Skip to content

Commit 2ac334b

Browse files
jorgectfjorgectf
committed
Adapt Webix modeling to support HTML use-cases
1 parent 1e663b8 commit 2ac334b

File tree

14 files changed

+148
-65
lines changed

14 files changed

+148
-65
lines changed

‎javascript/ql/lib/javascript.qll‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -134,6 +134,7 @@ import semmle.javascript.frameworks.TrustedTypes
134134
import semmle.javascript.frameworks.UriLibraries
135135
import semmle.javascript.frameworks.Vue
136136
import semmle.javascript.frameworks.Vuex
137+
import semmle.javascript.frameworks.Webix
137138
import semmle.javascript.frameworks.WebSocket
138139
import semmle.javascript.frameworks.XmlParsers
139140
import semmle.javascript.frameworks.xUnit

‎javascript/ql/lib/semmle/javascript/Extend.qll‎

Lines changed: 3 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -97,7 +97,9 @@ private class ExtendCallDeep extends ExtendCall {
9797
callee = LodashUnderscore::member("mergeWith") or
9898
callee = LodashUnderscore::member("defaultsDeep") or
9999
callee = AngularJS::angular().getAPropertyRead("merge") or
100-
callee = DataFlow::moduleImport("webix").getAPropertyRead(["extend", "copy"])
100+
callee =
101+
[DataFlow::moduleImport("webix"), DataFlow::globalVarRef("webix")]
102+
.getAPropertyRead(["extend", "copy"])
101103
)
102104
}
103105

‎javascript/ql/lib/semmle/javascript/frameworks/Webix.qll‎

Lines changed: 24 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,24 @@
1+
/**
2+
* Provides classes and predicates for working with the `webix` library.
3+
*/
4+
5+
private import javascript
6+
7+
/**
8+
* Provides classes and predicates for working with the `webix` library.
9+
*/
10+
module Webix {
11+
/** The global variable `webix` as an entry point for API graphs. */
12+
private class WebixGlobalEntry extends API::EntryPoint {
13+
WebixGlobalEntry() { this = "WebixGlobalEntry" }
14+
15+
override DataFlow::SourceNode getASource() { result = DataFlow::globalVarRef("webix") }
16+
}
17+
18+
/** Gets a reference to the Webix package. */
19+
API::Node webix() {
20+
result = API::moduleImport("webix") or
21+
result.asSource() = DataFlow::moduleImport("webix") or
22+
result = any(WebixGlobalEntry w).getANode()
23+
}
24+
}

‎javascript/ql/lib/semmle/javascript/security/dataflow/CodeInjectionCustomizations.qll‎

Lines changed: 3 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -316,7 +316,7 @@ module CodeInjection {
316316
* A value interpreted as code by the `webix` library.
317317
*/
318318
class WebixExec extends Sink {
319-
WebixExec() { this = API::moduleImport("webix").getMember("exec").getParameter(0).asSink() }
319+
WebixExec() { this = Webix::webix().getMember("exec").getParameter(0).asSink() }
320320
}
321321

322322
/** A sink for code injection via template injection. */
@@ -431,16 +431,10 @@ module CodeInjection {
431431
*/
432432
class WebixTemplateSink extends TemplateSink {
433433
WebixTemplateSink() {
434-
this =
435-
API::moduleImport("webix").getMember("ui").getParameter(0).getMember("template").asSink()
434+
this = Webix::webix().getMember("ui").getParameter(0).getMember("template").asSink()
436435
or
437436
this =
438-
API::moduleImport("webix")
439-
.getMember("ui")
440-
.getParameter(0)
441-
.getMember("template")
442-
.getReturn()
443-
.asSink()
437+
Webix::webix().getMember("ui").getParameter(0).getMember("template").getReturn().asSink()
444438
}
445439
}
446440

