Skip to content

Commit 0638907

Browse files
semmle-qlcisemmle-qlci
authored
Merge pull request #2324 from esbena/js/torrent-as-remote-source
Approved by max-schaefer
2 parents 7408726 + cc76834 commit 0638907

File tree

15 files changed

+174
-0
lines changed

15 files changed

+174
-0
lines changed

‎change-notes/1.23/analysis-javascript.md‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -10,6 +10,7 @@
1010
- [firebase](https://www.npmjs.com/package/firebase)
1111
- [mongodb](https://www.npmjs.com/package/mongodb)
1212
- [mongoose](https://www.npmjs.com/package/mongoose)
13+
- [parse-torrent](https://github.com/webtorrent/parse-torrent)
1314
- [rate-limiter-flexible](https://www.npmjs.com/package/rate-limiter-flexible)
1415

1516
* The call graph has been improved to resolve method calls in more cases. This may produce more security alerts.

‎javascript/ql/src/javascript.qll‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -90,6 +90,7 @@ import semmle.javascript.frameworks.SystemCommandExecutors
9090
import semmle.javascript.frameworks.SQL
9191
import semmle.javascript.frameworks.SocketIO
9292
import semmle.javascript.frameworks.StringFormatters
93+
import semmle.javascript.frameworks.TorrentLibraries
9394
import semmle.javascript.frameworks.UriLibraries
9495
import semmle.javascript.frameworks.Vue
9596
import semmle.javascript.frameworks.XmlParsers

‎javascript/ql/src/semmle/javascript/frameworks/TorrentLibraries.qll‎

Lines changed: 61 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,61 @@
1+
/**
2+
* Provides classes for modelling Torrent libraries.
3+
*/
4+
5+
import javascript
6+
7+
/**
8+
* Provides classes for working with [parse-torrent](https://github.com/webtorrent/parse-torrent) code.
9+
*/
10+
module ParseTorrent {
11+
private DataFlow::SourceNode mod() { result = DataFlow::moduleImport("parse-torrent") }
12+
13+
/**
14+
* A torrent that has been parsed into a JavaScript object.
15+
*/
16+
class ParsedTorrent extends DataFlow::SourceNode {
17+
ParsedTorrent() {
18+
this = mod().getACall() or
19+
this = mod().getAMemberCall("remote").getCallback(1).getParameter(1)
20+
}
21+
}
22+
23+
private DataFlow::SourceNode parsedTorrentRef(DataFlow::TypeTracker t) {
24+
t.start() and
25+
result instanceof ParsedTorrent
26+
or
27+
exists(DataFlow::TypeTracker t2 | result = parsedTorrentRef(t2).track(t2, t))
28+
}
29+
30+
/** Gets a data flow node referring to a parsed torrent. */
31+
DataFlow::SourceNode parsedTorrentRef() {
32+
result = parsedTorrentRef(DataFlow::TypeTracker::end())
33+
}
34+
35+
/**
36+
* An access to user-controlled torrent information.
37+
*/
38+
class UserControlledTorrentInfo extends RemoteFlowSource {
39+
UserControlledTorrentInfo() {
40+
exists(DataFlow::SourceNode ref, DataFlow::PropRead read |
41+
ref = parsedTorrentRef() and
42+
read = ref.getAPropertyRead() and
43+
this = read
44+
|
45+
exists(string prop |
46+
not (
47+
prop = "private" or
48+
prop = "infoHash" or
49+
prop = "length"
50+
// "pieceLength" and "lastPieceLength" are not guaranteed to be numbers as of commit ae3ad15d
51+
) and
52+
read.getPropertyName() = prop
53+
)
54+
or
55+
not exists(read.getPropertyName())
56+
)
57+
}
58+
59+
override string getSourceType() { result = "torrent information" }
60+
}
61+
}

‎javascript/ql/src/semmle/javascript/security/dataflow/StoredXss.qll‎

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -28,4 +28,9 @@ module StoredXss {
2828
class FileNameSourceAsSource extends Source {
2929
FileNameSourceAsSource() { this instanceof FileNameSource }
3030
}
31+
32+
/** User-controlled torrent information, considered as a flow source for stored XSS. */
33+
class UserControlledTorrentInfoAsSource extends Source {
34+
UserControlledTorrentInfoAsSource() { this instanceof ParseTorrent::UserControlledTorrentInfo }
35+
}
3136
}

‎javascript/ql/test/library-tests/TorrentLibraries/ParsedTorrent.expected‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1 @@
1+
| tst.js:4:15:4:28 | parseTorrent() |

‎javascript/ql/test/library-tests/TorrentLibraries/ParsedTorrent.ql‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,3 @@
1+
import javascript
2+
3+
select any(ParseTorrent::ParsedTorrent t)

‎javascript/ql/test/library-tests/TorrentLibraries/UserControlledTorrentInfo.expected‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,4 @@
1+
| tst.js:6:2:6:12 | parsed.name |
2+
| tst.js:8:2:8:19 | parsed.pieceLength |
3+
| tst.js:14:2:14:25 | indirec ... ed.name |
4+
| tst.js:20:2:20:7 | t.name |

‎javascript/ql/test/library-tests/TorrentLibraries/UserControlledTorrentInfo.ql‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,3 @@
1+
import javascript
2+
3+
select any(ParseTorrent::UserControlledTorrentInfo i)

‎javascript/ql/test/library-tests/TorrentLibraries/parsedTorrentRef.expected‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,3 @@
1+
| tst.js:4:15:4:28 | parseTorrent() |
2+
| tst.js:14:2:14:20 | indirection1.parsed |
3+
| tst.js:19:23:19:23 | t |

‎javascript/ql/test/library-tests/TorrentLibraries/parsedTorrentRef.ql‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,3 @@
1+
import javascript
2+
3+
select ParseTorrent::parsedTorrentRef()

0 commit comments

Comments
 (0)