Skip to content

Commit cc76834

Browse files
esbenaesbena
committed
JS: add security tests for malicious torrents
1 parent bea59ec commit cc76834

File tree

5 files changed

+73
-0
lines changed

5 files changed

+73
-0
lines changed

‎javascript/ql/src/semmle/javascript/security/dataflow/StoredXss.qll‎

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -28,4 +28,9 @@ module StoredXss {
2828
class FileNameSourceAsSource extends Source {
2929
FileNameSourceAsSource() { this instanceof FileNameSource }
3030
}
31+
32+
/** User-controlled torrent information, considered as a flow source for stored XSS. */
33+
class UserControlledTorrentInfoAsSource extends Source {
34+
UserControlledTorrentInfoAsSource() { this instanceof ParseTorrent::UserControlledTorrentInfo }
35+
}
3136
}

‎javascript/ql/test/query-tests/Security/CWE-022/TaintedPath/TaintedPath.expected‎

Lines changed: 42 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1183,6 +1183,26 @@ nodes
11831183
| tainted-sendFile.js:25:34:25:45 | req.params.x |
11841184
| tainted-sendFile.js:25:34:25:45 | req.params.x |
11851185
| tainted-sendFile.js:25:34:25:45 | req.params.x |
1186+
| torrents.js:5:6:5:38 | name |
1187+
| torrents.js:5:6:5:38 | name |
1188+
| torrents.js:5:6:5:38 | name |
1189+
| torrents.js:5:13:5:38 | parseTo ... t).name |
1190+
| torrents.js:5:13:5:38 | parseTo ... t).name |
1191+
| torrents.js:5:13:5:38 | parseTo ... t).name |
1192+
| torrents.js:5:13:5:38 | parseTo ... t).name |
1193+
| torrents.js:6:6:6:45 | loc |
1194+
| torrents.js:6:6:6:45 | loc |
1195+
| torrents.js:6:6:6:45 | loc |
1196+
| torrents.js:6:12:6:45 | dir + " ... t.data" |
1197+
| torrents.js:6:12:6:45 | dir + " ... t.data" |
1198+
| torrents.js:6:12:6:45 | dir + " ... t.data" |
1199+
| torrents.js:6:24:6:27 | name |
1200+
| torrents.js:6:24:6:27 | name |
1201+
| torrents.js:6:24:6:27 | name |
1202+
| torrents.js:7:25:7:27 | loc |
1203+
| torrents.js:7:25:7:27 | loc |
1204+
| torrents.js:7:25:7:27 | loc |
1205+
| torrents.js:7:25:7:27 | loc |
11861206
| views.js:1:43:1:55 | req.params[0] |
11871207
| views.js:1:43:1:55 | req.params[0] |
11881208
| views.js:1:43:1:55 | req.params[0] |
@@ -2910,6 +2930,27 @@ edges
29102930
| tainted-sendFile.js:25:34:25:45 | req.params.x | tainted-sendFile.js:25:16:25:46 | path.jo ... rams.x) |
29112931
| tainted-sendFile.js:25:34:25:45 | req.params.x | tainted-sendFile.js:25:16:25:46 | path.jo ... rams.x) |
29122932
| tainted-sendFile.js:25:34:25:45 | req.params.x | tainted-sendFile.js:25:16:25:46 | path.jo ... rams.x) |
2933+
| torrents.js:5:6:5:38 | name | torrents.js:6:24:6:27 | name |
2934+
| torrents.js:5:6:5:38 | name | torrents.js:6:24:6:27 | name |
2935+
| torrents.js:5:6:5:38 | name | torrents.js:6:24:6:27 | name |
2936+
| torrents.js:5:13:5:38 | parseTo ... t).name | torrents.js:5:6:5:38 | name |
2937+
| torrents.js:5:13:5:38 | parseTo ... t).name | torrents.js:5:6:5:38 | name |
2938+
| torrents.js:5:13:5:38 | parseTo ... t).name | torrents.js:5:6:5:38 | name |
2939+
| torrents.js:5:13:5:38 | parseTo ... t).name | torrents.js:5:6:5:38 | name |
