Skip to content

Commit 8ba5bdd

Browse files
erik-krogherik-krogh
committed
add jQuery options objects as sources
1 parent 5c37e6a commit 8ba5bdd

File tree

3 files changed

+55
-14
lines changed

3 files changed

+55
-14
lines changed

‎javascript/ql/src/semmle/javascript/security/dataflow/UnsafeHtmlConstructionCustomizations.qll

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -13,6 +13,7 @@ module UnsafeHtmlConstruction {
1313
private import semmle.javascript.security.dataflow.DomBasedXssCustomizations::DomBasedXss as DomBasedXss
1414
private import semmle.javascript.security.dataflow.UnsafeJQueryPluginCustomizations::UnsafeJQueryPlugin as UnsafeJQueryPlugin
1515
private import semmle.javascript.PackageExports as Exports
16+
private import semmle.javascript.security.dataflow.UnsafeJQueryPlugin::UnsafeJQueryPlugin as UnsafeJQueryPlugin
1617

1718
/**
1819
* A source for unsafe HTML constructed from library input.
@@ -29,6 +30,13 @@ module UnsafeHtmlConstruction {
2930
}
3031
}
3132

33+
/**
34+
* A jQuery plugin options object, seen as a source for unsafe HTML constructed from input.
35+
*/
36+
class JQueryPluginOptionsAsSource extends Source {
37+
JQueryPluginOptionsAsSource() { this instanceof UnsafeJQueryPlugin::JQueryPluginOptions }
38+
}
39+
3240
/**
3341
* A sink for unsafe HTML constructed from library input.
3442
* This sink somehow transforms its input into a value that can cause XSS if it ends up in a XSS sink.

‎javascript/ql/test/query-tests/Security/CWE-079/UnsafeHtmlConstruction/UnsafeHtmlConstruction.expected

