Skip to content

Commit 9d59cba

Browse files
codeql-cicodeql-ci
authored
Merge pull request github#6262 from erik-krogh/slash
Approved by asgerf
2 parents c87fe95 + 899e54f commit 9d59cba

File tree

4 files changed

+74
-0
lines changed

4 files changed

+74
-0
lines changed

‎javascript/change-notes/2021-07-12-slash.md

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,6 @@
1+
lgtm,codescanning
2+
* The `js/tainted-path` and `js/zipslip` queries now recognize path that have been
3+
normalized using the `slash` library.
4+
Affected packages are
5+
[slash](https://npmjs.com/package/slash)
6+

‎javascript/ql/src/semmle/javascript/security/dataflow/TaintedPathCustomizations.qll

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -798,6 +798,12 @@ module TaintedPath {
798798
srclabel instanceof Label::SplitPath and
799799
dstlabel.(Label::PosixPath).canContainDotDotSlash()
800800
)
801+
or
802+
exists(API::CallNode call | call = API::moduleImport("slash").getACall() |
803+
src = call.getArgument(0) and
804+
dst = call and
805+
srclabel = dstlabel
806+
)
801807
}
802808

803809
/**

‎javascript/ql/test/query-tests/Security/CWE-022/TaintedPath/TaintedPath.expected

