|
| 1 | +/** |
| 2 | + * @name Cross Origin Resource Sharing(CORS) Policy Bypass |
| 3 | + * @description Checking user supplied origin headers using weak comparators like 'string.startswith' may lead to CORS policy bypass. |
| 4 | + * @kind path-problem |
| 5 | + * @problem.severity warning |
| 6 | + * @id py/cors-bypass |
| 7 | + * @tags security |
| 8 | + * externa/cwe/CWE-346 |
| 9 | + */ |
| 10 | + |
| 11 | +import python |
| 12 | +import semmle.python.ApiGraphs |
| 13 | +import semmle.python.dataflow.new.TaintTracking |
| 14 | +import semmle.python.Flow |
| 15 | +import semmle.python.dataflow.new.RemoteFlowSources |
| 16 | + |
| 17 | +/** |
| 18 | + * Returns true if the control flow node may be useful in the current context. |
| 19 | + * |
| 20 | + * Ideally for more completeness, we should alert on every `startswith` call and every remote flow source which gets partailly checked. But, as this can lead to lots of FPs, we apply heuristics to filter some calls. This predicate provides logic for this filteration. |
| 21 | + */ |
| 22 | +private predicate maybeInteresting(ControlFlowNode c) { |
| 23 | + // Check if the name of the variable which calls the function matches the heuristic. |
| 24 | + // This would typically occur at the sink. |
| 25 | + // This should deal with cases like |
| 26 | + // `origin.startswith("bla")` |
| 27 | + heuristics(c.(CallNode).getFunction().(AttrNode).getObject().(NameNode).getId()) |
| 28 | + or |
| 29 | + // Check if the name of the variable passed as an argument to the functions matches the heuristic. This would typically occur at the sink. |
| 30 | + // This should deal with cases like |
| 31 | + // `bla.startswith(origin)` |
| 32 | + heuristics(c.(CallNode).getArg(0).(NameNode).getId()) |
| 33 | + or |
| 34 | + // Check if the value gets written to any interesting variable. This would typically occur at the source. |
| 35 | + // This should deal with cases like |
| 36 | + // `origin = request.headers.get('My-custom-header')` |
| 37 | + exists(Variable v | heuristics(v.getId()) | c.getASuccessor*().getNode() = v.getAStore()) |
| 38 | +} |
| 39 | + |
| 40 | +private class StringStartswithCall extends ControlFlowNode { |
| 41 | + StringStartswithCall() { this.(CallNode).getFunction().(AttrNode).getName() = "startswith" } |
| 42 | +} |
| 43 | + |
| 44 | +bindingset[s] |
| 45 | +predicate heuristics(string s) { s.matches(["%origin%", "%cors%"]) } |
| 46 | + |
| 47 | +/** |
| 48 | + * A member of the `cherrypy.request` class taken as a `RemoteFlowSource`. |
| 49 | + */ |
| 50 | +class CherryPyRequest extends RemoteFlowSource::Range { |
| 51 | + CherryPyRequest() { |
| 52 | + this = |
| 53 | + API::moduleImport("cherrypy") |
| 54 | + .getMember("request") |
| 55 | + .getMember([ |
| 56 | + "charset", "content_type", "filename", "fp", "name", "params", "headers", "length", |
| 57 | + ]) |
| 58 | + .asSource() |
| 59 | + } |
| 60 | + |
| 61 | + override string getSourceType() { result = "cherrypy.request" } |
| 62 | +} |
| 63 | + |
| 64 | +module CorsBypassConfig implements DataFlow::ConfigSig { |
| 65 | + predicate isSource(DataFlow::Node node) { node instanceof RemoteFlowSource } |
| 66 | + |
| 67 | + predicate isSink(DataFlow::Node node) { |
| 68 | + exists(StringStartswithCall s | |
| 69 | + node.asCfgNode() = s.(CallNode).getArg(0) or |
| 70 | + node.asCfgNode() = s.(CallNode).getFunction().(AttrNode).getObject() |
| 71 | + ) |
| 72 | + } |
| 73 | + |
| 74 | + predicate isAdditionalFlowStep(DataFlow::Node node1, DataFlow::Node node2) { |
| 75 | + exists(API::CallNode c, API::Node n | |
| 76 | + n = API::moduleImport("cherrypy").getMember("request").getMember("headers") and |
| 77 | + c = n.getMember("get").getACall() |
| 78 | + | |
| 79 | + c.getReturn().asSource() = node2 and n.asSource() = node1 |
| 80 | + ) |
| 81 | + } |
| 82 | +} |
| 83 | + |
| 84 | +module CorsFlow = TaintTracking::Global<CorsBypassConfig>; |
| 85 | + |
| 86 | +import CorsFlow::PathGraph |
| 87 | + |
| 88 | +from CorsFlow::PathNode source, CorsFlow::PathNode sink |
| 89 | +where |
| 90 | + CorsFlow::flowPath(source, sink) and |
| 91 | + ( |
| 92 | + maybeInteresting(source.getNode().asCfgNode()) |
| 93 | + or |
| 94 | + maybeInteresting(sink.getNode().asCfgNode()) |
| 95 | + ) |
| 96 | +select sink, source, sink, |
| 97 | + "Potentially incorrect string comparison which could lead to a CORS bypass." |
0 commit comments