Skip to content

Commit 5baba62

Browse files
esbenaesbena
committed
JS: model path-is-inside+is-path-inside for js/path-injection 
1 parent 86b836c commit 5baba62

File tree

4 files changed

+35
-43
lines changed

4 files changed

+35
-43
lines changed

‎javascript/ql/src/semmle/javascript/security/dataflow/TaintedPath.qll

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -35,7 +35,8 @@ module TaintedPath {
3535
guard instanceof StartsWithDotDotSanitizer or
3636
guard instanceof StartsWithDirSanitizer or
3737
guard instanceof IsAbsoluteSanitizer or
38-
guard instanceof ContainsDotDotSanitizer
38+
guard instanceof ContainsDotDotSanitizer or
39+
guard instanceof IsInsideCheckSanitizer
3940
}
4041

4142
override predicate isAdditionalFlowStep(

‎javascript/ql/src/semmle/javascript/security/dataflow/TaintedPathCustomizations.qll

Lines changed: 33 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -369,6 +369,39 @@ module TaintedPath {
369369
*/
370370
private class VarAccessBarrier extends Sanitizer, DataFlow::VarAccessBarrier { }
371371

372+
/**
373+
* An expression of form `isInside(x, y)` or similar, where `isInside` is
374+
* a library check for the relation between `x` and `y`.
375+
*/
376+
class IsInsideCheckSanitizer extends DataFlow::LabeledBarrierGuardNode {
377+
DataFlow::Node checked;
378+
boolean onlyNormalizedAbsolutePaths;
379+
380+
IsInsideCheckSanitizer() {
381+
exists(string name, DataFlow::CallNode check |
382+
name = "path-is-inside" and onlyNormalizedAbsolutePaths = true
383+
or
384+
name = "is-path-inside" and onlyNormalizedAbsolutePaths = false
385+
|
386+
check = DataFlow::moduleImport(name).getACall() and
387+
checked = check.getArgument(0) and
388+
check = this
389+
)
390+
}
391+
392+
override predicate blocks(boolean outcome, Expr e, DataFlow::FlowLabel label) {
393+
(
394+
onlyNormalizedAbsolutePaths = true and
395+
label.(Label::PosixPath).isNormalized() and
396+
label.(Label::PosixPath).isAbsolute()
397+
or
398+
onlyNormalizedAbsolutePaths = false
399+
) and
400+
e = checked.asExpr() and
401+
outcome = true
402+
}
403+
}
404+
372405
/**
373406
* A source of remote user input, considered as a flow source for
374407
* tainted-path vulnerabilities.

‎javascript/ql/test/query-tests/Security/CWE-022/TaintedPath/Consistency.expected

Lines changed: 0 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,4 @@
11
| normalizedPaths.js:208:38:208:63 | // OK - ... anyway | Spurious alert |
2-
| normalizedPaths.js:259:26:259:30 | // OK | Spurious alert |
3-
| normalizedPaths.js:275:36:275:40 | // OK | Spurious alert |
4-
| normalizedPaths.js:282:36:282:40 | // OK | Spurious alert |
52
| tainted-string-steps.js:25:43:25:74 | // NOT ... flagged | Missing alert |
63
| tainted-string-steps.js:26:49:26:74 | // OK - ... flagged | Spurious alert |
74
| tainted-string-steps.js:28:39:28:70 | // NOT ... flagged | Missing alert |

‎javascript/ql/test/query-tests/Security/CWE-022/TaintedPath/TaintedPath.expected

