Skip to content

Commit 0462eb4

Browse files
asger-semmleasger-semmle
committed
JS: add IncorrectSuffixCheck query
1 parent 2cc235d commit 0462eb4

File tree

11 files changed

+312
-0
lines changed

11 files changed

+312
-0
lines changed

‎change-notes/1.20/analysis-javascript.md‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -7,6 +7,7 @@
77
| **Query** | **Tags** | **Purpose** |
88
|-----------------------------------------------|------------------------------------------------------|-----------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
99
| Double escaping or unescaping (`js/double-escaping`) | correctness, security, external/cwe/cwe-116 | Highlights potential double escaping or unescaping of special characters, indicating a possible violation of [CWE-116](https://cwe.mitre.org/data/definitions/116.html). Results are shown on LGTM by default. |
10+
| Incorrect suffix check (`js/incorrect-suffix-check`) | correctness, security, external/cwe/cwe-020 | Highlights error-prone suffix checks based on `indexOf`, indicating a potential violation of [CWE-20](https://cwe.mitre.org/data/definitions/20.html). |
1011
| Useless comparison test (`js/useless-comparison-test`) | correctness | Highlights code that is unreachable due to a numeric comparison that is always true or always false. |
1112

1213
## Changes to existing queries

‎javascript/config/suites/javascript/security‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,6 @@
11
+ semmlecode-javascript-queries/DOM/TargetBlank.ql: /Security/CWE/CWE-200
22
+ semmlecode-javascript-queries/Electron/EnablingNodeIntegration.ql: /Security/CWE/CWE-094
3+
+ semmlecode-javascript-queries/Security/CWE-020/IncorrectSuffixCheck.ql: /Security/CWE/CWE-020
34
+ semmlecode-javascript-queries/Security/CWE-022/TaintedPath.ql: /Security/CWE/CWE-022
45
+ semmlecode-javascript-queries/Security/CWE-078/CommandInjection.ql: /Security/CWE/CWE-078
56
+ semmlecode-javascript-queries/Security/CWE-079/ReflectedXss.ql: /Security/CWE/CWE-079

‎javascript/ql/src/Security/CWE-020/IncorrectSuffixCheck.qhelp‎

Lines changed: 72 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,72 @@
1+
<!DOCTYPE qhelp PUBLIC
2+
"-//Semmle//qhelp//EN"
3+
"qhelp.dtd">
4+
<qhelp>
5+
6+
<overview>
7+
<p>
8+
9+
The <code>indexOf</code> and <code>lastIndexOf</code> methods are sometimes used to check
10+
if a substring occurs at a certain position in a string. However, if the returned index
11+
is compared to an expression that might evaluate to -1, the check can may pass in some
12+
cases where the substring was not found at all.
13+
14+
</p>
15+
<p>
16+
17+
Specifically, this can easily happen when implementing <code>endsWith</code> using
18+
<code>indexOf</code>.
19+
20+
</p>
21+
</overview>
22+
23+
<recommendation>
24+
25+
<p>
26+
27+
Use <code>String.prototype.endsWith</code> if it is available.
28+
Otherwise, explicitly handle the -1 case, either by checking the relative
29+
lengths of the strings, or check if the returned index is -1.
30+
31+
</p>
32+
33+
</recommendation>
34+
35+
<example>
36+
37+
<p>
38+
39+
The following example uses <code>lastIndexOf</code> to determine if the string <code>x</code>
40+
ends with the string <code>y</code>:
41+
42+
</p>
43+
44+
<sample src="examples/IncorrectSuffixCheck.js"/>
45+
46+
<p>
47+
48+
However, if <code>y</code> is one character longer than <code>x</code>, the right-hand side
49+
<code>x.length - y.length</code> becomes -1, which then equals the return value
50+
of <code>lastIndexOf</code>. This will make the test pass, evne though <code>x</code> does not
51+
end with <code>y</code>.
52+
53+
</p>
54+
55+
<p>
56+
57+
To avoid this, explicitly check for the -1 case:
58+
59+
</p>
60+
61+
<sample src="examples/IncorrectSuffixCheckGood.js"/>
62+
63+
64+
</example>
65+
66+
<references>
67+
68+
<li>MDN: <a href="https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Global_Objects/String/endsWith">String.prototype.endsWith</a></li>
69+
<li>MDN: <a href="https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Global_Objects/String/indexOf">String.prototype.indexOf</a></li>
70+
71+
</references>
72+
</qhelp>

