Skip to content

Commit e4427bb

Browse files
erik-krogherik-krogh
committed
add taint step through the wrap-ansi library
1 parent 626a653 commit e4427bb

File tree

4 files changed

+54
-30
lines changed

4 files changed

+54
-30
lines changed

‎javascript/change-notes/2021-06-22-colors.md

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -2,4 +2,5 @@ lgtm,codescanning
22
* The dataflow libraries now model dataflow through console styling libraries.
33
Affected packages are
44
[ansi-colors](https://npmjs.com/package/ansi-colors),
5-
[colors](https://npmjs.com/package/colors)
5+
[colors](https://npmjs.com/package/colors),
6+
[wrap-ansi](https://npmjs.com/package/wrap-ansi)

‎javascript/ql/src/semmle/javascript/frameworks/Logging.qll

Lines changed: 12 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -228,3 +228,15 @@ class ColorsStep extends TaintTracking::SharedTaintStep {
228228
)
229229
}
230230
}
231+
232+
/**
233+
* A step through the [`wrap-ansi`](https://npmjs.org/package/wrap-ansi) library.
234+
*/
235+
class WrapAnsiStep extends TaintTracking::SharedTaintStep {
236+
override predicate stringManipulationStep(DataFlow::Node pred, DataFlow::Node succ) {
237+
exists(API::CallNode call | call = API::moduleImport("wrap-ansi").getACall() |
238+
pred = call.getArgument(0) and
239+
succ = call
240+
)
241+
}
242+
}

