Skip to content

Remove dependencies on isSink in the taint tracking configurations of the default queries #180

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
merged 6 commits into from
Apr 3, 2025
Merged

Remove dependencies on isSink in the taint tracking configurations of the default queries #180

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
6 commits
Select commit Hold shift + click to select a range
44dcf9e
Remove uses of configuration of default queries in the custom queries
jeongsoolee09 Mar 28, 2025
a6509fe
Update expected results of `UI5Xss`
jeongsoolee09 Mar 28, 2025
58b85c4
Merge branch 'main' into jeongsoolee09/remove-duplicate-alerts
jeongsoolee09 Apr 3, 2025
c4eb9a4
Make the `TaintTracking::Configuration` s extend the default configur…
jeongsoolee09 Apr 3, 2025
cab928d
Remove the overriding characteristic predicates
jeongsoolee09 Apr 3, 2025
883aed5
Update .expected of `XSJSReflectedXss`
jeongsoolee09 Apr 3, 2025
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
3 changes: 2 additions & 1 deletion ...t/frameworks/cap/lib/advanced_security/javascript/frameworks/cap/CAPLogInjectionQuery.qll
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -45,7 +45,8 @@ class CdsLogSink extends DataFlow::Node {

class CAPLogInjectionConfiguration extends LogInjectionConfiguration {
override predicate isSource(DataFlow::Node start) {
super.isSource(start) or
super.isSource(start)
or
start instanceof RemoteFlowSource
}

Expand Down
6 changes: 2 additions & 4 deletions javascript/frameworks/ui5/lib/advanced_security/javascript/frameworks/ui5/UI5XssQuery.qll
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -2,7 +2,6 @@ import javascript
import advanced_security.javascript.frameworks.ui5.dataflow.DataFlow as UI5DataFlow
import advanced_security.javascript.frameworks.ui5.UI5View
import semmle.javascript.security.dataflow.DomBasedXssQuery as DomBasedXss
import semmle.javascript.security.dataflow.ClientSideUrlRedirectCustomizations::ClientSideUrlRedirect as UrlRedirect

class Configuration extends DomBasedXss::Configuration {
override predicate isSource(DataFlow::Node start) {
Expand Down Expand Up @@ -56,21 +55,20 @@ class Configuration extends DomBasedXss::Configuration {

override predicate isSink(DataFlow::Node node) {
node instanceof UI5ExtHtmlISink or
node instanceof UrlRedirect::LocationSink or
node instanceof UI5ModelHtmlISink
}
}

/**
* An HTML injection sink associated with a `UI5BoundNode`, typically for library controls acting as sinks.
*/
class UI5ModelHtmlISink extends DomBasedXss::Sink {
class UI5ModelHtmlISink extends DataFlow::Node {
UI5ModelHtmlISink() { exists(UI5View view | view.getAnHtmlISink().getNode() = this) }
}

/**
* An HTML injection sink typically for custom controls whose RenderManager calls acting as sinks.
*/
private class UI5ExtHtmlISink extends DomBasedXss::Sink {
private class UI5ExtHtmlISink extends DataFlow::Node {
UI5ExtHtmlISink() { this = ModelOutput::getASinkNode("ui5-html-injection").asSink() }
}
8 changes: 2 additions & 6 deletions ...rameworks/xsjs/lib/advanced_security/javascript/frameworks/xsjs/XSJSReflectedXssQuery.qll
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,6 +1,6 @@
import javascript
import advanced_security.javascript.frameworks.xsjs.AsyncXSJS
import semmle.javascript.security.dataflow.DomBasedXssQuery as DomBasedXss
import semmle.javascript.security.dataflow.ReflectedXssQuery as ReflectedXssQuery

class XSJSResponseSetBodyCall extends MethodCallNode {
XSJSResponse response;
Expand All @@ -13,17 +13,13 @@ class XSJSResponseSetBodyCall extends MethodCallNode {
XSJSResponse getParentXSJSResponse() { result = response }
}

class Configuration extends TaintTracking::Configuration {
Configuration() { this = "XSJS Reflected XSS Query" }

class Configuration extends ReflectedXssQuery::Configuration {
override predicate isSource(DataFlow::Node start) {
super.isSource(start) or
start instanceof RemoteFlowSource
}

