Skip to content

Commit 6e2b924

Browse files
erik-krogherik-krogh
committed
add taint step through the slice-ansi library
1 parent 35c513d commit 6e2b924

File tree

4 files changed

+88
-64
lines changed

4 files changed

+88
-64
lines changed

‎javascript/change-notes/2021-06-22-colors.md

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -6,4 +6,5 @@ lgtm,codescanning
66
[wrap-ansi](https://npmjs.com/package/wrap-ansi),
77
[colorette](https://npmjs.com/package/colorette),
88
[cli-highlight](https://npmjs.com/package/cli-highlight),
9-
[cli-color](https://npmjs.com/package/cli-color)
9+
[cli-color](https://npmjs.com/package/cli-color),
10+
[slice-ansi](https://npmjs.com/package/slice-ansi)

‎javascript/ql/src/semmle/javascript/frameworks/Logging.qll

Lines changed: 12 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -278,3 +278,15 @@ class CliColorStep extends TaintTracking::SharedTaintStep {
278278
)
279279
}
280280
}
281+
282+
/**
283+
* A step through the [`slice-ansi`](https://npmjs.org/package/slice-ansi) library.
284+
*/
285+
class SliceAnsiStep extends TaintTracking::SharedTaintStep {
286+
override predicate stringManipulationStep(DataFlow::Node pred, DataFlow::Node succ) {
287+
exists(API::CallNode call | call = API::moduleImport("slice-ansi").getACall() |
288+
pred = call.getArgument(0) and
289+
succ = call
290+
)
291+
}
292+
}