‎javascript/ql/src/Security/CWE-020/IncorrectSuffixCheck.ql‎

Lines changed: 142 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,142 @@
1+
/**
2+
* @name Incorrect suffix check
3+
* @description Using indexOf to implement endsWith functionality is error prone if the -1 case is not explicitly handled.
4+
* @kind problem
5+
* @problem.severity error
6+
* @precision high
7+
* @id js/incorrect-suffix-check
8+
* @tags security
9+
* correctness
10+
* external/cwe/cwe-020
11+
*/
12+
import javascript
13+
14+
/**
15+
* A call to `indexOf` or `lastIndexOf`.
16+
*/
17+
class IndexOfCall extends DataFlow::MethodCallNode {
18+
IndexOfCall() {
19+
exists (string name | name = getMethodName() |
20+
name = "indexOf" or
21+
name = "lastIndexOf") and
22+
getNumArgument() = 1
23+
}
24+
25+
/** Gets the receiver or argument of this call. */
26+
DataFlow::Node getAnOperand() {
27+
result = getReceiver() or
28+
result = getArgument(0)
29+
}
30+
31+
/**
32+
* Gets an `indexOf` call with the same receiver, argument, and method name, including this call itself.
33+
*/
34+
IndexOfCall getAnEqualiventIndexOfCall() {
35+
result.getReceiver().getALocalSource() = this.getReceiver().getALocalSource() and
36+
result.getArgument(0).getALocalSource() = this.getArgument(0).getALocalSource() and
37+
result.getMethodName() = this.getMethodName()
38+
}
39+
}
40+
41+
/**
42+
* Gets a source of the given string value.
43+
*/
44+
DataFlow::SourceNode getStringSource(DataFlow::Node node) {
45+
result = node.getALocalSource()
46+
or
47+
result = StringConcatenation::getAnOperand(node).getALocalSource()
48+
}
49+
50+
/**
51+
* An expression that takes the length of a string literal.
52+
*/
53+
class LiteralLengthExpr extends DotExpr {
54+
LiteralLengthExpr() {
55+
getPropertyName() = "length" and
56+
getBase() instanceof StringLiteral
57+
}
58+
59+
/**
60+
* Gets the value of the string literal whose length is taken.
61+
*/
62+
string getBaseValue() {
63+
result = getBase().getStringValue()
64+
}
65+
}
66+
67+
/**
68+
* Holds if `node` is derived from the length of the given `indexOf`-operand.
69+
*/
70+
predicate isDerivedFromLength(DataFlow::Node length, DataFlow::Node operand) {
71+
exists (IndexOfCall call | operand = call.getAnOperand() |
72+
length = getStringSource(operand).getAPropertyRead("length")
73+
or
74+
// Find a literal length with the same string constant
75+
exists (LiteralLengthExpr lengthExpr |
76+
lengthExpr.getContainer() = call.getContainer() and
77+
lengthExpr.getBaseValue() = operand.asExpr().getStringValue() and
78+
length = lengthExpr.flow())
79+
or
80+
// Find an integer constants that equals the length of string constant
81+
exists (Expr lengthExpr |
82+
lengthExpr.getContainer() = call.getContainer() and
83+
lengthExpr.getIntValue() = operand.asExpr().getStringValue().length() and
84+
length = lengthExpr.flow())
85+
)
86+
or
87+
exists (DataFlow::Node mid |
88+
isDerivedFromLength(mid, operand) and
89+
length = mid.getASuccessor())
90+
or
91+
exists (SubExpr sub |
92+
isDerivedFromLength(sub.getAnOperand().flow(), operand) and
93+
length = sub.flow())
94+
}
95+
96+
/**
97+
* An equality comparison of form `A.indexOf(B) === A.length - B.length` or similar.
98+
*/
99+
class UnsafeIndexOfComparison extends EqualityTest {
100+
IndexOfCall indexOf;
101+
DataFlow::Node testedValue;
102+
103+
UnsafeIndexOfComparison() {
104+
hasOperands(indexOf.asExpr(), testedValue.asExpr()) and
105+
isDerivedFromLength(testedValue, indexOf.getReceiver()) and
106+
isDerivedFromLength(testedValue, indexOf.getArgument(0)) and
107+
108+
// Ignore cases like `x.indexOf("/") === x.length - 1` that can only be bypassed if `x` is the empty string.
109+
// Sometimes strings are just known to be non-empty from the context, and it is unlikely to be a security issue,
110+
// since it's obviously not a domain name check.
111+
not indexOf.getArgument(0).mayHaveStringValue(any(string s | s.length() = 1)) and
112+
113+
// Relative string length comparison, such as A.length > B.length, or (A.length - B.length) > 0
114+
not exists (RelationalComparison compare |
115+
isDerivedFromLength(compare.getAnOperand().flow(), indexOf.getReceiver()) and
116+
isDerivedFromLength(compare.getAnOperand().flow(), indexOf.getArgument(0))
117+
) and
118+
119+
// Check for indexOf being -1
120+
not exists (EqualityTest test, Expr minusOne |
121+
test.hasOperands(indexOf.getAnEqualiventIndexOfCall().asExpr(), minusOne) and
122+
minusOne.getIntValue() = -1
123+
) and
124+
125+
// Check for indexOf being >1, or >=0, etc
126+
not exists (RelationalComparison test |
127+
test.getGreaterOperand() = indexOf.getAnEqualiventIndexOfCall().asExpr() and
128+
exists (int value | value = test.getLesserOperand().getIntValue() |
129+
value >= 0
130+
or
131+
not test.isInclusive() and
132+
value = -1)
133+
)
134+
}
135+
136+
IndexOfCall getIndexOf() {
137+
result = indexOf
138+
}
139+
}
140+
141+
from UnsafeIndexOfComparison comparison
142+
select comparison, "This suffix check is missing a length comparison to correctly handle " + comparison.getIndexOf().getMethodName() + " returning -1."

