Skip to content

Commit ba8a37c

Browse files
MathiasVPMathiasVP
committed
PS: Add more injetion sinks and type models.
1 parent 308afb9 commit ba8a37c

File tree

11 files changed

+99
-4
lines changed

11 files changed

+99
-4
lines changed

‎powershell/ql/lib/semmle/code/powershell/Frameworks.qll

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -2,3 +2,6 @@
22
* Helper file that imports all framework modeling.
33
*/
44

5+
import semmle.code.powershell.frameworks.SystemManagementAutomationRunspaces.Runspaces
6+
import semmle.code.powershell.frameworks.SystemManagementAutomationPowerShell.PowerShell
7+
import semmle.code.powershell.frameworks.SystemManagementAutomationEngineIntrinsics.EngineIntrinsics

‎powershell/ql/lib/semmle/code/powershell/dataflow/FlowSummary.qll

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -13,6 +13,9 @@ private import internal.DataFlowPrivate
1313
private module Summaries {
1414
private import semmle.code.powershell.Frameworks
1515
private import semmle.code.powershell.frameworks.data.ModelsAsData
16+
import RunspaceFactory
17+
import PowerShell
18+
import EngineIntrinsics
1619
}
1720

1821
/** A callable with a flow summary, identified by a unique string. */

‎powershell/ql/lib/semmle/code/powershell/frameworks/SystemManagementAutomationEngineIntrinsics/EngineIntrinsics.qll

Lines changed: 12 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,12 @@
1+
import powershell
2+
import semmle.code.powershell.frameworks.data.internal.ApiGraphModels
3+
private import semmle.code.powershell.dataflow.internal.DataFlowPublic as DataFlow
4+
5+
module EngineIntrinsics {
6+
private class EngineIntrinsicsGlobalEntry extends ModelInput::TypeModel {
7+
override DataFlow::Node getASource(string type) {
8+
type = "System.Management.Automation.EngineIntrinsics" and
9+
result.asExpr().getExpr().(VarReadAccess).getUserPath().toLowerCase() = "executioncontext"
10+
}
11+
}
12+
}

‎powershell/ql/lib/semmle/code/powershell/frameworks/SystemManagementAutomationEngineIntrinsics/model.yml

Lines changed: 12 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,12 @@
1+
extensions:
2+
- addsTo:
3+
pack: microsoft-sdl/powershell-all
4+
extensible: sinkModel
5+
data:
6+
- ["System.Management.Automation.CommandInvocationIntrinsics", "Method[ExpandString].Argument[0]", "command-injection"]
7+
8+
- addsTo:
9+
pack: microsoft-sdl/powershell-all
10+
extensible: typeModel
11+
data:
12+
- ["System.Management.Automation.CommandInvocationIntrinsics","System.Management.Automation.EngineIntrinsics","Member[InvokeCommand]"]

‎powershell/ql/lib/semmle/code/powershell/frameworks/SystemManagementAutomationPowerShell/PowerShell.qll

Lines changed: 12 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,12 @@
1+
import powershell
2+
import semmle.code.powershell.frameworks.data.internal.ApiGraphModels
3+
private import semmle.code.powershell.dataflow.internal.DataFlowPublic as DataFlow
4+
5+
module PowerShell {
6+
private class PowerShellGlobalEntry extends ModelInput::TypeModel {
7+
override DataFlow::Node getASource(string type) {
8+
type = "System.Management.Automation.PowerShell!" and
9+
result.asExpr().getExpr().(TypeNameExpr).getName().toLowerCase() = "powershell"
10+
}
11+
}
12+
}

‎powershell/ql/lib/semmle/code/powershell/frameworks/SystemManagementAutomationPowerShell/model.yml

Lines changed: 13 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,13 @@
1+
extensions:
2+
- addsTo:
3+
pack: microsoft-sdl/powershell-all
4+
extensible: sinkModel
5+
data:
6+
- ["System.Management.Automation.PowerShell", "Method[AddScript].Argument[0]", "command-injection"]
7+
- ["System.Management.Automation.ScriptBlock!", "Method[Create].Argument[0]", "command-injection"]
8+
9+
- addsTo:
10+
pack: microsoft-sdl/powershell-all
11+
extensible: typeModel
12+
data:
13+
- ["System.Management.Automation.PowerShell","System.Management.Automation.PowerShell!","Method[Create].ReturnValue"]

‎powershell/ql/lib/semmle/code/powershell/frameworks/SystemManagementAutomationRunspaces/Runspaces.qll

Lines changed: 12 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,12 @@
1+
import powershell
2+
import semmle.code.powershell.frameworks.data.internal.ApiGraphModels
3+
private import semmle.code.powershell.dataflow.internal.DataFlowPublic as DataFlow
4+
5+
module RunspaceFactory {
6+
private class RunspaceFactoryGlobalEntry extends ModelInput::TypeModel {
7+
override DataFlow::Node getASource(string type) {
8+
type = "System.Management.Automation.Runspaces.RunspaceFactory!" and
9+
result.asExpr().getExpr().(TypeNameExpr).getName().toLowerCase() = "runspacefactory"
10+
}
11+
}
12+
}

‎powershell/ql/lib/semmle/code/powershell/frameworks/SystemManagementAutomationRunspaces/model.yml

Lines changed: 13 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,13 @@
1+
extensions:
2+
- addsTo:
3+
pack: microsoft-sdl/powershell-all
4+
extensible: sinkModel
5+
data:
6+
- ["System.Management.Automation.Runspaces.Runspace", "Method[CreateNestedPipeline].Argument[0]", "command-injection"]
7+
- ["System.Management.Automation.Runspaces.Runspace", "Method[CreatePipeline].Argument[0]", "command-injection"]
8+
9+
- addsTo:
10+
pack: microsoft-sdl/powershell-all
11+
extensible: typeModel
12+
data:
13+
- ["System.Management.Automation.Runspaces.Runspace","System.Management.Automation.Runspaces.RunspaceFactory!","Method[CreateRunspace].ReturnValue"]

‎powershell/ql/lib/semmle/code/powershell/frameworks/SystemManagementAutomationScriptBlock/model.yml

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,6 @@
1+
extensions:
2+
- addsTo:
3+
pack: microsoft-sdl/powershell-all
4+
extensible: sinkModel
5+
data:
6+
- ["System.Management.Automation.ScriptBlock!", "Method[Create].Argument[0]", "command-injection"]

‎powershell/ql/lib/semmle/code/powershell/frameworks/SystemNetSockets/model.yml

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -3,7 +3,7 @@ extensions:
33
pack: microsoft-sdl/powershell-all
44
extensible: sourceModel
55
data:
6-
- ["System.Net.Sockets.TcpClient", "Instance.Method[GetStream].ReturnValue", "remote"]
7-
- ["System.Net.Sockets.UpdClient", "Instance.Method[EndReceive].ReturnValue", "remote"]
8-
- ["System.Net.Sockets.UpdClient", "Instance.Method[Receive].ReturnValue", "remote"]
9-
- ["System.Net.Sockets.UpdClient", "Instance.Method[ReceiveAsync].ReturnValue", "remote"]
6+
- ["System.Net.Sockets.TcpClient", "Method[GetStream].ReturnValue", "remote"]
7+
- ["System.Net.Sockets.UpdClient", "Method[EndReceive].ReturnValue", "remote"]
8+
- ["System.Net.Sockets.UpdClient", "Method[Receive].ReturnValue", "remote"]
9+
- ["System.Net.Sockets.UpdClient", "Method[ReceiveAsync].ReturnValue", "remote"]

0 commit comments

Comments
 (0)