Skip to content

Commit 9c20531

Browse files
erik-krogherik-krogh
committed
writing out the truth table for DotDotSlashPrefixRemovingReplace
1 parent 94751c1 commit 9c20531

File tree

2 files changed

+21
-39
lines changed

2 files changed

+21
-39
lines changed

‎javascript/ql/src/semmle/javascript/security/dataflow/TaintedPath.qll

Lines changed: 9 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -209,9 +209,15 @@ module TaintedPath {
209209
// foo.replace(/(\.\.\/)*/, "") and similar
210210
exists(DotDotSlashPrefixRemovingReplace call |
211211
src = call.getInput() and
212-
dst = call.getOutput() and
213-
(srclabel.isNonNormalized() or dstlabel.isAbsolute()) and // if src is normalized, then dst must be absolute (if dst is relative, then dst is sanitized)
214-
dstlabel.toAbsolute() = srclabel.toAbsolute() // preserves normalization status
212+
dst = call.getOutput()
213+
|
214+
// the 4 possible combinations of normalized + relative for `srclabel`, and the possible values for `dstlabel` in each case.
215+
srclabel.isNonNormalized() and srclabel.isRelative() // raw + relative -> any()
216+
or
217+
srclabel.isNormalized() and srclabel.isAbsolute() and srclabel = dstlabel // normalized + absolute -> normalized + absolute
218+
or
219+
srclabel.isNonNormalized() and srclabel.isAbsolute() and dstlabel.isAbsolute() // raw + absolute -> raw/normalized + absolute
220+
// normalized + relative -> none()
215221
)
216222
or
217223
// path.join()

‎javascript/ql/test/query-tests/Security/CWE-022/TaintedPath/TaintedPath.expected

