Skip to content

Commit ec9c885

Browse files
erik-krogherik-krogh
committed
add taint step through the cli-highlight library
1 parent d114cdc commit ec9c885

File tree

4 files changed

+74
-50
lines changed

4 files changed

+74
-50
lines changed

‎javascript/change-notes/2021-06-22-colors.md

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -4,4 +4,5 @@ lgtm,codescanning
44
[ansi-colors](https://npmjs.com/package/ansi-colors),
55
[colors](https://npmjs.com/package/colors),
66
[wrap-ansi](https://npmjs.com/package/wrap-ansi),
7-
[colorette](https://npmjs.com/package/colorette)
7+
[colorette](https://npmjs.com/package/colorette),
8+
[cli-highlight](https://npmjs.com/package/cli-highlight)

‎javascript/ql/src/semmle/javascript/frameworks/Logging.qll

Lines changed: 14 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -252,3 +252,17 @@ class ColoretteStep extends TaintTracking::SharedTaintStep {
252252
)
253253
}
254254
}
255+
256+
/**
257+
* A step through the [`cli-highlight`](https://npmjs.org/package/cli-highlight) library.
258+
*/
259+
class CliHighlightStep extends TaintTracking::SharedTaintStep {
260+
override predicate stringManipulationStep(DataFlow::Node pred, DataFlow::Node succ) {
261+
exists(API::CallNode call |
262+
call = API::moduleImport("cli-highlight").getMember("highlight").getACall()
263+
|
264+
pred = call.getArgument(0) and
265+
succ = call
266+
)
267+
}
268+
}