‎javascript/ql/test/query-tests/Security/CWE-117/LogInjection.expected

Lines changed: 38 additions & 29 deletions
Original file line numberDiff line numberDiff line change
@@ -22,20 +22,24 @@ nodes
2222
| logInjectionBad.js:30:23:30:49 | `[ERROR ... rror}"` |
2323
| logInjectionBad.js:30:23:30:49 | `[ERROR ... rror}"` |
2424
| logInjectionBad.js:30:42:30:46 | error |
25-
| logInjectionBad.js:38:9:38:36 | q |
26-
| logInjectionBad.js:38:13:38:36 | url.par ... , true) |
27-
| logInjectionBad.js:38:23:38:29 | req.url |
28-
| logInjectionBad.js:38:23:38:29 | req.url |
29-
| logInjectionBad.js:39:9:39:35 | username |
30-
| logInjectionBad.js:39:20:39:20 | q |
31-
| logInjectionBad.js:39:20:39:26 | q.query |
32-
| logInjectionBad.js:39:20:39:35 | q.query.username |
33-
| logInjectionBad.js:41:18:41:54 | ansiCol ... ername) |
34-
| logInjectionBad.js:41:18:41:54 | ansiCol ... ername) |
35-
| logInjectionBad.js:41:46:41:53 | username |
36-
| logInjectionBad.js:42:18:42:47 | colors. ... ername) |
37-
| logInjectionBad.js:42:18:42:47 | colors. ... ername) |
38-
| logInjectionBad.js:42:39:42:46 | username |
25+
| logInjectionBad.js:39:9:39:36 | q |
26+
| logInjectionBad.js:39:13:39:36 | url.par ... , true) |
27+
| logInjectionBad.js:39:23:39:29 | req.url |
28+
| logInjectionBad.js:39:23:39:29 | req.url |
29+
| logInjectionBad.js:40:9:40:35 | username |
30+
| logInjectionBad.js:40:20:40:20 | q |
31+
| logInjectionBad.js:40:20:40:26 | q.query |
32+
| logInjectionBad.js:40:20:40:35 | q.query.username |
33+
| logInjectionBad.js:42:18:42:54 | ansiCol ... ername) |
34+
| logInjectionBad.js:42:18:42:54 | ansiCol ... ername) |
35+
| logInjectionBad.js:42:46:42:53 | username |
36+
| logInjectionBad.js:43:18:43:47 | colors. ... ername) |
37+
| logInjectionBad.js:43:18:43:47 | colors. ... ername) |
38+
| logInjectionBad.js:43:39:43:46 | username |
39+
| logInjectionBad.js:44:18:44:61 | wrapAns ... e), 20) |
40+
| logInjectionBad.js:44:18:44:61 | wrapAns ... e), 20) |
41+
| logInjectionBad.js:44:27:44:56 | colors. ... ername) |
42+
| logInjectionBad.js:44:48:44:55 | username |
3943
edges
4044
| logInjectionBad.js:19:9:19:36 | q | logInjectionBad.js:20:20:20:20 | q |
4145
| logInjectionBad.js:19:13:19:36 | url.par ... , true) | logInjectionBad.js:19:9:19:36 | q |
@@ -59,24 +63,29 @@ edges
5963
| logInjectionBad.js:29:14:29:18 | error | logInjectionBad.js:30:42:30:46 | error |
6064
| logInjectionBad.js:30:42:30:46 | error | logInjectionBad.js:30:23:30:49 | `[ERROR ... rror}"` |
6165
| logInjectionBad.js:30:42:30:46 | error | logInjectionBad.js:30:23:30:49 | `[ERROR ... rror}"` |
62-
| logInjectionBad.js:38:9:38:36 | q | logInjectionBad.js:39:20:39:20 | q |
63-
| logInjectionBad.js:38:13:38:36 | url.par ... , true) | logInjectionBad.js:38:9:38:36 | q |
64-
| logInjectionBad.js:38:23:38:29 | req.url | logInjectionBad.js:38:13:38:36 | url.par ... , true) |
65-
| logInjectionBad.js:38:23:38:29 | req.url | logInjectionBad.js:38:13:38:36 | url.par ... , true) |
66-
| logInjectionBad.js:39:9:39:35 | username | logInjectionBad.js:41:46:41:53 | username |
67-
| logInjectionBad.js:39:9:39:35 | username | logInjectionBad.js:42:39:42:46 | username |
68-
| logInjectionBad.js:39:20:39:20 | q | logInjectionBad.js:39:20:39:26 | q.query |
69-
| logInjectionBad.js:39:20:39:26 | q.query | logInjectionBad.js:39:20:39:35 | q.query.username |
70-
| logInjectionBad.js:39:20:39:35 | q.query.username | logInjectionBad.js:39:9:39:35 | username |
71-
| logInjectionBad.js:41:46:41:53 | username | logInjectionBad.js:41:18:41:54 | ansiCol ... ername) |
72-
| logInjectionBad.js:41:46:41:53 | username | logInjectionBad.js:41:18:41:54 | ansiCol ... ername) |
73-
| logInjectionBad.js:42:39:42:46 | username | logInjectionBad.js:42:18:42:47 | colors. ... ername) |
74-
| logInjectionBad.js:42:39:42:46 | username | logInjectionBad.js:42:18:42:47 | colors. ... ername) |
66+
| logInjectionBad.js:39:9:39:36 | q | logInjectionBad.js:40:20:40:20 | q |
67+
| logInjectionBad.js:39:13:39:36 | url.par ... , true) | logInjectionBad.js:39:9:39:36 | q |
68+
| logInjectionBad.js:39:23:39:29 | req.url | logInjectionBad.js:39:13:39:36 | url.par ... , true) |
69+
| logInjectionBad.js:39:23:39:29 | req.url | logInjectionBad.js:39:13:39:36 | url.par ... , true) |
70+
| logInjectionBad.js:40:9:40:35 | username | logInjectionBad.js:42:46:42:53 | username |
71+
