Skip to content

Commit 6c2c51a

Browse files
codeql-cicodeql-ci
authored
Merge pull request #6287 from erik-krogh/react-tooltip
Approved by asgerf
2 parents d4fa1f7 + 22dfe84 commit 6c2c51a

File tree

5 files changed

+60
-0
lines changed

5 files changed

+60
-0
lines changed

‎javascript/change-notes/2021-07-14-react-tooltip.md‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,4 @@
1+
lgtm,codescanning
2+
* The XSS queries now recognize when the `react-tooltip` library is being used with HTML.
3+
Affected packages are
4+
[react-tooltip](https://npmjs.com/package/react-tooltip)

‎javascript/ql/src/semmle/javascript/security/dataflow/Xss.qll‎

Lines changed: 14 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -318,6 +318,20 @@ module DomBasedXss {
318318
}
319319
}
320320

321+
/**
322+
* A React tooltip where the `data-html` attribute is set to `true`.
323+
*/
324+
class TooltipSink extends Sink {
325+
TooltipSink() {
326+
exists(JSXElement el |
327+
el.getAttributeByName("data-html").getStringValue() = "true" or
328+
el.getAttributeByName("data-html").getValue().mayHaveBooleanValue(true)
329+
|
330+
this = el.getAttributeByName("data-tip").getValue().flow()
331+
)
332+
}
333+
}
334+
321335
/**
322336
* The HTML body of an email, viewed as an XSS sink.
323337
*/

‎javascript/ql/test/query-tests/Security/CWE-079/DomBasedXss/Xss.expected‎

Lines changed: 15 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -374,6 +374,13 @@ nodes
374374
| string-manipulations.js:10:16:10:45 | String( ... n.href) |
375375
| string-manipulations.js:10:23:10:44 | documen ... on.href |
376376
| string-manipulations.js:10:23:10:44 | documen ... on.href |
377+
| tooltip.jsx:6:11:6:30 | source |
378+
| tooltip.jsx:6:20:6:30 | window.name |
379+
| tooltip.jsx:6:20:6:30 | window.name |
380+
| tooltip.jsx:10:25:10:30 | source |
381+
| tooltip.jsx:10:25:10:30 | source |
382+
| tooltip.jsx:11:25:11:30 | source |
383+
| tooltip.jsx:11:25:11:30 | source |
377384
| translate.js:6:7:6:39 | target |
378385
| translate.js:6:16:6:39 | documen ... .search |
379386
| translate.js:6:16:6:39 | documen ... .search |
@@ -1085,6 +1092,12 @@ edges
10851092
| string-manipulations.js:10:23:10:44 | documen ... on.href | string-manipulations.js:10:16:10:45 | String( ... n.href) |
10861093
| string-manipulations.js:10:23:10:44 | documen ... on.href | string-manipulations.js:10:16:10:45 | String( ... n.href) |
10871094
| string-manipulations.js:10:23:10:44 | documen ... on.href | string-manipulations.js:10:16:10:45 | String( ... n.href) |
1095+
| tooltip.jsx:6:11:6:30 | source | tooltip.jsx:10:25:10:30 | source |
1096+
| tooltip.jsx:6:11:6:30 | source | tooltip.jsx:10:25:10:30 | source |
1097+
| tooltip.jsx:6:11:6:30 | source | tooltip.jsx:11:25:11:30 | source |
1098+
| tooltip.jsx:6:11:6:30 | source | tooltip.jsx:11:25:11:30 | source |
1099+
| tooltip.jsx:6:20:6:30 | window.name | tooltip.jsx:6:11:6:30 | source |
1100+
| tooltip.jsx:6:20:6:30 | window.name | tooltip.jsx:6:11:6:30 | source |
10881101
| translate.js:6:7:6:39 | target | translate.js:7:42:7:47 | target |
10891102
| translate.js:6:16:6:39 | documen ... .search | translate.js:6:7:6:39 | target |
10901103
| translate.js:6:16:6:39 | documen ... .search | translate.js:6:7:6:39 | target |
@@ -1498,6 +1511,8 @@ edges
14981511
| string-manipulations.js:8:16:8:48 | documen ... mLeft() | string-manipulations.js:8:16:8:37 | documen ... on.href | string-manipulations.js:8:16:8:48 | documen ... mLeft() | Cross-site scripting vulnerability due to $@. | string-manipulations.js:8:16:8:37 | documen ... on.href | user-provided value |
14991512
| string-manipulations.js:9:16:9:58 | String. ... n.href) | string-manipulations.js:9:36:9:57 | documen ... on.href | string-manipulations.js:9:16:9:58 | String. ... n.href) | Cross-site scripting vulnerability due to $@. | string-manipulations.js:9:36:9:57 | documen ... on.href | user-provided value |
15001513
| string-manipulations.js:10:16:10:45 | String( ... n.href) | string-manipulations.js:10:23:10:44 | documen ... on.href | string-manipulations.js:10:16:10:45 | String( ... n.href) | Cross-site scripting vulnerability due to $@. | string-manipulations.js:10:23:10:44 | documen ... on.href | user-provided value |
1514+
| tooltip.jsx:10:25:10:30 | source | tooltip.jsx:6:20:6:30 | window.name | tooltip.jsx:10:25:10:30 | source | Cross-site scripting vulnerability due to $@. | tooltip.jsx:6:20:6:30 | window.name | user-provided value |
1515+
| tooltip.jsx:11:25:11:30 | source | tooltip.jsx:6:20:6:30 | window.name | tooltip.jsx:11:25:11:30 | source | Cross-site scripting vulnerability due to $@. | tooltip.jsx:6:20:6:30 | window.name | user-provided value |
15011516
| translate.js:9:27:9:50 | searchP ... 'term') | translate.js:6:16:6:39 | documen ... .search | translate.js:9:27:9:50 | searchP ... 'term') | Cross-site scripting vulnerability due to $@. | translate.js:6:16:6:39 | documen ... .search | user-provided value |
15021517
| tst3.js:4:25:4:32 | data.src | tst3.js:2:42:2:63 | window. ... .search | tst3.js:4:25:4:32 | data.src | Cross-site scripting vulnerability due to $@. | tst3.js:2:42:2:63 | window. ... .search | user-provided value |
15031518
| tst3.js:5:26:5:31 | data.p | tst3.js:2:42:2:63 | window. ... .search | tst3.js:5:26:5:31 | data.p | Cross-site scripting vulnerability due to $@. | tst3.js:2:42:2:63 | window. ... .search | user-provided value |

