Skip to content

Commit 354fcbe

Browse files
am0o0am0o0
committed
apply changes from @erik-krogh 
1 parent b360c8a commit 354fcbe

File tree

3 files changed

+25
-53
lines changed

3 files changed

+25
-53
lines changed

‎javascript/ql/lib/semmle/javascript/security/dataflow/HardcodedCredentialsCustomizations.qll

Lines changed: 6 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -4,6 +4,7 @@
44
* own.
55
*/
66

7+
import semmle.javascript.filters.ClassifyFiles
78
import javascript
89
private import semmle.javascript.security.SensitiveActions
910

@@ -38,5 +39,9 @@ module HardcodedCredentials {
3839
*/
3940
class DefaultCredentialsSink extends Sink instanceof CredentialsNode {
4041
override string getKind() { result = super.getCredentialsKind() }
42+
43+
DefaultCredentialsSink() {
44+
not (super.getCredentialsKind() = "jwt key" and isTestFile(this.getFile()))
45+
}
4146
}
42-
}
47+
}

‎javascript/ql/src/Security/CWE-798/HardcodedCredentials.ql

Lines changed: 18 additions & 38 deletions
Original file line numberDiff line numberDiff line change
@@ -16,50 +16,30 @@
1616
import javascript
1717
import semmle.javascript.security.dataflow.HardcodedCredentialsQuery
1818
import DataFlow::PathGraph
19-
import semmle.javascript.filters.ClassifyFiles
2019

2120
bindingset[s]
2221
predicate looksLikeATemplate(string s) { s.regexpMatch(".*((\\{\\{.*\\}\\})|(<.*>)|(\\(.*\\))).*") }
2322

24-
predicate updateMessageWithSourceValue(string value, DataFlow::Node source, DataFlow::Node sink) {
25-
exists(string val | val = source.getStringValue() |
26-
// exclude dummy passwords and templates
27-
not (
28-
sink.(Sink).(DefaultCredentialsSink).getKind() = ["password", "credentials", "token", "key"] and
29-
PasswordHeuristics::isDummyPassword(val)
30-
or
31-
sink.(Sink).getKind() = "authorization header" and
32-
PasswordHeuristics::isDummyAuthHeader(val)
33-
or
34-
looksLikeATemplate(val)
35-
) and
36-
value = "The hard-coded value \"" + val + "\""
37-
)
38-
}
39-
4023
from Configuration cfg, DataFlow::PathNode source, DataFlow::PathNode sink, string value
4124
where
4225
cfg.hasFlowPath(source, sink) and
43-
// sink kind is "jwt key" and source is constant string
44-
if
45-
sink.getNode().(Sink).(DefaultCredentialsSink).getKind() = "jwt key" and
46-
// use source value in message if it's available
47-
source.getNode().asExpr() instanceof ConstantString
26+
// use source value in message if it's available
27+
if source.getNode().asExpr() instanceof ConstantString
4828
then
49-
not isTestFile(sink.getNode().getFile()) and
50-
updateMessageWithSourceValue(value, source.getNode(), sink.getNode())
51-
else
52-
// sink kind is "jwt key" and source is not constant string
53-
if
54-
sink.getNode().(Sink).(DefaultCredentialsSink).getKind() = "jwt key" and
55-
not source.getNode().asExpr() instanceof ConstantString
56-
then not isTestFile(sink.getNode().getFile()) and value = "This hard-coded value"
57-
else
58-
// sink kind is not "jwt key" and source is constant string
59-
if
60-
not sink.getNode().(Sink).(DefaultCredentialsSink).getKind() = "jwt key" and
61-
source.getNode().asExpr() instanceof ConstantString
62-
then updateMessageWithSourceValue(value, source.getNode(), sink.getNode())
63-
else value = "This hard-coded value"
29+
exists(string val | val = source.getNode().getStringValue() |
30+
// exclude dummy passwords and templates
31+
not (
32+
sink.getNode().(Sink).(DefaultCredentialsSink).getKind() =
33+
["password", "credentials", "token", "key"] and
34+
PasswordHeuristics::isDummyPassword(val)
35+
or
36+
sink.getNode().(Sink).getKind() = "authorization header" and
37+
PasswordHeuristics::isDummyAuthHeader(val)
38+
or
39+
looksLikeATemplate(val)
40+
) and
41+
value = "The hard-coded value \"" + val + "\""
42+
)
43+
else value = "This hard-coded value"
6444
select source.getNode(), source, sink, value + " is used as $@.", sink.getNode(),
65-
sink.getNode().(Sink).getKind()
45+
sink.getNode().(Sink).getKind()