Lines changed: 0 additions & 39 deletions
Original file line numberDiff line numberDiff line change
@@ -1509,11 +1509,6 @@ nodes
15091509
| normalizedPaths.js:257:18:257:21 | path |
15101510
| normalizedPaths.js:257:18:257:21 | path |
15111511
| normalizedPaths.js:257:18:257:21 | path |
1512-
| normalizedPaths.js:259:19:259:22 | path |
1513-
| normalizedPaths.js:259:19:259:22 | path |
1514-
| normalizedPaths.js:259:19:259:22 | path |
1515-
| normalizedPaths.js:259:19:259:22 | path |
1516-
| normalizedPaths.js:259:19:259:22 | path |
15171512
| normalizedPaths.js:262:19:262:22 | path |
15181513
| normalizedPaths.js:262:19:262:22 | path |
15191514
| normalizedPaths.js:262:19:262:22 | path |
@@ -1523,7 +1518,6 @@ nodes
15231518
| normalizedPaths.js:266:19:266:22 | path |
15241519
| normalizedPaths.js:266:19:266:22 | path |
15251520
| normalizedPaths.js:266:19:266:22 | path |
1526-
| normalizedPaths.js:266:19:266:22 | path |
15271521
| normalizedPaths.js:269:19:269:22 | path |
15281522
| normalizedPaths.js:269:19:269:22 | path |
15291523
| normalizedPaths.js:269:19:269:22 | path |
@@ -1538,18 +1532,10 @@ nodes
15381532
| normalizedPaths.js:273:45:273:48 | path |
15391533
| normalizedPaths.js:273:45:273:48 | path |
15401534
| normalizedPaths.js:273:45:273:48 | path |
1541-
| normalizedPaths.js:275:19:275:32 | normalizedPath |
1542-
| normalizedPaths.js:275:19:275:32 | normalizedPath |
1543-
| normalizedPaths.js:275:19:275:32 | normalizedPath |
1544-
| normalizedPaths.js:275:19:275:32 | normalizedPath |
15451535
| normalizedPaths.js:278:19:278:32 | normalizedPath |
15461536
| normalizedPaths.js:278:19:278:32 | normalizedPath |
15471537
| normalizedPaths.js:278:19:278:32 | normalizedPath |
15481538
| normalizedPaths.js:278:19:278:32 | normalizedPath |
1549-
| normalizedPaths.js:282:19:282:32 | normalizedPath |
1550-
| normalizedPaths.js:282:19:282:32 | normalizedPath |
1551-
| normalizedPaths.js:282:19:282:32 | normalizedPath |
1552-
| normalizedPaths.js:282:19:282:32 | normalizedPath |
15531539
| normalizedPaths.js:285:19:285:32 | normalizedPath |
15541540
| normalizedPaths.js:285:19:285:32 | normalizedPath |
15551541
| normalizedPaths.js:285:19:285:32 | normalizedPath |
@@ -4295,14 +4281,6 @@ edges
42954281
| normalizedPaths.js:256:6:256:26 | path | normalizedPaths.js:257:18:257:21 | path |
42964282
| normalizedPaths.js:256:6:256:26 | path | normalizedPaths.js:257:18:257:21 | path |
42974283
| normalizedPaths.js:256:6:256:26 | path | normalizedPaths.js:257:18:257:21 | path |
4298-
| normalizedPaths.js:256:6:256:26 | path | normalizedPaths.js:259:19:259:22 | path |
4299-
| normalizedPaths.js:256:6:256:26 | path | normalizedPaths.js:259:19:259:22 | path |
4300-
| normalizedPaths.js:256:6:256:26 | path | normalizedPaths.js:259:19:259:22 | path |
4301-
| normalizedPaths.js:256:6:256:26 | path | normalizedPaths.js:259:19:259:22 | path |
4302-
| normalizedPaths.js:256:6:256:26 | path | normalizedPaths.js:259:19:259:22 | path |
4303-
| normalizedPaths.js:256:6:256:26 | path | normalizedPaths.js:259:19:259:22 | path |
4304-
| normalizedPaths.js:256:6:256:26 | path | normalizedPaths.js:259:19:259:22 | path |
4305-
| normalizedPaths.js:256:6:256:26 | path | normalizedPaths.js:259:19:259:22 | path |
43064284
| normalizedPaths.js:256:6:256:26 | path | normalizedPaths.js:262:19:262:22 | path |
43074285
| normalizedPaths.js:256:6:256:26 | path | normalizedPaths.js:262:19:262:22 | path |
43084286