‎javascript/ql/lib/semmle/javascript/security/dataflow/PrototypePollutionCustomizations.qll‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -173,7 +173,7 @@ module PrototypePollution {
173173
id = "angular"
174174
or
175175
call.isDeep() and
176-
call = DataFlow::moduleImport("webix").getAMemberCall(["extend", "copy"]) and
176+
call = Webix::webix().getMember(["extend", "copy"]).getACall() and
177177
id = "webix"
178178
}
179179
}

‎javascript/ql/test/query-tests/Security/CWE-094/CodeInjection/CodeInjection.expected‎

Lines changed: 30 additions & 15 deletions
Original file line numberDiff line numberDiff line change
@@ -143,10 +143,6 @@ nodes
143143
| template-sinks.js:32:16:32:22 | tainted |
144144
| template-sinks.js:33:17:33:23 | tainted |
145145
| template-sinks.js:33:17:33:23 | tainted |
146-
| template-sinks.js:34:26:34:32 | tainted |
147-
| template-sinks.js:34:26:34:32 | tainted |
148-
| template-sinks.js:35:47:35:53 | tainted |
149-
| template-sinks.js:35:47:35:53 | tainted |
150146
| tst.js:2:6:2:27 | documen ... on.href |
151147
| tst.js:2:6:2:27 | documen ... on.href |
152148
| tst.js:2:6:2:83 | documen ... t=")+8) |
@@ -185,9 +181,24 @@ nodes
185181
| tst.js:35:28:35:33 | source |
186182
| tst.js:37:33:37:38 | source |
187183
| tst.js:37:33:37:38 | source |
188-
| webix.js:3:12:3:33 | documen ... on.hash |
189-
| webix.js:3:12:3:33 | documen ... on.hash |
190-
| webix.js:3:12:3:33 | documen ... on.hash |
184+
| webix/webix.html:3:16:3:37 | documen ... on.hash |
185+
| webix/webix.html:3:16:3:37 | documen ... on.hash |
186+
| webix/webix.html:3:16:3:37 | documen ... on.hash |
187+
| webix/webix.html:4:26:4:47 | documen ... on.hash |
188+
| webix/webix.html:4:26:4:47 | documen ... on.hash |
189+
| webix/webix.html:4:26:4:47 | documen ... on.hash |
190+
| webix/webix.html:5:47:5:68 | documen ... on.hash |
191+
| webix/webix.html:5:47:5:68 | documen ... on.hash |
192+
| webix/webix.html:5:47:5:68 | documen ... on.hash |
193+
| webix/webix.js:3:12:3:33 | documen ... on.hash |
194+
| webix/webix.js:3:12:3:33 | documen ... on.hash |
195+
| webix/webix.js:3:12:3:33 | documen ... on.hash |
196+
| webix/webix.js:4:22:4:43 | documen ... on.hash |
197+
| webix/webix.js:4:22:4:43 | documen ... on.hash |
198+
| webix/webix.js:4:22:4:43 | documen ... on.hash |
199+
| webix/webix.js:5:43:5:64 | documen ... on.hash |
200+
| webix/webix.js:5:43:5:64 | documen ... on.hash |
201+
| webix/webix.js:5:43:5:64 | documen ... on.hash |
191202
edges
192203
| NoSQLCodeInjection.js:18:24:18:31 | req.body | NoSQLCodeInjection.js:18:24:18:37 | req.body.query |
193204
| NoSQLCodeInjection.js:18:24:18:31 | req.body | NoSQLCodeInjection.js:18:24:18:37 | req.body.query |
@@ -281,10 +292,6 @@ edges
281292
| template-sinks.js:18:9:18:31 | tainted | template-sinks.js:32:16:32:22 | tainted |
282293
| template-sinks.js:18:9:18:31 | tainted | template-sinks.js:33:17:33:23 | tainted |
283294
| template-sinks.js:18:9:18:31 | tainted | template-sinks.js:33:17:33:23 | tainted |
284-
| template-sinks.js:18:9:18:31 | tainted | template-sinks.js:34:26:34:32 | tainted |
285-
| template-sinks.js:18:9:18:31 | tainted | template-sinks.js:34:26:34:32 | tainted |
286-
| template-sinks.js:18:9:18:31 | tainted | template-sinks.js:35:47:35:53 | tainted |
287-
