Skip to content

Commit 436168a

Browse files
codeql-cicodeql-ci
authored
Merge pull request github#6267 from erik-krogh/read-pkg
Approved by asgerf
2 parents 8dc1f28 + 086c9c8 commit 436168a

File tree

4 files changed

+122
-0
lines changed

4 files changed

+122
-0
lines changed

‎javascript/change-notes/2021-07-12-read-pkg.md‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,4 @@
1+
lgtm,codescanning
2+
* The `cwd` option from the `read-pkg` library is recognized as a sink for `js/tainted-path`.
3+
Affected packages are
4+
[read-pkg](https://npmjs.com/package/read-pkg)

‎javascript/ql/src/semmle/javascript/security/dataflow/TaintedPathCustomizations.qll‎

Lines changed: 14 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -682,6 +682,20 @@ module TaintedPath {
682682
}
683683
}
684684

685+
/**
686+
* The `cwd` option for the `read-pkg` library.
687+
*/
688+
private class ReadPkgCwdSink extends TaintedPath::Sink {
689+
ReadPkgCwdSink() {
690+
this =
691+
API::moduleImport("read-pkg")
692+
.getMember(["readPackageAsync", "readPackageSync"])
693+
.getParameter(0)
694+
.getMember("cwd")
695+
.getARhs()
696+
}
697+
}
698+
685699
/**
686700
* Holds if there is a step `src -> dst` mapping `srclabel` to `dstlabel` relevant for path traversal vulnerabilities.
687701
*/

‎javascript/ql/test/query-tests/Security/CWE-022/TaintedPath/TaintedPath.expected‎