‎javascript/ql/test/query-tests/Security/CWE-117/LogInjection.expected

Lines changed: 72 additions & 63 deletions
Original file line numberDiff line numberDiff line change
@@ -22,35 +22,39 @@ nodes
2222
| logInjectionBad.js:30:23:30:49 | `[ERROR ... rror}"` |
2323
| logInjectionBad.js:30:23:30:49 | `[ERROR ... rror}"` |
2424
| logInjectionBad.js:30:42:30:46 | error |
25-
| logInjectionBad.js:42:9:42:36 | q |
26-
| logInjectionBad.js:42:13:42:36 | url.par ... , true) |
27-
| logInjectionBad.js:42:23:42:29 | req.url |
28-
| logInjectionBad.js:42:23:42:29 | req.url |
29-
| logInjectionBad.js:43:9:43:35 | username |
30-
| logInjectionBad.js:43:20:43:20 | q |
31-
| logInjectionBad.js:43:20:43:26 | q.query |
32-
| logInjectionBad.js:43:20:43:35 | q.query.username |
33-
| logInjectionBad.js:45:18:45:54 | ansiCol ... ername) |
34-
| logInjectionBad.js:45:18:45:54 | ansiCol ... ername) |
35-
| logInjectionBad.js:45:46:45:53 | username |
36-
| logInjectionBad.js:46:18:46:47 | colors. ... ername) |
37-
| logInjectionBad.js:46:18:46:47 | colors. ... ername) |
38-
| logInjectionBad.js:46:39:46:46 | username |
39-
| logInjectionBad.js:47:18:47:61 | wrapAns ... e), 20) |
40-
| logInjectionBad.js:47:18:47:61 | wrapAns ... e), 20) |
41-
| logInjectionBad.js:47:27:47:56 | colors. ... ername) |
42-
| logInjectionBad.js:47:48:47:55 | username |
43-
| logInjectionBad.js:48:17:48:47 | underli ... name))) |
44-
| logInjectionBad.js:48:17:48:47 | underli ... name))) |
45-
| logInjectionBad.js:48:27:48:46 | bold(blue(username)) |
46-
| logInjectionBad.js:48:32:48:45 | blue(username) |
47-
| logInjectionBad.js:48:37:48:44 | username |
48-
| logInjectionBad.js:49:17:49:76 | highlig ... true}) |
49-
| logInjectionBad.js:49:17:49:76 | highlig ... true}) |
50-
| logInjectionBad.js:49:27:49:34 | username |
51-
| logInjectionBad.js:50:17:50:51 | clc.red ... ername) |
52-
| logInjectionBad.js:50:17:50:51 | clc.red ... ername) |
53-
| logInjectionBad.js:50:43:50:50 | username |
25+
| logInjectionBad.js:43:9:43:36 | q |
26+
| logInjectionBad.js:43:13:43:36 | url.par ... , true) |
27+
| logInjectionBad.js:43:23:43:29 | req.url |
28+
| logInjectionBad.js:43:23:43:29 | req.url |
29+
| logInjectionBad.js:44:9:44:35 | username |
30+
| logInjectionBad.js:44:20:44:20 | q |
31+
| logInjectionBad.js:44:20:44:26 | q.query |
32+
| logInjectionBad.js:44:20:44:35 | q.query.username |
33+
| logInjectionBad.js:46:18:46:54 | ansiCol ... ername) |
34+
| logInjectionBad.js:46:18:46:54 | ansiCol ... ername) |
35+
| logInjectionBad.js:46:46:46:53 | username |
36+
| logInjectionBad.js:47:18:47:47 | colors. ... ername) |
37+
| logInjectionBad.js:47:18:47:47 | colors. ... ername) |
38+
| logInjectionBad.js:47:39:47:46 | username |
39+
| logInjectionBad.js:48:18:48:61 | wrapAns ... e), 20) |
40+
| logInjectionBad.js:48:18:48:61 | wrapAns ... e), 20) |
41+
| logInjectionBad.js:48:27:48:56 | colors. ... ername) |
42+
| logInjectionBad.js:48:48:48:55 | username |
43+
| logInjectionBad.js:49:17:49:47 | underli ... name))) |
44+
| logInjectionBad.js:49:17:49:47 | underli ... name))) |
45+
| logInjectionBad.js:49:27:49:46 | bold(blue(username)) |
46+
| logInjectionBad.js:49:32:49:45 | blue(username) |
47+
| logInjectionBad.js:49:37:49:44 | username |
48+
| logInjectionBad.js:50:17:50:76 | highlig ... true}) |
49+
| logInjectionBad.js:50:17:50:76 | highlig ... true}) |
50+
| logInjectionBad.js:50:27:50:34 | username |
51+
| logInjectionBad.js:51:17:51:51 | clc.red ... ername) |
52+
| logInjectionBad.js:51:17:51:51 | clc.red ... ername) |
53+
| logInjectionBad.js:51:43:51:50 | username |
54+
| logInjectionBad.js:52:17:52:65 | sliceAn ... 20, 30) |
55+
| logInjectionBad.js:52:17:52:65 | sliceAn ... 20, 30) |
56+
| logInjectionBad.js:52:27:52:56 | colors. ... ername) |
57+
| logInjectionBad.js:52:48:52:55 | username |
5458
edges
5559
| logInjectionBad.js:19:9:19:36 | q | logInjectionBad.js:20:20:20:20 | q |
5660
