Skip to content

Commit 4f83907

Browse files
asgerfasgerf
committed
JS: Port experimental EnvValueAndKeyInjection to ConfigSig
1 parent 8887ca1 commit 4f83907

File tree

2 files changed

+40
-62
lines changed

2 files changed

+40
-62
lines changed

‎javascript/ql/src/experimental/Security/CWE-099/EnvValueAndKeyInjection.ql‎

Lines changed: 12 additions & 11 deletions
Original file line numberDiff line numberDiff line change
@@ -11,20 +11,17 @@
1111
*/
1212

1313
import javascript
14-
import DataFlow::PathGraph
1514

1615
/** A taint tracking configuration for unsafe environment injection. */
17-
class Configuration extends TaintTracking::Configuration {
18-
Configuration() { this = "envInjection" }
16+
module EnvValueAndKeyInjectionConfig implements DataFlow::ConfigSig {
17+
predicate isSource(DataFlow::Node source) { source instanceof ActiveThreatModelSource }
1918

20-
override predicate isSource(DataFlow::Node source) { source instanceof RemoteFlowSource }
21-
22-
override predicate isSink(DataFlow::Node sink) {
19+
predicate isSink(DataFlow::Node sink) {
2320
sink = keyOfEnv() or
2421
sink = valueOfEnv()
2522
}
2623

27-
override predicate isAdditionalTaintStep(DataFlow::Node pred, DataFlow::Node succ) {
24+
predicate isAdditionalFlowStep(DataFlow::Node pred, DataFlow::Node succ) {
2825
exists(DataFlow::InvokeNode ikn |
2926
ikn = DataFlow::globalVarRef("Object").getAMemberInvocation("keys")
3027
|
@@ -38,6 +35,8 @@ class Configuration extends TaintTracking::Configuration {
3835
}
3936
}
4037

38+
module EnvValueAndKeyInjectionFlow = TaintTracking::Global<EnvValueAndKeyInjectionConfig>;
39+
4140
DataFlow::Node keyOfEnv() {
4241
result =
4342
NodeJSLib::process().getAPropertyRead("env").getAPropertyWrite().getPropertyNameExpr().flow()
@@ -56,13 +55,15 @@ private predicate readToProcessEnv(DataFlow::Node envKey, DataFlow::Node envValu
5655
)
5756
}
5857

58+
import EnvValueAndKeyInjectionFlow::PathGraph
59+
5960
from
60-
Configuration cfgForValue, Configuration cfgForKey, DataFlow::PathNode source,
61-
DataFlow::PathNode envKey, DataFlow::PathNode envValue
61+
EnvValueAndKeyInjectionFlow::PathNode source, EnvValueAndKeyInjectionFlow::PathNode envKey,
62+
EnvValueAndKeyInjectionFlow::PathNode envValue
6263
where
63-
cfgForValue.hasFlowPath(source, envKey) and
64+
EnvValueAndKeyInjectionFlow::flowPath(source, envKey) and
6465
envKey.getNode() = keyOfEnv() and
65-
cfgForKey.hasFlowPath(source, envValue) and
66+
EnvValueAndKeyInjectionFlow::flowPath(source, envValue) and
6667
envValue.getNode() = valueOfEnv() and
6768
readToProcessEnv(envKey.getNode(), envValue.getNode())
6869
select envKey.getNode(), source, envKey, "arbitrary environment variable assignment from this $@.",

‎javascript/ql/test/experimental/Security/CWE-099/EnvValueAndKeyInjection/EnvValueAndKeyInjection.expected‎