| template-sinks.js:18:9:18:31 | tainted | template-sinks.js:35:47:35:53 | tainted |
288295
| template-sinks.js:18:19:18:31 | req.query.foo | template-sinks.js:18:9:18:31 | tainted |
289296
| template-sinks.js:18:19:18:31 | req.query.foo | template-sinks.js:18:9:18:31 | tainted |
290297
| tst.js:2:6:2:27 | documen ... on.href | tst.js:2:6:2:83 | documen ... t=")+8) |
@@ -317,7 +324,12 @@ edges
317324
| tst.js:29:18:29:41 | documen ... .search | tst.js:29:18:29:82 | documen ... , "$1") |
318325
| tst.js:29:18:29:41 | documen ... .search | tst.js:29:18:29:82 | documen ... , "$1") |
319326
| tst.js:29:18:29:82 | documen ... , "$1") | tst.js:29:9:29:82 | source |
320-
| webix.js:3:12:3:33 | documen ... on.hash | webix.js:3:12:3:33 | documen ... on.hash |
327+
| webix/webix.html:3:16:3:37 | documen ... on.hash | webix/webix.html:3:16:3:37 | documen ... on.hash |
328+
| webix/webix.html:4:26:4:47 | documen ... on.hash | webix/webix.html:4:26:4:47 | documen ... on.hash |
329+
| webix/webix.html:5:47:5:68 | documen ... on.hash | webix/webix.html:5:47:5:68 | documen ... on.hash |
330+
| webix/webix.js:3:12:3:33 | documen ... on.hash | webix/webix.js:3:12:3:33 | documen ... on.hash |
331+
| webix/webix.js:4:22:4:43 | documen ... on.hash | webix/webix.js:4:22:4:43 | documen ... on.hash |
332+
| webix/webix.js:5:43:5:64 | documen ... on.hash | webix/webix.js:5:43:5:64 | documen ... on.hash |
321333
#select
322334
| NoSQLCodeInjection.js:18:24:18:37 | req.body.query | NoSQLCodeInjection.js:18:24:18:31 | req.body | NoSQLCodeInjection.js:18:24:18:37 | req.body.query | This code execution depends on a $@. | NoSQLCodeInjection.js:18:24:18:31 | req.body | user-provided value |
323335
| NoSQLCodeInjection.js:19:24:19:48 | "name = ... dy.name | NoSQLCodeInjection.js:19:36:19:43 | req.body | NoSQLCodeInjection.js:19:24:19:48 | "name = ... dy.name | This code execution depends on a $@. | NoSQLCodeInjection.js:19:36:19:43 | req.body | user-provided value |
@@ -366,8 +378,6 @@ edges
366378
| template-sinks.js:31:19:31:25 | tainted | template-sinks.js:18:19:18:31 | req.query.foo | template-sinks.js:31:19:31:25 | tainted | Template, which may contain code, depends on a $@. | template-sinks.js:18:19:18:31 | req.query.foo | user-provided value |
367379
| template-sinks.js:32:16:32:22 | tainted | template-sinks.js:18:19:18:31 | req.query.foo | template-sinks.js:32:16:32:22 | tainted | Template, which may contain code, depends on a $@. | template-sinks.js:18:19:18:31 | req.query.foo | user-provided value |
368380
| template-sinks.js:33:17:33:23 | tainted | template-sinks.js:18:19:18:31 | req.query.foo | template-sinks.js:33:17:33:23 | tainted | Template, which may contain code, depends on a $@. | template-sinks.js:18:19:18:31 | req.query.foo | user-provided value |
369-
| template-sinks.js:34:26:34:32 | tainted | template-sinks.js:18:19:18:31 | req.query.foo | template-sinks.js:34:26:34:32 | tainted | Template, which may contain code, depends on a $@. | template-sinks.js:18:19:18:31 | req.query.foo | user-provided value |
370-
| template-sinks.js:35:47:35:53 | tainted | template-sinks.js:18:19:18:31 | req.query.foo | template-sinks.js:35:47:35:53 | tainted | Template, which may contain code, depends on a $@. | template-sinks.js:18:19:18:31 | req.query.foo | user-provided value |
