Skip to content

Commit 51067af

Browse files
erik-krogherik-krogh
committed
add "uid" (and friends) as maybe being sensitive account info
1 parent 9b0c24a commit 51067af

File tree

3 files changed

+50
-2
lines changed

3 files changed

+50
-2
lines changed

‎javascript/ql/src/semmle/javascript/security/internal/SensitiveDataHeuristics.qll‎

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -58,7 +58,8 @@ module HeuristicNames {
5858
*/
5959
string maybeAccountInfo() {
6060
result = "(?is).*acc(ou)?nt.*" or
61-
result = "(?is).*(puid|username|userid).*"
61+
result = "(?is).*(puid|username|userid).*" or
62+
result = "(?is).*(u|^|_|[a-z(?=U)])(uid).*"
6263
}
6364

6465
/**

‎javascript/ql/test/query-tests/Security/CWE-338/InsecureRandomness.expected‎

Lines changed: 40 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -66,6 +66,26 @@ nodes
6666
| tst.js:95:33:95:45 | Math.random() |
6767
| tst.js:95:33:95:45 | Math.random() |
6868
| tst.js:95:33:95:45 | Math.random() |
69+
| tst.js:115:16:115:56 | Math.fl ... 00_000) |
70+
| tst.js:115:16:115:56 | Math.fl ... 00_000) |
71+
| tst.js:115:27:115:39 | Math.random() |
72+
| tst.js:115:27:115:39 | Math.random() |
73+
| tst.js:115:27:115:55 | Math.ra ... 000_000 |
74+
| tst.js:116:22:116:62 | Math.fl ... 00_000) |
75+
| tst.js:116:22:116:62 | Math.fl ... 00_000) |
76+
| tst.js:116:33:116:45 | Math.random() |
77+
| tst.js:116:33:116:45 | Math.random() |
78+
| tst.js:116:33:116:61 | Math.ra ... 000_000 |
79+
| tst.js:117:15:117:55 | Math.fl ... 00_000) |
80+
| tst.js:117:15:117:55 | Math.fl ... 00_000) |
81+
| tst.js:117:26:117:38 | Math.random() |
82+
| tst.js:117:26:117:38 | Math.random() |
83+
| tst.js:117:26:117:54 | Math.ra ... 000_000 |
84+
| tst.js:118:23:118:63 | Math.fl ... 00_000) |
85+
| tst.js:118:23:118:63 | Math.fl ... 00_000) |
86+
| tst.js:118:34:118:46 | Math.random() |
87+
| tst.js:118:34:118:46 | Math.random() |
88+
| tst.js:118:34:118:62 | Math.ra ... 000_000 |
6989
edges
7090
| tst.js:2:20:2:32 | Math.random() | tst.js:2:20:2:32 | Math.random() |
7191
| tst.js:6:31:6:43 | Math.random() | tst.js:6:20:6:43 | "prefix ... andom() |
@@ -114,6 +134,22 @@ edges
114134
| tst.js:84:19:84:31 | Math.random() | tst.js:84:19:84:31 | Math.random() |
115135
| tst.js:90:32:90:44 | Math.random() | tst.js:90:32:90:44 | Math.random() |
116136
| tst.js:95:33:95:45 | Math.random() | tst.js:95:33:95:45 | Math.random() |
137+
| tst.js:115:27:115:39 | Math.random() | tst.js:115:27:115:55 | Math.ra ... 000_000 |
138+
| tst.js:115:27:115:39 | Math.random() | tst.js:115:27:115:55 | Math.ra ... 000_000 |
139+
| tst.js:115:27:115:55 | Math.ra ... 000_000 | tst.js:115:16:115:56 | Math.fl ... 00_000) |
140+
| tst.js:115:27:115:55 | Math.ra ... 000_000 | tst.js:115:16:115:56 | Math.fl ... 00_000) |
141+
| tst.js:116:33:116:45 | Math.random() | tst.js:116:33:116:61 | Math.ra ... 000_000 |
142+
| tst.js:116:33:116:45 | Math.random() | tst.js:116:33:116:61 | Math.ra ... 000_000 |
143+
| tst.js:116:33:116:61 | Math.ra ... 000_000 | tst.js:116:22:116:62 | Math.fl ... 00_000) |
144+
| tst.js:116:33:116:61 | Math.ra ... 000_000 | tst.js:116:22:116:62 | Math.fl ... 00_000) |
145+
| tst.js:117:26:117:38 | Math.random() | tst.js:117:26:117:54 | Math.ra ... 000_000 |
146+
| tst.js:117:26:117:38 | Math.random() | tst.js:117:26:117:54 | Math.ra ... 000_000 |
147+
