Skip to content

Commit 96bf9db

Browse files
asger-semmleasgerf
asger-semmle
authored and
asgerf
committed
JS: Add another test and more barriers
1 parent bc78710 commit 96bf9db

File tree

3 files changed

+98
-32
lines changed

3 files changed

+98
-32
lines changed

‎javascript/ql/src/Security/CWE-400/PrototypePollutionUtility.ql‎

Lines changed: 23 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -214,6 +214,17 @@ class PropNameTracking extends DataFlow::Configuration {
214214
)
215215
}
216216

217+
override predicate isBarrier(DataFlow::Node node) {
218+
super.isBarrier(node)
219+
or
220+
exists(ConditionGuardNode guard, SsaRefinementNode refinement |
221+
node = DataFlow::ssaDefinitionNode(refinement) and
222+
refinement.getGuard() = guard and
223+
guard.getTest() instanceof VarAccess and
224+
guard.getOutcome() = false
225+
)
226+
}
227+
217228
override predicate isBarrierGuard(DataFlow::BarrierGuardNode node) {
218229
node instanceof EqualityGuard or
219230
node instanceof HasOwnPropertyGuard or
@@ -307,6 +318,18 @@ class TypeofGuard extends DataFlow::LabeledBarrierGuardNode, DataFlow::ValueNode
307318
typeofStr = "function" and
308319
label = "__proto__"
309320
)
321+
or
322+
e = typeof.getOperand() and
323+
outcome = astNode.getPolarity().booleanNot() and
324+
(
325+
// If something is not an object, sanitize object, as both must end
326+
// in non-function prototype object.
327+
typeofStr = "object" and
328+
label instanceof UnsafePropLabel
329+
or
330+
typeofStr = "function" and
331+
label = "constructor"
332+
)
310333
}
311334
}
312335

‎javascript/ql/test/query-tests/Security/CWE-400/PrototypePollutionUtility.expected‎