2940+
| torrents.js:5:13:5:38 | parseTo ... t).name | torrents.js:5:6:5:38 | name |
2941+
| torrents.js:5:13:5:38 | parseTo ... t).name | torrents.js:5:6:5:38 | name |
2942+
| torrents.js:6:6:6:45 | loc | torrents.js:7:25:7:27 | loc |
2943+
| torrents.js:6:6:6:45 | loc | torrents.js:7:25:7:27 | loc |
2944+
| torrents.js:6:6:6:45 | loc | torrents.js:7:25:7:27 | loc |
2945+
| torrents.js:6:6:6:45 | loc | torrents.js:7:25:7:27 | loc |
2946+
| torrents.js:6:6:6:45 | loc | torrents.js:7:25:7:27 | loc |
2947+
| torrents.js:6:6:6:45 | loc | torrents.js:7:25:7:27 | loc |
2948+
| torrents.js:6:12:6:45 | dir + " ... t.data" | torrents.js:6:6:6:45 | loc |
2949+
| torrents.js:6:12:6:45 | dir + " ... t.data" | torrents.js:6:6:6:45 | loc |
2950+
| torrents.js:6:12:6:45 | dir + " ... t.data" | torrents.js:6:6:6:45 | loc |
2951+
| torrents.js:6:24:6:27 | name | torrents.js:6:12:6:45 | dir + " ... t.data" |
2952+
| torrents.js:6:24:6:27 | name | torrents.js:6:12:6:45 | dir + " ... t.data" |
2953+
| torrents.js:6:24:6:27 | name | torrents.js:6:12:6:45 | dir + " ... t.data" |
29132954
| views.js:1:43:1:55 | req.params[0] | views.js:1:43:1:55 | req.params[0] |
29142955
#select
29152956
| TaintedPath-es6.js:10:26:10:45 | join("public", path) | TaintedPath-es6.js:7:20:7:26 | req.url | TaintedPath-es6.js:10:26:10:45 | join("public", path) | This path depends on $@. | TaintedPath-es6.js:7:20:7:26 | req.url | a user-provided value |
@@ -2981,4 +3022,5 @@ edges
29813022
| tainted-sendFile.js:18:43:18:58 | req.param("dir") | tainted-sendFile.js:18:43:18:58 | req.param("dir") | tainted-sendFile.js:18:43:18:58 | req.param("dir") | This path depends on $@. | tainted-sendFile.js:18:43:18:58 | req.param("dir") | a user-provided value |
29823023
| tainted-sendFile.js:24:16:24:49 | path.re ... rams.x) | tainted-sendFile.js:24:37:24:48 | req.params.x | tainted-sendFile.js:24:16:24:49 | path.re ... rams.x) | This path depends on $@. | tainted-sendFile.js:24:37:24:48 | req.params.x | a user-provided value |
29833024
| tainted-sendFile.js:25:16:25:46 | path.jo ... rams.x) | tainted-sendFile.js:25:34:25:45 | req.params.x | tainted-sendFile.js:25:16:25:46 | path.jo ... rams.x) | This path depends on $@. | tainted-sendFile.js:25:34:25:45 | req.params.x | a user-provided value |
3025+
| torrents.js:7:25:7:27 | loc | torrents.js:5:13:5:38 | parseTo ... t).name | torrents.js:7:25:7:27 | loc | This path depends on $@. | torrents.js:5:13:5:38 | parseTo ... t).name | a user-provided value |
29843026
| views.js:1:43:1:55 | req.params[0] | views.js:1:43:1:55 | req.params[0] | views.js:1:43:1:55 | req.params[0] | This path depends on $@. | views.js:1:43:1:55 | req.params[0] | a user-provided value |

‎javascript/ql/test/query-tests/Security/CWE-022/TaintedPath/torrents.js‎

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,8 @@
1+
const parseTorrent = require('parse-torrent'),
2+
fs = require('fs');
3+
4+
function getTorrentData(dir, torrent){
5+
let name = parseTorrent(torrent).name,
6+
loc = dir + "/" + name + ".torrent.data";
7+
return fs.readFileSync(loc); // NOT OK
8+
}