| logInjectionBad.js:19:13:19:36 | url.par ... , true) | logInjectionBad.js:19:9:19:36 | q |
@@ -74,43 +78,48 @@ edges
7478
| logInjectionBad.js:29:14:29:18 | error | logInjectionBad.js:30:42:30:46 | error |
7579
| logInjectionBad.js:30:42:30:46 | error | logInjectionBad.js:30:23:30:49 | `[ERROR ... rror}"` |
7680
| logInjectionBad.js:30:42:30:46 | error | logInjectionBad.js:30:23:30:49 | `[ERROR ... rror}"` |
77-
| logInjectionBad.js:42:9:42:36 | q | logInjectionBad.js:43:20:43:20 | q |
78-
| logInjectionBad.js:42:13:42:36 | url.par ... , true) | logInjectionBad.js:42:9:42:36 | q |
79-
| logInjectionBad.js:42:23:42:29 | req.url | logInjectionBad.js:42:13:42:36 | url.par ... , true) |
80-
| logInjectionBad.js:42:23:42:29 | req.url | logInjectionBad.js:42:13:42:36 | url.par ... , true) |
81-
| logInjectionBad.js:43:9:43:35 | username | logInjectionBad.js:45:46:45:53 | username |
82-
| logInjectionBad.js:43:9:43:35 | username | logInjectionBad.js:46:39:46:46 | username |
83-
| logInjectionBad.js:43:9:43:35 | username | logInjectionBad.js:47:48:47:55 | username |
84-
| logInjectionBad.js:43:9:43:35 | username | logInjectionBad.js:48:37:48:44 | username |
85-
| logInjectionBad.js:43:9:43:35 | username | logInjectionBad.js:49:27:49:34 | username |
86-
| logInjectionBad.js:43:9:43:35 | username | logInjectionBad.js:50:43:50:50 | username |
87-
| logInjectionBad.js:43:20:43:20 | q | logInjectionBad.js:43:20:43:26 | q.query |
88-
| logInjectionBad.js:43:20:43:26 | q.query | logInjectionBad.js:43:20:43:35 | q.query.username |
89-
| logInjectionBad.js:43:20:43:35 | q.query.username | logInjectionBad.js:43:9:43:35 | username |
90-
| logInjectionBad.js:45:46:45:53 | username | logInjectionBad.js:45:18:45:54 | ansiCol ... ername) |
91-
| logInjectionBad.js:45:46:45:53 | username | logInjectionBad.js:45:18:45:54 | ansiCol ... ername) |
92-
| logInjectionBad.js:46:39:46:46 | username | logInjectionBad.js:46:18:46:47 | colors. ... ername) |
93-
| logInjectionBad.js:46:39:46:46 | username | logInjectionBad.js:46:18:46:47 | colors. ... ername) |
94-
| logInjectionBad.js:47:27:47:56 | colors. ... ername) | logInjectionBad.js:47:18:47:61 | wrapAns ... e), 20) |
95-
| logInjectionBad.js:47:27:47:56 | colors. ... ername) | logInjectionBad.js:47:18:47:61 | wrapAns ... e), 20) |
96-
| logInjectionBad.js:47:48:47:55 | username | logInjectionBad.js:47:27:47:56 | colors. ... ername) |
97-
| logInjectionBad.js:48:27:48:46 | bold(blue(username)) | logInjectionBad.js:48:17:48:47 | underli ... name))) |
98-
| logInjectionBad.js:48:27:48:46 | bold(blue(username)) | logInjectionBad.js:48:17:48:47 | underli ... name))) |
99-
| logInjectionBad.js:48:32:48:45 | blue(username) | logInjectionBad.js:48:27:48:46 | bold(blue(username)) |
100-
| logInjectionBad.js:48:37:48:44 | username | logInjectionBad.js:48:32:48:45 | blue(username) |
101-
| logInjectionBad.js:49:27:49:34 | username | logInjectionBad.js:49:17:49:76 | highlig ... true}) |
102-
| logInjectionBad.js:49:27:49:34 | username | logInjectionBad.js:49:17:49:76 | highlig ... true}) |
103-
| logInjectionBad.js:50:43:50:50 | username | logInjectionBad.js:50:17:50:51 | clc.red ... ername) |
104-
| logInjectionBad.js:50:43:50:50 | username | logInjectionBad.js:50:17:50:51 | clc.red ... ername) |
81+
| logInjectionBad.js:43:9:43:36 | q | logInjectionBad.js:44:20:44:20 | q |
82+
| logInjectionBad.js:43:13:43:36 | url.par ... , true) | logInjectionBad.js:43:9:43:36 | q |
83+
| logInjectionBad.js:43:23:43:29 | req.url | logInjectionBad.js:43:13:43:36 | url.par ... , true) |
84+
| logInjectionBad.js:43:23:43:29 | req.url | logInjectionBad.js:43:13:43:36 | url.par ... , true) |
85+
| logInjectionBad.js:44:9:44:35 | username | logInjectionBad.js:46:46:46:53 | username |
86+
| logInjectionBad.js:44:9:44:35 | username | logInjectionBad.js:47:39:47:46 | username |
87+
| logInjectionBad.js:44:9:44:35 | username | logInjectionBad.js:48:48:48:55 | username |
88+
| logInjectionBad.js:44:9:44:35 | username | logInjectionBad.js:49:37:49:44 | username |
