Skip to content

Commit d28af95

Browse files
NapalysNapalys
committed
Added sink models for hana's client prepare function.
1 parent 9229962 commit d28af95

File tree

3 files changed

+44
-10
lines changed

3 files changed

+44
-10
lines changed

‎javascript/ql/lib/ext/hana-db-client.model.yml‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -3,6 +3,6 @@ extensions:
33
pack: codeql/javascript-all
44
extensible: sinkModel
55
data:
6-
- ["@sap/hana-client", "Member[createConnection].ReturnValue.Member[exec].Argument[0]", "sql-injection"]
6+
- ["@sap/hana-client", "Member[createConnection].ReturnValue.Member[exec,prepare].Argument[0]", "sql-injection"]
77

8-
- ["hdb", "Member[createClient].ReturnValue.Member[exec].Argument[0]", "sql-injection"]
8+
- ["hdb", "Member[createClient].ReturnValue.Member[exec,prepare].Argument[0]", "sql-injection"]

‎javascript/ql/test/query-tests/Security/CWE-089/untyped/SqlInjection.expected‎

Lines changed: 34 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -11,9 +11,14 @@
1111
| graphql.js:82:14:88:8 | `{\\n ... }` | graphql.js:73:14:73:25 | req.query.id | graphql.js:82:14:88:8 | `{\\n ... }` | This query string depends on a $@. | graphql.js:73:14:73:25 | req.query.id | user-provided value |
1212
| graphql.js:118:38:118:48 | `foo ${id}` | graphql.js:117:16:117:28 | req.params.id | graphql.js:118:38:118:48 | `foo ${id}` | This query string depends on a $@. | graphql.js:117:16:117:28 | req.params.id | user-provided value |
1313
| hana.js:11:19:11:23 | query | hana.js:9:30:9:37 | req.body | hana.js:11:19:11:23 | query | This query string depends on a $@. | hana.js:9:30:9:37 | req.body | user-provided value |
14+
| hana.js:17:35:17:100 | `SELECT ... usInput | hana.js:16:32:16:39 | req.body | hana.js:17:35:17:100 | `SELECT ... usInput | This query string depends on a $@. | hana.js:16:32:16:39 | req.body | user-provided value |
15+
| hana.js:24:33:24:96 | `INSERT ... usInput | hana.js:23:32:23:39 | req.body | hana.js:24:33:24:96 | `INSERT ... usInput | This query string depends on a $@. | hana.js:23:32:23:39 | req.body | user-provided value |
16+
| hana.js:31:31:31:97 | "SELECT ... usInput | hana.js:30:30:30:37 | req.body | hana.js:31:31:31:97 | "SELECT ... usInput | This query string depends on a $@. | hana.js:30:30:30:37 | req.body | user-provided value |
1417
| hana.js:71:44:71:99 | "INSERT ... usInput | hana.js:68:24:68:31 | req.body | hana.js:71:44:71:99 | "INSERT ... usInput | This query string depends on a $@. | hana.js:68:24:68:31 | req.body | user-provided value |
1518
| hana.js:73:17:73:54 | 'select ... usInput | hana.js:68:24:68:31 | req.body | hana.js:73:17:73:54 | 'select ... usInput | This query string depends on a $@. | hana.js:68:24:68:31 | req.body | user-provided value |
1619
| hana.js:74:17:74:54 | 'select ... usInput | hana.js:68:24:68:31 | req.body | hana.js:74:17:74:54 | 'select ... usInput | This query string depends on a $@. | hana.js:68:24:68:31 | req.body | user-provided value |
20+
| hana.js:76:20:76:73 | 'select ... usInput | hana.js:68:24:68:31 | req.body | hana.js:76:20:76:73 | 'select ... usInput | This query string depends on a $@. | hana.js:68:24:68:31 | req.body | user-provided value |
21+
| hana.js:80:20:80:69 | 'call P ... usInput | hana.js:68:24:68:31 | req.body | hana.js:80:20:80:69 | 'call P ... usInput | This query string depends on a $@. | hana.js:68:24:68:31 | req.body | user-provided value |
1722
| html-sanitizer.js:16:9:16:59 | `SELECT ... param1 | html-sanitizer.js:13:39:13:44 | param1 | html-sanitizer.js:16:9:16:59 | `SELECT ... param1 | This query string depends on a $@. | html-sanitizer.js:13:39:13:44 | param1 | user-provided value |
1823
| json-schema-validator.js:33:22:33:26 | query | json-schema-validator.js:25:34:25:47 | req.query.data | json-schema-validator.js:33:22:33:26 | query | This query object depends on a $@. | json-schema-validator.js:25:34:25:47 | req.query.data | user-provided value |
1924
| json-schema-validator.js:35:18:35:22 | query | json-schema-validator.js:25:34:25:47 | req.query.data | json-schema-validator.js:35:18:35:22 | query | This query object depends on a $@. | json-schema-validator.js:25:34:25:47 | req.query.data | user-provided value |
@@ -160,13 +165,26 @@ edges
160165
| hana.js:9:30:9:37 | req.body | hana.js:9:13:9:42 | maliciousInput | provenance | |
161166
| hana.js:10:15:10:80 | query | hana.js:11:19:11:23 | query | provenance | |
162167
| hana.js:10:64:10:77 | maliciousInput | hana.js:10:15:10:80 | query | provenance | |
168+