Lines changed: 100 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -2362,6 +2362,40 @@ nodes
23622362
| other-fs-libraries.js:59:39:59:42 | path |
23632363
| other-fs-libraries.js:59:39:59:42 | path |
23642364
| other-fs-libraries.js:59:39:59:42 | path |
2365+
| other-fs-libraries.js:62:43:62:46 | path |
2366+
| other-fs-libraries.js:62:43:62:46 | path |
2367+
| other-fs-libraries.js:62:43:62:46 | path |
2368+
| other-fs-libraries.js:62:43:62:46 | path |
2369+
| other-fs-libraries.js:62:43:62:46 | path |
2370+
| other-fs-libraries.js:62:43:62:46 | path |
2371+
| other-fs-libraries.js:62:43:62:46 | path |
2372+
| other-fs-libraries.js:62:43:62:46 | path |
2373+
| other-fs-libraries.js:62:43:62:46 | path |
2374+
| other-fs-libraries.js:62:43:62:46 | path |
2375+
| other-fs-libraries.js:62:43:62:46 | path |
2376+
| other-fs-libraries.js:62:43:62:46 | path |
2377+
| other-fs-libraries.js:62:43:62:46 | path |
2378+
| other-fs-libraries.js:62:43:62:46 | path |
2379+
| other-fs-libraries.js:62:43:62:46 | path |
2380+
| other-fs-libraries.js:62:43:62:46 | path |
2381+
| other-fs-libraries.js:62:43:62:46 | path |
2382+
| other-fs-libraries.js:63:51:63:54 | path |
2383+
| other-fs-libraries.js:63:51:63:54 | path |
2384+
| other-fs-libraries.js:63:51:63:54 | path |
2385+
| other-fs-libraries.js:63:51:63:54 | path |
2386+
| other-fs-libraries.js:63:51:63:54 | path |
2387+
| other-fs-libraries.js:63:51:63:54 | path |
2388+
| other-fs-libraries.js:63:51:63:54 | path |
2389+
| other-fs-libraries.js:63:51:63:54 | path |
2390+
| other-fs-libraries.js:63:51:63:54 | path |
2391+
| other-fs-libraries.js:63:51:63:54 | path |
2392+
| other-fs-libraries.js:63:51:63:54 | path |
2393+
| other-fs-libraries.js:63:51:63:54 | path |
2394+
| other-fs-libraries.js:63:51:63:54 | path |
2395+
| other-fs-libraries.js:63:51:63:54 | path |
2396+
| other-fs-libraries.js:63:51:63:54 | path |
2397+
| other-fs-libraries.js:63:51:63:54 | path |
2398+
| other-fs-libraries.js:63:51:63:54 | path |
23652399
| prettier.js:6:11:6:28 | p |
23662400
| prettier.js:6:11:6:28 | p |
23672401
| prettier.js:6:11:6:28 | p |
@@ -6866,6 +6900,70 @@ edges
68666900
| other-fs-libraries.js:49:7:49:48 | path | other-fs-libraries.js:59:39:59:42 | path |
68676901
| other-fs-libraries.js:49:7:49:48 | path | other-fs-libraries.js:59:39:59:42 | path |
68686902
| other-fs-libraries.js:49:7:49:48 | path | other-fs-libraries.js:59:39:59:42 | path |
6903+
| other-fs-libraries.js:49:7:49:48 | path | other-fs-libraries.js:62:43:62:46 | path |
6904+
| other-fs-libraries.js:49:7:49:48 | path | other-fs-libraries.js:62:43:62:46 | path |
6905+
| other-fs-libraries.js:49:7:49:48 | path | other-fs-libraries.js:62:43:62:46 | path |
6906+
| other-fs-libraries.js:49:7:49:48 | path | other-fs-libraries.js:62:43:62:46 | path |
6907+
| other-fs-libraries.js:49:7:49:48 | path | other-fs-libraries.js:62:43:62:46 | path |
6908+
| other-fs-libraries.js:49:7:49:48 | path | other-fs-libraries.js:62:43:62:46 | path |
6909+
| other-fs-libraries.js:49:7:49:48 | path | other-fs-libraries.js:62:43:62:46 | path |
6910+
| other-fs-libraries.js:49:7:49:48 | path | other-fs-libraries.js:62:43:62:46 | path |
6911+
| other-fs-libraries.js:49:7:49:48 | path | other-fs-libraries.js:62:43:62:46 | path |
6912+
| other-fs-libraries.js:49:7:49:48 | path | other-fs-libraries.js:62:43:62:46 | path |
6913+
| other-fs-libraries.js:49:7:49:48 | path | other-fs-libraries.js:62:43:62:46 | path |
6914+
| other-fs-libraries.js:49:7:49:48 | path | other-fs-libraries.js:62:43:62:46 | path |
6915+
| other-fs-libraries.js:49:7:49:48 | path | other-fs-libraries.js:62:43:62:46 | path |
6916+
| other-fs-libraries.js:49:7:49:48 | path | other-fs-libraries.js:62:43:62:46 | path |