‎javascript/ql/test/query-tests/Security/CWE-117/LogInjection.expected

Lines changed: 56 additions & 49 deletions
Original file line numberDiff line numberDiff line change
@@ -22,29 +22,32 @@ nodes
2222
| logInjectionBad.js:30:23:30:49 | `[ERROR ... rror}"` |
2323
| logInjectionBad.js:30:23:30:49 | `[ERROR ... rror}"` |
2424
| logInjectionBad.js:30:42:30:46 | error |
25-
| logInjectionBad.js:40:9:40:36 | q |
26-
| logInjectionBad.js:40:13:40:36 | url.par ... , true) |
27-
| logInjectionBad.js:40:23:40:29 | req.url |
28-
| logInjectionBad.js:40:23:40:29 | req.url |
29-
| logInjectionBad.js:41:9:41:35 | username |
30-
| logInjectionBad.js:41:20:41:20 | q |
31-
| logInjectionBad.js:41:20:41:26 | q.query |
32-
| logInjectionBad.js:41:20:41:35 | q.query.username |
33-
| logInjectionBad.js:43:18:43:54 | ansiCol ... ername) |
34-
| logInjectionBad.js:43:18:43:54 | ansiCol ... ername) |
35-
| logInjectionBad.js:43:46:43:53 | username |
36-
| logInjectionBad.js:44:18:44:47 | colors. ... ername) |
37-
| logInjectionBad.js:44:18:44:47 | colors. ... ername) |
38-
| logInjectionBad.js:44:39:44:46 | username |
39-
| logInjectionBad.js:45:18:45:61 | wrapAns ... e), 20) |
40-
| logInjectionBad.js:45:18:45:61 | wrapAns ... e), 20) |
41-
| logInjectionBad.js:45:27:45:56 | colors. ... ername) |
42-
| logInjectionBad.js:45:48:45:55 | username |
43-
| logInjectionBad.js:46:17:46:47 | underli ... name))) |
44-
| logInjectionBad.js:46:17:46:47 | underli ... name))) |
45-
| logInjectionBad.js:46:27:46:46 | bold(blue(username)) |
46-
| logInjectionBad.js:46:32:46:45 | blue(username) |
47-
| logInjectionBad.js:46:37:46:44 | username |
25+
| logInjectionBad.js:41:9:41:36 | q |
26+
| logInjectionBad.js:41:13:41:36 | url.par ... , true) |
27+
| logInjectionBad.js:41:23:41:29 | req.url |
28+
| logInjectionBad.js:41:23:41:29 | req.url |
29+
| logInjectionBad.js:42:9:42:35 | username |
30+
| logInjectionBad.js:42:20:42:20 | q |
31+
| logInjectionBad.js:42:20:42:26 | q.query |
32+
| logInjectionBad.js:42:20:42:35 | q.query.username |
33+
| logInjectionBad.js:44:18:44:54 | ansiCol ... ername) |
34+
| logInjectionBad.js:44:18:44:54 | ansiCol ... ername) |
35+
| logInjectionBad.js:44:46:44:53 | username |
36+
| logInjectionBad.js:45:18:45:47 | colors. ... ername) |
37+
| logInjectionBad.js:45:18:45:47 | colors. ... ername) |
38+
| logInjectionBad.js:45:39:45:46 | username |
39+
| logInjectionBad.js:46:18:46:61 | wrapAns ... e), 20) |
40+
| logInjectionBad.js:46:18:46:61 | wrapAns ... e), 20) |
41+
| logInjectionBad.js:46:27:46:56 | colors. ... ername) |
42+
| logInjectionBad.js:46:48:46:55 | username |
43+
| logInjectionBad.js:47:17:47:47 | underli ... name))) |
44+
| logInjectionBad.js:47:17:47:47 | underli ... name))) |
45+
| logInjectionBad.js:47:27:47:46 | bold(blue(username)) |
46+
| logInjectionBad.js:47:32:47:45 | blue(username) |
47+
| logInjectionBad.js:47:37:47:44 | username |
48+
| logInjectionBad.js:48:17:48:76 | highlig ... true}) |
49+
| logInjectionBad.js:48:17:48:76 | highlig ... true}) |
50+
| logInjectionBad.js:48:27:48:34 | username |
4851
edges
4952
| logInjectionBad.js:19:9:19:36 | q | logInjectionBad.js:20:20:20:20 | q |
5053
| logInjectionBad.js:19:13:19:36 | url.par ... , true) | logInjectionBad.js:19:9:19:36 | q |
@@ -68,35 +71,39 @@ edges
6871
| logInjectionBad.js:29:14:29:18 | error | logInjectionBad.js:30:42:30:46 | error |
6972
| logInjectionBad.js:30:42:30:46 | error | logInjectionBad.js:30:23:30:49 | `[ERROR ... rror}"` |
7073
| logInjectionBad.js:30:42:30:46 | error | logInjectionBad.js:30:23:30:49 | `[ERROR ... rror}"` |
71-
| logInjectionBad.js:40:9:40:36 | q | logInjectionBad.js:41:20:41:20 | q |
72-
| logInjectionBad.js:40:13:40:36 | url.par ... , true) | logInjectionBad.js:40:9:40:36 | q |
73-
| logInjectionBad.js:40:23:40:29 | req.url | logInjectionBad.js:40:13:40:36 | url.par ... , true) |
74-
| logInjectionBad.js:40:23:40:29 | req.url | logInjectionBad.js:40:13:40:36 | url.par ... , true) |
75-
| logInjectionBad.js:41:9:41:35 | username | logInjectionBad.js:43:46:43:53 | username |
76-
| logInjectionBad.js:41:9:41:35 | username | logInjectionBad.js:44:39:44:46 | username |
77-
| logInjectionBad.js:41:9:41:35 | username | logInjectionBad.js:45:48:45:55 | username |