Lines changed: 37 additions & 14 deletions
Original file line numberDiff line numberDiff line change
@@ -15,13 +15,24 @@ nodes
1515
| main.js:21:47:21:47 | s |
1616
| main.js:22:34:22:34 | s |
1717
| main.js:22:34:22:34 | s |
18-
| main.js:46:17:46:17 | s |
19-
| main.js:47:21:47:21 | s |
20-
| main.js:52:65:52:73 | this.step |
21-
| main.js:52:65:52:73 | this.step |
22-
| main.js:57:41:57:41 | s |
23-
| main.js:57:41:57:41 | s |
24-
| main.js:58:20:58:20 | s |
18+
| main.js:41:17:41:17 | s |
19+
| main.js:42:21:42:21 | s |
20+
| main.js:47:65:47:73 | this.step |
21+
| main.js:47:65:47:73 | this.step |
22+
| main.js:52:41:52:41 | s |
23+
| main.js:52:41:52:41 | s |
24+
| main.js:53:20:53:20 | s |
25+
| main.js:56:28:56:34 | options |
26+
| main.js:56:28:56:34 | options |
27+
| main.js:57:11:59:5 | defaults |
28+
| main.js:57:22:59:5 | {\\n ... "\\n } |
29+
| main.js:60:11:60:48 | settings |
30+
| main.js:60:22:60:48 | $.exten ... ptions) |
31+
| main.js:60:31:60:38 | defaults |
32+
| main.js:60:41:60:47 | options |
33+
| main.js:62:19:62:26 | settings |
34+
| main.js:62:19:62:31 | settings.name |
35+
| main.js:62:19:62:31 | settings.name |
2536
| typed.ts:1:39:1:39 | s |
2637
| typed.ts:1:39:1:39 | s |
2738
| typed.ts:2:29:2:29 | s |
@@ -54,12 +65,23 @@ edges
5465
| main.js:21:47:21:47 | s | main.js:22:34:22:34 | s |
5566
| main.js:21:47:21:47 | s | main.js:22:34:22:34 | s |
5667
| main.js:21:47:21:47 | s | main.js:22:34:22:34 | s |
57-
| main.js:46:17:46:17 | s | main.js:47:21:47:21 | s |
58-
| main.js:47:21:47:21 | s | main.js:52:65:52:73 | this.step |
59-
| main.js:47:21:47:21 | s | main.js:52:65:52:73 | this.step |
60-
| main.js:57:41:57:41 | s | main.js:58:20:58:20 | s |
61-
| main.js:57:41:57:41 | s | main.js:58:20:58:20 | s |
62-
| main.js:58:20:58:20 | s | main.js:46:17:46:17 | s |
68+
| main.js:41:17:41:17 | s | main.js:42:21:42:21 | s |
69+
| main.js:42:21:42:21 | s | main.js:47:65:47:73 | this.step |
70+
| main.js:42:21:42:21 | s | main.js:47:65:47:73 | this.step |
71+
| main.js:52:41:52:41 | s | main.js:53:20:53:20 | s |
72+
| main.js:52:41:52:41 | s | main.js:53:20:53:20 | s |
73+
| main.js:53:20:53:20 | s | main.js:41:17:41:17 | s |
74+
| main.js:56:28:56:34 | options | main.js:60:41:60:47 | options |
75+
| main.js:56:28:56:34 | options | main.js:60:41:60:47 | options |
76+
| main.js:57:11:59:5 | defaults | main.js:60:31:60:38 | defaults |
77+
| main.js:57:22:59:5 | {\\n ... "\\n } | main.js:57:11:59:5 | defaults |
78+
| main.js:60:11:60:48 | settings | main.js:62:19:62:26 | settings |
79+
| main.js:60:22:60:48 | $.exten ... ptions) | main.js:60:11:60:48 | settings |
80+
| main.js:60:31:60:38 | defaults | main.js:60:22:60:48 | $.exten ... ptions) |
81+
| main.js:60:41:60:47 | options | main.js:57:22:59:5 | {\\n ... "\\n } |
82+
| main.js:60:41:60:47 | options | main.js:60:22:60:48 | $.exten ... ptions) |
83+
| main.js:62:19:62:26 | settings | main.js:62:19:62:31 | settings.name |
84+
| main.js:62:19:62:26 | settings | main.js:62:19:62:31 | settings.name |
6385
| typed.ts:1:39:1:39 | s | typed.ts:2:29:2:29 | s |
6486
| typed.ts:1:39:1:39 | s | typed.ts:2:29:2:29 | s |
6587
| typed.ts:1:39:1:39 | s | typed.ts:2:29:2:29 | s |
@@ -80,6 +102,7 @@ edges
80102
| main.js:12:49:12:49 | s | main.js:11:60:11:60 | s | main.js:12:49:12:49 | s | $@ based on $@ might later cause $@. | main.js:12:49:12:49 | s | XML parsing | main.js:11:60:11:60 | s | library input | main.js:16:21:16:35 | xml.cloneNode() | cross-site scripting |
81103
| main.js:12:49:12:49 | s | main.js:11:60:11:60 | s | main.js:12:49:12:49 | s | $@ based on $@ might later cause $@. | main.js:12:49:12:49 | s | XML parsing | main.js:11:60:11:60 | s | library input | main.js:17:48:17:50 | tmp | cross-site scripting |
82104
| main.js:22:34:22:34 | s | main.js:21:47:21:47 | s | main.js:22:34:22:34 | s | $@ based on $@ might later cause $@. | main.js:22:34:22:34 | s | Markdown rendering | main.js:21:47:21:47 | s | library input | main.js:23:53:23:56 | html | cross-site scripting |
83-
| main.js:52:65:52:73 | this.step | main.js:57:41:57:41 | s | main.js:52:65:52:73 | this.step | $@ based on $@ might later cause $@. | main.js:52:65:52:73 | this.step | HTML construction | main.js:57:41:57:41 | s | library input | main.js:52:54:52:85 | "<span> ... /span>" | cross-site scripting |
105+
| main.js:47:65:47:73 | this.step | main.js:52:41:52:41 | s | main.js:47:65:47:73 | this.step | $@ based on $@ might later cause $@. | main.js:47:65:47:73 | this.step | HTML construction | main.js:52:41:52:41 | s | library input | main.js:47:54:47:85 | "<span> ... /span>" | cross-site scripting |
106+
| main.js:62:19:62:31 | settings.name | main.js:56:28:56:34 | options | main.js:62:19:62:31 | settings.name | $@ based on $@ might later cause $@. | main.js:62:19:62:31 | settings.name | HTML construction | main.js:56:28:56:34 | options | library input | main.js:62:11:62:40 | "<b>" + ... "</b>" | cross-site scripting |
84107
| typed.ts:2:29:2:29 | s | typed.ts:1:39:1:39 | s | typed.ts:2:29:2:29 | s | $@ based on $@ might later cause $@. | typed.ts:2:29:2:29 | s | HTML construction | typed.ts:1:39:1:39 | s | library input | typed.ts:3:31:3:34 | html | cross-site scripting |
85108
| typed.ts:8:40:8:40 | s | typed.ts:6:43:6:43 | s | typed.ts:8:40:8:40 | s | $@ based on $@ might later cause $@. | typed.ts:8:40:8:40 | s | HTML construction | typed.ts:6:43:6:43 | s | library input | typed.ts:8:29:8:52 | "<span> ... /span>" | cross-site scripting |

‎javascript/ql/test/query-tests/Security/CWE-079/UnsafeHtmlConstruction/main.js

Lines changed: 10 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -52,3 +52,13 @@ class Foo {
5252
module.exports.createsClass = function (s) {
5353
return new Foo(s);
5454
}
55+
56+
$.fn.xssPlugin = function (options) {
57+
const defaults = {
58+
name: "name"
59+
};
60+
const settings = $.extend(defaults, options);
61+
return this.each(function () {
62+
$("<b>" + settings.name + "</b>").appendTo(this); // NOT OK
63+
});
64+
}

0 commit comments

Comments
 (0)