Skip to content

Commit e75259d

Browse files
erik-krogherik-krogh
committed
model the verify function in jsonwebtoken 
1 parent 6732493 commit e75259d

File tree

4 files changed

+61
-0
lines changed

4 files changed

+61
-0
lines changed

‎javascript/ql/src/semmle/javascript/frameworks/JWT.qll‎

Lines changed: 17 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -20,3 +20,20 @@ private module JwtDecode {
2020
}
2121
}
2222
}
23+
24+
/**
25+
* Provides classes and predicates modelling the `jsonwebtoken` libary.
26+
*/
27+
private module JsonWebToken {
28+
/**
29+
* A taint-step for `require("jsonwebtoken").verify(pred, "key", (err succ) => {...})`.
30+
*/
31+
private class VerifyStep extends TaintTracking::AdditionalTaintStep, DataFlow::CallNode {
32+
VerifyStep() { this = DataFlow::moduleMember("jsonwebtoken", "verify").getACall() }
33+
34+
override predicate step(DataFlow::Node pred, DataFlow::Node succ) {
35+
pred = this.getArgument(0) and
36+
succ = this.getABoundCallbackParameter(2, 1)
37+
}
38+
}
39+
}

‎javascript/ql/test/query-tests/Security/CWE-079/DomBasedXss/Xss.expected‎

Lines changed: 16 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -125,6 +125,14 @@ nodes
125125
| jquery.js:16:38:16:52 | window.location |
126126
| jquery.js:16:38:16:52 | window.location |
127127
| jquery.js:16:38:16:63 | window. ... tring() |
128+
| jwt-server.js:7:9:7:35 | taint |
129+
| jwt-server.js:7:17:7:35 | req.param("wobble") |
130+
| jwt-server.js:7:17:7:35 | req.param("wobble") |
131+
| jwt-server.js:9:16:9:20 | taint |
132+
| jwt-server.js:9:55:9:61 | decoded |
133+
| jwt-server.js:11:19:11:25 | decoded |
134+
| jwt-server.js:11:19:11:29 | decoded.foo |
135+
| jwt-server.js:11:19:11:29 | decoded.foo |
128136
| nodemailer.js:13:11:13:69 | `Hi, yo ... sage}.` |
129137
| nodemailer.js:13:11:13:69 | `Hi, yo ... sage}.` |
130138
| nodemailer.js:13:50:13:66 | req.query.message |
@@ -716,6 +724,13 @@ edges
716724
| jquery.js:16:38:16:52 | window.location | jquery.js:16:38:16:63 | window. ... tring() |
717725
| jquery.js:16:38:16:63 | window. ... tring() | jquery.js:16:19:16:64 | decodeU ... ring()) |
718726
| jquery.js:16:38:16:63 | window. ... tring() | jquery.js:16:19:16:64 | decodeU ... ring()) |
727+
| jwt-server.js:7:9:7:35 | taint | jwt-server.js:9:16:9:20 | taint |
728+
| jwt-server.js:7:17:7:35 | req.param("wobble") | jwt-server.js:7:9:7:35 | taint |
729+
| jwt-server.js:7:17:7:35 | req.param("wobble") | jwt-server.js:7:9:7:35 | taint |
730+
| jwt-server.js:9:16:9:20 | taint | jwt-server.js:9:55:9:61 | decoded |
731+
| jwt-server.js:9:55:9:61 | decoded | jwt-server.js:11:19:11:25 | decoded |
732+
| jwt-server.js:11:19:11:25 | decoded | jwt-server.js:11:19:11:29 | decoded.foo |
733+
| jwt-server.js:11:19:11:25 | decoded | jwt-server.js:11:19:11:29 | decoded.foo |
719734
| nodemailer.js:13:50:13:66 | req.query.message | nodemailer.js:13:11:13:69 | `Hi, yo ... sage}.` |
720735
| nodemailer.js:13:50:13:66 | req.query.message | nodemailer.js:13:11:13:69 | `Hi, yo ... sage}.` |
721736
| nodemailer.js:13:50:13:66 | req.query.message | nodemailer.js:13:11:13:69 | `Hi, yo ... sage}.` |
@@ -1186,6 +1201,7 @@ edges
11861201
| jquery.js:14:19:14:58 | decodeU ... n.hash) | jquery.js:14:38:14:52 | window.location | jquery.js:14:19:14:58 | decodeU ... n.hash) | Cross-site scripting vulnerability due to $@. | jquery.js:14:38:14:52 | window.location | user-provided value |
11871202
| jquery.js:15:19:15:60 | decodeU ... search) | jquery.js:15:38:15:52 | window.location | jquery.js:15:19:15:60 | decodeU ... search) | Cross-site scripting vulnerability due to $@. | jquery.js:15:38:15:52 | window.location | user-provided value |
11881203
| jquery.js:16:19:16:64 | decodeU ... ring()) | jquery.js:16:38:16:52 | window.location | jquery.js:16:19:16:64 | decodeU ... ring()) | Cross-site scripting vulnerability due to $@. | jquery.js:16:38:16:52 | window.location | user-provided value |
1204+
| jwt-server.js:11:19:11:29 | decoded.foo | jwt-server.js:7:17:7:35 | req.param("wobble") | jwt-server.js:11:19:11:29 | decoded.foo | Cross-site scripting vulnerability due to $@. | jwt-server.js:7:17:7:35 | req.param("wobble") | user-provided value |
11891205
| nodemailer.js:13:11:13:69 | `Hi, yo ... sage}.` | nodemailer.js:13:50:13:66 | req.query.message | nodemailer.js:13:11:13:69 | `Hi, yo ... sage}.` | HTML injection vulnerability due to $@. | nodemailer.js:13:50:13:66 | req.query.message | user-provided value |
11901206
| optionalSanitizer.js:6:18:6:23 | target | optionalSanitizer.js:2:16:2:32 | document.location | optionalSanitizer.js:6:18:6:23 | target | Cross-site scripting vulnerability due to $@. | optionalSanitizer.js:2:16:2:32 | document.location | user-provided value |
11911207
| optionalSanitizer.js:9:18:9:24 | tainted | optionalSanitizer.js:2:16:2:32 | document.location | optionalSanitizer.js:9:18:9:24 | tainted | Cross-site scripting vulnerability due to $@. | optionalSanitizer.js:2:16:2:32 | document.location | user-provided value |