‎javascript/ql/test/query-tests/Security/CWE-798/HardcodedCredentials.expected

Lines changed: 1 addition & 14 deletions
Original file line numberDiff line numberDiff line change
@@ -344,13 +344,6 @@ nodes
344344
| __tests__/HardcodedCredentialsDemo.js:8:19:8:28 | 'hgfedcba' |
345345
| __tests__/HardcodedCredentialsDemo.js:8:19:8:28 | 'hgfedcba' |
346346
| __tests__/HardcodedCredentialsDemo.js:8:19:8:28 | 'hgfedcba' |
347-
| __tests__/HardcodedCredentialsDemo.js:18:9:18:43 | secretKey |
348-
| __tests__/HardcodedCredentialsDemo.js:18:21:18:43 | "myHard ... ateKey" |
349-
| __tests__/HardcodedCredentialsDemo.js:18:21:18:43 | "myHard ... ateKey" |
350-
| __tests__/HardcodedCredentialsDemo.js:21:24:21:32 | secretKey |
351-
| __tests__/HardcodedCredentialsDemo.js:21:24:21:32 | secretKey |
352-
| __tests__/HardcodedCredentialsDemo.js:28:31:28:39 | secretKey |
353-
| __tests__/HardcodedCredentialsDemo.js:28:31:28:39 | secretKey |
354347
edges
355348
| HardcodedCredentials.js:5:15:5:22 | 'dbuser' | HardcodedCredentials.js:5:15:5:22 | 'dbuser' |
356349
| HardcodedCredentials.js:8:19:8:28 | 'hgfedcba' | HardcodedCredentials.js:8:19:8:28 | 'hgfedcba' |
@@ -532,12 +525,6 @@ edges
532525
| HardcodedCredentials.js:414:21:414:43 | "myHard ... ateKey" | HardcodedCredentials.js:414:9:414:43 | secretKey |
533526
| __tests__/HardcodedCredentialsDemo.js:5:15:5:22 | 'dbuser' | __tests__/HardcodedCredentialsDemo.js:5:15:5:22 | 'dbuser' |
534527
| __tests__/HardcodedCredentialsDemo.js:8:19:8:28 | 'hgfedcba' | __tests__/HardcodedCredentialsDemo.js:8:19:8:28 | 'hgfedcba' |
535-
| __tests__/HardcodedCredentialsDemo.js:18:9:18:43 | secretKey | __tests__/HardcodedCredentialsDemo.js:21:24:21:32 | secretKey |
536-
| __tests__/HardcodedCredentialsDemo.js:18:9:18:43 | secretKey | __tests__/HardcodedCredentialsDemo.js:21:24:21:32 | secretKey |
537-
| __tests__/HardcodedCredentialsDemo.js:18:9:18:43 | secretKey | __tests__/HardcodedCredentialsDemo.js:28:31:28:39 | secretKey |
538-
| __tests__/HardcodedCredentialsDemo.js:18:9:18:43 | secretKey | __tests__/HardcodedCredentialsDemo.js:28:31:28:39 | secretKey |
539-
| __tests__/HardcodedCredentialsDemo.js:18:21:18:43 | "myHard ... ateKey" | __tests__/HardcodedCredentialsDemo.js:18:9:18:43 | secretKey |
540-
| __tests__/HardcodedCredentialsDemo.js:18:21:18:43 | "myHard ... ateKey" | __tests__/HardcodedCredentialsDemo.js:18:9:18:43 | secretKey |
541528
#select
542529
| HardcodedCredentials.js:5:15:5:22 | 'dbuser' | HardcodedCredentials.js:5:15:5:22 | 'dbuser' | HardcodedCredentials.js:5:15:5:22 | 'dbuser' | The hard-coded value "dbuser" is used as $@. | HardcodedCredentials.js:5:15:5:22 | 'dbuser' | user name |
543530
| HardcodedCredentials.js:8:19:8:28 | 'hgfedcba' | HardcodedCredentials.js:8:19:8:28 | 'hgfedcba' | HardcodedCredentials.js:8:19:8:28 | 'hgfedcba' | The hard-coded value "hgfedcba" is used as $@. | HardcodedCredentials.js:8:19:8:28 | 'hgfedcba' | password |
@@ -616,4 +603,4 @@ edges
616603
| HardcodedCredentials.js:396:21:396:43 | "myHard ... ateKey" | HardcodedCredentials.js:396:21:396:43 | "myHard ... ateKey" | HardcodedCredentials.js:399:17:399:25 | secretKey | The hard-coded value "myHardCodedPrivateKey" is used as $@. | HardcodedCredentials.js:399:17:399:25 | secretKey | jwt key |
617604
| HardcodedCredentials.js:414:21:414:43 | "myHard ... ateKey" | HardcodedCredentials.js:414:21:414:43 | "myHard ... ateKey" | HardcodedCredentials.js:416:27:416:35 | secretKey | The hard-coded value "myHardCodedPrivateKey" is used as $@. | HardcodedCredentials.js:416:27:416:35 | secretKey | jwt key |
618605
| __tests__/HardcodedCredentialsDemo.js:5:15:5:22 | 'dbuser' | __tests__/HardcodedCredentialsDemo.js:5:15:5:22 | 'dbuser' | __tests__/HardcodedCredentialsDemo.js:5:15:5:22 | 'dbuser' | The hard-coded value "dbuser" is used as $@. | __tests__/HardcodedCredentialsDemo.js:5:15:5:22 | 'dbuser' | user name |
619-
| __tests__/HardcodedCredentialsDemo.js:8:19:8:28 | 'hgfedcba' | __tests__/HardcodedCredentialsDemo.js:8:19:8:28 | 'hgfedcba' | __tests__/HardcodedCredentialsDemo.js:8:19:8:28 | 'hgfedcba' | The hard-coded value "hgfedcba" is used as $@. | __tests__/HardcodedCredentialsDemo.js:8:19:8:28 | 'hgfedcba' | password |
606+
| __tests__/HardcodedCredentialsDemo.js:8:19:8:28 | 'hgfedcba' | __tests__/HardcodedCredentialsDemo.js:8:19:8:28 | 'hgfedcba' | __tests__/HardcodedCredentialsDemo.js:8:19:8:28 | 'hgfedcba' | The hard-coded value "hgfedcba" is used as $@. | __tests__/HardcodedCredentialsDemo.js:8:19:8:28 | 'hgfedcba' | password |

0 commit comments

Comments
 (0)