Skip to content

Commit c4f27ed

Browse files
erik-krogherik-krogh
committed
rename TaintedLength to LoopBoundInjection
1 parent 673e883 commit c4f27ed

18 files changed

+70
-70
lines changed

‎javascript/config/suites/javascript/security‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -42,7 +42,7 @@
4242
+ semmlecode-javascript-queries/Security/CWE-798/HardcodedCredentials.ql: /Security/CWE/CWE-798
4343
+ semmlecode-javascript-queries/Security/CWE-807/ConditionalBypass.ql: /Security/CWE/CWE-807
4444
+ semmlecode-javascript-queries/Security/CWE-807/DifferentKindsComparisonBypass.ql: /Security/CWE/CWE-807
45-
+ semmlecode-javascript-queries/Security/CWE-834/TaintedLength.ql: /Security/CWE/CWE-834
45+
+ semmlecode-javascript-queries/Security/CWE-834/LoopBoundInjection.ql: /Security/CWE/CWE-834
4646
+ semmlecode-javascript-queries/Security/CWE-843/TypeConfusionThroughParameterTampering.ql: /Security/CWE/CWE-834
4747
+ semmlecode-javascript-queries/Security/CWE-916/InsufficientPasswordHash.ql: /Security/CWE/CWE-916
4848
+ semmlecode-javascript-queries/Security/CWE-918/RequestForgery.ql: /Security/CWE/CWE-918

‎javascript/ql/src/Security/CWE-834/LoopBoundInjection.qhelp‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -9,7 +9,7 @@
99
cause indefinite looping since a malicious attacker can set the
1010
<code>.length</code> property to a very large number. For example,
1111
when a program that expects an array is passed a JSON object such as
12-
<code>{length: 1e100}</code>, the loop will be run for 1e100
12+
<code>{length: 1e100}</code>, the loop will be run for 10<sup>100</sup>
1313
iterations. This may cause the program to hang or run out of memory,
1414
which can be used to mount a denial-of-service (DoS) attack.
1515
</p>
@@ -30,7 +30,7 @@
3030
<code>obj</code> to an array.
3131
</p>
3232

33-
<sample src="examples/TaintedLength.js" />
33+
<sample src="examples/LoopBoundInjection.js" />
3434

3535
<p>
3636
This is not secure since an attacker can control the value of
@@ -39,7 +39,7 @@
3939
the user controlled object is an array.
4040
</p>
4141

42-
<sample src="examples/TaintedLength_fixed.js" />
42+
<sample src="examples/LoopBoundInjection_fixed.js" />
4343
</example>
4444

4545
<references></references>

‎javascript/ql/src/Security/CWE-834/LoopBoundInjection.ql‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,5 @@
11
/**
2-
* @name Tainted .length in loop condition
2+
* @name Loop bound injection
33
* @description Iterating over an object with a user-controlled .length
44
* property can cause indefinite looping.
55
* @kind path-problem
@@ -11,7 +11,7 @@
1111
*/
1212

1313
import javascript
14-
import semmle.javascript.security.dataflow.TaintedLength::TaintedLength
14+
import semmle.javascript.security.dataflow.LoopBoundInjection::LoopBoundInjection
1515

1616
from Configuration dataflow, DataFlow::PathNode source, DataFlow::PathNode sink
1717
where dataflow.hasFlowPath(source, sink)

javascript/ql/src/semmle/javascript/security/dataflow/TaintedLength.qll renamed to javascript/ql/src/semmle/javascript/security/dataflow/LoopBoundInjection.qll

Lines changed: 5 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -3,21 +3,21 @@
33
* using a user controlled object with an unbounded .length property.
44
*
55
* Note, for performance reasons: only import this file if
6-
* `TaintedLength::Configuration` is needed, otherwise
7-
* `TaintedLengthCustomizations` should be imported instead.
6+
* `LoopBoundInjection::Configuration` is needed, otherwise
7+
* `LoopBoundInjectionCustomizations` should be imported instead.
88
*/
99

1010
import javascript
1111
import semmle.javascript.security.TaintedObject
1212

13-
module TaintedLength {
14-
import TaintedLengthCustomizations::TaintedLength
13+
module LoopBoundInjection {
14+
import LoopBoundInjectionCustomizations::LoopBoundInjection
1515

1616
/**
1717
* A taint-tracking configuration for reasoning about looping on tainted objects with unbounded length.
1818
*/
1919
class Configuration extends TaintTracking::Configuration {
20-
Configuration() { this = "TaintedLength" }
20+
Configuration() { this = "LoopBoundInjection" }
2121

2222
override predicate isSource(DataFlow::Node source, DataFlow::FlowLabel label) {
2323
source instanceof Source and label = TaintedObject::label()

javascript/ql/src/semmle/javascript/security/dataflow/TaintedLengthCustomizations.qll renamed to javascript/ql/src/semmle/javascript/security/dataflow/LoopBoundInjectionCustomizations.qll