Lines changed: 56 additions & 32 deletions
Original file line numberDiff line numberDiff line change
@@ -314,24 +314,12 @@ nodes
314314
| PrototypePollutionUtility/tests.js:128:20:128:27 | src[key] |
315315
| PrototypePollutionUtility/tests.js:128:24:128:26 | key |
316316
| PrototypePollutionUtility/tests.js:128:24:128:26 | key |
317-
| PrototypePollutionUtility/tests.js:140:16:140:18 | src |
318317
| PrototypePollutionUtility/tests.js:143:14:143:16 | key |
319318
| PrototypePollutionUtility/tests.js:143:14:143:16 | key |
320319
| PrototypePollutionUtility/tests.js:143:14:143:16 | key |
321320
| PrototypePollutionUtility/tests.js:144:16:144:18 | key |
322321
| PrototypePollutionUtility/tests.js:144:16:144:18 | key |
323322
| PrototypePollutionUtility/tests.js:144:16:144:18 | key |
324-
| PrototypePollutionUtility/tests.js:144:23:144:37 | clone(src[key]) |
325-
| PrototypePollutionUtility/tests.js:144:23:144:37 | clone(src[key]) |
326-
| PrototypePollutionUtility/tests.js:144:23:144:37 | clone(src[key]) |
327-
| PrototypePollutionUtility/tests.js:144:23:144:37 | clone(src[key]) |
328-
| PrototypePollutionUtility/tests.js:144:29:144:31 | src |
329-
| PrototypePollutionUtility/tests.js:144:29:144:36 | src[key] |
330-
| PrototypePollutionUtility/tests.js:144:29:144:36 | src[key] |
331-
| PrototypePollutionUtility/tests.js:144:29:144:36 | src[key] |
332-
| PrototypePollutionUtility/tests.js:144:29:144:36 | src[key] |
333-
| PrototypePollutionUtility/tests.js:144:33:144:35 | key |
334-
| PrototypePollutionUtility/tests.js:144:33:144:35 | key |
335323
| PrototypePollutionUtility/tests.js:149:31:149:33 | dst |
336324
| PrototypePollutionUtility/tests.js:149:31:149:33 | dst |
337325
| PrototypePollutionUtility/tests.js:149:31:149:33 | dst |
@@ -628,6 +616,28 @@ nodes
628616
| PrototypePollutionUtility/tests.js:240:36:240:44 | data[key] |
629617
| PrototypePollutionUtility/tests.js:240:41:240:43 | key |
630618
| PrototypePollutionUtility/tests.js:240:41:240:43 | key |
619+
| PrototypePollutionUtility/tests.js:252:29:252:31 | src |
620+
| PrototypePollutionUtility/tests.js:252:29:252:31 | src |
621+
| PrototypePollutionUtility/tests.js:255:14:255:16 | key |
622+
| PrototypePollutionUtility/tests.js:255:14:255:16 | key |
623+
| PrototypePollutionUtility/tests.js:255:14:255:16 | key |
624+
| PrototypePollutionUtility/tests.js:257:20:257:22 | key |
625+
| PrototypePollutionUtility/tests.js:257:20:257:22 | key |
626+
| PrototypePollutionUtility/tests.js:257:20:257:22 | key |
627+
| PrototypePollutionUtility/tests.js:257:27:257:59 | mergeWi ... c[key]) |
628+
| PrototypePollutionUtility/tests.js:257:27:257:59 | mergeWi ... c[key]) |
629+
| PrototypePollutionUtility/tests.js:257:27:257:59 | mergeWi ... c[key]) |
630+
| PrototypePollutionUtility/tests.js:257:27:257:59 | mergeWi ... c[key]) |
631+
| PrototypePollutionUtility/tests.js:257:27:257:59 | mergeWi ... c[key]) |
632+
| PrototypePollutionUtility/tests.js:257:51:257:53 | src |
633+
| PrototypePollutionUtility/tests.js:257:51:257:53 | src |
634+
| PrototypePollutionUtility/tests.js:257:51:257:58 | src[key] |
635+
| PrototypePollutionUtility/tests.js:257:51:257:58 | src[key] |
636+
| PrototypePollutionUtility/tests.js:257:51:257:58 | src[key] |
637+
| PrototypePollutionUtility/tests.js:257:51:257:58 | src[key] |
638+
| PrototypePollutionUtility/tests.js:257:51:257:58 | src[key] |
639+
| PrototypePollutionUtility/tests.js:257:55:257:57 | key |
640+
| PrototypePollutionUtility/tests.js:257:55:257:57 | key |