override predicate isSink(DataFlow::Node end) {
super.isSink(end)
or
exists(XSJSResponseSetBodyCall setBody, XSJSResponse thisOrAnotherXSJSResponse |
thisOrAnotherXSJSResponse = setBody.getParentXSJSResponse() or
thisOrAnotherXSJSResponse = setBody.getParentXSJSResponse().getAPredOrSuccResponse()
Expand Down
8 changes: 3 additions & 5 deletions ...rameworks/xsjs/lib/advanced_security/javascript/frameworks/xsjs/XSJSSqlInjectionQuery.qll
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -12,16 +12,14 @@ class XSJSDBConnectionPrepareStatementArgument extends DataFlow::ValueNode {
predicate isConcatenated() { this.getAPredecessor+() instanceof StringOps::ConcatenationNode }
}

class Configuration extends TaintTracking::Configuration {
Configuration() { this = "XSJS SQL Injection Query" }

class Configuration extends SqlInjection::Configuration {
override predicate isSource(DataFlow::Node start) {
super.isSource(start) or
super.isSource(start)
or
start instanceof RemoteFlowSource
}

override predicate isSink(DataFlow::Node end) {
super.isSink(end) or
end.(XSJSDBConnectionPrepareStatementArgument).isConcatenated()
}
}
9 changes: 3 additions & 6 deletions ...frameworks/xsjs/lib/advanced_security/javascript/frameworks/xsjs/XSJSUrlRedirectQuery.qll
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -2,17 +2,14 @@ import javascript
import advanced_security.javascript.frameworks.xsjs.AsyncXSJS
import semmle.javascript.security.dataflow.ServerSideUrlRedirectQuery as UrlRedirect

class Configuration extends TaintTracking::Configuration {
Configuration() { this = "XSJS URL Redirect Query" }

class Configuration extends UrlRedirect::Configuration {
override predicate isSource(DataFlow::Node start) {
super.isSource(start) or
super.isSource(start)
or
start instanceof RemoteFlowSource
}