6917+
| other-fs-libraries.js:49:7:49:48 | path | other-fs-libraries.js:62:43:62:46 | path |
6918+
| other-fs-libraries.js:49:7:49:48 | path | other-fs-libraries.js:62:43:62:46 | path |
6919+
| other-fs-libraries.js:49:7:49:48 | path | other-fs-libraries.js:62:43:62:46 | path |
6920+
| other-fs-libraries.js:49:7:49:48 | path | other-fs-libraries.js:62:43:62:46 | path |
6921+
| other-fs-libraries.js:49:7:49:48 | path | other-fs-libraries.js:62:43:62:46 | path |
6922+
| other-fs-libraries.js:49:7:49:48 | path | other-fs-libraries.js:62:43:62:46 | path |
6923+
| other-fs-libraries.js:49:7:49:48 | path | other-fs-libraries.js:62:43:62:46 | path |
6924+
| other-fs-libraries.js:49:7:49:48 | path | other-fs-libraries.js:62:43:62:46 | path |
6925+
| other-fs-libraries.js:49:7:49:48 | path | other-fs-libraries.js:62:43:62:46 | path |
6926+
| other-fs-libraries.js:49:7:49:48 | path | other-fs-libraries.js:62:43:62:46 | path |
6927+
| other-fs-libraries.js:49:7:49:48 | path | other-fs-libraries.js:62:43:62:46 | path |
6928+
| other-fs-libraries.js:49:7:49:48 | path | other-fs-libraries.js:62:43:62:46 | path |
6929+
| other-fs-libraries.js:49:7:49:48 | path | other-fs-libraries.js:62:43:62:46 | path |
6930+
| other-fs-libraries.js:49:7:49:48 | path | other-fs-libraries.js:62:43:62:46 | path |
6931+
| other-fs-libraries.js:49:7:49:48 | path | other-fs-libraries.js:62:43:62:46 | path |
6932+
| other-fs-libraries.js:49:7:49:48 | path | other-fs-libraries.js:62:43:62:46 | path |
6933+
| other-fs-libraries.js:49:7:49:48 | path | other-fs-libraries.js:62:43:62:46 | path |
6934+
| other-fs-libraries.js:49:7:49:48 | path | other-fs-libraries.js:62:43:62:46 | path |
6935+
| other-fs-libraries.js:49:7:49:48 | path | other-fs-libraries.js:63:51:63:54 | path |
6936+
| other-fs-libraries.js:49:7:49:48 | path | other-fs-libraries.js:63:51:63:54 | path |
6937+
| other-fs-libraries.js:49:7:49:48 | path | other-fs-libraries.js:63:51:63:54 | path |
6938+
| other-fs-libraries.js:49:7:49:48 | path | other-fs-libraries.js:63:51:63:54 | path |
6939+
| other-fs-libraries.js:49:7:49:48 | path | other-fs-libraries.js:63:51:63:54 | path |
6940+
| other-fs-libraries.js:49:7:49:48 | path | other-fs-libraries.js:63:51:63:54 | path |
6941+
| other-fs-libraries.js:49:7:49:48 | path | other-fs-libraries.js:63:51:63:54 | path |
6942+
| other-fs-libraries.js:49:7:49:48 | path | other-fs-libraries.js:63:51:63:54 | path |
6943+
| other-fs-libraries.js:49:7:49:48 | path | other-fs-libraries.js:63:51:63:54 | path |
6944+
| other-fs-libraries.js:49:7:49:48 | path | other-fs-libraries.js:63:51:63:54 | path |
6945+
| other-fs-libraries.js:49:7:49:48 | path | other-fs-libraries.js:63:51:63:54 | path |
6946+
| other-fs-libraries.js:49:7:49:48 | path | other-fs-libraries.js:63:51:63:54 | path |
6947+
| other-fs-libraries.js:49:7:49:48 | path | other-fs-libraries.js:63:51:63:54 | path |
6948+
| other-fs-libraries.js:49:7:49:48 | path | other-fs-libraries.js:63:51:63:54 | path |
6949+
| other-fs-libraries.js:49:7:49:48 | path | other-fs-libraries.js:63:51:63:54 | path |
6950+
| other-fs-libraries.js:49:7:49:48 | path | other-fs-libraries.js:63:51:63:54 | path |
6951+
| other-fs-libraries.js:49:7:49:48 | path | other-fs-libraries.js:63:51:63:54 | path |
6952+
| other-fs-libraries.js:49:7:49:48 | path | other-fs-libraries.js:63:51:63:54 | path |
6953+
| other-fs-libraries.js:49:7:49:48 | path | other-fs-libraries.js:63:51:63:54 | path |
6954+
| other-fs-libraries.js:49:7:49:48 | path | other-fs-libraries.js:63:51:63:54 | path |
6955+
| other-fs-libraries.js:49:7:49:48 | path | other-fs-libraries.js:63:51:63:54 | path |
6956+
