Skip to content

Commit 1af289c

Browse files
NapalysNapalys
committed
Added modeling of client-s3 v2 and v3
1 parent 44008a8 commit 1af289c

File tree

3 files changed

+54
-5
lines changed

3 files changed

+54
-5
lines changed

‎javascript/ql/lib/ext/client-s3.model.yml‎

Lines changed: 20 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,20 @@
1+
extensions:
2+
- addsTo:
3+
pack: codeql/javascript-all
4+
extensible: sinkModel
5+
data:
6+
- ["S3ClientV3", "ReturnValue.Member[send].Argument[0]", "sql-injection"]
7+
- ["S3ClientV2", "ReturnValue.Member[selectObjectContent].Argument[0].Member[Expression]", "sql-injection"]
8+
9+
- addsTo:
10+
pack: codeql/javascript-all
11+
extensible: summaryModel
12+
data:
13+
- ["@aws-sdk/client-s3", "Member[SelectObjectContentCommand]", "Argument[0].Member[Expression]", "ReturnValue", "taint"]
14+
15+
- addsTo:
16+
pack: codeql/javascript-all
17+
extensible: typeModel
18+
data:
19+
- ["S3ClientV3", "@aws-sdk/client-s3", "Member[S3Client]"]
20+
- ["S3ClientV2", "aws-sdk", "Member[S3]"]

‎javascript/ql/test/query-tests/Security/CWE-089/untyped/SqlInjection.expected‎

Lines changed: 29 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,7 @@
11
#select
2+
| clients3.js:18:23:18:60 | new Sel ... params) | clients3.js:10:26:10:33 | req.body | clients3.js:18:23:18:60 | new Sel ... params) | This query string depends on a $@. | clients3.js:10:26:10:33 | req.body | user-provided value |
3+
| clients3.js:29:21:29:68 | "SELECT ... usInput | clients3.js:23:26:23:33 | req.body | clients3.js:29:21:29:68 | "SELECT ... usInput | This query string depends on a $@. | clients3.js:23:26:23:33 | req.body | user-provided value |
4+
| clients3.js:38:21:38:68 | "SELECT ... usInput | clients3.js:23:26:23:33 | req.body | clients3.js:38:21:38:68 | "SELECT ... usInput | This query string depends on a $@. | clients3.js:23:26:23:33 | req.body | user-provided value |
25
| dynamodb.js:15:23:15:29 | command | dynamodb.js:9:26:9:33 | req.body | dynamodb.js:15:23:15:29 | command | This query string depends on a $@. | dynamodb.js:9:26:9:33 | req.body | user-provided value |
36
| dynamodb.js:21:23:21:35 | updateCommand | dynamodb.js:9:26:9:33 | req.body | dynamodb.js:21:23:21:35 | updateCommand | This query string depends on a $@. | dynamodb.js:9:26:9:33 | req.body | user-provided value |
47
| dynamodb.js:47:24:47:30 | command | dynamodb.js:9:26:9:33 | req.body | dynamodb.js:47:24:47:30 | command | This query string depends on a $@. | dynamodb.js:9:26:9:33 | req.body | user-provided value |
@@ -143,6 +146,18 @@
143146
| tst4.js:8:10:8:66 | 'SELECT ... d + '"' | tst4.js:8:46:8:60 | $routeParams.id | tst4.js:8:10:8:66 | 'SELECT ... d + '"' | This query string depends on a $@. | tst4.js:8:46:8:60 | $routeParams.id | user-provided value |
144147
| tst.js:10:10:10:64 | 'SELECT ... d + '"' | tst.js:10:46:10:58 | req.params.id | tst.js:10:10:10:64 | 'SELECT ... d + '"' | This query string depends on a $@. | tst.js:10:46:10:58 | req.params.id | user-provided value |
145148
edges
149+
| clients3.js:10:9:10:40 | maliciousInput | clients3.js:16:55:16:68 | maliciousInput | provenance | |
150+
| clients3.js:10:26:10:33 | req.body | clients3.js:10:9:10:40 | maliciousInput | provenance | |
151+
| clients3.js:12:11:17:5 | params [Expression] | clients3.js:18:54:18:59 | params [Expression] | provenance | |
152+
| clients3.js:12:20:17:5 | {\\n ... ,\\n } [Expression] | clients3.js:12:11:17:5 | params [Expression] | provenance | |
153+
| clients3.js:16:21:16:68 | "SELECT ... usInput | clients3.js:12:20:17:5 | {\\n ... ,\\n } [Expression] | provenance | |
154+
| clients3.js:16:55:16:68 | maliciousInput | clients3.js:16:21:16:68 | "SELECT ... usInput | provenance | |
155+
| clients3.js:18:54:18:59 | params [Expression] | clients3.js:18:23:18:60 | new Sel ... params) | provenance | |
156+
| clients3.js:23:9:23:40 | maliciousInput | clients3.js:29:55:29:68 | maliciousInput | provenance | |
157+
| clients3.js:23:9:23:40 | maliciousInput | clients3.js:38:55:38:68 | maliciousInput | provenance | |
158+
| clients3.js:23:26:23:33 | req.body | clients3.js:23:9:23:40 | maliciousInput | provenance | |
159+
| clients3.js:29:55:29:68 | maliciousInput | clients3.js:29:21:29:68 | "SELECT ... usInput | provenance | |
160+
| clients3.js:38:55:38:68 | maliciousInput | clients3.js:38:21:38:68 | "SELECT ... usInput | provenance | |
146161
| dynamodb.js:9:9:9:38 | maliciousInput | dynamodb.js:11:64:11:77 | maliciousInput | provenance | |
147162
| dynamodb.js:9:9:9:38 | maliciousInput | dynamodb.js:17:80:17:93 | maliciousInput | provenance | |
148163
| dynamodb.js:9:26:9:33 | req.body | dynamodb.js:9:9:9:38 | maliciousInput | provenance | |
@@ -547,6 +562,20 @@ edges
547562
| tst4.js:8:46:8:60 | $routeParams.id | tst4.js:8:10:8:66 | 'SELECT ... d + '"' | provenance | |
548563
| tst.js:10:46:10:58 | req.params.id | tst.js:10:10:10:64 | 'SELECT ... d + '"' | provenance | |
549564
nodes
565+
| clients3.js:10:9:10:40 | maliciousInput | semmle.label | maliciousInput |
566+
| clients3.js:10:26:10:33 | req.body | semmle.label | req.body |
567+
| clients3.js:12:11:17:5 | params [Expression] | semmle.label | params [Expression] |
568+
| clients3.js:12:20:17:5 | {\\n ... ,\\n } [Expression] | semmle.label | {\\n ... ,\\n } [Expression] |
569+
| clients3.js:16:21:16:68 | "SELECT ... usInput | semmle.label | "SELECT ... usInput |
570+
| clients3.js:16:55:16:68 | maliciousInput | semmle.label | maliciousInput |
571+
| clients3.js:18:23:18:60 | new Sel ... params) | semmle.label | new Sel ... params) |
572+
| clients3.js:18:54:18:59 | params [Expression] | semmle.label | params [Expression] |
573+
| clients3.js:23:9:23:40 | maliciousInput | semmle.label | maliciousInput |
574+
| clients3.js:23:26:23:33 | req.body | semmle.label | req.body |
575+
| clients3.js:29:21:29:68 | "SELECT ... usInput | semmle.label | "SELECT ... usInput |
576+
| clients3.js:29:55:29:68 | maliciousInput | semmle.label | maliciousInput |
577+
| clients3.js:38:21:38:68 | "SELECT ... usInput | semmle.label | "SELECT ... usInput |
578+
| clients3.js:38:55:38:68 | maliciousInput | semmle.label | maliciousInput |
550579
| dynamodb.js:9:9:9:38 | maliciousInput | semmle.label | maliciousInput |
551580
| dynamodb.js:9:26:9:33 | req.body | semmle.label | req.body |
552581
| dynamodb.js:11:11:11:80 | statement | semmle.label | statement |