89+
| logInjectionBad.js:44:9:44:35 | username | logInjectionBad.js:50:27:50:34 | username |
90+
| logInjectionBad.js:44:9:44:35 | username | logInjectionBad.js:51:43:51:50 | username |
91+
| logInjectionBad.js:44:9:44:35 | username | logInjectionBad.js:52:48:52:55 | username |
92+
| logInjectionBad.js:44:20:44:20 | q | logInjectionBad.js:44:20:44:26 | q.query |
93+
| logInjectionBad.js:44:20:44:26 | q.query | logInjectionBad.js:44:20:44:35 | q.query.username |
94+
| logInjectionBad.js:44:20:44:35 | q.query.username | logInjectionBad.js:44:9:44:35 | username |
95+
| logInjectionBad.js:46:46:46:53 | username | logInjectionBad.js:46:18:46:54 | ansiCol ... ername) |
96+
| logInjectionBad.js:46:46:46:53 | username | logInjectionBad.js:46:18:46:54 | ansiCol ... ername) |
97+
| logInjectionBad.js:47:39:47:46 | username | logInjectionBad.js:47:18:47:47 | colors. ... ername) |
98+
| logInjectionBad.js:47:39:47:46 | username | logInjectionBad.js:47:18:47:47 | colors. ... ername) |
99+
| logInjectionBad.js:48:27:48:56 | colors. ... ername) | logInjectionBad.js:48:18:48:61 | wrapAns ... e), 20) |
100+
| logInjectionBad.js:48:27:48:56 | colors. ... ername) | logInjectionBad.js:48:18:48:61 | wrapAns ... e), 20) |
101+
| logInjectionBad.js:48:48:48:55 | username | logInjectionBad.js:48:27:48:56 | colors. ... ername) |
102+
| logInjectionBad.js:49:27:49:46 | bold(blue(username)) | logInjectionBad.js:49:17:49:47 | underli ... name))) |
103+
| logInjectionBad.js:49:27:49:46 | bold(blue(username)) | logInjectionBad.js:49:17:49:47 | underli ... name))) |
104+
| logInjectionBad.js:49:32:49:45 | blue(username) | logInjectionBad.js:49:27:49:46 | bold(blue(username)) |
105+
| logInjectionBad.js:49:37:49:44 | username | logInjectionBad.js:49:32:49:45 | blue(username) |
106+
| logInjectionBad.js:50:27:50:34 | username | logInjectionBad.js:50:17:50:76 | highlig ... true}) |
107+
| logInjectionBad.js:50:27:50:34 | username | logInjectionBad.js:50:17:50:76 | highlig ... true}) |
108+
| logInjectionBad.js:51:43:51:50 | username | logInjectionBad.js:51:17:51:51 | clc.red ... ername) |
109+
| logInjectionBad.js:51:43:51:50 | username | logInjectionBad.js:51:17:51:51 | clc.red ... ername) |
110+
| logInjectionBad.js:52:27:52:56 | colors. ... ername) | logInjectionBad.js:52:17:52:65 | sliceAn ... 20, 30) |
111+
| logInjectionBad.js:52:27:52:56 | colors. ... ername) | logInjectionBad.js:52:17:52:65 | sliceAn ... 20, 30) |
112+
| logInjectionBad.js:52:48:52:55 | username | logInjectionBad.js:52:27:52:56 | colors. ... ername) |
105113
#select
106114
| logInjectionBad.js:22:18:22:43 | `[INFO] ... rname}` | logInjectionBad.js:19:23:19:29 | req.url | logInjectionBad.js:22:18:22:43 | `[INFO] ... rname}` | $@ flows to log entry. | logInjectionBad.js:19:23:19:29 | req.url | User-provided value |
107115
| logInjectionBad.js:23:37:23:44 | username | logInjectionBad.js:19:23:19:29 | req.url | logInjectionBad.js:23:37:23:44 | username | $@ flows to log entry. | logInjectionBad.js:19:23:19:29 | req.url | User-provided value |
108116
| logInjectionBad.js:24:35:24:42 | username | logInjectionBad.js:19:23:19:29 | req.url | logInjectionBad.js:24:35:24:42 | username | $@ flows to log entry. | logInjectionBad.js:19:23:19:29 | req.url | User-provided value |
109117
| logInjectionBad.js:25:36:25:43 | username | logInjectionBad.js:19:23:19:29 | req.url | logInjectionBad.js:25:36:25:43 | username | $@ flows to log entry. | logInjectionBad.js:19:23:19:29 | req.url | User-provided value |
110118
| logInjectionBad.js:30:23:30:49 | `[ERROR ... rror}"` | logInjectionBad.js:19:23:19:29 | req.url | logInjectionBad.js:30:23:30:49 | `[ERROR ... rror}"` | $@ flows to log entry. | logInjectionBad.js:19:23:19:29 | req.url | User-provided value |
111-
| logInjectionBad.js:45:18:45:54 | ansiCol ... ername) | logInjectionBad.js:42:23:42:29 | req.url | logInjectionBad.js:45:18:45:54 | ansiCol ... ername) | $@ flows to log entry. | logInjectionBad.js:42:23:42:29 | req.url | User-provided value |