| other-fs-libraries.js:49:7:49:48 | path | other-fs-libraries.js:63:51:63:54 | path |
6957+
| other-fs-libraries.js:49:7:49:48 | path | other-fs-libraries.js:63:51:63:54 | path |
6958+
| other-fs-libraries.js:49:7:49:48 | path | other-fs-libraries.js:63:51:63:54 | path |
6959+
| other-fs-libraries.js:49:7:49:48 | path | other-fs-libraries.js:63:51:63:54 | path |
6960+
| other-fs-libraries.js:49:7:49:48 | path | other-fs-libraries.js:63:51:63:54 | path |
6961+
| other-fs-libraries.js:49:7:49:48 | path | other-fs-libraries.js:63:51:63:54 | path |
6962+
| other-fs-libraries.js:49:7:49:48 | path | other-fs-libraries.js:63:51:63:54 | path |
6963+
| other-fs-libraries.js:49:7:49:48 | path | other-fs-libraries.js:63:51:63:54 | path |
6964+
| other-fs-libraries.js:49:7:49:48 | path | other-fs-libraries.js:63:51:63:54 | path |
6965+
| other-fs-libraries.js:49:7:49:48 | path | other-fs-libraries.js:63:51:63:54 | path |
6966+
| other-fs-libraries.js:49:7:49:48 | path | other-fs-libraries.js:63:51:63:54 | path |
68696967
| other-fs-libraries.js:49:14:49:37 | url.par ... , true) | other-fs-libraries.js:49:14:49:43 | url.par ... ).query |
68706968
| other-fs-libraries.js:49:14:49:37 | url.par ... , true) | other-fs-libraries.js:49:14:49:43 | url.par ... ).query |
68716969
| other-fs-libraries.js:49:14:49:37 | url.par ... , true) | other-fs-libraries.js:49:14:49:43 | url.par ... ).query |
@@ -8605,6 +8703,8 @@ edges
86058703
| other-fs-libraries.js:55:36:55:39 | path | other-fs-libraries.js:49:24:49:30 | req.url | other-fs-libraries.js:55:36:55:39 | path | This path depends on $@. | other-fs-libraries.js:49:24:49:30 | req.url | a user-provided value |
86068704
| other-fs-libraries.js:57:46:57:49 | path | other-fs-libraries.js:49:24:49:30 | req.url | other-fs-libraries.js:57:46:57:49 | path | This path depends on $@. | other-fs-libraries.js:49:24:49:30 | req.url | a user-provided value |
86078705
| other-fs-libraries.js:59:39:59:42 | path | other-fs-libraries.js:49:24:49:30 | req.url | other-fs-libraries.js:59:39:59:42 | path | This path depends on $@. | other-fs-libraries.js:49:24:49:30 | req.url | a user-provided value |
8706+
| other-fs-libraries.js:62:43:62:46 | path | other-fs-libraries.js:49:24:49:30 | req.url | other-fs-libraries.js:62:43:62:46 | path | This path depends on $@. | other-fs-libraries.js:49:24:49:30 | req.url | a user-provided value |
8707+
| other-fs-libraries.js:63:51:63:54 | path | other-fs-libraries.js:49:24:49:30 | req.url | other-fs-libraries.js:63:51:63:54 | path | This path depends on $@. | other-fs-libraries.js:49:24:49:30 | req.url | a user-provided value |
86088708
| prettier.js:7:28:7:28 | p | prettier.js:6:13:6:13 | p | prettier.js:7:28:7:28 | p | This path depends on $@. | prettier.js:6:13:6:13 | p | a user-provided value |
86098709
| prettier.js:11:44:11:44 | p | prettier.js:6:13:6:13 | p | prettier.js:11:44:11:44 | p | This path depends on $@. | prettier.js:6:13:6:13 | p | a user-provided value |
86108710
| pupeteer.js:9:28:9:34 | tainted | pupeteer.js:5:28:5:53 | parseTo ... t).name | pupeteer.js:9:28:9:34 | tainted | This path depends on $@. | pupeteer.js:5:28:5:53 | parseTo ... t).name | a user-provided value |

‎javascript/ql/test/query-tests/Security/CWE-022/TaintedPath/other-fs-libraries.js‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -57,4 +57,8 @@ http.createServer(function(req, res) {
5757
require('util.promisify')(fs.readFileSync)(path); // NOT OK
5858

5959
require("thenify")(fs.readFileSync)(path); // NOT OK
60+
61+
const readPkg = require('read-pkg');
62+
var pkg = readPkg.readPackageSync({cwd: path}); // NOT OK
63+
var pkgPromise = readPkg.readPackageAsync({cwd: path}); // NOT OK
6064
});

0 commit comments

Comments
 (0)