| hana.js:16:15:16:44 | maliciousInput | hana.js:17:87:17:100 | maliciousInput | provenance | |
169+
| hana.js:16:32:16:39 | req.body | hana.js:16:15:16:44 | maliciousInput | provenance | |
170+
| hana.js:17:87:17:100 | maliciousInput | hana.js:17:35:17:100 | `SELECT ... usInput | provenance | |
171+
| hana.js:23:15:23:44 | maliciousInput | hana.js:24:83:24:96 | maliciousInput | provenance | |
172+
| hana.js:23:32:23:39 | req.body | hana.js:23:15:23:44 | maliciousInput | provenance | |
173+
| hana.js:24:83:24:96 | maliciousInput | hana.js:24:33:24:96 | `INSERT ... usInput | provenance | |
174+
| hana.js:30:13:30:42 | maliciousInput | hana.js:31:84:31:97 | maliciousInput | provenance | |
175+
| hana.js:30:30:30:37 | req.body | hana.js:30:13:30:42 | maliciousInput | provenance | |
176+
| hana.js:31:84:31:97 | maliciousInput | hana.js:31:31:31:97 | "SELECT ... usInput | provenance | |
163177
| hana.js:68:7:68:36 | maliciousInput | hana.js:71:86:71:99 | maliciousInput | provenance | |
164178
| hana.js:68:7:68:36 | maliciousInput | hana.js:73:41:73:54 | maliciousInput | provenance | |
165179
| hana.js:68:7:68:36 | maliciousInput | hana.js:74:41:74:54 | maliciousInput | provenance | |
180+
| hana.js:68:7:68:36 | maliciousInput | hana.js:76:60:76:73 | maliciousInput | provenance | |
181+
| hana.js:68:7:68:36 | maliciousInput | hana.js:80:56:80:69 | maliciousInput | provenance | |
166182
| hana.js:68:24:68:31 | req.body | hana.js:68:7:68:36 | maliciousInput | provenance | |
167183
| hana.js:71:86:71:99 | maliciousInput | hana.js:71:44:71:99 | "INSERT ... usInput | provenance | |
168184
| hana.js:73:41:73:54 | maliciousInput | hana.js:73:17:73:54 | 'select ... usInput | provenance | |
169185
| hana.js:74:41:74:54 | maliciousInput | hana.js:74:17:74:54 | 'select ... usInput | provenance | |
186+
| hana.js:76:60:76:73 | maliciousInput | hana.js:76:20:76:73 | 'select ... usInput | provenance | |
187+
| hana.js:80:56:80:69 | maliciousInput | hana.js:80:20:80:69 | 'call P ... usInput | provenance | |
170188
| html-sanitizer.js:13:39:13:44 | param1 | html-sanitizer.js:14:18:14:23 | param1 | provenance | |
171189
| html-sanitizer.js:14:5:14:24 | param1 | html-sanitizer.js:16:54:16:59 | param1 | provenance | |
172190
| html-sanitizer.js:14:14:14:24 | xss(param1) | html-sanitizer.js:14:5:14:24 | param1 | provenance | |
@@ -524,6 +542,18 @@ nodes
524542
| hana.js:10:15:10:80 | query | semmle.label | query |
525543
| hana.js:10:64:10:77 | maliciousInput | semmle.label | maliciousInput |
526544
| hana.js:11:19:11:23 | query | semmle.label | query |
545+
| hana.js:16:15:16:44 | maliciousInput | semmle.label | maliciousInput |
546+
| hana.js:16:32:16:39 | req.body | semmle.label | req.body |
547+
| hana.js:17:35:17:100 | `SELECT ... usInput | semmle.label | `SELECT ... usInput |
548+
| hana.js:17:87:17:100 | maliciousInput | semmle.label | maliciousInput |
549+
| hana.js:23:15:23:44 | maliciousInput | semmle.label | maliciousInput |
550+
| hana.js:23:32:23:39 | req.body | semmle.label | req.body |
551+
| hana.js:24:33:24:96 | `INSERT ... usInput | semmle.label | `INSERT ... usInput |
552+
| hana.js:24:83:24:96 | maliciousInput | semmle.label | maliciousInput |
553+
| hana.js:30:13:30:42 | maliciousInput | semmle.label | maliciousInput |
554+
| hana.js:30:30:30:37 | req.body | semmle.label | req.body |
555+
| hana.js:31:31:31:97 | "SELECT ... usInput | semmle.label | "SELECT ... usInput |
556+
| hana.js:31:84:31:97 | maliciousInput | semmle.label | maliciousInput |
527557
| hana.js:68:7:68:36 | maliciousInput | semmle.label | maliciousInput |
528558
| hana.js:68:24:68:31 | req.body | semmle.label | req.body |
529559
| hana.js:71:44:71:99 | "INSERT ... usInput | semmle.label | "INSERT ... usInput |
@@ -532,6 +562,10 @@ nodes
532562
| hana.js:73:41:73:54 | maliciousInput | semmle.label | maliciousInput |
533563
| hana.js:74:17:74:54 | 'select ... usInput | semmle.label | 'select ... usInput |
534564
| hana.js:74:41:74:54 | maliciousInput | semmle.label | maliciousInput |
565+
| hana.js:76:20:76:73 | 'select ... usInput | semmle.label | 'select ... usInput |
566+
| hana.js:76:60:76:73 | maliciousInput | semmle.label | maliciousInput |
567+
| hana.js:80:20:80:69 | 'call P ... usInput | semmle.label | 'call P ... usInput |
568+
| hana.js:80:56:80:69 | maliciousInput | semmle.label | maliciousInput |
535569
| html-sanitizer.js:13:39:13:44 | param1 | semmle.label | param1 |
536570
| html-sanitizer.js:14:5:14:24 | param1 | semmle.label | param1 |
537571
| html-sanitizer.js:14:14:14:24 | xss(param1) | semmle.label | xss(param1) |

