Skip to content

JS: Some preliminary fixes from name resolution branch #19192

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
asgerf merged 6 commits into from
Apr 3, 2025
Merged

JS: Some preliminary fixes from name resolution branch #19192

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
6 commits
Select commit Hold shift + click to select a range
48db2b9
JS: Add test
asgerf Apr 2, 2025
46f88e7
JS: Updates to DOM model
asgerf Apr 2, 2025
78b2538
JS: Protect against bad join in BadRandomness
asgerf Apr 2, 2025
30a9cd7
JS: Include document as a DOM value
asgerf Apr 2, 2025
2c40359
JS: Change note
asgerf Apr 2, 2025
6c3bc94
Merge branch 'main' into js/name-resolution-independent-fixes
asgerf Apr 2, 2025
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
6 changes: 4 additions & 2 deletions javascript/ql/lib/semmle/javascript/DOM.qll
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -247,7 +247,7 @@ module DOM {
]
|
(
result = documentRef().getAMethodCall(collectionName) or
result = domValueRef().getAMethodCall(collectionName) or
result = DataFlow::globalVarRef(collectionName).getACall()
)
)
Expand Down Expand Up @@ -441,10 +441,12 @@ module DOM {
DataFlow::SourceNode domValueRef() {
result = domValueRef(DataFlow::TypeTracker::end())
or
result.hasUnderlyingType("Element")
result.hasUnderlyingType(["Element", "HTMLCollection", "HTMLCollectionOf"])
or
result.hasUnderlyingType(any(string s | s.matches("HTML%Element")))
or
result = documentRef()
or
exists(DataFlow::ClassNode cls |
cls.getASuperClassNode().getALocalSource() =
DataFlow::globalVarRef(any(string s | s.matches("HTML%Element"))) and
Expand Down
32 changes: 14 additions & 18 deletions javascript/ql/src/Security/CWE-327/BadRandomness.ql
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -30,30 +30,26 @@ private int powerOfTwo() {
* Gets a node that has value 2^n for some n.
*/
private DataFlow::Node isPowerOfTwo() {
exists(DataFlow::Node prev |
prev.getIntValue() = powerOfTwo()
or
// Getting around the 32 bit ints in QL. These are some hex values of the form 0x10000000
prev.asExpr().(NumberLiteral).getValue() =
["281474976710656", "17592186044416", "1099511627776", "68719476736", "4294967296"]
|
result = prev.getASuccessor*()
)
result.getIntValue() = powerOfTwo()
or
// Getting around the 32 bit ints in QL. These are some hex values of the form 0x10000000
result.asExpr().(NumberLiteral).getValue() =
["281474976710656", "17592186044416", "1099511627776", "68719476736", "4294967296"]
or
Comment on lines +35 to +38
Copy link
Contributor

@erik-krogh erik-krogh Apr 2, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I think I remember something about bigint in CodeQL? Has that shipped yet?

Copy link
Contributor Author

@asgerf asgerf Apr 3, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Yes, string.toBigInt() is a thing now. But I'd rather leave it for another PR

result = isPowerOfTwo().getASuccessor()
}

/**
* Gets a node that has value (2^n)-1 for some n.
*/
private DataFlow::Node isPowerOfTwoMinusOne() {
exists(DataFlow::Node prev |
prev.getIntValue() = powerOfTwo() - 1
or
// Getting around the 32 bit ints in QL. These are some hex values of the form 0xfffffff
prev.asExpr().(NumberLiteral).getValue() =
["281474976710655", "17592186044415", "1099511627775", "68719476735", "4294967295"]
|
result = prev.getASuccessor*()
)
result.getIntValue() = powerOfTwo() - 1
or
// Getting around the 32 bit ints in QL. These are some hex values of the form 0xfffffff
result.asExpr().(NumberLiteral).getValue() =
["281474976710655", "17592186044415", "1099511627775", "68719476735", "4294967295"]
or
result = isPowerOfTwoMinusOne().getASuccessor()
}