| normalizedPaths.js:256:6:256:26 | path | normalizedPaths.js:262:19:262:22 | path |
@@ -4317,8 +4295,6 @@ edges
43174295
| normalizedPaths.js:256:6:256:26 | path | normalizedPaths.js:266:19:266:22 | path |
43184296
| normalizedPaths.js:256:6:256:26 | path | normalizedPaths.js:266:19:266:22 | path |
43194297
| normalizedPaths.js:256:6:256:26 | path | normalizedPaths.js:266:19:266:22 | path |
4320-
| normalizedPaths.js:256:6:256:26 | path | normalizedPaths.js:266:19:266:22 | path |
4321-
| normalizedPaths.js:256:6:256:26 | path | normalizedPaths.js:266:19:266:22 | path |
43224298
| normalizedPaths.js:256:6:256:26 | path | normalizedPaths.js:269:19:269:22 | path |
43234299
| normalizedPaths.js:256:6:256:26 | path | normalizedPaths.js:269:19:269:22 | path |
43244300
| normalizedPaths.js:256:6:256:26 | path | normalizedPaths.js:269:19:269:22 | path |
@@ -4338,24 +4314,12 @@ edges
43384314
| normalizedPaths.js:256:13:256:26 | req.query.path | normalizedPaths.js:256:6:256:26 | path |
43394315
| normalizedPaths.js:256:13:256:26 | req.query.path | normalizedPaths.js:256:6:256:26 | path |
43404316
| normalizedPaths.js:256:13:256:26 | req.query.path | normalizedPaths.js:256:6:256:26 | path |
4341-
| normalizedPaths.js:273:6:273:49 | normalizedPath | normalizedPaths.js:275:19:275:32 | normalizedPath |
4342-
| normalizedPaths.js:273:6:273:49 | normalizedPath | normalizedPaths.js:275:19:275:32 | normalizedPath |
4343-
| normalizedPaths.js:273:6:273:49 | normalizedPath | normalizedPaths.js:275:19:275:32 | normalizedPath |
4344-
| normalizedPaths.js:273:6:273:49 | normalizedPath | normalizedPaths.js:275:19:275:32 | normalizedPath |
4345-
| normalizedPaths.js:273:6:273:49 | normalizedPath | normalizedPaths.js:275:19:275:32 | normalizedPath |
4346-
| normalizedPaths.js:273:6:273:49 | normalizedPath | normalizedPaths.js:275:19:275:32 | normalizedPath |
43474317
| normalizedPaths.js:273:6:273:49 | normalizedPath | normalizedPaths.js:278:19:278:32 | normalizedPath |
43484318
| normalizedPaths.js:273:6:273:49 | normalizedPath | normalizedPaths.js:278:19:278:32 | normalizedPath |
43494319
| normalizedPaths.js:273:6:273:49 | normalizedPath | normalizedPaths.js:278:19:278:32 | normalizedPath |
43504320
| normalizedPaths.js:273:6:273:49 | normalizedPath | normalizedPaths.js:278:19:278:32 | normalizedPath |
43514321
| normalizedPaths.js:273:6:273:49 | normalizedPath | normalizedPaths.js:278:19:278:32 | normalizedPath |
43524322
| normalizedPaths.js:273:6:273:49 | normalizedPath | normalizedPaths.js:278:19:278:32 | normalizedPath |
4353-
| normalizedPaths.js:273:6:273:49 | normalizedPath | normalizedPaths.js:282:19:282:32 | normalizedPath |
4354-
| normalizedPaths.js:273:6:273:49 | normalizedPath | normalizedPaths.js:282:19:282:32 | normalizedPath |
4355-
| normalizedPaths.js:273:6:273:49 | normalizedPath | normalizedPaths.js:282:19:282:32 | normalizedPath |
4356-
| normalizedPaths.js:273:6:273:49 | normalizedPath | normalizedPaths.js:282:19:282:32 | normalizedPath |
4357-
| normalizedPaths.js:273:6:273:49 | normalizedPath | normalizedPaths.js:282:19:282:32 | normalizedPath |
4358-
| normalizedPaths.js:273:6:273:49 | normalizedPath | normalizedPaths.js:282:19:282:32 | normalizedPath |
43594323
| normalizedPaths.js:273:6:273:49 | normalizedPath | normalizedPaths.js:285:19:285:32 | normalizedPath |
43604324
| normalizedPaths.js:273:6:273:49 | normalizedPath | normalizedPaths.js:285:19:285:32 | normalizedPath |
43614325
| normalizedPaths.js:273:6:273:49 | normalizedPath | normalizedPaths.js:285:19:285:32 | normalizedPath |