371381
| tst.js:2:6:2:83 | documen ... t=")+8) | tst.js:2:6:2:27 | documen ... on.href | tst.js:2:6:2:83 | documen ... t=")+8) | This code execution depends on a $@. | tst.js:2:6:2:27 | documen ... on.href | user-provided value |
372382
| tst.js:5:12:5:33 | documen ... on.hash | tst.js:5:12:5:33 | documen ... on.hash | tst.js:5:12:5:33 | documen ... on.hash | This code execution depends on a $@. | tst.js:5:12:5:33 | documen ... on.hash | user-provided value |
373383
| tst.js:14:10:14:74 | documen ... , "$1") | tst.js:14:10:14:33 | documen ... .search | tst.js:14:10:14:74 | documen ... , "$1") | This code execution depends on a $@. | tst.js:14:10:14:33 | documen ... .search | user-provided value |
@@ -379,4 +389,9 @@ edges
379389
| tst.js:33:14:33:19 | source | tst.js:29:18:29:41 | documen ... .search | tst.js:33:14:33:19 | source | This code execution depends on a $@. | tst.js:29:18:29:41 | documen ... .search | user-provided value |
380390
| tst.js:35:28:35:33 | source | tst.js:29:18:29:41 | documen ... .search | tst.js:35:28:35:33 | source | This code execution depends on a $@. | tst.js:29:18:29:41 | documen ... .search | user-provided value |
381391
| tst.js:37:33:37:38 | source | tst.js:29:18:29:41 | documen ... .search | tst.js:37:33:37:38 | source | This code execution depends on a $@. | tst.js:29:18:29:41 | documen ... .search | user-provided value |
382-
| webix.js:3:12:3:33 | documen ... on.hash | webix.js:3:12:3:33 | documen ... on.hash | webix.js:3:12:3:33 | documen ... on.hash | This code execution depends on a $@. | webix.js:3:12:3:33 | documen ... on.hash | user-provided value |
392+
| webix/webix.html:3:16:3:37 | documen ... on.hash | webix/webix.html:3:16:3:37 | documen ... on.hash | webix/webix.html:3:16:3:37 | documen ... on.hash | This code execution depends on a $@. | webix/webix.html:3:16:3:37 | documen ... on.hash | user-provided value |
393+
| webix/webix.html:4:26:4:47 | documen ... on.hash | webix/webix.html:4:26:4:47 | documen ... on.hash | webix/webix.html:4:26:4:47 | documen ... on.hash | Template, which may contain code, depends on a $@. | webix/webix.html:4:26:4:47 | documen ... on.hash | user-provided value |
394+
| webix/webix.html:5:47:5:68 | documen ... on.hash | webix/webix.html:5:47:5:68 | documen ... on.hash | webix/webix.html:5:47:5:68 | documen ... on.hash | Template, which may contain code, depends on a $@. | webix/webix.html:5:47:5:68 | documen ... on.hash | user-provided value |
395+
| webix/webix.js:3:12:3:33 | documen ... on.hash | webix/webix.js:3:12:3:33 | documen ... on.hash | webix/webix.js:3:12:3:33 | documen ... on.hash | This code execution depends on a $@. | webix/webix.js:3:12:3:33 | documen ... on.hash | user-provided value |
396+
| webix/webix.js:4:22:4:43 | documen ... on.hash | webix/webix.js:4:22:4:43 | documen ... on.hash | webix/webix.js:4:22:4:43 | documen ... on.hash | Template, which may contain code, depends on a $@. | webix/webix.js:4:22:4:43 | documen ... on.hash | user-provided value |
397+
| webix/webix.js:5:43:5:64 | documen ... on.hash | webix/webix.js:5:43:5:64 | documen ... on.hash | webix/webix.js:5:43:5:64 | documen ... on.hash | Template, which may contain code, depends on a $@. | webix/webix.js:5:43:5:64 | documen ... on.hash | user-provided value |