override predicate isSink(DataFlow::Node end) {
super.isSink(end)
or
exists(XSJSRequestOrResponseHeaders headers |
end = headers.getHeaderSetCall("location").getArgument(1)
)
Expand Down
33 changes: 0 additions & 33 deletions javascript/frameworks/xsjs/test/queries/XSJSReflectedXss/XSJSReflectedXss.expected
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -3,49 +3,16 @@ WARNING: type 'PathNode' has been deprecated and may be removed in future (XSJSR
WARNING: type 'PathNode' has been deprecated and may be removed in future (XSJSReflectedXss.ql:17,55-73)
nodes
| XSJSReflectedXss.xsjs:11:7:11:67 | someParameterValue1 |
| XSJSReflectedXss.xsjs:11:7:11:67 | someParameterValue1 |
| XSJSReflectedXss.xsjs:11:29:11:67 | request ... eter1") |
| XSJSReflectedXss.xsjs:11:29:11:67 | request ... eter1") |
| XSJSReflectedXss.xsjs:11:29:11:67 | request ... eter1") |
| XSJSReflectedXss.xsjs:11:29:11:67 | request ... eter1") |
| XSJSReflectedXss.xsjs:13:22:13:65 | request ... Value1) |
| XSJSReflectedXss.xsjs:13:22:13:65 | request ... Value1) |
| XSJSReflectedXss.xsjs:13:22:13:65 | request ... Value1) |
| XSJSReflectedXss.xsjs:13:22:13:65 | request ... Value1) |
| XSJSReflectedXss.xsjs:13:46:13:64 | someParameterValue1 |
| XSJSReflectedXss.xsjs:13:46:13:64 | someParameterValue1 |
| XSJSReflectedXss.xsjs:21:7:21:67 | someParameterValue2 |
| XSJSReflectedXss.xsjs:21:29:21:67 | request ... eter2") |
| XSJSReflectedXss.xsjs:21:29:21:67 | request ... eter2") |
| XSJSReflectedXss.xsjs:23:22:23:65 | request ... Value2) |
| XSJSReflectedXss.xsjs:23:22:23:65 | request ... Value2) |
| XSJSReflectedXss.xsjs:23:46:23:64 | someParameterValue2 |
| XSJSReflectedXss.xsjs:31:7:31:67 | someParameterValue3 |
| XSJSReflectedXss.xsjs:31:29:31:67 | request ... eter3") |
| XSJSReflectedXss.xsjs:31:29:31:67 | request ... eter3") |
| XSJSReflectedXss.xsjs:32:22:32:65 | request ... Value3) |
| XSJSReflectedXss.xsjs:32:22:32:65 | request ... Value3) |
| XSJSReflectedXss.xsjs:32:46:32:64 | someParameterValue3 |
edges
| XSJSReflectedXss.xsjs:11:7:11:67 | someParameterValue1 | XSJSReflectedXss.xsjs:13:46:13:64 | someParameterValue1 |
| XSJSReflectedXss.xsjs:11:7:11:67 | someParameterValue1 | XSJSReflectedXss.xsjs:13:46:13:64 | someParameterValue1 |
| XSJSReflectedXss.xsjs:11:29:11:67 | request ... eter1") | XSJSReflectedXss.xsjs:11:7:11:67 | someParameterValue1 |
| XSJSReflectedXss.xsjs:11:29:11:67 | request ... eter1") | XSJSReflectedXss.xsjs:11:7:11:67 | someParameterValue1 |
| XSJSReflectedXss.xsjs:11:29:11:67 | request ... eter1") | XSJSReflectedXss.xsjs:11:7:11:67 | someParameterValue1 |
| XSJSReflectedXss.xsjs:11:29:11:67 | request ... eter1") | XSJSReflectedXss.xsjs:11:7:11:67 | someParameterValue1 |
| XSJSReflectedXss.xsjs:13:46:13:64 | someParameterValue1 | XSJSReflectedXss.xsjs:13:22:13:65 | request ... Value1) |
| XSJSReflectedXss.xsjs:13:46:13:64 | someParameterValue1 | XSJSReflectedXss.xsjs:13:22:13:65 | request ... Value1) |
| XSJSReflectedXss.xsjs:13:46:13:64 | someParameterValue1 | XSJSReflectedXss.xsjs:13:22:13:65 | request ... Value1) |
| XSJSReflectedXss.xsjs:13:46:13:64 | someParameterValue1 | XSJSReflectedXss.xsjs:13:22:13:65 | request ... Value1) |
| XSJSReflectedXss.xsjs:21:7:21:67 | someParameterValue2 | XSJSReflectedXss.xsjs:23:46:23:64 | someParameterValue2 |
| XSJSReflectedXss.xsjs:21:29:21:67 | request ... eter2") | XSJSReflectedXss.xsjs:21:7:21:67 | someParameterValue2 |
| XSJSReflectedXss.xsjs:21:29:21:67 | request ... eter2") | XSJSReflectedXss.xsjs:21:7:21:67 | someParameterValue2 |
| XSJSReflectedXss.xsjs:23:46:23:64 | someParameterValue2 | XSJSReflectedXss.xsjs:23:22:23:65 | request ... Value2) |
| XSJSReflectedXss.xsjs:23:46:23:64 | someParameterValue2 | XSJSReflectedXss.xsjs:23:22:23:65 | request ... Value2) |
| XSJSReflectedXss.xsjs:31:7:31:67 | someParameterValue3 | XSJSReflectedXss.xsjs:32:46:32:64 | someParameterValue3 |
| XSJSReflectedXss.xsjs:31:29:31:67 | request ... eter3") | XSJSReflectedXss.xsjs:31:7:31:67 | someParameterValue3 |
| XSJSReflectedXss.xsjs:31:29:31:67 | request ... eter3") | XSJSReflectedXss.xsjs:31:7:31:67 | someParameterValue3 |
| XSJSReflectedXss.xsjs:32:46:32:64 | someParameterValue3 | XSJSReflectedXss.xsjs:32:22:32:65 | request ... Value3) |
| XSJSReflectedXss.xsjs:32:46:32:64 | someParameterValue3 | XSJSReflectedXss.xsjs:32:22:32:65 | request ... Value3) |
#select
| XSJSReflectedXss.xsjs:13:22:13:65 | request ... Value1) | XSJSReflectedXss.xsjs:11:29:11:67 | request ... eter1") | XSJSReflectedXss.xsjs:13:22:13:65 | request ... Value1) | Reflected XSS vulnerability due to $@. | XSJSReflectedXss.xsjs:11:29:11:67 | request ... eter1") | user-provided value |