@@ -5237,13 +5201,10 @@ edges
52375201
| normalizedPaths.js:245:21:245:24 | path | normalizedPaths.js:236:33:236:46 | req.query.path | normalizedPaths.js:245:21:245:24 | path | This path depends on $@. | normalizedPaths.js:236:33:236:46 | req.query.path | a user-provided value |
52385202
| normalizedPaths.js:250:21:250:24 | path | normalizedPaths.js:236:33:236:46 | req.query.path | normalizedPaths.js:250:21:250:24 | path | This path depends on $@. | normalizedPaths.js:236:33:236:46 | req.query.path | a user-provided value |
52395203
| normalizedPaths.js:257:18:257:21 | path | normalizedPaths.js:256:13:256:26 | req.query.path | normalizedPaths.js:257:18:257:21 | path | This path depends on $@. | normalizedPaths.js:256:13:256:26 | req.query.path | a user-provided value |
5240-
| normalizedPaths.js:259:19:259:22 | path | normalizedPaths.js:256:13:256:26 | req.query.path | normalizedPaths.js:259:19:259:22 | path | This path depends on $@. | normalizedPaths.js:256:13:256:26 | req.query.path | a user-provided value |
52415204
| normalizedPaths.js:262:19:262:22 | path | normalizedPaths.js:256:13:256:26 | req.query.path | normalizedPaths.js:262:19:262:22 | path | This path depends on $@. | normalizedPaths.js:256:13:256:26 | req.query.path | a user-provided value |
52425205
| normalizedPaths.js:266:19:266:22 | path | normalizedPaths.js:256:13:256:26 | req.query.path | normalizedPaths.js:266:19:266:22 | path | This path depends on $@. | normalizedPaths.js:256:13:256:26 | req.query.path | a user-provided value |
52435206
| normalizedPaths.js:269:19:269:22 | path | normalizedPaths.js:256:13:256:26 | req.query.path | normalizedPaths.js:269:19:269:22 | path | This path depends on $@. | normalizedPaths.js:256:13:256:26 | req.query.path | a user-provided value |
5244-
| normalizedPaths.js:275:19:275:32 | normalizedPath | normalizedPaths.js:256:13:256:26 | req.query.path | normalizedPaths.js:275:19:275:32 | normalizedPath | This path depends on $@. | normalizedPaths.js:256:13:256:26 | req.query.path | a user-provided value |
52455207
| normalizedPaths.js:278:19:278:32 | normalizedPath | normalizedPaths.js:256:13:256:26 | req.query.path | normalizedPaths.js:278:19:278:32 | normalizedPath | This path depends on $@. | normalizedPaths.js:256:13:256:26 | req.query.path | a user-provided value |
5246-
| normalizedPaths.js:282:19:282:32 | normalizedPath | normalizedPaths.js:256:13:256:26 | req.query.path | normalizedPaths.js:282:19:282:32 | normalizedPath | This path depends on $@. | normalizedPaths.js:256:13:256:26 | req.query.path | a user-provided value |
52475208
| normalizedPaths.js:285:19:285:32 | normalizedPath | normalizedPaths.js:256:13:256:26 | req.query.path | normalizedPaths.js:285:19:285:32 | normalizedPath | This path depends on $@. | normalizedPaths.js:256:13:256:26 | req.query.path | a user-provided value |
52485209
| tainted-require.js:7:19:7:37 | req.param("module") | tainted-require.js:7:19:7:37 | req.param("module") | tainted-require.js:7:19:7:37 | req.param("module") | This path depends on $@. | tainted-require.js:7:19:7:37 | req.param("module") | a user-provided value |
52495210
| tainted-sendFile.js:8:16:8:33 | req.param("gimme") | tainted-sendFile.js:8:16:8:33 | req.param("gimme") | tainted-sendFile.js:8:16:8:33 | req.param("gimme") | This path depends on $@. | tainted-sendFile.js:8:16:8:33 | req.param("gimme") | a user-provided value |

0 commit comments

Comments
 (0)