/**
Expand Down
4 changes: 4 additions & 0 deletions javascript/ql/src/change-notes/2025-04-02-name-resolution-independent-fixes.md
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,4 @@
---
category: minorAnalysis
---
* Slightly improved detection of DOM element references, leading to XSS results being detected in more cases.
6 changes: 6 additions & 0 deletions javascript/ql/test/library-tests/DOM/Customizations.expected
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -7,20 +7,26 @@ test_documentRef
test_locationRef
| customization.js:3:3:3:14 | doc.location |
test_domValueRef
| customization.js:2:13:2:31 | customGetDocument() |
| customization.js:3:3:3:14 | doc.location |
| customization.js:4:3:4:20 | doc.getElementById |
| customization.js:4:3:4:28 | doc.get ... 'test') |
| event-handler-receiver.html:4:20:4:19 | this |
| event-handler-receiver.js:1:1:1:8 | document |
| event-handler-receiver.js:1:1:1:23 | documen ... entById |
| event-handler-receiver.js:1:1:1:32 | documen ... my-id') |
| event-handler-receiver.js:1:44:1:43 | this |
| event-handler-receiver.js:2:3:2:17 | this.parentNode |
| event-handler-receiver.js:5:1:5:8 | document |
| event-handler-receiver.js:5:1:5:23 | documen ... entById |
| event-handler-receiver.js:5:1:5:32 | documen ... my-id') |
| event-handler-receiver.js:5:60:5:59 | this |
| event-handler-receiver.js:6:3:6:17 | this.parentNode |
| nameditems.js:1:1:1:8 | document |
| nameditems.js:1:1:1:23 | documen ... entById |
| nameditems.js:1:1:1:30 | documen ... ('foo') |
| nameditems.js:1:1:2:19 | documen ... em('x') |
| querySelectorAll.js:2:5:2:12 | document |
| querySelectorAll.js:2:5:2:29 | documen ... ctorAll |
| querySelectorAll.js:2:5:2:36 | documen ... ('foo') |
| querySelectorAll.js:2:46:2:48 | elm |
Expand Down
2 changes: 2 additions & 0 deletions javascript/ql/test/query-tests/Security/CWE-079/DomBasedXss/Xss.expected
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -53,6 +53,7 @@
| dates.js:57:31:57:101 | `Time i ... aint)}` | dates.js:54:36:54:55 | window.location.hash | dates.js:57:31:57:101 | `Time i ... aint)}` | Cross-site scripting vulnerability due to $@. | dates.js:54:36:54:55 | window.location.hash | user-provided value |
| dates.js:59:31:59:87 | `Time i ... aint)}` | dates.js:54:36:54:55 | window.location.hash | dates.js:59:31:59:87 | `Time i ... aint)}` | Cross-site scripting vulnerability due to $@. | dates.js:54:36:54:55 | window.location.hash | user-provided value |
| dates.js:61:31:61:88 | `Time i ... aint)}` | dates.js:54:36:54:55 | window.location.hash | dates.js:61:31:61:88 | `Time i ... aint)}` | Cross-site scripting vulnerability due to $@. | dates.js:54:36:54:55 | window.location.hash | user-provided value |
| dom.js:4:20:4:30 | window.name | dom.js:4:20:4:30 | window.name | dom.js:4:20:4:30 | window.name | Cross-site scripting vulnerability due to $@. | dom.js:4:20:4:30 | window.name | user-provided value |
| dragAndDrop.ts:15:25:15:28 | html | dragAndDrop.ts:8:18:8:50 | dataTra ... /html') | dragAndDrop.ts:15:25:15:28 | html | Cross-site scripting vulnerability due to $@. | dragAndDrop.ts:8:18:8:50 | dataTra ... /html') | user-provided value |
| dragAndDrop.ts:24:23:24:57 | e.dataT ... /html') | dragAndDrop.ts:24:23:24:57 | e.dataT ... /html') | dragAndDrop.ts:24:23:24:57 | e.dataT ... /html') | Cross-site scripting vulnerability due to $@. | dragAndDrop.ts:24:23:24:57 | e.dataT ... /html') | user-provided value |
| dragAndDrop.ts:29:19:29:53 | e.dataT ... /html') | dragAndDrop.ts:29:19:29:53 | e.dataT ... /html') | dragAndDrop.ts:29:19:29:53 | e.dataT ... /html') | Cross-site scripting vulnerability due to $@. | dragAndDrop.ts:29:19:29:53 | e.dataT ... /html') | user-provided value |
Expand Down Expand Up @@ -937,6 +938,7 @@ nodes
| dates.js:61:31:61:88 | `Time i ... aint)}` | semmle.label | `Time i ... aint)}` |
| dates.js:61:42:61:86 | dayjs.s ... (taint) | semmle.label | dayjs.s ... (taint) |
| dates.js:61:81:61:85 | taint | semmle.label | taint |
| dom.js:4:20:4:30 | window.name | semmle.label | window.name |
| dragAndDrop.ts:8:11:8:50 | html | semmle.label | html |
| dragAndDrop.ts:8:18:8:50 | dataTra ... /html') | semmle.label | dataTra ... /html') |
| dragAndDrop.ts:15:25:15:28 | html | semmle.label | html |
Expand Down
1 change: 1 addition & 0 deletions ...script/ql/test/query-tests/Security/CWE-079/DomBasedXss/XssWithAdditionalSources.expected
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -138,6 +138,7 @@ nodes
| dates.js:61:31:61:88 | `Time i ... aint)}` | semmle.label | `Time i ... aint)}` |
| dates.js:61:42:61:86 | dayjs.s ... (taint) | semmle.label | dayjs.s ... (taint) |
| dates.js:61:81:61:85 | taint | semmle.label | taint |
| dom.js:4:20:4:30 | window.name | semmle.label | window.name |
| dragAndDrop.ts:8:11:8:50 | html | semmle.label | html |
| dragAndDrop.ts:8:18:8:50 | dataTra ... /html') | semmle.label | dataTra ... /html') |
| dragAndDrop.ts:15:25:15:28 | html | semmle.label | html |
Expand Down
5 changes: 5 additions & 0 deletions javascript/ql/test/query-tests/Security/CWE-079/DomBasedXss/dom.js
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,5 @@
function t1() {
const elm = document.getElementById("foo");
const e2 = elm.getElementsByTagName("bar")[0];
e2.innerHTML = window.name; // $ Alert
}