78-
| logInjectionBad.js:41:9:41:35 | username | logInjectionBad.js:46:37:46:44 | username |
79-
| logInjectionBad.js:41:20:41:20 | q | logInjectionBad.js:41:20:41:26 | q.query |
80-
| logInjectionBad.js:41:20:41:26 | q.query | logInjectionBad.js:41:20:41:35 | q.query.username |
81-
| logInjectionBad.js:41:20:41:35 | q.query.username | logInjectionBad.js:41:9:41:35 | username |
82-
| logInjectionBad.js:43:46:43:53 | username | logInjectionBad.js:43:18:43:54 | ansiCol ... ername) |
83-
| logInjectionBad.js:43:46:43:53 | username | logInjectionBad.js:43:18:43:54 | ansiCol ... ername) |
84-
| logInjectionBad.js:44:39:44:46 | username | logInjectionBad.js:44:18:44:47 | colors. ... ername) |
85-
| logInjectionBad.js:44:39:44:46 | username | logInjectionBad.js:44:18:44:47 | colors. ... ername) |
86-
| logInjectionBad.js:45:27:45:56 | colors. ... ername) | logInjectionBad.js:45:18:45:61 | wrapAns ... e), 20) |
87-
| logInjectionBad.js:45:27:45:56 | colors. ... ername) | logInjectionBad.js:45:18:45:61 | wrapAns ... e), 20) |
88-
| logInjectionBad.js:45:48:45:55 | username | logInjectionBad.js:45:27:45:56 | colors. ... ername) |
89-
| logInjectionBad.js:46:27:46:46 | bold(blue(username)) | logInjectionBad.js:46:17:46:47 | underli ... name))) |
90-
| logInjectionBad.js:46:27:46:46 | bold(blue(username)) | logInjectionBad.js:46:17:46:47 | underli ... name))) |
91-
| logInjectionBad.js:46:32:46:45 | blue(username) | logInjectionBad.js:46:27:46:46 | bold(blue(username)) |
92-
| logInjectionBad.js:46:37:46:44 | username | logInjectionBad.js:46:32:46:45 | blue(username) |
74+
| logInjectionBad.js:41:9:41:36 | q | logInjectionBad.js:42:20:42:20 | q |
75+
| logInjectionBad.js:41:13:41:36 | url.par ... , true) | logInjectionBad.js:41:9:41:36 | q |
76+
| logInjectionBad.js:41:23:41:29 | req.url | logInjectionBad.js:41:13:41:36 | url.par ... , true) |
77+
| logInjectionBad.js:41:23:41:29 | req.url | logInjectionBad.js:41:13:41:36 | url.par ... , true) |
78+
| logInjectionBad.js:42:9:42:35 | username | logInjectionBad.js:44:46:44:53 | username |
79+
| logInjectionBad.js:42:9:42:35 | username | logInjectionBad.js:45:39:45:46 | username |
80+
| logInjectionBad.js:42:9:42:35 | username | logInjectionBad.js:46:48:46:55 | username |
81+
| logInjectionBad.js:42:9:42:35 | username | logInjectionBad.js:47:37:47:44 | username |
82+
| logInjectionBad.js:42:9:42:35 | username | logInjectionBad.js:48:27:48:34 | username |
83+
| logInjectionBad.js:42:20:42:20 | q | logInjectionBad.js:42:20:42:26 | q.query |
84+
| logInjectionBad.js:42:20:42:26 | q.query | logInjectionBad.js:42:20:42:35 | q.query.username |
85+
| logInjectionBad.js:42:20:42:35 | q.query.username | logInjectionBad.js:42:9:42:35 | username |
86+
| logInjectionBad.js:44:46:44:53 | username | logInjectionBad.js:44:18:44:54 | ansiCol ... ername) |
87+
| logInjectionBad.js:44:46:44:53 | username | logInjectionBad.js:44:18:44:54 | ansiCol ... ername) |
88+
| logInjectionBad.js:45:39:45:46 | username | logInjectionBad.js:45:18:45:47 | colors. ... ername) |
89+
| logInjectionBad.js:45:39:45:46 | username | logInjectionBad.js:45:18:45:47 | colors. ... ername) |
90+
| logInjectionBad.js:46:27:46:56 | colors. ... ername) | logInjectionBad.js:46:18:46:61 | wrapAns ... e), 20) |
91+
| logInjectionBad.js:46:27:46:56 | colors. ... ername) | logInjectionBad.js:46:18:46:61 | wrapAns ... e), 20) |
92+
| logInjectionBad.js:46:48:46:55 | username | logInjectionBad.js:46:27:46:56 | colors. ... ername) |
93+
| logInjectionBad.js:47:27:47:46 | bold(blue(username)) | logInjectionBad.js:47:17:47:47 | underli ... name))) |
94+
| logInjectionBad.js:47:27:47:46 | bold(blue(username)) | logInjectionBad.js:47:17:47:47 | underli ... name))) |
95+
| logInjectionBad.js:47:32:47:45 | blue(username) | logInjectionBad.js:47:27:47:46 | bold(blue(username)) |
96+
| logInjectionBad.js:47:37:47:44 | username | logInjectionBad.js:47:32:47:45 | blue(username) |
97+
| logInjectionBad.js:48:27:48:34 | username | logInjectionBad.js:48:17:48:76 | highlig ... true}) |
98+
| logInjectionBad.js:48:27:48:34 | username | logInjectionBad.js:48:17:48:76 | highlig ... true}) |
9399
#select
94100