Lines changed: 53 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1843,6 +1843,29 @@ nodes
18431843
| normalizedPaths.js:363:21:363:31 | requestPath |
18441844
| normalizedPaths.js:363:21:363:31 | requestPath |
18451845
| normalizedPaths.js:363:21:363:31 | requestPath |
1846+
| normalizedPaths.js:377:7:377:27 | path |
1847+
| normalizedPaths.js:377:7:377:27 | path |
1848+
| normalizedPaths.js:377:7:377:27 | path |
1849+
| normalizedPaths.js:377:7:377:27 | path |
1850+
| normalizedPaths.js:377:14:377:27 | req.query.path |
1851+
| normalizedPaths.js:377:14:377:27 | req.query.path |
1852+
| normalizedPaths.js:377:14:377:27 | req.query.path |
1853+
| normalizedPaths.js:377:14:377:27 | req.query.path |
1854+
| normalizedPaths.js:377:14:377:27 | req.query.path |
1855+
| normalizedPaths.js:379:19:379:22 | path |
1856+
| normalizedPaths.js:379:19:379:22 | path |
1857+
| normalizedPaths.js:379:19:379:22 | path |
1858+
| normalizedPaths.js:379:19:379:22 | path |
1859+
| normalizedPaths.js:379:19:379:22 | path |
1860+
| normalizedPaths.js:381:19:381:29 | slash(path) |
1861+
| normalizedPaths.js:381:19:381:29 | slash(path) |
1862+
| normalizedPaths.js:381:19:381:29 | slash(path) |
1863+
| normalizedPaths.js:381:19:381:29 | slash(path) |
1864+
| normalizedPaths.js:381:19:381:29 | slash(path) |
1865+
| normalizedPaths.js:381:25:381:28 | path |
1866+
| normalizedPaths.js:381:25:381:28 | path |
1867+
| normalizedPaths.js:381:25:381:28 | path |
1868+
| normalizedPaths.js:381:25:381:28 | path |
18461869
| other-fs-libraries.js:9:7:9:48 | path |
18471870
| other-fs-libraries.js:9:7:9:48 | path |
18481871
| other-fs-libraries.js:9:7:9:48 | path |
@@ -6111,6 +6134,34 @@ edges
61116134
| normalizedPaths.js:358:47:358:50 | path | normalizedPaths.js:358:21:358:51 | pathMod ... , path) |
61126135
| normalizedPaths.js:358:47:358:50 | path | normalizedPaths.js:358:21:358:51 | pathMod ... , path) |
61136136
| normalizedPaths.js:358:47:358:50 | path | normalizedPaths.js:358:21:358:51 | pathMod ... , path) |
6137+
| normalizedPaths.js:377:7:377:27 | path | normalizedPaths.js:379:19:379:22 | path |
6138+
| normalizedPaths.js:377:7:377:27 | path | normalizedPaths.js:379:19:379:22 | path |
6139+
| normalizedPaths.js:377:7:377:27 | path | normalizedPaths.js:379:19:379:22 | path |
6140+
| normalizedPaths.js:377:7:377:27 | path | normalizedPaths.js:379:19:379:22 | path |
6141+
| normalizedPaths.js:377:7:377:27 | path | normalizedPaths.js:379:19:379:22 | path |
6142+
| normalizedPaths.js:377:7:377:27 | path | normalizedPaths.js:379:19:379:22 | path |
6143+
| normalizedPaths.js:377:7:377:27 | path | normalizedPaths.js:379:19:379:22 | path |
6144+
| normalizedPaths.js:377:7:377:27 | path | normalizedPaths.js:379:19:379:22 | path |
6145+
| normalizedPaths.js:377:7:377:27 | path | normalizedPaths.js:381:25:381:28 | path |
6146+
| normalizedPaths.js:377:7:377:27 | path | normalizedPaths.js:381:25:381:28 | path |
6147+
| normalizedPaths.js:377:7:377:27 | path | normalizedPaths.js:381:25:381:28 | path |
6148+
| normalizedPaths.js:377:7:377:27 | path | normalizedPaths.js:381:25:381:28 | path |
6149+
| normalizedPaths.js:377:14:377:27 | req.query.path | normalizedPaths.js:377:7:377:27 | path |
6150+
| normalizedPaths.js:377:14:377:27 | req.query.path | normalizedPaths.js:377:7:377:27 | path |
6151+
| normalizedPaths.js:377:14:377:27 | req.query.path | normalizedPaths.js:377:7:377:27 | path |
6152+
| normalizedPaths.js:377:14:377:27 | req.query.path | normalizedPaths.js:377:7:377:27 | path |
6153+
| normalizedPaths.js:377:14:377:27 | req.query.path | normalizedPaths.js:377:7:377:27 | path |
6154+
| normalizedPaths.js:377:14:377:27 | req.query.path | normalizedPaths.js:377:7:377:27 | path |
6155+
| normalizedPaths.js:377:14:377:27 | req.query.path | normalizedPaths.js:377:7:377:27 | path |
6156+
| normalizedPaths.js:377:14:377:27 | req.query.path | normalizedPaths.js:377:7:377:27 | path |
6157+
| normalizedPaths.js:381:25:381:28 | path | normalizedPaths.js:381:19:381:29 | slash(path) |
6158+
| normalizedPaths.js:381:25:381:28 | path | normalizedPaths.js:381:19:381:29 | slash(path) |
6159+
| normalizedPaths.js:381:25:381:28 | path | normalizedPaths.js:381:19:381:29 | slash(path) |
6160+
| normalizedPaths.js:381:25:381:28 | path | normalizedPaths.js:381:19:381:29 | slash(path) |
6161+
| normalizedPaths.js:381:25:381:28 | path | normalizedPaths.js:381:19:381:29 | slash(path) |
6162+
| normalizedPaths.js:381:25:381:28 | path | normalizedPaths.js:381:19:381:29 | slash(path) |
6163+
| normalizedPaths.js:381:25:381:28 | path | normalizedPaths.js:381:19:381:29 | slash(path) |
6164+
| normalizedPaths.js:381:25:381:28 | path | normalizedPaths.js:381:19:381:29 | slash(path) |
61146165
| other-fs-libraries.js:9:7:9:48 | path | other-fs-libraries.js:11:19:11:22 | path |
61156166
| other-fs-libraries.js:9:7:9:48 | path | other-fs-libraries.js:11:19:11:22 | path |
61166167
| other-fs-libraries.js:9:7:9:48 | path | other-fs-libraries.js:11:19:11:22 | path |
@@ -8535,6 +8586,8 @@ edges
85358586
| normalizedPaths.js:346:19:346:22 | path | normalizedPaths.js:339:32:339:45 | req.query.path | normalizedPaths.js:346:19:346:22 | path | This path depends on $@. | normalizedPaths.js:339:32:339:45 | req.query.path | a user-provided value |
85368587
| normalizedPaths.js:356:19:356:22 | path | normalizedPaths.js:354:14:354:27 | req.query.path | normalizedPaths.js:356:19:356:22 | path | This path depends on $@. | normalizedPaths.js:354:14:354:27 | req.query.path | a user-provided value |
85378588
| normalizedPaths.js:363:21:363:31 | requestPath | normalizedPaths.js:354:14:354:27 | req.query.path | normalizedPaths.js:363:21:363:31 | requestPath | This path depends on $@. | normalizedPaths.js:354:14:354:27 | req.query.path | a user-provided value |
8589+
| normalizedPaths.js:379:19:379:22 | path | normalizedPaths.js:377:14:377:27 | req.query.path | normalizedPaths.js:379:19:379:22 | path | This path depends on $@. | normalizedPaths.js:377:14:377:27 | req.query.path | a user-provided value |
8590+
| normalizedPaths.js:381:19:381:29 | slash(path) | normalizedPaths.js:377:14:377:27 | req.query.path | normalizedPaths.js:381:19:381:29 | slash(path) | This path depends on $@. | normalizedPaths.js:377:14:377:27 | req.query.path | a user-provided value |
85388591
| other-fs-libraries.js:11:19:11:22 | path | other-fs-libraries.js:9:24:9:30 | req.url | other-fs-libraries.js:11:19:11:22 | path | This path depends on $@. | other-fs-libraries.js:9:24:9:30 | req.url | a user-provided value |
85398592
| other-fs-libraries.js:12:27:12:30 | path | other-fs-libraries.js:9:24:9:30 | req.url | other-fs-libraries.js:12:27:12:30 | path | This path depends on $@. | other-fs-libraries.js:9:24:9:30 | req.url | a user-provided value |
85408593
| other-fs-libraries.js:13:24:13:27 | path | other-fs-libraries.js:9:24:9:30 | req.url | other-fs-libraries.js:13:24:13:27 | path | This path depends on $@. | other-fs-libraries.js:9:24:9:30 | req.url | a user-provided value |

‎javascript/ql/test/query-tests/Security/CWE-022/TaintedPath/normalizedPaths.js

Lines changed: 9 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -370,4 +370,13 @@ app.get('/yet-another-prefix2', (req, res) => {
370370
function allowPath(requestPath, rootPath) {
371371
return requestPath.indexOf(rootPath) === 0;
372372
}
373+
});
374+
375+
import slash from 'slash';
376+
app.get('/slash-stuff', (req, res) => {
377+
let path = req.query.path;
378+
379+
fs.readFileSync(path); // NOT OK
380+
381+
fs.readFileSync(slash(path)); // NOT OK
373382
});

0 commit comments

Comments
 (0)