88+
| tst.js:118:34:118:62 | Math.ra ... 000_000 |
89+
| tst.js:120:16:120:28 | Math.random() |
90+
| tst.js:120:16:120:28 | Math.random() |
91+
| tst.js:120:16:120:28 | Math.random() |
92+
| tst.js:121:18:121:30 | Math.random() |
93+
| tst.js:121:18:121:30 | Math.random() |
94+
| tst.js:121:18:121:30 | Math.random() |
6995
edges
7096
| tst.js:2:20:2:32 | Math.random() | tst.js:2:20:2:32 | Math.random() |
7197
| tst.js:6:31:6:43 | Math.random() | tst.js:6:20:6:43 | "prefix ... andom() |
@@ -114,6 +140,24 @@ edges
114140
| tst.js:84:19:84:31 | Math.random() | tst.js:84:19:84:31 | Math.random() |
115141
| tst.js:90:32:90:44 | Math.random() | tst.js:90:32:90:44 | Math.random() |
116142
| tst.js:95:33:95:45 | Math.random() | tst.js:95:33:95:45 | Math.random() |
143+
| tst.js:115:27:115:39 | Math.random() | tst.js:115:27:115:55 | Math.ra ... 000_000 |
144+
| tst.js:115:27:115:39 | Math.random() | tst.js:115:27:115:55 | Math.ra ... 000_000 |
145+
| tst.js:115:27:115:55 | Math.ra ... 000_000 | tst.js:115:16:115:56 | Math.fl ... 00_000) |
146+
| tst.js:115:27:115:55 | Math.ra ... 000_000 | tst.js:115:16:115:56 | Math.fl ... 00_000) |
147+
| tst.js:116:33:116:45 | Math.random() | tst.js:116:33:116:61 | Math.ra ... 000_000 |
148+
| tst.js:116:33:116:45 | Math.random() | tst.js:116:33:116:61 | Math.ra ... 000_000 |
149+
| tst.js:116:33:116:61 | Math.ra ... 000_000 | tst.js:116:22:116:62 | Math.fl ... 00_000) |
150+
| tst.js:116:33:116:61 | Math.ra ... 000_000 | tst.js:116:22:116:62 | Math.fl ... 00_000) |
151+
| tst.js:117:26:117:38 | Math.random() | tst.js:117:26:117:54 | Math.ra ... 000_000 |
152+
| tst.js:117:26:117:38 | Math.random() | tst.js:117:26:117:54 | Math.ra ... 000_000 |
153+
| tst.js:117:26:117:54 | Math.ra ... 000_000 | tst.js:117:15:117:55 | Math.fl ... 00_000) |
154+
| tst.js:117:26:117:54 | Math.ra ... 000_000 | tst.js:117:15:117:55 | Math.fl ... 00_000) |
155+
| tst.js:118:34:118:46 | Math.random() | tst.js:118:34:118:62 | Math.ra ... 000_000 |
156+
| tst.js:118:34:118:46 | Math.random() | tst.js:118:34:118:62 | Math.ra ... 000_000 |
157+
| tst.js:118:34:118:62 | Math.ra ... 000_000 | tst.js:118:23:118:63 | Math.fl ... 00_000) |
158+
| tst.js:118:34:118:62 | Math.ra ... 000_000 | tst.js:118:23:118:63 | Math.fl ... 00_000) |
159+
| tst.js:120:16:120:28 | Math.random() | tst.js:120:16:120:28 | Math.random() |
160+
| tst.js:121:18:121:30 | Math.random() | tst.js:121:18:121:30 | Math.random() |
117161
#select
118162
| tst.js:2:20:2:32 | Math.random() | tst.js:2:20:2:32 | Math.random() | tst.js:2:20:2:32 | Math.random() | Cryptographically insecure $@ in a security context. | tst.js:2:20:2:32 | Math.random() | random value |
119163
| tst.js:6:20:6:43 | "prefix ... andom() | tst.js:6:31:6:43 | Math.random() | tst.js:6:20:6:43 | "prefix ... andom() | Cryptographically insecure $@ in a security context. | tst.js:6:31:6:43 | Math.random() | random value |
@@ -131,3 +175,9 @@ edges
131175
| tst.js:84:19:84:31 | Math.random() | tst.js:84:19:84:31 | Math.random() | tst.js:84:19:84:31 | Math.random() | Cryptographically insecure $@ in a security context. | tst.js:84:19:84:31 | Math.random() | random value |
132176
| tst.js:90:32:90:44 | Math.random() | tst.js:90:32:90:44 | Math.random() | tst.js:90:32:90:44 | Math.random() | Cryptographically insecure $@ in a security context. | tst.js:90:32:90:44 | Math.random() | random value |
133177
| tst.js:95:33:95:45 | Math.random() | tst.js:95:33:95:45 | Math.random() | tst.js:95:33:95:45 | Math.random() | Cryptographically insecure $@ in a security context. | tst.js:95:33:95:45 | Math.random() | random value |
178+
| tst.js:115:16:115:56 | Math.fl ... 00_000) | tst.js:115:27:115:39 | Math.random() | tst.js:115:16:115:56 | Math.fl ... 00_000) | Cryptographically insecure $@ in a security context. | tst.js:115:27:115:39 | Math.random() | random value |
179+
| tst.js:116:22:116:62 | Math.fl ... 00_000) | tst.js:116:33:116:45 | Math.random() | tst.js:116:22:116:62 | Math.fl ... 00_000) | Cryptographically insecure $@ in a security context. | tst.js:116:33:116:45 | Math.random() | random value |
180+
| tst.js:117:15:117:55 | Math.fl ... 00_000) | tst.js:117:26:117:38 | Math.random() | tst.js:117:15:117:55 | Math.fl ... 00_000) | Cryptographically insecure $@ in a security context. | tst.js:117:26:117:38 | Math.random() | random value |
181+
| tst.js:118:23:118:63 | Math.fl ... 00_000) | tst.js:118:34:118:46 | Math.random() | tst.js:118:23:118:63 | Math.fl ... 00_000) | Cryptographically insecure $@ in a security context. | tst.js:118:34:118:46 | Math.random() | random value |
182+
| tst.js:120:16:120:28 | Math.random() | tst.js:120:16:120:28 | Math.random() | tst.js:120:16:120:28 | Math.random() | Cryptographically insecure $@ in a security context. | tst.js:120:16:120:28 | Math.random() | random value |
183+
| tst.js:121:18:121:30 | Math.random() | tst.js:121:18:121:30 | Math.random() | tst.js:121:18:121:30 | Math.random() | Cryptographically insecure $@ in a security context. | tst.js:121:18:121:30 | Math.random() | random value |