| tst.js:117:26:117:54 | Math.ra ... 000_000 | tst.js:117:15:117:55 | Math.fl ... 00_000) |
148+
| tst.js:117:26:117:54 | Math.ra ... 000_000 | tst.js:117:15:117:55 | Math.fl ... 00_000) |
149+
| tst.js:118:34:118:46 | Math.random() | tst.js:118:34:118:62 | Math.ra ... 000_000 |
150+
| tst.js:118:34:118:46 | Math.random() | tst.js:118:34:118:62 | Math.ra ... 000_000 |
151+
| tst.js:118:34:118:62 | Math.ra ... 000_000 | tst.js:118:23:118:63 | Math.fl ... 00_000) |
152+
| tst.js:118:34:118:62 | Math.ra ... 000_000 | tst.js:118:23:118:63 | Math.fl ... 00_000) |
117153
#select
118154
| tst.js:2:20:2:32 | Math.random() | tst.js:2:20:2:32 | Math.random() | tst.js:2:20:2:32 | Math.random() | Cryptographically insecure $@ in a security context. | tst.js:2:20:2:32 | Math.random() | random value |
119155
| tst.js:6:20:6:43 | "prefix ... andom() | tst.js:6:31:6:43 | Math.random() | tst.js:6:20:6:43 | "prefix ... andom() | Cryptographically insecure $@ in a security context. | tst.js:6:31:6:43 | Math.random() | random value |
@@ -131,3 +167,7 @@ edges
131167
| tst.js:84:19:84:31 | Math.random() | tst.js:84:19:84:31 | Math.random() | tst.js:84:19:84:31 | Math.random() | Cryptographically insecure $@ in a security context. | tst.js:84:19:84:31 | Math.random() | random value |
132168
| tst.js:90:32:90:44 | Math.random() | tst.js:90:32:90:44 | Math.random() | tst.js:90:32:90:44 | Math.random() | Cryptographically insecure $@ in a security context. | tst.js:90:32:90:44 | Math.random() | random value |
133169
| tst.js:95:33:95:45 | Math.random() | tst.js:95:33:95:45 | Math.random() | tst.js:95:33:95:45 | Math.random() | Cryptographically insecure $@ in a security context. | tst.js:95:33:95:45 | Math.random() | random value |
170+
| tst.js:115:16:115:56 | Math.fl ... 00_000) | tst.js:115:27:115:39 | Math.random() | tst.js:115:16:115:56 | Math.fl ... 00_000) | Cryptographically insecure $@ in a security context. | tst.js:115:27:115:39 | Math.random() | random value |
171+
| tst.js:116:22:116:62 | Math.fl ... 00_000) | tst.js:116:33:116:45 | Math.random() | tst.js:116:22:116:62 | Math.fl ... 00_000) | Cryptographically insecure $@ in a security context. | tst.js:116:33:116:45 | Math.random() | random value |
172+
| tst.js:117:15:117:55 | Math.fl ... 00_000) | tst.js:117:26:117:38 | Math.random() | tst.js:117:15:117:55 | Math.fl ... 00_000) | Cryptographically insecure $@ in a security context. | tst.js:117:26:117:38 | Math.random() | random value |
173+
| tst.js:118:23:118:63 | Math.fl ... 00_000) | tst.js:118:34:118:46 | Math.random() | tst.js:118:23:118:63 | Math.fl ... 00_000) | Cryptographically insecure $@ in a security context. | tst.js:118:34:118:46 | Math.random() | random value |

‎javascript/ql/test/query-tests/Security/CWE-338/tst.js‎

Lines changed: 8 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -109,4 +109,11 @@ function f18() {
109109
}
110110
};
111111
var secret = genRandom(); // OK - Math.random() is only a fallback.
112-
})();
112+
})();
113+
114+
function uid() {
115+
var uuid = Math.floor(Math.random() * 4_000_000_000); // NOT OK
116+
var sessionUid = Math.floor(Math.random() * 4_000_000_000); // NOT OK
117+
var uid = Math.floor(Math.random() * 4_000_000_000); // NOT OK
118+
var my_nice_uid = Math.floor(Math.random() * 4_000_000_000); // NOT OK
119+
}

0 commit comments

Comments
 (0)