Lines changed: 12 additions & 36 deletions
Original file line numberDiff line numberDiff line change
@@ -1298,10 +1298,10 @@ nodes
12981298
| TaintedPath.js:201:40:201:73 | path.re ... +/, '') |
12991299
| TaintedPath.js:201:40:201:73 | path.re ... +/, '') |
13001300
| TaintedPath.js:201:40:201:73 | path.re ... +/, '') |
1301-
| TaintedPath.js:202:29:202:54 | pathMod ... e(path) |
1302-
| TaintedPath.js:202:29:202:54 | pathMod ... e(path) |
1303-
| TaintedPath.js:202:29:202:54 | pathMod ... e(path) |
1304-
| TaintedPath.js:202:29:202:54 | pathMod ... e(path) |
1301+
| TaintedPath.js:201:40:201:73 | path.re ... +/, '') |
1302+
| TaintedPath.js:201:40:201:73 | path.re ... +/, '') |
1303+
| TaintedPath.js:201:40:201:73 | path.re ... +/, '') |
1304+
| TaintedPath.js:201:40:201:73 | path.re ... +/, '') |
13051305
| TaintedPath.js:202:29:202:54 | pathMod ... e(path) |
13061306
| TaintedPath.js:202:29:202:54 | pathMod ... e(path) |
13071307
| TaintedPath.js:202:29:202:54 | pathMod ... e(path) |
@@ -1319,14 +1319,6 @@ nodes
13191319
| TaintedPath.js:202:50:202:53 | path |
13201320
| TaintedPath.js:202:50:202:53 | path |
13211321
| TaintedPath.js:202:50:202:53 | path |
1322-
| TaintedPath.js:202:50:202:53 | path |
1323-
| TaintedPath.js:202:50:202:53 | path |
1324-
| TaintedPath.js:202:50:202:53 | path |
1325-
| TaintedPath.js:202:50:202:53 | path |
1326-
| TaintedPath.js:202:50:202:53 | path |
1327-
| TaintedPath.js:202:50:202:53 | path |
1328-
| TaintedPath.js:202:50:202:53 | path |
1329-
| TaintedPath.js:202:50:202:53 | path |
13301322
| normalizedPaths.js:11:7:11:27 | path |
13311323
| normalizedPaths.js:11:7:11:27 | path |
13321324
| normalizedPaths.js:11:7:11:27 | path |
@@ -4451,14 +4443,6 @@ edges
44514443
| TaintedPath.js:173:7:173:48 | path | TaintedPath.js:202:50:202:53 | path |
44524444
| TaintedPath.js:173:7:173:48 | path | TaintedPath.js:202:50:202:53 | path |
44534445
| TaintedPath.js:173:7:173:48 | path | TaintedPath.js:202:50:202:53 | path |
4454-
| TaintedPath.js:173:7:173:48 | path | TaintedPath.js:202:50:202:53 | path |
4455-
| TaintedPath.js:173:7:173:48 | path | TaintedPath.js:202:50:202:53 | path |
4456-
| TaintedPath.js:173:7:173:48 | path | TaintedPath.js:202:50:202:53 | path |
4457-
| TaintedPath.js:173:7:173:48 | path | TaintedPath.js:202:50:202:53 | path |
4458-
| TaintedPath.js:173:7:173:48 | path | TaintedPath.js:202:50:202:53 | path |
4459-
| TaintedPath.js:173:7:173:48 | path | TaintedPath.js:202:50:202:53 | path |
4460-
| TaintedPath.js:173:7:173:48 | path | TaintedPath.js:202:50:202:53 | path |
4461-
| TaintedPath.js:173:7:173:48 | path | TaintedPath.js:202:50:202:53 | path |
44624446
| TaintedPath.js:173:14:173:37 | url.par ... , true) | TaintedPath.js:173:14:173:43 | url.par ... ).query |
44634447
| TaintedPath.js:173:14:173:37 | url.par ... , true) | TaintedPath.js:173:14:173:43 | url.par ... ).query |
44644448
| TaintedPath.js:173:14:173:37 | url.par ... , true) | TaintedPath.js:173:14:173:43 | url.par ... ).query |
@@ -4667,6 +4651,14 @@ edges
46674651
| TaintedPath.js:201:40:201:73 | path.re ... +/, '') | TaintedPath.js:201:29:201:73 | "prefix ... +/, '') |
46684652
| TaintedPath.js:201:40:201:73 | path.re ... +/, '') | TaintedPath.js:201:29:201:73 | "prefix ... +/, '') |
46694653
| TaintedPath.js:201:40:201:73 | path.re ... +/, '') | TaintedPath.js:201:29:201:73 | "prefix ... +/, '') |
4654+
| TaintedPath.js:201:40:201:73 | path.re ... +/, '') | TaintedPath.js:201:29:201:73 | "prefix ... +/, '') |
4655+
