diff --git a/javascript/lib/ghsl/Utils.qll b/javascript/lib/ghsl/Utils.qll index 45d4df85..aa3cbb1a 100644 --- a/javascript/lib/ghsl/Utils.qll +++ b/javascript/lib/ghsl/Utils.qll @@ -6,6 +6,7 @@ private import semmle.javascript.security.dataflow.CommandInjectionCustomization private import semmle.javascript.security.dataflow.CodeInjectionCustomizations private import semmle.javascript.security.dataflow.LogInjectionQuery as LogInjection private import semmle.javascript.security.dataflow.NosqlInjectionCustomizations +private import semmle.javascript.security.dataflow.SqlInjectionCustomizations private import semmle.javascript.security.dataflow.Xss as Xss private import semmle.javascript.security.dataflow.XxeCustomizations @@ -77,6 +78,8 @@ class AllSinks extends DataFlow::Node { sink = "log-injection" or this instanceof NosqlInjection::Sink and sink = "nosql-injection" or + this instanceof SqlInjection::Sink and + sink = "sql-injection" or this instanceof Xss::Shared::Sink and sink = "xss" or this instanceof Xxe::Sink and diff --git a/javascript/src/debugging/PartialPathsFromSink.ql b/javascript/src/debugging/PartialPathsFromSink.ql new file mode 100644 index 00000000..f9592bbf --- /dev/null +++ b/javascript/src/debugging/PartialPathsFromSink.ql @@ -0,0 +1,39 @@ +/** + * @name Partial Path Query from Sink + * @kind path-problem + * @problem.severity warning + * @security-severity 1.0 + * @sub-severity low + * @precision low + * @id js/debugging/partial-path-from-sink + * @tags debugging + */ + +import javascript +import ghsl +import DataFlow + +// Partial Graph +module PartialFlowConfig implements DataFlow::ConfigSig { + predicate isSource(DataFlow::Node source) { any() } + + predicate isSink(DataFlow::Node sink) { sink instanceof AllSinks } +} + +int explorationLimit() { result = 10 } + +private module PartialFlows = DataFlow::Global; + +private module PartialFlowsGraph = PartialFlows::FlowExplorationRev; + +private import PartialFlowsGraph::PartialPathGraph + +from PartialFlowsGraph::PartialPathNode source, PartialFlowsGraph::PartialPathNode sink +where + /// Only show sinks from a certain file + //filterByLocation(sink.getNode(), "index.js", _) and + /// Only show sources that match our criteria + //checkSource(source.getNode()) and + /// Partial Path + PartialFlowsGraph::partialFlow(source, sink, _) +select sink.getNode(), source, sink, "Partial Graph $@.", source.getNode(), "user-provided value" diff --git a/javascript/src/debugging/PartialPathsFromSource.ql b/javascript/src/debugging/PartialPathsFromSource.ql new file mode 100644 index 00000000..b0f20c32 --- /dev/null +++ b/javascript/src/debugging/PartialPathsFromSource.ql @@ -0,0 +1,38 @@ +/** + * @name Partial Path Query from Source + * @kind path-problem + * @problem.severity warning + * @security-severity 1.0 + * @sub-severity low + * @precision low + * @id js/debugging/partial-path-from-source + * @tags debugging + */ + +import javascript +import ghsl +import DataFlow + +// Partial Graph +module PartialFlowConfig implements DataFlow::ConfigSig { + predicate isSource(DataFlow::Node source) { + source instanceof AllSources + } + + predicate isSink(DataFlow::Node sink) { none() } +} + +int explorationLimit() { result = 10 } + +private module PartialFlows = DataFlow::Global; + +private module PartialFlowsGraph = PartialFlows::FlowExplorationFwd; + +private import PartialFlowsGraph::PartialPathGraph + +from PartialFlowsGraph::PartialPathNode source, PartialFlowsGraph::PartialPathNode sink +where + /// Filter by location + // filterByLocation(source.getNode(), "main.js", _) and + PartialFlowsGraph::partialFlow(source, sink, _) +select sink.getNode(), source, sink, "Partial Graph $@.", source.getNode(), "user-provided value"