‎javascript/ql/src/Security/CWE-020/examples/IncorrectSuffixCheck.js‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,3 @@
1+
function endsWith(x, y) {
2+
return x.lastIndexOf(y) === x.length - y.length;
3+
}

‎javascript/ql/src/Security/CWE-020/examples/IncorrectSuffixCheckGood.js‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,4 @@
1+
function endsWith(x, y) {
2+
let index = x.lastIndexOf(y);
3+
return index !== -1 && index === x.length - y.length;
4+
}

‎javascript/ql/test/query-tests/Security/CWE-020/IncorrectSuffixCheck.expected‎

Lines changed: 9 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,9 @@
1+
| examples/IncorrectSuffixCheck.js:2:10:2:49 | x.lastI ... .length | This suffix check is missing a length comparison to correctly handle lastIndexOf returning -1. |
2+
| tst.js:2:10:2:45 | x.index ... .length | This suffix check is missing a length comparison to correctly handle indexOf returning -1. |
3+
| tst.js:9:10:9:55 | x.index ... gth - 1 | This suffix check is missing a length comparison to correctly handle indexOf returning -1. |
4+
| tst.js:17:10:17:31 | x.index ... = delta | This suffix check is missing a length comparison to correctly handle indexOf returning -1. |
5+
| tst.js:25:10:25:69 | x.index ... .length | This suffix check is missing a length comparison to correctly handle indexOf returning -1. |
6+
| tst.js:32:10:32:51 | x.index ... th - 11 | This suffix check is missing a length comparison to correctly handle indexOf returning -1. |
7+
| tst.js:39:10:39:49 | x.lastI ... .length | This suffix check is missing a length comparison to correctly handle lastIndexOf returning -1. |
8+
| tst.js:55:32:55:71 | x.index ... gth - 1 | This suffix check is missing a length comparison to correctly handle indexOf returning -1. |
9+
| tst.js:67:32:67:71 | x.index ... gth - 1 | This suffix check is missing a length comparison to correctly handle indexOf returning -1. |

‎javascript/ql/test/query-tests/Security/CWE-020/IncorrectSuffixCheck.qlref‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1 @@
1+
Security/CWE-020/IncorrectSuffixCheck.ql

‎javascript/ql/test/query-tests/Security/CWE-020/examples/IncorrectSuffixCheck.js‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,3 @@
1+
function endsWith(x, y) {
2+
return x.lastIndexOf(y) === x.length - y.length;
3+
}

‎javascript/ql/test/query-tests/Security/CWE-020/examples/IncorrectSuffixCheckGood.js‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,4 @@
1+
function endsWith(x, y) {
2+
let index = x.lastIndexOf(y);
3+
return index !== -1 && index === x.length - y.length;
4+
}

0 commit comments

Comments
 (0)