‎javascript/ql/test/query-tests/Security/CWE-089/untyped/clients3.js‎

Lines changed: 5 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -7,26 +7,26 @@ const app = express();
77
app.use(bodyParser.json());
88

99
app.post('/client/v3/execute', async (req, res) => {
10-
let maliciousInput = req.body.filter; // $ MISSING: Source
10+
let maliciousInput = req.body.filter; // $ Source
1111
const client = new S3Client({ region: "us-east-1" });
1212
const params = {
1313
Bucket: "my-bucket",
1414
Key: "data.csv",
1515
ExpressionType: "SQL",
1616
Expression: "SELECT * FROM S3Object WHERE " + maliciousInput,
1717
};
18-
await client.send(new SelectObjectContentCommand(params)); // $ MISSING: Alert
18+
await client.send(new SelectObjectContentCommand(params)); // $ Alert
1919
res.end();
2020
});
2121

2222
app.post('/client/v2/execute', async (req, res) => {
23-
let maliciousInput = req.body.filter; // $ MISSING: Source
23+
let maliciousInput = req.body.filter; // $ Source
2424
const s3 = new AWS.S3({ region: "us-east-1" });
2525
const params = {
2626
Bucket: "my-bucket",
2727
Key: "data.csv",
2828
ExpressionType: "SQL",
29-
Expression: "SELECT * FROM S3Object WHERE " + maliciousInput, // $ MISSING: Alert
29+
Expression: "SELECT * FROM S3Object WHERE " + maliciousInput, // $ Alert
3030
};
3131
await s3.selectObjectContent(params).promise();
3232
res.end();
@@ -35,7 +35,7 @@ app.post('/client/v2/execute', async (req, res) => {
3535
Bucket: "my-bucket",
3636
Key: "data.csv",
3737
ExpressionType: "SQL",
38-
Expression: "SELECT * FROM S3Object WHERE " + maliciousInput, // $ MISSING: Alert
38+
Expression: "SELECT * FROM S3Object WHERE " + maliciousInput, // $ Alert
3939
};
4040

4141
s3.selectObjectContent(params1, (err, data) => {

0 commit comments

Comments
 (0)