631641
| examples/PrototypePollutionUtility.js:1:16:1:18 | dst |
632642
| examples/PrototypePollutionUtility.js:1:16:1:18 | dst |
633643
| examples/PrototypePollutionUtility.js:1:21:1:23 | src |
@@ -1113,33 +1123,13 @@ edges
11131123
| PrototypePollutionUtility/tests.js:128:24:128:26 | key | PrototypePollutionUtility/tests.js:128:20:128:27 | src[key] |
11141124
| PrototypePollutionUtility/tests.js:128:24:128:26 | key | PrototypePollutionUtility/tests.js:128:20:128:27 | src[key] |
11151125
| PrototypePollutionUtility/tests.js:128:24:128:26 | key | PrototypePollutionUtility/tests.js:128:20:128:27 | src[key] |
1116-
| PrototypePollutionUtility/tests.js:140:16:140:18 | src | PrototypePollutionUtility/tests.js:144:29:144:31 | src |
11171126
| PrototypePollutionUtility/tests.js:143:14:143:16 | key | PrototypePollutionUtility/tests.js:144:16:144:18 | key |
11181127
| PrototypePollutionUtility/tests.js:143:14:143:16 | key | PrototypePollutionUtility/tests.js:144:16:144:18 | key |
11191128
| PrototypePollutionUtility/tests.js:143:14:143:16 | key | PrototypePollutionUtility/tests.js:144:16:144:18 | key |
11201129
| PrototypePollutionUtility/tests.js:143:14:143:16 | key | PrototypePollutionUtility/tests.js:144:16:144:18 | key |
11211130
| PrototypePollutionUtility/tests.js:143:14:143:16 | key | PrototypePollutionUtility/tests.js:144:16:144:18 | key |
11221131
| PrototypePollutionUtility/tests.js:143:14:143:16 | key | PrototypePollutionUtility/tests.js:144:16:144:18 | key |
11231132
| PrototypePollutionUtility/tests.js:143:14:143:16 | key | PrototypePollutionUtility/tests.js:144:16:144:18 | key |
1124-
| PrototypePollutionUtility/tests.js:143:14:143:16 | key | PrototypePollutionUtility/tests.js:144:33:144:35 | key |
1125-
| PrototypePollutionUtility/tests.js:143:14:143:16 | key | PrototypePollutionUtility/tests.js:144:33:144:35 | key |
1126-
| PrototypePollutionUtility/tests.js:143:14:143:16 | key | PrototypePollutionUtility/tests.js:144:33:144:35 | key |
1127-
| PrototypePollutionUtility/tests.js:143:14:143:16 | key | PrototypePollutionUtility/tests.js:144:33:144:35 | key |
1128-
| PrototypePollutionUtility/tests.js:144:29:144:31 | src | PrototypePollutionUtility/tests.js:144:29:144:36 | src[key] |
1129-
| PrototypePollutionUtility/tests.js:144:29:144:36 | src[key] | PrototypePollutionUtility/tests.js:140:16:140:18 | src |
1130-
| PrototypePollutionUtility/tests.js:144:29:144:36 | src[key] | PrototypePollutionUtility/tests.js:140:16:140:18 | src |
1131-
| PrototypePollutionUtility/tests.js:144:29:144:36 | src[key] | PrototypePollutionUtility/tests.js:140:16:140:18 | src |
1132-
| PrototypePollutionUtility/tests.js:144:29:144:36 | src[key] | PrototypePollutionUtility/tests.js:144:23:144:37 | clone(src[key]) |
1133-
| PrototypePollutionUtility/tests.js:144:29:144:36 | src[key] | PrototypePollutionUtility/tests.js:144:23:144:37 | clone(src[key]) |
1134-
| PrototypePollutionUtility/tests.js:144:29:144:36 | src[key] | PrototypePollutionUtility/tests.js:144:23:144:37 | clone(src[key]) |
1135-
| PrototypePollutionUtility/tests.js:144:29:144:36 | src[key] | PrototypePollutionUtility/tests.js:144:23:144:37 | clone(src[key]) |
1136-
| PrototypePollutionUtility/tests.js:144:29:144:36 | src[key] | PrototypePollutionUtility/tests.js:144:23:144:37 | clone(src[key]) |
1137-
| PrototypePollutionUtility/tests.js:144:29:144:36 | src[key] | PrototypePollutionUtility/tests.js:144:23:144:37 | clone(src[key]) |
1138-