| logInjectionBad.js:40:9:40:35 | username | logInjectionBad.js:43:39:43:46 | username |
72+
| logInjectionBad.js:40:9:40:35 | username | logInjectionBad.js:44:48:44:55 | username |
73+
| logInjectionBad.js:40:20:40:20 | q | logInjectionBad.js:40:20:40:26 | q.query |
74+
| logInjectionBad.js:40:20:40:26 | q.query | logInjectionBad.js:40:20:40:35 | q.query.username |
75+
| logInjectionBad.js:40:20:40:35 | q.query.username | logInjectionBad.js:40:9:40:35 | username |
76+
| logInjectionBad.js:42:46:42:53 | username | logInjectionBad.js:42:18:42:54 | ansiCol ... ername) |
77+
| logInjectionBad.js:42:46:42:53 | username | logInjectionBad.js:42:18:42:54 | ansiCol ... ername) |
78+
| logInjectionBad.js:43:39:43:46 | username | logInjectionBad.js:43:18:43:47 | colors. ... ername) |
79+
| logInjectionBad.js:43:39:43:46 | username | logInjectionBad.js:43:18:43:47 | colors. ... ername) |
80+
| logInjectionBad.js:44:27:44:56 | colors. ... ername) | logInjectionBad.js:44:18:44:61 | wrapAns ... e), 20) |
81+
| logInjectionBad.js:44:27:44:56 | colors. ... ername) | logInjectionBad.js:44:18:44:61 | wrapAns ... e), 20) |
82+
| logInjectionBad.js:44:48:44:55 | username | logInjectionBad.js:44:27:44:56 | colors. ... ername) |
7583
#select
7684
| logInjectionBad.js:22:18:22:43 | `[INFO] ... rname}` | logInjectionBad.js:19:23:19:29 | req.url | logInjectionBad.js:22:18:22:43 | `[INFO] ... rname}` | $@ flows to log entry. | logInjectionBad.js:19:23:19:29 | req.url | User-provided value |
7785
| logInjectionBad.js:23:37:23:44 | username | logInjectionBad.js:19:23:19:29 | req.url | logInjectionBad.js:23:37:23:44 | username | $@ flows to log entry. | logInjectionBad.js:19:23:19:29 | req.url | User-provided value |
7886
| logInjectionBad.js:24:35:24:42 | username | logInjectionBad.js:19:23:19:29 | req.url | logInjectionBad.js:24:35:24:42 | username | $@ flows to log entry. | logInjectionBad.js:19:23:19:29 | req.url | User-provided value |
7987
| logInjectionBad.js:25:36:25:43 | username | logInjectionBad.js:19:23:19:29 | req.url | logInjectionBad.js:25:36:25:43 | username | $@ flows to log entry. | logInjectionBad.js:19:23:19:29 | req.url | User-provided value |
8088
| logInjectionBad.js:30:23:30:49 | `[ERROR ... rror}"` | logInjectionBad.js:19:23:19:29 | req.url | logInjectionBad.js:30:23:30:49 | `[ERROR ... rror}"` | $@ flows to log entry. | logInjectionBad.js:19:23:19:29 | req.url | User-provided value |
81-
| logInjectionBad.js:41:18:41:54 | ansiCol ... ername) | logInjectionBad.js:38:23:38:29 | req.url | logInjectionBad.js:41:18:41:54 | ansiCol ... ername) | $@ flows to log entry. | logInjectionBad.js:38:23:38:29 | req.url | User-provided value |
82-
| logInjectionBad.js:42:18:42:47 | colors. ... ername) | logInjectionBad.js:38:23:38:29 | req.url | logInjectionBad.js:42:18:42:47 | colors. ... ername) | $@ flows to log entry. | logInjectionBad.js:38:23:38:29 | req.url | User-provided value |
89+
| logInjectionBad.js:42:18:42:54 | ansiCol ... ername) | logInjectionBad.js:39:23:39:29 | req.url | logInjectionBad.js:42:18:42:54 | ansiCol ... ername) | $@ flows to log entry. | logInjectionBad.js:39:23:39:29 | req.url | User-provided value |
90+
| logInjectionBad.js:43:18:43:47 | colors. ... ername) | logInjectionBad.js:39:23:39:29 | req.url | logInjectionBad.js:43:18:43:47 | colors. ... ername) | $@ flows to log entry. | logInjectionBad.js:39:23:39:29 | req.url | User-provided value |
91+
| logInjectionBad.js:44:18:44:61 | wrapAns ... e), 20) | logInjectionBad.js:39:23:39:29 | req.url | logInjectionBad.js:44:18:44:61 | wrapAns ... e), 20) | $@ flows to log entry. | logInjectionBad.js:39:23:39:29 | req.url | User-provided value |

‎javascript/ql/test/query-tests/Security/CWE-117/logInjectionBad.js

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -33,11 +33,13 @@ const server = http.createServer((req, res) => {
3333

3434
const ansiColors = require('ansi-colors');
3535
const colors = require('colors');
36+
import wrapAnsi from 'wrap-ansi';
3637

3738
const server2 = http.createServer((req, res) => {
3839
let q = url.parse(req.url, true);
3940
let username = q.query.username;
4041

4142
console.info(ansiColors.yellow.underline(username)); // NOT OK
4243
console.info(colors.red.underline(username)); // NOT OK
44+
console.info(wrapAnsi(colors.red.underline(username), 20)); // NOT OK
4345
});

0 commit comments

Comments
 (0)