Lines changed: 28 additions & 51 deletions
Original file line numberDiff line numberDiff line change
@@ -1,55 +1,32 @@
1-
nodes
2-
| test.js:5:9:5:28 | { EnvValue, EnvKey } |
3-
| test.js:5:9:5:39 | EnvKey |
4-
| test.js:5:9:5:39 | EnvValue |
5-
| test.js:5:11:5:18 | EnvValue |
6-
| test.js:5:21:5:26 | EnvKey |
7-
| test.js:5:32:5:39 | req.body |
8-
| test.js:5:32:5:39 | req.body |
9-
| test.js:6:15:6:20 | EnvKey |
10-
| test.js:6:15:6:20 | EnvKey |
11-
| test.js:6:25:6:32 | EnvValue |
12-
| test.js:6:25:6:32 | EnvValue |
13-
| test.js:7:15:7:20 | EnvKey |
14-
| test.js:7:15:7:20 | EnvKey |
15-
| test.js:7:25:7:32 | EnvValue |
16-
| test.js:7:25:7:32 | EnvValue |
17-
| test.js:13:9:13:28 | { EnvValue, EnvKey } |
18-
| test.js:13:9:13:39 | EnvKey |
19-
| test.js:13:9:13:39 | EnvValue |
20-
| test.js:13:11:13:18 | EnvValue |
21-
| test.js:13:21:13:26 | EnvKey |
22-
| test.js:13:32:13:39 | req.body |
23-
| test.js:13:32:13:39 | req.body |
24-
| test.js:15:15:15:20 | EnvKey |
25-
| test.js:15:15:15:20 | EnvKey |
26-
| test.js:16:26:16:33 | EnvValue |
27-
| test.js:16:26:16:33 | EnvValue |
281
edges
29-
| test.js:5:9:5:28 | { EnvValue, EnvKey } | test.js:5:11:5:18 | EnvValue |
30-
| test.js:5:9:5:28 | { EnvValue, EnvKey } | test.js:5:21:5:26 | EnvKey |
31-
| test.js:5:9:5:39 | EnvKey | test.js:6:15:6:20 | EnvKey |
32-
| test.js:5:9:5:39 | EnvKey | test.js:6:15:6:20 | EnvKey |
33-
| test.js:5:9:5:39 | EnvKey | test.js:7:15:7:20 | EnvKey |
34-
| test.js:5:9:5:39 | EnvKey | test.js:7:15:7:20 | EnvKey |
35-
| test.js:5:9:5:39 | EnvValue | test.js:6:25:6:32 | EnvValue |
36-
| test.js:5:9:5:39 | EnvValue | test.js:6:25:6:32 | EnvValue |
37-
| test.js:5:9:5:39 | EnvValue | test.js:7:25:7:32 | EnvValue |
38-
| test.js:5:9:5:39 | EnvValue | test.js:7:25:7:32 | EnvValue |
39-
| test.js:5:11:5:18 | EnvValue | test.js:5:9:5:39 | EnvValue |
40-
| test.js:5:21:5:26 | EnvKey | test.js:5:9:5:39 | EnvKey |
41-
| test.js:5:32:5:39 | req.body | test.js:5:9:5:28 | { EnvValue, EnvKey } |
42-
| test.js:5:32:5:39 | req.body | test.js:5:9:5:28 | { EnvValue, EnvKey } |
43-
| test.js:13:9:13:28 | { EnvValue, EnvKey } | test.js:13:11:13:18 | EnvValue |
44-
| test.js:13:9:13:28 | { EnvValue, EnvKey } | test.js:13:21:13:26 | EnvKey |
45-
| test.js:13:9:13:39 | EnvKey | test.js:15:15:15:20 | EnvKey |
46-
| test.js:13:9:13:39 | EnvKey | test.js:15:15:15:20 | EnvKey |
47-
| test.js:13:9:13:39 | EnvValue | test.js:16:26:16:33 | EnvValue |
48-
| test.js:13:9:13:39 | EnvValue | test.js:16:26:16:33 | EnvValue |
49-
| test.js:13:11:13:18 | EnvValue | test.js:13:9:13:39 | EnvValue |
50-
| test.js:13:21:13:26 | EnvKey | test.js:13:9:13:39 | EnvKey |
51-
| test.js:13:32:13:39 | req.body | test.js:13:9:13:28 | { EnvValue, EnvKey } |
52-
| test.js:13:32:13:39 | req.body | test.js:13:9:13:28 | { EnvValue, EnvKey } |
2+
| test.js:5:9:5:28 | { EnvValue, EnvKey } | test.js:5:9:5:39 | EnvKey | provenance | |
3+
| test.js:5:9:5:28 | { EnvValue, EnvKey } | test.js:5:9:5:39 | EnvValue | provenance | |
4+
| test.js:5:9:5:39 | EnvKey | test.js:6:15:6:20 | EnvKey | provenance | |
5+
| test.js:5:9:5:39 | EnvKey | test.js:7:15:7:20 | EnvKey | provenance | |
6+
| test.js:5:9:5:39 | EnvValue | test.js:6:25:6:32 | EnvValue | provenance | |
7+
| test.js:5:9:5:39 | EnvValue | test.js:7:25:7:32 | EnvValue | provenance | |
8+
| test.js:5:32:5:39 | req.body | test.js:5:9:5:28 | { EnvValue, EnvKey } | provenance | |
9+
| test.js:13:9:13:28 | { EnvValue, EnvKey } | test.js:13:9:13:39 | EnvKey | provenance | |
10+
| test.js:13:9:13:28 | { EnvValue, EnvKey } | test.js:13:9:13:39 | EnvValue | provenance | |
11+
| test.js:13:9:13:39 | EnvKey | test.js:15:15:15:20 | EnvKey | provenance | |
12+
| test.js:13:9:13:39 | EnvValue | test.js:16:26:16:33 | EnvValue | provenance | |
13+
| test.js:13:32:13:39 | req.body | test.js:13:9:13:28 | { EnvValue, EnvKey } | provenance | |
14+
nodes
15+
| test.js:5:9:5:28 | { EnvValue, EnvKey } | semmle.label | { EnvValue, EnvKey } |
16+
| test.js:5:9:5:39 | EnvKey | semmle.label | EnvKey |
17+
| test.js:5:9:5:39 | EnvValue | semmle.label | EnvValue |
18+
| test.js:5:32:5:39 | req.body | semmle.label | req.body |
19+
| test.js:6:15:6:20 | EnvKey | semmle.label | EnvKey |
20+
| test.js:6:25:6:32 | EnvValue | semmle.label | EnvValue |
21+
| test.js:7:15:7:20 | EnvKey | semmle.label | EnvKey |
22+
| test.js:7:25:7:32 | EnvValue | semmle.label | EnvValue |
23+
| test.js:13:9:13:28 | { EnvValue, EnvKey } | semmle.label | { EnvValue, EnvKey } |
24+
| test.js:13:9:13:39 | EnvKey | semmle.label | EnvKey |
25+
| test.js:13:9:13:39 | EnvValue | semmle.label | EnvValue |
26+
| test.js:13:32:13:39 | req.body | semmle.label | req.body |
27+
| test.js:15:15:15:20 | EnvKey | semmle.label | EnvKey |
28+
| test.js:16:26:16:33 | EnvValue | semmle.label | EnvValue |
29+
subpaths
5330
#select
5431
| test.js:6:15:6:20 | EnvKey | test.js:5:32:5:39 | req.body | test.js:6:15:6:20 | EnvKey | arbitrary environment variable assignment from this $@. | test.js:5:32:5:39 | req.body | user controllable source |
5532
| test.js:7:15:7:20 | EnvKey | test.js:5:32:5:39 | req.body | test.js:7:15:7:20 | EnvKey | arbitrary environment variable assignment from this $@. | test.js:5:32:5:39 | req.body | user controllable source |

0 commit comments

Comments
 (0)