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -6,7 +6,7 @@
66

77
import javascript
88

9-
module TaintedLength {
9+
module LoopBoundInjection {
1010
import semmle.javascript.security.dataflow.RemoteFlowSources
1111
import semmle.javascript.security.TaintedObject
1212
import DataFlow::PathGraph

‎javascript/ql/test/query-tests/Security/CWE-834/LoopBoundInjection.expected‎

Lines changed: 57 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,57 @@
1+
nodes
2+
| LoopBoundInjectionBad.js:8:13:8:20 | req.body |
3+
| LoopBoundInjectionBad.js:10:15:10:22 | req.body |
4+
| LoopBoundInjectionBad.js:12:25:12:32 | req.body |
5+
| LoopBoundInjectionBad.js:14:19:14:26 | req.body |
6+
| LoopBoundInjectionBad.js:17:18:17:20 | val |
7+
| LoopBoundInjectionBad.js:20:25:20:27 | val |
8+
| LoopBoundInjectionBad.js:25:20:25:22 | val |
9+
| LoopBoundInjectionBad.js:29:16:29:18 | val |
10+
| LoopBoundInjectionBad.js:35:30:35:32 | val |
11+
| LoopBoundInjectionBad.js:38:15:38:17 | val |
12+
| LoopBoundInjectionBad.js:46:24:46:26 | val |
13+
| LoopBoundInjectionBad.js:51:25:51:27 | val |
14+
| LoopBoundInjectionExitBad.js:8:9:8:16 | req.body |
15+
| LoopBoundInjectionExitBad.js:10:9:10:16 | req.body |
16+
| LoopBoundInjectionExitBad.js:12:10:12:17 | req.body |
17+
| LoopBoundInjectionExitBad.js:14:14:14:21 | req.body |
18+
| LoopBoundInjectionExitBad.js:17:17:17:19 | val |
19+
| LoopBoundInjectionExitBad.js:20:22:20:24 | val |
20+
| LoopBoundInjectionExitBad.js:31:17:31:19 | val |
21+
| LoopBoundInjectionExitBad.js:34:22:34:24 | val |
22+
| LoopBoundInjectionExitBad.js:46:18:46:20 | val |
23+
| LoopBoundInjectionExitBad.js:49:22:49:24 | val |
24+
| LoopBoundInjectionExitBad.js:59:22:59:24 | val |
25+
| LoopBoundInjectionExitBad.js:60:8:60:10 | val |
26+
| LoopBoundInjectionLodash.js:9:13:9:20 | req.body |
27+
| LoopBoundInjectionLodash.js:12:18:12:20 | val |
28+
| LoopBoundInjectionLodash.js:13:13:13:15 | val |
29+
edges
30+
| LoopBoundInjectionBad.js:8:13:8:20 | req.body | LoopBoundInjectionBad.js:17:18:17:20 | val |
31+
| LoopBoundInjectionBad.js:10:15:10:22 | req.body | LoopBoundInjectionBad.js:25:20:25:22 | val |
32+
| LoopBoundInjectionBad.js:12:25:12:32 | req.body | LoopBoundInjectionBad.js:35:30:35:32 | val |
33+
| LoopBoundInjectionBad.js:14:19:14:26 | req.body | LoopBoundInjectionBad.js:46:24:46:26 | val |
34+
| LoopBoundInjectionBad.js:17:18:17:20 | val | LoopBoundInjectionBad.js:20:25:20:27 | val |
35+
| LoopBoundInjectionBad.js:25:20:25:22 | val | LoopBoundInjectionBad.js:29:16:29:18 | val |
36+
| LoopBoundInjectionBad.js:35:30:35:32 | val | LoopBoundInjectionBad.js:38:15:38:17 | val |
37+
| LoopBoundInjectionBad.js:46:24:46:26 | val | LoopBoundInjectionBad.js:51:25:51:27 | val |
38+
| LoopBoundInjectionExitBad.js:8:9:8:16 | req.body | LoopBoundInjectionExitBad.js:17:17:17:19 | val |
39+
| LoopBoundInjectionExitBad.js:10:9:10:16 | req.body | LoopBoundInjectionExitBad.js:31:17:31:19 | val |
40+
| LoopBoundInjectionExitBad.js:12:10:12:17 | req.body | LoopBoundInjectionExitBad.js:46:18:46:20 | val |
41+
| LoopBoundInjectionExitBad.js:14:14:14:21 | req.body | LoopBoundInjectionExitBad.js:59:22:59:24 | val |
42+
| LoopBoundInjectionExitBad.js:17:17:17:19 | val | LoopBoundInjectionExitBad.js:20:22:20:24 | val |
43+
| LoopBoundInjectionExitBad.js:31:17:31:19 | val | LoopBoundInjectionExitBad.js:34:22:34:24 | val |
44+
| LoopBoundInjectionExitBad.js:46:18:46:20 | val | LoopBoundInjectionExitBad.js:49:22:49:24 | val |
45+
| LoopBoundInjectionExitBad.js:59:22:59:24 | val | LoopBoundInjectionExitBad.js:60:8:60:10 | val |
46+
| LoopBoundInjectionLodash.js:9:13:9:20 | req.body | LoopBoundInjectionLodash.js:12:18:12:20 | val |