112-
| logInjectionBad.js:46:18:46:47 | colors. ... ername) | logInjectionBad.js:42:23:42:29 | req.url | logInjectionBad.js:46:18:46:47 | colors. ... ername) | $@ flows to log entry. | logInjectionBad.js:42:23:42:29 | req.url | User-provided value |
113-
| logInjectionBad.js:47:18:47:61 | wrapAns ... e), 20) | logInjectionBad.js:42:23:42:29 | req.url | logInjectionBad.js:47:18:47:61 | wrapAns ... e), 20) | $@ flows to log entry. | logInjectionBad.js:42:23:42:29 | req.url | User-provided value |
114-
| logInjectionBad.js:48:17:48:47 | underli ... name))) | logInjectionBad.js:42:23:42:29 | req.url | logInjectionBad.js:48:17:48:47 | underli ... name))) | $@ flows to log entry. | logInjectionBad.js:42:23:42:29 | req.url | User-provided value |
115-
| logInjectionBad.js:49:17:49:76 | highlig ... true}) | logInjectionBad.js:42:23:42:29 | req.url | logInjectionBad.js:49:17:49:76 | highlig ... true}) | $@ flows to log entry. | logInjectionBad.js:42:23:42:29 | req.url | User-provided value |
116-
| logInjectionBad.js:50:17:50:51 | clc.red ... ername) | logInjectionBad.js:42:23:42:29 | req.url | logInjectionBad.js:50:17:50:51 | clc.red ... ername) | $@ flows to log entry. | logInjectionBad.js:42:23:42:29 | req.url | User-provided value |
119+
| logInjectionBad.js:46:18:46:54 | ansiCol ... ername) | logInjectionBad.js:43:23:43:29 | req.url | logInjectionBad.js:46:18:46:54 | ansiCol ... ername) | $@ flows to log entry. | logInjectionBad.js:43:23:43:29 | req.url | User-provided value |
120+
| logInjectionBad.js:47:18:47:47 | colors. ... ername) | logInjectionBad.js:43:23:43:29 | req.url | logInjectionBad.js:47:18:47:47 | colors. ... ername) | $@ flows to log entry. | logInjectionBad.js:43:23:43:29 | req.url | User-provided value |
121+
| logInjectionBad.js:48:18:48:61 | wrapAns ... e), 20) | logInjectionBad.js:43:23:43:29 | req.url | logInjectionBad.js:48:18:48:61 | wrapAns ... e), 20) | $@ flows to log entry. | logInjectionBad.js:43:23:43:29 | req.url | User-provided value |
122+
| logInjectionBad.js:49:17:49:47 | underli ... name))) | logInjectionBad.js:43:23:43:29 | req.url | logInjectionBad.js:49:17:49:47 | underli ... name))) | $@ flows to log entry. | logInjectionBad.js:43:23:43:29 | req.url | User-provided value |
123+
| logInjectionBad.js:50:17:50:76 | highlig ... true}) | logInjectionBad.js:43:23:43:29 | req.url | logInjectionBad.js:50:17:50:76 | highlig ... true}) | $@ flows to log entry. | logInjectionBad.js:43:23:43:29 | req.url | User-provided value |
124+
| logInjectionBad.js:51:17:51:51 | clc.red ... ername) | logInjectionBad.js:43:23:43:29 | req.url | logInjectionBad.js:51:17:51:51 | clc.red ... ername) | $@ flows to log entry. | logInjectionBad.js:43:23:43:29 | req.url | User-provided value |
125+
| logInjectionBad.js:52:17:52:65 | sliceAn ... 20, 30) | logInjectionBad.js:43:23:43:29 | req.url | logInjectionBad.js:52:17:52:65 | sliceAn ... 20, 30) | $@ flows to log entry. | logInjectionBad.js:43:23:43:29 | req.url | User-provided value |

‎javascript/ql/test/query-tests/Security/CWE-117/logInjectionBad.js

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -37,6 +37,7 @@ import wrapAnsi from 'wrap-ansi';
3737
import { blue, bold, underline } from "colorette"
3838
const highlight = require('cli-highlight').highlight;
3939
var clc = require("cli-color");
40+
import sliceAnsi from 'slice-ansi';
4041

4142
const server2 = http.createServer((req, res) => {
4243
let q = url.parse(req.url, true);
@@ -48,4 +49,5 @@ const server2 = http.createServer((req, res) => {
4849
console.log(underline(bold(blue(username)))); // NOT OK
4950
console.log(highlight(username, {language: 'sql', ignoreIllegals: true})); // NOT OK
5051
console.log(clc.red.bgWhite.underline(username)); // NOT OK
52+
console.log(sliceAnsi(colors.red.underline(username), 20, 30)); // NOT OK
5153
});

0 commit comments

Comments
 (0)