‎javascript/ql/test/query-tests/Security/CWE-079/DomBasedXss/XssWithAdditionalSources.expected‎

Lines changed: 15 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -125,6 +125,14 @@ nodes
125125
| jquery.js:16:38:16:52 | window.location |
126126
| jquery.js:16:38:16:52 | window.location |
127127
| jquery.js:16:38:16:63 | window. ... tring() |
128+
| jwt-server.js:7:9:7:35 | taint |
129+
| jwt-server.js:7:17:7:35 | req.param("wobble") |
130+
| jwt-server.js:7:17:7:35 | req.param("wobble") |
131+
| jwt-server.js:9:16:9:20 | taint |
132+
| jwt-server.js:9:55:9:61 | decoded |
133+
| jwt-server.js:11:19:11:25 | decoded |
134+
| jwt-server.js:11:19:11:29 | decoded.foo |
135+
| jwt-server.js:11:19:11:29 | decoded.foo |
128136
| jwt.js:4:36:4:39 | data |
129137
| jwt.js:4:36:4:39 | data |
130138
| jwt.js:5:9:5:34 | decoded |
@@ -727,6 +735,13 @@ edges
727735
| jquery.js:16:38:16:52 | window.location | jquery.js:16:38:16:63 | window. ... tring() |
728736
| jquery.js:16:38:16:63 | window. ... tring() | jquery.js:16:19:16:64 | decodeU ... ring()) |
729737
| jquery.js:16:38:16:63 | window. ... tring() | jquery.js:16:19:16:64 | decodeU ... ring()) |
738+
| jwt-server.js:7:9:7:35 | taint | jwt-server.js:9:16:9:20 | taint |
739+
| jwt-server.js:7:17:7:35 | req.param("wobble") | jwt-server.js:7:9:7:35 | taint |
740+
| jwt-server.js:7:17:7:35 | req.param("wobble") | jwt-server.js:7:9:7:35 | taint |
741+
| jwt-server.js:9:16:9:20 | taint | jwt-server.js:9:55:9:61 | decoded |
742+
| jwt-server.js:9:55:9:61 | decoded | jwt-server.js:11:19:11:25 | decoded |
743+
| jwt-server.js:11:19:11:25 | decoded | jwt-server.js:11:19:11:29 | decoded.foo |
744+
| jwt-server.js:11:19:11:25 | decoded | jwt-server.js:11:19:11:29 | decoded.foo |
730745
| jwt.js:4:36:4:39 | data | jwt.js:5:30:5:33 | data |
731746
| jwt.js:4:36:4:39 | data | jwt.js:5:30:5:33 | data |
732747
| jwt.js:5:9:5:34 | decoded | jwt.js:6:14:6:20 | decoded |

‎javascript/ql/test/query-tests/Security/CWE-079/DomBasedXss/jwt-server.js‎

Lines changed: 13 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,13 @@
1+
var express = require('express');
2+
var app = express();
3+
import jwt from "jsonwebtoken";
4+
5+
import { JSDOM } from "jsdom";
6+
app.get('/some/path', function (req, res) {
7+
var taint = req.param("wobble");
8+
9+
jwt.verify(taint, 'my-secret-key', function (err, decoded) {
10+
// NOT OK
11+
new JSDOM(decoded.foo, { runScripts: "dangerously" });
12+
});
13+
});

0 commit comments

Comments
 (0)