| PrototypePollutionUtility/tests.js:144:29:144:36 | src[key] | PrototypePollutionUtility/tests.js:144:23:144:37 | clone(src[key]) |
1139-
| PrototypePollutionUtility/tests.js:144:29:144:36 | src[key] | PrototypePollutionUtility/tests.js:144:23:144:37 | clone(src[key]) |
1140-
| PrototypePollutionUtility/tests.js:144:29:144:36 | src[key] | PrototypePollutionUtility/tests.js:144:23:144:37 | clone(src[key]) |
1141-
| PrototypePollutionUtility/tests.js:144:33:144:35 | key | PrototypePollutionUtility/tests.js:144:29:144:36 | src[key] |
1142-
| PrototypePollutionUtility/tests.js:144:33:144:35 | key | PrototypePollutionUtility/tests.js:144:29:144:36 | src[key] |
11431133
| PrototypePollutionUtility/tests.js:149:31:149:33 | dst | PrototypePollutionUtility/tests.js:152:22:152:24 | dst |
11441134
| PrototypePollutionUtility/tests.js:149:31:149:33 | dst | PrototypePollutionUtility/tests.js:152:22:152:24 | dst |
11451135
| PrototypePollutionUtility/tests.js:149:31:149:33 | dst | PrototypePollutionUtility/tests.js:152:22:152:24 | dst |
@@ -1515,6 +1505,40 @@ edges
15151505
| PrototypePollutionUtility/tests.js:240:36:240:44 | data[key] | PrototypePollutionUtility/tests.js:229:38:229:42 | value |
15161506
| PrototypePollutionUtility/tests.js:240:41:240:43 | key | PrototypePollutionUtility/tests.js:240:36:240:44 | data[key] |
15171507
| PrototypePollutionUtility/tests.js:240:41:240:43 | key | PrototypePollutionUtility/tests.js:240:36:240:44 | data[key] |
1508+
| PrototypePollutionUtility/tests.js:252:29:252:31 | src | PrototypePollutionUtility/tests.js:257:51:257:53 | src |
1509+
| PrototypePollutionUtility/tests.js:252:29:252:31 | src | PrototypePollutionUtility/tests.js:257:51:257:53 | src |
1510+
| PrototypePollutionUtility/tests.js:255:14:255:16 | key | PrototypePollutionUtility/tests.js:257:20:257:22 | key |
1511+
| PrototypePollutionUtility/tests.js:255:14:255:16 | key | PrototypePollutionUtility/tests.js:257:20:257:22 | key |
1512+
| PrototypePollutionUtility/tests.js:255:14:255:16 | key | PrototypePollutionUtility/tests.js:257:20:257:22 | key |
1513+
| PrototypePollutionUtility/tests.js:255:14:255:16 | key | PrototypePollutionUtility/tests.js:257:20:257:22 | key |
1514+
| PrototypePollutionUtility/tests.js:255:14:255:16 | key | PrototypePollutionUtility/tests.js:257:20:257:22 | key |
1515+
| PrototypePollutionUtility/tests.js:255:14:255:16 | key | PrototypePollutionUtility/tests.js:257:20:257:22 | key |
1516+
| PrototypePollutionUtility/tests.js:255:14:255:16 | key | PrototypePollutionUtility/tests.js:257:20:257:22 | key |
1517+
| PrototypePollutionUtility/tests.js:255:14:255:16 | key | PrototypePollutionUtility/tests.js:257:55:257:57 | key |
1518+
| PrototypePollutionUtility/tests.js:255:14:255:16 | key | PrototypePollutionUtility/tests.js:257:55:257:57 | key |
1519+
| PrototypePollutionUtility/tests.js:255:14:255:16 | key | PrototypePollutionUtility/tests.js:257:55:257:57 | key |
1520+
| PrototypePollutionUtility/tests.js:255:14:255:16 | key | PrototypePollutionUtility/tests.js:257:55:257:57 | key |
1521+
| PrototypePollutionUtility/tests.js:257:51:257:53 | src | PrototypePollutionUtility/tests.js:257:51:257:58 | src[key] |
1522+
| PrototypePollutionUtility/tests.js:257:51:257:53 | src | PrototypePollutionUtility/tests.js:257:51:257:58 | src[key] |
1523+
| PrototypePollutionUtility/tests.js:257:51:257:58 | src[key] | PrototypePollutionUtility/tests.js:252:29:252:31 | src |
1524+
| PrototypePollutionUtility/tests.js:257:51:257:58 | src[key] | PrototypePollutionUtility/tests.js:252:29:252:31 | src |