47+
| LoopBoundInjectionLodash.js:12:18:12:20 | val | LoopBoundInjectionLodash.js:13:13:13:15 | val |
48+
#select
49+
| LoopBoundInjectionBad.js:20:25:20:27 | val | LoopBoundInjectionBad.js:8:13:8:20 | req.body | LoopBoundInjectionBad.js:20:25:20:27 | val | Iterating over user-controlled object with a potentially unbounded .length property from $@. | LoopBoundInjectionBad.js:8:13:8:20 | req.body | here |
50+
| LoopBoundInjectionBad.js:29:16:29:18 | val | LoopBoundInjectionBad.js:10:15:10:22 | req.body | LoopBoundInjectionBad.js:29:16:29:18 | val | Iterating over user-controlled object with a potentially unbounded .length property from $@. | LoopBoundInjectionBad.js:10:15:10:22 | req.body | here |
51+
| LoopBoundInjectionBad.js:38:15:38:17 | val | LoopBoundInjectionBad.js:12:25:12:32 | req.body | LoopBoundInjectionBad.js:38:15:38:17 | val | Iterating over user-controlled object with a potentially unbounded .length property from $@. | LoopBoundInjectionBad.js:12:25:12:32 | req.body | here |
52+
| LoopBoundInjectionBad.js:51:25:51:27 | val | LoopBoundInjectionBad.js:14:19:14:26 | req.body | LoopBoundInjectionBad.js:51:25:51:27 | val | Iterating over user-controlled object with a potentially unbounded .length property from $@. | LoopBoundInjectionBad.js:14:19:14:26 | req.body | here |
53+
| LoopBoundInjectionExitBad.js:20:22:20:24 | val | LoopBoundInjectionExitBad.js:8:9:8:16 | req.body | LoopBoundInjectionExitBad.js:20:22:20:24 | val | Iterating over user-controlled object with a potentially unbounded .length property from $@. | LoopBoundInjectionExitBad.js:8:9:8:16 | req.body | here |
54+
| LoopBoundInjectionExitBad.js:34:22:34:24 | val | LoopBoundInjectionExitBad.js:10:9:10:16 | req.body | LoopBoundInjectionExitBad.js:34:22:34:24 | val | Iterating over user-controlled object with a potentially unbounded .length property from $@. | LoopBoundInjectionExitBad.js:10:9:10:16 | req.body | here |
55+
| LoopBoundInjectionExitBad.js:49:22:49:24 | val | LoopBoundInjectionExitBad.js:12:10:12:17 | req.body | LoopBoundInjectionExitBad.js:49:22:49:24 | val | Iterating over user-controlled object with a potentially unbounded .length property from $@. | LoopBoundInjectionExitBad.js:12:10:12:17 | req.body | here |
56+
| LoopBoundInjectionExitBad.js:60:8:60:10 | val | LoopBoundInjectionExitBad.js:14:14:14:21 | req.body | LoopBoundInjectionExitBad.js:60:8:60:10 | val | Iterating over user-controlled object with a potentially unbounded .length property from $@. | LoopBoundInjectionExitBad.js:14:14:14:21 | req.body | here |
57+
| LoopBoundInjectionLodash.js:13:13:13:15 | val | LoopBoundInjectionLodash.js:9:13:9:20 | req.body | LoopBoundInjectionLodash.js:13:13:13:15 | val | Iterating over user-controlled object with a potentially unbounded .length property from $@. | LoopBoundInjectionLodash.js:9:13:9:20 | req.body | here |

‎javascript/ql/test/query-tests/Security/CWE-834/LoopBoundInjection.qlref‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1 @@
1+
Security/CWE-834/LoopBoundInjection.ql

javascript/ql/test/query-tests/Security/CWE-834/TaintedLengthBad.js renamed to javascript/ql/test/query-tests/Security/CWE-834/LoopBoundInjectionBad.js

File renamed without changes.

javascript/ql/test/query-tests/Security/CWE-834/TaintedLengthExitBad.js renamed to javascript/ql/test/query-tests/Security/CWE-834/LoopBoundInjectionExitBad.js

File renamed without changes.

javascript/ql/test/query-tests/Security/CWE-834/TaintedLengthExitGood.js renamed to javascript/ql/test/query-tests/Security/CWE-834/LoopBoundInjectionExitGood.js

File renamed without changes.

0 commit comments

Comments
 (0)