‎javascript/ql/test/query-tests/Security/CWE-338/tst.js

Lines changed: 11 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -109,4 +109,14 @@ function f18() {
109109
}
110110
};
111111
var secret = genRandom(); // OK - Math.random() is only a fallback.
112-
})();
112+
})();
113+
114+
function uid() {
115+
var uuid = Math.floor(Math.random() * 4_000_000_000); // NOT OK
116+
var sessionUid = Math.floor(Math.random() * 4_000_000_000); // NOT OK
117+
var uid = Math.floor(Math.random() * 4_000_000_000); // NOT OK
118+
var my_nice_uid = Math.floor(Math.random() * 4_000_000_000); // NOT OK
119+
var liquid = Math.random(); // OK
120+
var UUID = Math.random(); // NOT OK
121+
var MY_UID = Math.random(); // NOK OK
122+
}

‎python/ql/src/semmle/python/security/internal/SensitiveDataHeuristics.qll

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -58,7 +58,8 @@ module HeuristicNames {
5858
*/
5959
string maybeAccountInfo() {
6060
result = "(?is).*acc(ou)?nt.*" or
61-
result = "(?is).*(puid|username|userid).*"
61+
result = "(?is).*(puid|username|userid).*" or
62+
result = "(?s).*([uU]|^|_|[a-z](?=U))([uU][iI][dD]).*"
6263
}
6364

6465
/**

0 commit comments

Comments
 (0)