1525+
| PrototypePollutionUtility/tests.js:257:51:257:58 | src[key] | PrototypePollutionUtility/tests.js:252:29:252:31 | src |
1526+
| PrototypePollutionUtility/tests.js:257:51:257:58 | src[key] | PrototypePollutionUtility/tests.js:252:29:252:31 | src |
1527+
| PrototypePollutionUtility/tests.js:257:51:257:58 | src[key] | PrototypePollutionUtility/tests.js:252:29:252:31 | src |
1528+
| PrototypePollutionUtility/tests.js:257:51:257:58 | src[key] | PrototypePollutionUtility/tests.js:252:29:252:31 | src |
1529+
| PrototypePollutionUtility/tests.js:257:51:257:58 | src[key] | PrototypePollutionUtility/tests.js:257:27:257:59 | mergeWi ... c[key]) |
1530+
| PrototypePollutionUtility/tests.js:257:51:257:58 | src[key] | PrototypePollutionUtility/tests.js:257:27:257:59 | mergeWi ... c[key]) |
1531+
| PrototypePollutionUtility/tests.js:257:51:257:58 | src[key] | PrototypePollutionUtility/tests.js:257:27:257:59 | mergeWi ... c[key]) |
1532+
| PrototypePollutionUtility/tests.js:257:51:257:58 | src[key] | PrototypePollutionUtility/tests.js:257:27:257:59 | mergeWi ... c[key]) |
1533+
| PrototypePollutionUtility/tests.js:257:51:257:58 | src[key] | PrototypePollutionUtility/tests.js:257:27:257:59 | mergeWi ... c[key]) |
1534+
| PrototypePollutionUtility/tests.js:257:51:257:58 | src[key] | PrototypePollutionUtility/tests.js:257:27:257:59 | mergeWi ... c[key]) |
1535+
| PrototypePollutionUtility/tests.js:257:51:257:58 | src[key] | PrototypePollutionUtility/tests.js:257:27:257:59 | mergeWi ... c[key]) |
1536+
| PrototypePollutionUtility/tests.js:257:51:257:58 | src[key] | PrototypePollutionUtility/tests.js:257:27:257:59 | mergeWi ... c[key]) |
1537+
| PrototypePollutionUtility/tests.js:257:51:257:58 | src[key] | PrototypePollutionUtility/tests.js:257:27:257:59 | mergeWi ... c[key]) |
1538+
| PrototypePollutionUtility/tests.js:257:51:257:58 | src[key] | PrototypePollutionUtility/tests.js:257:27:257:59 | mergeWi ... c[key]) |
1539+
| PrototypePollutionUtility/tests.js:257:51:257:58 | src[key] | PrototypePollutionUtility/tests.js:257:27:257:59 | mergeWi ... c[key]) |
1540+
| PrototypePollutionUtility/tests.js:257:55:257:57 | key | PrototypePollutionUtility/tests.js:257:51:257:58 | src[key] |
1541+
| PrototypePollutionUtility/tests.js:257:55:257:57 | key | PrototypePollutionUtility/tests.js:257:51:257:58 | src[key] |
15181542
| examples/PrototypePollutionUtility.js:1:16:1:18 | dst | examples/PrototypePollutionUtility.js:5:19:5:21 | dst |
15191543
| examples/PrototypePollutionUtility.js:1:16:1:18 | dst | examples/PrototypePollutionUtility.js:5:19:5:21 | dst |
15201544
| examples/PrototypePollutionUtility.js:1:16:1:18 | dst | examples/PrototypePollutionUtility.js:7:13:7:15 | dst |

‎javascript/ql/test/query-tests/Security/CWE-400/PrototypePollutionUtility/tests.js‎

Lines changed: 19 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -240,3 +240,22 @@ function deepSetCallerBad(data) {
240240
deepSetBad(map1, 'x', key, data[key]);
241241
}
242242
}
243+
244+
function maybeCopy(x) {
245+
if (x && typeof x === 'object') {
246+
return {...x};
247+
} else {
248+
return x;
249+
}
250+
}
251+
252+
function mergeWithCopy(dst, src) {
253+
if (dst == null) return src;
254+
let result = maybeCopy(dst);
255+
for (let key in src) {
256+
if (src.hasOwnProperty(key)) {
257+
result[key] = mergeWithCopy(dst[key], src[key]); // OK
258+
}
259+
}
260+
return result;
261+
}

0 commit comments

Comments
 (0)