‎javascript/ql/test/query-tests/Security/CWE-094/CodeInjection/HeuristicSourceCodeInjection.expected‎

Lines changed: 24 additions & 12 deletions
Original file line numberDiff line numberDiff line change
@@ -147,10 +147,6 @@ nodes
147147
| template-sinks.js:32:16:32:22 | tainted |
148148
| template-sinks.js:33:17:33:23 | tainted |
149149
| template-sinks.js:33:17:33:23 | tainted |
150-
| template-sinks.js:34:26:34:32 | tainted |
151-
| template-sinks.js:34:26:34:32 | tainted |
152-
| template-sinks.js:35:47:35:53 | tainted |
153-
| template-sinks.js:35:47:35:53 | tainted |
154150
| tst.js:2:6:2:27 | documen ... on.href |
155151
| tst.js:2:6:2:27 | documen ... on.href |
156152
| tst.js:2:6:2:83 | documen ... t=")+8) |
@@ -189,9 +185,24 @@ nodes
189185
| tst.js:35:28:35:33 | source |
190186
| tst.js:37:33:37:38 | source |
191187
| tst.js:37:33:37:38 | source |
192-
| webix.js:3:12:3:33 | documen ... on.hash |
193-
| webix.js:3:12:3:33 | documen ... on.hash |
194-
| webix.js:3:12:3:33 | documen ... on.hash |
188+
| webix/webix.html:3:16:3:37 | documen ... on.hash |
189+
| webix/webix.html:3:16:3:37 | documen ... on.hash |
190+
| webix/webix.html:3:16:3:37 | documen ... on.hash |
191+
| webix/webix.html:4:26:4:47 | documen ... on.hash |
192+
| webix/webix.html:4:26:4:47 | documen ... on.hash |
193+
| webix/webix.html:4:26:4:47 | documen ... on.hash |
194+
| webix/webix.html:5:47:5:68 | documen ... on.hash |
195+
| webix/webix.html:5:47:5:68 | documen ... on.hash |
196+
| webix/webix.html:5:47:5:68 | documen ... on.hash |
197+
| webix/webix.js:3:12:3:33 | documen ... on.hash |
198+
| webix/webix.js:3:12:3:33 | documen ... on.hash |
199+
| webix/webix.js:3:12:3:33 | documen ... on.hash |
200+
| webix/webix.js:4:22:4:43 | documen ... on.hash |
201+
| webix/webix.js:4:22:4:43 | documen ... on.hash |
202+
| webix/webix.js:4:22:4:43 | documen ... on.hash |
203+
| webix/webix.js:5:43:5:64 | documen ... on.hash |
204+
| webix/webix.js:5:43:5:64 | documen ... on.hash |
205+
| webix/webix.js:5:43:5:64 | documen ... on.hash |
195206
edges
196207
| NoSQLCodeInjection.js:18:24:18:31 | req.body | NoSQLCodeInjection.js:18:24:18:37 | req.body.query |
197208
| NoSQLCodeInjection.js:18:24:18:31 | req.body | NoSQLCodeInjection.js:18:24:18:37 | req.body.query |
@@ -289,10 +300,6 @@ edges
289300
| template-sinks.js:18:9:18:31 | tainted | template-sinks.js:32:16:32:22 | tainted |
290301
| template-sinks.js:18:9:18:31 | tainted | template-sinks.js:33:17:33:23 | tainted |
291302
| template-sinks.js:18:9:18:31 | tainted | template-sinks.js:33:17:33:23 | tainted |
292-
| template-sinks.js:18:9:18:31 | tainted | template-sinks.js:34:26:34:32 | tainted |
293-
| template-sinks.js:18:9:18:31 | tainted | template-sinks.js:34:26:34:32 | tainted |
294-
