adds the Selection API as a new DOM text source

Author: bananabr

javascript/ql/lib/change-notes/2022-04-30-xss-selection-source.md

@@ -0,0 +1,4 @@
+---
+category: minorAnalysis
+---
+* Added the `Selection` api as a DOM text source in the `XssThroughDomCustomizations` library.

javascript/ql/lib/semmle/javascript/security/dataflow/XssThroughDomCustomizations.qll

@@ -216,4 +216,26 @@ module XssThroughDom {
       }
     }
   }
+
+
+  /**
+   * A source for text from the DOM from a Selection object toString method call
+   * https://developer.mozilla.org/en-US/docs/Web/API/Selection
+   */
+  DataFlow::SourceNode getSelectionCall(DataFlow::TypeTracker t) {
+    t.start() and
+    exists(DataFlow::CallNode call |
+      call = DataFlow::globalVarRef("getSelection").getACall()
+    |
+      result = call
+    )
+    or
+    exists(DataFlow::TypeTracker t2 | result = getSelectionCall(t2).track(t2, t))
+  }
+  
+  class SelectionSource extends Source {
+    SelectionSource() {
+      this = getSelectionCall(DataFlow::TypeTracker::end()).getAMethodCall("toString")
+    }
+  }
 }

javascript/ql/test/query-tests/Security/CWE-079/XssThroughDom/XssThroughDom.expected

@@ -139,6 +139,12 @@ nodes
 | xss-through-dom.js:122:53:122:67 | ev.target.files |
 | xss-through-dom.js:122:53:122:67 | ev.target.files |
 | xss-through-dom.js:122:53:122:70 | ev.target.files[0] |
+| xss-through-dom.js:129:6:129:42 | linkText |
+| xss-through-dom.js:129:17:129:36 | selection.toString() |
+| xss-through-dom.js:129:17:129:36 | selection.toString() |
+| xss-through-dom.js:129:17:129:42 | selecti ... ) \|\| '' |
+| xss-through-dom.js:130:19:130:26 | linkText |
+| xss-through-dom.js:130:19:130:26 | linkText |
 edges
 | forms.js:8:23:8:28 | values | forms.js:9:31:9:36 | values |
 | forms.js:8:23:8:28 | values | forms.js:9:31:9:36 | values |
@@ -225,6 +231,11 @@ edges
 | xss-through-dom.js:122:53:122:67 | ev.target.files | xss-through-dom.js:122:53:122:70 | ev.target.files[0] |
 | xss-through-dom.js:122:53:122:70 | ev.target.files[0] | xss-through-dom.js:122:33:122:71 | URL.cre ... les[0]) |
 | xss-through-dom.js:122:53:122:70 | ev.target.files[0] | xss-through-dom.js:122:33:122:71 | URL.cre ... les[0]) |
+| xss-through-dom.js:129:6:129:42 | linkText | xss-through-dom.js:130:19:130:26 | linkText |
+| xss-through-dom.js:129:6:129:42 | linkText | xss-through-dom.js:130:19:130:26 | linkText |
+| xss-through-dom.js:129:17:129:36 | selection.toString() | xss-through-dom.js:129:17:129:42 | selecti ... ) \|\| '' |
+| xss-through-dom.js:129:17:129:36 | selection.toString() | xss-through-dom.js:129:17:129:42 | selecti ... ) \|\| '' |
+| xss-through-dom.js:129:17:129:42 | selecti ... ) \|\| '' | xss-through-dom.js:129:6:129:42 | linkText |
 #select
 | forms.js:9:31:9:40 | values.foo | forms.js:8:23:8:28 | values | forms.js:9:31:9:40 | values.foo | $@ is reinterpreted as HTML without escaping meta-characters. | forms.js:8:23:8:28 | values | DOM text |
 | forms.js:12:31:12:40 | values.bar | forms.js:11:24:11:29 | values | forms.js:12:31:12:40 | values.bar | $@ is reinterpreted as HTML without escaping meta-characters. | forms.js:11:24:11:29 | values | DOM text |
@@ -262,3 +273,4 @@ edges
 | xss-through-dom.js:115:16:115:18 | src | xss-through-dom.js:114:17:114:52 | documen ... k").src | xss-through-dom.js:115:16:115:18 | src | $@ is reinterpreted as HTML without escaping meta-characters. | xss-through-dom.js:114:17:114:52 | documen ... k").src | DOM text |
 | xss-through-dom.js:120:23:120:45 | ev.targ ... 0].name | xss-through-dom.js:120:23:120:37 | ev.target.files | xss-through-dom.js:120:23:120:45 | ev.targ ... 0].name | $@ is reinterpreted as HTML without escaping meta-characters. | xss-through-dom.js:120:23:120:37 | ev.target.files | DOM text |
 | xss-through-dom.js:122:33:122:71 | URL.cre ... les[0]) | xss-through-dom.js:122:53:122:67 | ev.target.files | xss-through-dom.js:122:33:122:71 | URL.cre ... les[0]) | $@ is reinterpreted as HTML without escaping meta-characters. | xss-through-dom.js:122:53:122:67 | ev.target.files | DOM text |
+| xss-through-dom.js:130:19:130:26 | linkText | xss-through-dom.js:129:17:129:36 | selection.toString() | xss-through-dom.js:130:19:130:26 | linkText | $@ is reinterpreted as HTML without escaping meta-characters. | xss-through-dom.js:129:17:129:36 | selection.toString() | DOM text |

javascript/ql/test/query-tests/Security/CWE-079/XssThroughDom/xss-through-dom.js

@@ -122,3 +122,11 @@ class Sub extends Super {
         $("img#id").attr("src", URL.createObjectURL(ev.target.files[0])); // NOT OK
     }
 })();
+
+(function () {
+	let elem = document.createElement('a');
+	const selection = getSelection();
+	let linkText = selection.toString() || '';
+	elem.innerHTML = linkText; // NOT OK
+	elem.innerText = linkText; // OK
+})();