JS: add "host" as a sink for js/request-forgery

Author: Esben Sparre Andreasen

javascript/ql/src/semmle/javascript/security/dataflow/RequestForgery.qll

@@ -72,16 +72,20 @@ module RequestForgery {
 
     ClientRequest request;
 
+    string kind;
+
     ClientRequestUrlAsSink() {
-      this = request.getUrl()
+      this = request.getUrl() and kind = "URL" or
+      this = request.getHost() and kind = "host"
     }
 
     override DataFlow::Node getARequest() {
       result = request
     }
 
     override string getKind() {
-      result = "URL"
+      result = kind
     }
+
   }
 }

javascript/ql/test/query-tests/Security/CWE-918/RequestForgery.expected

@@ -13,13 +13,15 @@ nodes
 | tst.js:26:36:26:42 | tainted |
 | tst.js:28:13:28:43 | "http:/ ... tainted |
 | tst.js:28:37:28:43 | tainted |
+| tst.js:32:34:32:40 | tainted |
 edges
 | tst.js:12:9:12:52 | tainted | tst.js:16:13:16:19 | tainted |
 | tst.js:12:9:12:52 | tainted | tst.js:18:17:18:23 | tainted |
 | tst.js:12:9:12:52 | tainted | tst.js:21:19:21:25 | tainted |
 | tst.js:12:9:12:52 | tainted | tst.js:24:25:24:31 | tainted |
 | tst.js:12:9:12:52 | tainted | tst.js:26:36:26:42 | tainted |
 | tst.js:12:9:12:52 | tainted | tst.js:28:37:28:43 | tainted |
+| tst.js:12:9:12:52 | tainted | tst.js:32:34:32:40 | tainted |
 | tst.js:12:19:12:42 | url.par ... , true) | tst.js:12:19:12:48 | url.par ... ).query |
 | tst.js:12:19:12:48 | url.par ... ).query | tst.js:12:19:12:52 | url.par ... ery.url |
 | tst.js:12:19:12:52 | url.par ... ery.url | tst.js:12:9:12:52 | tainted |
@@ -34,3 +36,4 @@ edges
 | tst.js:24:5:24:32 | request ... ainted) | tst.js:12:29:12:35 | req.url | tst.js:24:13:24:31 | "http://" + tainted | The $@ of this request depends on $@. | tst.js:24:13:24:31 | "http://" + tainted | URL | tst.js:12:29:12:35 | req.url | a user-provided value |
 | tst.js:26:5:26:43 | request ... ainted) | tst.js:12:29:12:35 | req.url | tst.js:26:13:26:42 | "http:/ ... tainted | The $@ of this request depends on $@. | tst.js:26:13:26:42 | "http:/ ... tainted | URL | tst.js:12:29:12:35 | req.url | a user-provided value |
 | tst.js:28:5:28:44 | request ... ainted) | tst.js:12:29:12:35 | req.url | tst.js:28:13:28:43 | "http:/ ... tainted | The $@ of this request depends on $@. | tst.js:28:13:28:43 | "http:/ ... tainted | URL | tst.js:12:29:12:35 | req.url | a user-provided value |
+| tst.js:32:5:32:42 | http.ge ... inted}) | tst.js:12:29:12:35 | req.url | tst.js:32:34:32:40 | tainted | The $@ of this request depends on $@. | tst.js:32:34:32:40 | tainted | host | tst.js:12:29:12:35 | req.url | a user-provided value |

javascript/ql/test/query-tests/Security/CWE-918/tst.js

@@ -28,4 +28,6 @@ var server = http.createServer(function(req, res) {
     request("http://example.com/" + tainted); // NOT OK
 
     request("http://example.com/?" + tainted); // OK
+
+    http.get(relativeUrl, {host: tainted}); // NOT OK
 })