‎javascript/ql/test/query-tests/Security/CWE-079/StoredXss.expected‎

Lines changed: 10 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -19,6 +19,11 @@ nodes
1919
| xss-through-filenames.js:35:29:35:34 | files2 |
2020
| xss-through-filenames.js:37:19:37:24 | files3 |
2121
| xss-through-filenames.js:37:19:37:24 | files3 |
22+
| xss-through-torrent.js:6:6:6:24 | name |
23+
| xss-through-torrent.js:6:13:6:24 | torrent.name |
24+
| xss-through-torrent.js:6:13:6:24 | torrent.name |
25+
| xss-through-torrent.js:7:11:7:14 | name |
26+
| xss-through-torrent.js:7:11:7:14 | name |
2227
edges
2328
| xss-through-filenames.js:7:43:7:48 | files1 | xss-through-filenames.js:8:18:8:23 | files1 |
2429
| xss-through-filenames.js:7:43:7:48 | files1 | xss-through-filenames.js:8:18:8:23 | files1 |
@@ -41,8 +46,13 @@ edges
4146
| xss-through-filenames.js:35:13:35:35 | files3 | xss-through-filenames.js:37:19:37:24 | files3 |
4247
| xss-through-filenames.js:35:22:35:35 | format(files2) | xss-through-filenames.js:35:13:35:35 | files3 |
4348
| xss-through-filenames.js:35:29:35:34 | files2 | xss-through-filenames.js:35:22:35:35 | format(files2) |
49+
| xss-through-torrent.js:6:6:6:24 | name | xss-through-torrent.js:7:11:7:14 | name |
50+
| xss-through-torrent.js:6:6:6:24 | name | xss-through-torrent.js:7:11:7:14 | name |
51+
| xss-through-torrent.js:6:13:6:24 | torrent.name | xss-through-torrent.js:6:6:6:24 | name |
52+
| xss-through-torrent.js:6:13:6:24 | torrent.name | xss-through-torrent.js:6:6:6:24 | name |
4453
#select
4554
| xss-through-filenames.js:8:18:8:23 | files1 | xss-through-filenames.js:7:43:7:48 | files1 | xss-through-filenames.js:8:18:8:23 | files1 | Stored cross-site scripting vulnerability due to $@. | xss-through-filenames.js:7:43:7:48 | files1 | stored value |
4655
| xss-through-filenames.js:26:19:26:24 | files1 | xss-through-filenames.js:25:43:25:48 | files1 | xss-through-filenames.js:26:19:26:24 | files1 | Stored cross-site scripting vulnerability due to $@. | xss-through-filenames.js:25:43:25:48 | files1 | stored value |
4756
| xss-through-filenames.js:33:19:33:24 | files2 | xss-through-filenames.js:25:43:25:48 | files1 | xss-through-filenames.js:33:19:33:24 | files2 | Stored cross-site scripting vulnerability due to $@. | xss-through-filenames.js:25:43:25:48 | files1 | stored value |
4857
| xss-through-filenames.js:37:19:37:24 | files3 | xss-through-filenames.js:25:43:25:48 | files1 | xss-through-filenames.js:37:19:37:24 | files3 | Stored cross-site scripting vulnerability due to $@. | xss-through-filenames.js:25:43:25:48 | files1 | stored value |
58+
| xss-through-torrent.js:7:11:7:14 | name | xss-through-torrent.js:6:13:6:24 | torrent.name | xss-through-torrent.js:7:11:7:14 | name | Stored cross-site scripting vulnerability due to $@. | xss-through-torrent.js:6:13:6:24 | torrent.name | stored value |

‎javascript/ql/test/query-tests/Security/CWE-079/xss-through-torrent.js‎

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,8 @@
1+
const parseTorrent = require('parse-torrent'),
2+
express = require('express');
3+
4+
express().get('/user/:id', function(req, res) {
5+
let torrent = parseTorrent(unknown),
6+
name = torrent.name;
7+
res.send(name); // NOT OK
8+
});

0 commit comments

Comments
 (0)