| template-sinks.js:18:9:18:31 | tainted | template-sinks.js:35:47:35:53 | tainted |
295-
| template-sinks.js:18:9:18:31 | tainted | template-sinks.js:35:47:35:53 | tainted |
296303
| template-sinks.js:18:19:18:31 | req.query.foo | template-sinks.js:18:9:18:31 | tainted |
297304
| template-sinks.js:18:19:18:31 | req.query.foo | template-sinks.js:18:9:18:31 | tainted |
298305
| tst.js:2:6:2:27 | documen ... on.href | tst.js:2:6:2:83 | documen ... t=")+8) |
@@ -325,6 +332,11 @@ edges
325332
| tst.js:29:18:29:41 | documen ... .search | tst.js:29:18:29:82 | documen ... , "$1") |
326333
| tst.js:29:18:29:41 | documen ... .search | tst.js:29:18:29:82 | documen ... , "$1") |
327334
| tst.js:29:18:29:82 | documen ... , "$1") | tst.js:29:9:29:82 | source |
328-
| webix.js:3:12:3:33 | documen ... on.hash | webix.js:3:12:3:33 | documen ... on.hash |
335+
| webix/webix.html:3:16:3:37 | documen ... on.hash | webix/webix.html:3:16:3:37 | documen ... on.hash |
336+
| webix/webix.html:4:26:4:47 | documen ... on.hash | webix/webix.html:4:26:4:47 | documen ... on.hash |
337+
| webix/webix.html:5:47:5:68 | documen ... on.hash | webix/webix.html:5:47:5:68 | documen ... on.hash |
338+
| webix/webix.js:3:12:3:33 | documen ... on.hash | webix/webix.js:3:12:3:33 | documen ... on.hash |
339+
| webix/webix.js:4:22:4:43 | documen ... on.hash | webix/webix.js:4:22:4:43 | documen ... on.hash |
340+
| webix/webix.js:5:43:5:64 | documen ... on.hash | webix/webix.js:5:43:5:64 | documen ... on.hash |
329341
#select
330342
| eslint-escope-build.js:21:16:21:16 | c | eslint-escope-build.js:20:22:20:22 | c | eslint-escope-build.js:21:16:21:16 | c | $@ flows to here and is interpreted as code. | eslint-escope-build.js:20:22:20:22 | c | User-provided value |

‎javascript/ql/test/query-tests/Security/CWE-094/CodeInjection/template-sinks.js‎

Lines changed: 0 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -31,6 +31,4 @@ app.get('/some/path', function (req, res) {
3131
Hogan.compile(tainted); // NOT OK
3232
Eta.render(tainted); // NOT OK
3333
Sqrl.render(tainted); // NOT OK
34-
webix.ui({ template: tainted }); // NOT OK
35-
webix.ui({ template: function () { return tainted } }); // NOT OK
3634
});

‎javascript/ql/test/query-tests/Security/CWE-094/CodeInjection/webix.js‎

Lines changed: 0 additions & 3 deletions
This file was deleted.

‎javascript/ql/test/query-tests/Security/CWE-094/CodeInjection/webix/webix.html‎

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,6 @@
1+
<script src="path/to/webix.js" type="text/javascript" charset="utf-8"></script>
2+
<script>
3+
webix.exec(document.location.hash); // NOT OK
4+
webix.ui({ template: document.location.hash }); // NOT OK
5+
webix.ui({ template: function () { return document.location.hash } }); // NOT OK
6+
</script>

0 commit comments

Comments
 (0)