‎javascript/ql/test/query-tests/Security/CWE-089/untyped/hana.js‎

Lines changed: 8 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -13,22 +13,22 @@ app.post('/documents/find', (req, res) => {
1313
});
1414

1515
conn.connect(connectionParams, (err) => {
16-
const maliciousInput = req.body.data; // $ MISSING: Source
17-
const stmt = conn.prepare(`SELECT * FROM Test WHERE ID = ? AND username = ` + maliciousInput); // $ MISSING: Alert
16+
const maliciousInput = req.body.data; // $ Source
17+
const stmt = conn.prepare(`SELECT * FROM Test WHERE ID = ? AND username = ` + maliciousInput); // $ Alert
1818
stmt.exec([maliciousInput], (err, rows) => {}); // maliciousInput is treated as a parameter
1919
conn.disconnect();
2020
});
2121

2222
conn.connect(connectionParams, (err) => {
23-
const maliciousInput = req.body.data; // $ MISSING: Source
24-
var stmt = conn.prepare(`INSERT INTO Customers(ID, NAME) VALUES(?, ?) ` + maliciousInput); // $ MISSING: Alert
23+
const maliciousInput = req.body.data; // $ Source
24+
var stmt = conn.prepare(`INSERT INTO Customers(ID, NAME) VALUES(?, ?) ` + maliciousInput); // $ Alert
2525
stmt.execBatch([[1, maliciousInput], [2, maliciousInput]], function(err, rows) {}); // maliciousInput is treated as a parameter
2626
conn.disconnect();
2727
});
2828

2929
conn.connect(connectionParams, (err) => {
30-
const maliciousInput = req.body.data; // $ MISSING: Source
31-
var stmt = conn.prepare("SELECT * FROM Customers WHERE ID >= ? AND ID < ?" + maliciousInput); // $ MISSING: Alert
30+
const maliciousInput = req.body.data; // $ Source
31+
var stmt = conn.prepare("SELECT * FROM Customers WHERE ID >= ? AND ID < ?" + maliciousInput); // $ Alert
3232
stmt.execQuery([100, maliciousInput], function(err, rs) {}); // $ maliciousInput is treated as a parameter
3333
conn.disconnect();
3434
});
@@ -73,11 +73,11 @@ app2.post('/documents/find', (req, res) => {
7373
client.exec('select * from DUMMY' + maliciousInput, function (err, rows) {}); // $ Alert
7474
client.exec('select * from DUMMY' + maliciousInput, options, function(err, rows) {}); // $ Alert
7575

76-
client.prepare('select * from DUMMY where DUMMY = ?' + maliciousInput, function (err, statement){ // $ MISSING: Alert
76+
client.prepare('select * from DUMMY where DUMMY = ?' + maliciousInput, function (err, statement){ // $ Alert
7777
statement.exec([maliciousInput], function (err, rows) {}); // maliciousInput is treated as a parameter
7878
});
7979

80-
client.prepare('call PROC_DUMMY (?, ?, ?, ?, ?)' + maliciousInput, function(err, statement){ // $ MISSING: Alert
80+
client.prepare('call PROC_DUMMY (?, ?, ?, ?, ?)' + maliciousInput, function(err, statement){ // $ Alert
8181
statement.exec({A: 3, B: maliciousInput}, function(err, parameters, dummyRows, tableRows) {});
8282
});
8383

0 commit comments

Comments
 (0)