| TaintedPath.js:201:40:201:73 | path.re ... +/, '') | TaintedPath.js:201:29:201:73 | "prefix ... +/, '') |
4656+
| TaintedPath.js:201:40:201:73 | path.re ... +/, '') | TaintedPath.js:201:29:201:73 | "prefix ... +/, '') |
4657+
| TaintedPath.js:201:40:201:73 | path.re ... +/, '') | TaintedPath.js:201:29:201:73 | "prefix ... +/, '') |
4658+
| TaintedPath.js:201:40:201:73 | path.re ... +/, '') | TaintedPath.js:201:29:201:73 | "prefix ... +/, '') |
4659+
| TaintedPath.js:201:40:201:73 | path.re ... +/, '') | TaintedPath.js:201:29:201:73 | "prefix ... +/, '') |
4660+
| TaintedPath.js:201:40:201:73 | path.re ... +/, '') | TaintedPath.js:201:29:201:73 | "prefix ... +/, '') |
4661+
| TaintedPath.js:201:40:201:73 | path.re ... +/, '') | TaintedPath.js:201:29:201:73 | "prefix ... +/, '') |
46704662
| TaintedPath.js:202:29:202:54 | pathMod ... e(path) | TaintedPath.js:202:29:202:84 | pathMod ... +/, '') |
46714663
| TaintedPath.js:202:29:202:54 | pathMod ... e(path) | TaintedPath.js:202:29:202:84 | pathMod ... +/, '') |
46724664
| TaintedPath.js:202:29:202:54 | pathMod ... e(path) | TaintedPath.js:202:29:202:84 | pathMod ... +/, '') |
@@ -4675,22 +4667,6 @@ edges
46754667
| TaintedPath.js:202:29:202:54 | pathMod ... e(path) | TaintedPath.js:202:29:202:84 | pathMod ... +/, '') |
46764668
| TaintedPath.js:202:29:202:54 | pathMod ... e(path) | TaintedPath.js:202:29:202:84 | pathMod ... +/, '') |
46774669
| TaintedPath.js:202:29:202:54 | pathMod ... e(path) | TaintedPath.js:202:29:202:84 | pathMod ... +/, '') |
4678-
| TaintedPath.js:202:29:202:54 | pathMod ... e(path) | TaintedPath.js:202:29:202:84 | pathMod ... +/, '') |
4679-
| TaintedPath.js:202:29:202:54 | pathMod ... e(path) | TaintedPath.js:202:29:202:84 | pathMod ... +/, '') |
4680-
| TaintedPath.js:202:29:202:54 | pathMod ... e(path) | TaintedPath.js:202:29:202:84 | pathMod ... +/, '') |
4681-
| TaintedPath.js:202:29:202:54 | pathMod ... e(path) | TaintedPath.js:202:29:202:84 | pathMod ... +/, '') |
4682-
| TaintedPath.js:202:29:202:54 | pathMod ... e(path) | TaintedPath.js:202:29:202:84 | pathMod ... +/, '') |
4683-
| TaintedPath.js:202:29:202:54 | pathMod ... e(path) | TaintedPath.js:202:29:202:84 | pathMod ... +/, '') |
4684-
| TaintedPath.js:202:29:202:54 | pathMod ... e(path) | TaintedPath.js:202:29:202:84 | pathMod ... +/, '') |
4685-
| TaintedPath.js:202:29:202:54 | pathMod ... e(path) | TaintedPath.js:202:29:202:84 | pathMod ... +/, '') |
4686-
| TaintedPath.js:202:50:202:53 | path | TaintedPath.js:202:29:202:54 | pathMod ... e(path) |
4687-
| TaintedPath.js:202:50:202:53 | path | TaintedPath.js:202:29:202:54 | pathMod ... e(path) |
4688-
| TaintedPath.js:202:50:202:53 | path | TaintedPath.js:202:29:202:54 | pathMod ... e(path) |
4689-
| TaintedPath.js:202:50:202:53 | path | TaintedPath.js:202:29:202:54 | pathMod ... e(path) |
4690-
| TaintedPath.js:202:50:202:53 | path | TaintedPath.js:202:29:202:54 | pathMod ... e(path) |
4691-
| TaintedPath.js:202:50:202:53 | path | TaintedPath.js:202:29:202:54 | pathMod ... e(path) |
4692-
| TaintedPath.js:202:50:202:53 | path | TaintedPath.js:202:29:202:54 | pathMod ... e(path) |
4693-
| TaintedPath.js:202:50:202:53 | path | TaintedPath.js:202:29:202:54 | pathMod ... e(path) |
46944670
| TaintedPath.js:202:50:202:53 | path | TaintedPath.js:202:29:202:54 | pathMod ... e(path) |
46954671
| TaintedPath.js:202:50:202:53 | path | TaintedPath.js:202:29:202:54 | pathMod ... e(path) |
46964672
| TaintedPath.js:202:50:202:53 | path | TaintedPath.js:202:29:202:54 | pathMod ... e(path) |

0 commit comments

Comments
 (0)