| logInjectionBad.js:22:18:22:43 | `[INFO] ... rname}` | logInjectionBad.js:19:23:19:29 | req.url | logInjectionBad.js:22:18:22:43 | `[INFO] ... rname}` | $@ flows to log entry. | logInjectionBad.js:19:23:19:29 | req.url | User-provided value |
95101
| logInjectionBad.js:23:37:23:44 | username | logInjectionBad.js:19:23:19:29 | req.url | logInjectionBad.js:23:37:23:44 | username | $@ flows to log entry. | logInjectionBad.js:19:23:19:29 | req.url | User-provided value |
96102
| logInjectionBad.js:24:35:24:42 | username | logInjectionBad.js:19:23:19:29 | req.url | logInjectionBad.js:24:35:24:42 | username | $@ flows to log entry. | logInjectionBad.js:19:23:19:29 | req.url | User-provided value |
97103
| logInjectionBad.js:25:36:25:43 | username | logInjectionBad.js:19:23:19:29 | req.url | logInjectionBad.js:25:36:25:43 | username | $@ flows to log entry. | logInjectionBad.js:19:23:19:29 | req.url | User-provided value |
98104
| logInjectionBad.js:30:23:30:49 | `[ERROR ... rror}"` | logInjectionBad.js:19:23:19:29 | req.url | logInjectionBad.js:30:23:30:49 | `[ERROR ... rror}"` | $@ flows to log entry. | logInjectionBad.js:19:23:19:29 | req.url | User-provided value |
99-
| logInjectionBad.js:43:18:43:54 | ansiCol ... ername) | logInjectionBad.js:40:23:40:29 | req.url | logInjectionBad.js:43:18:43:54 | ansiCol ... ername) | $@ flows to log entry. | logInjectionBad.js:40:23:40:29 | req.url | User-provided value |
100-
| logInjectionBad.js:44:18:44:47 | colors. ... ername) | logInjectionBad.js:40:23:40:29 | req.url | logInjectionBad.js:44:18:44:47 | colors. ... ername) | $@ flows to log entry. | logInjectionBad.js:40:23:40:29 | req.url | User-provided value |
101-
| logInjectionBad.js:45:18:45:61 | wrapAns ... e), 20) | logInjectionBad.js:40:23:40:29 | req.url | logInjectionBad.js:45:18:45:61 | wrapAns ... e), 20) | $@ flows to log entry. | logInjectionBad.js:40:23:40:29 | req.url | User-provided value |
102-
| logInjectionBad.js:46:17:46:47 | underli ... name))) | logInjectionBad.js:40:23:40:29 | req.url | logInjectionBad.js:46:17:46:47 | underli ... name))) | $@ flows to log entry. | logInjectionBad.js:40:23:40:29 | req.url | User-provided value |
105+
| logInjectionBad.js:44:18:44:54 | ansiCol ... ername) | logInjectionBad.js:41:23:41:29 | req.url | logInjectionBad.js:44:18:44:54 | ansiCol ... ername) | $@ flows to log entry. | logInjectionBad.js:41:23:41:29 | req.url | User-provided value |
106+
| logInjectionBad.js:45:18:45:47 | colors. ... ername) | logInjectionBad.js:41:23:41:29 | req.url | logInjectionBad.js:45:18:45:47 | colors. ... ername) | $@ flows to log entry. | logInjectionBad.js:41:23:41:29 | req.url | User-provided value |
107+
| logInjectionBad.js:46:18:46:61 | wrapAns ... e), 20) | logInjectionBad.js:41:23:41:29 | req.url | logInjectionBad.js:46:18:46:61 | wrapAns ... e), 20) | $@ flows to log entry. | logInjectionBad.js:41:23:41:29 | req.url | User-provided value |
108+
| logInjectionBad.js:47:17:47:47 | underli ... name))) | logInjectionBad.js:41:23:41:29 | req.url | logInjectionBad.js:47:17:47:47 | underli ... name))) | $@ flows to log entry. | logInjectionBad.js:41:23:41:29 | req.url | User-provided value |
109+
| logInjectionBad.js:48:17:48:76 | highlig ... true}) | logInjectionBad.js:41:23:41:29 | req.url | logInjectionBad.js:48:17:48:76 | highlig ... true}) | $@ flows to log entry. | logInjectionBad.js:41:23:41:29 | req.url | User-provided value |

‎javascript/ql/test/query-tests/Security/CWE-117/logInjectionBad.js

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -35,6 +35,7 @@ const ansiColors = require('ansi-colors');
3535
const colors = require('colors');
3636
import wrapAnsi from 'wrap-ansi';
3737
import { blue, bold, underline } from "colorette"
38+
const highlight = require('cli-highlight').highlight;
3839

3940
const server2 = http.createServer((req, res) => {
4041
let q = url.parse(req.url, true);
@@ -44,4 +45,5 @@ const server2 = http.createServer((req, res) => {
4445
console.info(colors.red.underline(username)); // NOT OK
4546
console.info(wrapAnsi(colors.red.underline(username), 20)); // NOT OK
4647
console.log(underline(bold(blue(username)))); // NOT OK
48+
console.log(highlight(username, {language: 'sql', ignoreIllegals: true})); // NOT OK
4749
});

0 commit comments

Comments
 (0)