‎javascript/ql/test/query-tests/Security/CWE-079/DomBasedXss/XssWithAdditionalSources.expected‎

Lines changed: 13 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -381,6 +381,13 @@ nodes
381381
| string-manipulations.js:10:16:10:45 | String( ... n.href) |
382382
| string-manipulations.js:10:23:10:44 | documen ... on.href |
383383
| string-manipulations.js:10:23:10:44 | documen ... on.href |
384+
| tooltip.jsx:6:11:6:30 | source |
385+
| tooltip.jsx:6:20:6:30 | window.name |
386+
| tooltip.jsx:6:20:6:30 | window.name |
387+
| tooltip.jsx:10:25:10:30 | source |
388+
| tooltip.jsx:10:25:10:30 | source |
389+
| tooltip.jsx:11:25:11:30 | source |
390+
| tooltip.jsx:11:25:11:30 | source |
384391
| translate.js:6:7:6:39 | target |
385392
| translate.js:6:16:6:39 | documen ... .search |
386393
| translate.js:6:16:6:39 | documen ... .search |
@@ -1109,6 +1116,12 @@ edges
11091116
| string-manipulations.js:10:23:10:44 | documen ... on.href | string-manipulations.js:10:16:10:45 | String( ... n.href) |
11101117
| string-manipulations.js:10:23:10:44 | documen ... on.href | string-manipulations.js:10:16:10:45 | String( ... n.href) |
11111118
| string-manipulations.js:10:23:10:44 | documen ... on.href | string-manipulations.js:10:16:10:45 | String( ... n.href) |
1119+
| tooltip.jsx:6:11:6:30 | source | tooltip.jsx:10:25:10:30 | source |
1120+
| tooltip.jsx:6:11:6:30 | source | tooltip.jsx:10:25:10:30 | source |
1121+
| tooltip.jsx:6:11:6:30 | source | tooltip.jsx:11:25:11:30 | source |
1122+
| tooltip.jsx:6:11:6:30 | source | tooltip.jsx:11:25:11:30 | source |
1123+
| tooltip.jsx:6:20:6:30 | window.name | tooltip.jsx:6:11:6:30 | source |
1124+
| tooltip.jsx:6:20:6:30 | window.name | tooltip.jsx:6:11:6:30 | source |
11121125
| translate.js:6:7:6:39 | target | translate.js:7:42:7:47 | target |
11131126
| translate.js:6:16:6:39 | documen ... .search | translate.js:6:7:6:39 | target |
11141127
| translate.js:6:16:6:39 | documen ... .search | translate.js:6:7:6:39 | target |

‎javascript/ql/test/query-tests/Security/CWE-079/DomBasedXss/tooltip.jsx‎

Lines changed: 14 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,14 @@
1+
import React from 'react';
2+
import ReactDOM from 'react-dom';
3+
import ReactTooltip from 'react-tooltip';
4+
5+
function tooltips() {
6+
const source = window.name;
7+
return <span>
8+
<span data-tip={source}/> // OK
9+
<span data-tip={source} data-html={false} /> // OK
10+
<span data-tip={source} data-html="true" /> // NOT OK
11+
<span data-tip={source} data-html={true} /> // NOT OK
12+
<ReactTooltip />
13+
</span>
14+
}

0 commit comments

Comments
 (0)