github / github/codeql

CodeQL unable to find out sources of a chosen dataflow node in Javascript

Offen
#19,720 1 Kommentar 0 Reaktionen 0 zugewiesene Personen Auf GitHub ansehen
question
Vorherrschende Sprache
CodeQL
Sterne
10.1k
Forks
2.1k
Ø Merge
2 T. 15 Std.
Gemergte PRs (30 T.)
141

Beschreibung

Hi, for the following snippet i'm interested in finding out what nodes flow to `s + c` node.
```javascript
function main() {
let s = window.location;
let c = "";
let input = s + c;
eval(input);
}
```
By looking at the snippet, the answer clearly consists of five dataflow nodes. `s + c` itself, c , "" , s , window.location.

The followings are methods i tried so far.

CodeQL query for locating `s + c` explicitly by providing location
```codeql
import javascript

class SinkNode extends DataFlow::Node {
SinkNode() {
exists(DataFlow::Node node |
node.hasLocationInfo("filepath to the snippet",
4, 15, 4, 19) and
this = node
)
}
}

```
```codeql
class TestSucessor extends DataFlow::Node {
TestSucessor() {
exists(DataFlow::Node node |
node instanceof Sink and
exists(DataFlow::Node source |
source.getASuccessor*() = node and
this = source
)
)
}
}
```
This would only mark `s + c` as a predecessor.

![Image](https://github.com/user-attachments/assets/26b3f5dd-b549-4f5e-ab13-6b3a6cee58ff)

```codeql
class TestPredecessor extends DataFlow::Node {
TestPredecessor() {
exists(DataFlow::Node node |
node instanceof Sink and
this = node.getAPredecessor*()
)
}
}
```
This would only mark `s + c` as a predecessor.
```codeql

class TestLocalSource extends DataFlow::Node {
TestLocalSource() {
exists(DataFlow::Node node |
this = node.getALocalSource*() and
node instanceof Sink
)
}
}

class TestLocalUse extends DataFlow::SourceNode {
TestLocalUse() {
exists(DataFlow::SourceNode src |
exists(DataFlow::Node node |
node instanceof Sink and
src.getALocalUse() = node and
this = src
)
)
}
}
```
Neither mark anything out.

I would see that an overkill for this issue is simply using tainted analysis. Mark `s+c` as sink and use `any()` for the source. However, i want to keep it simple. Any idea how to do it simply?

Many thanks.

Beitragsleitfaden

Beitragsleitfaden öffnen

Rechercherichtung

Start by reproducing the JavaScript snippet and the supplied CodeQL queries, then read the DataFlow::Node APIs mentioned: getASuccessor*, getAPredecessor*, getALocalSource* and getALocalUse. Done means a simple query identifies the five expected nodes flowing into s + c: the expression, c, "", s, and window.location.

Vom Indexierungsmodell aus dem Issue-Text verfasst.

Bewertung

Tech-Stack
javascript
Bereich
devtools, security
Issue-Typ
Bug
Schwierigkeit
4/5
Geschätzter Aufwand
3-5 Tage
Aktivitätsstatus
Veraltet
Klarheit
Größtenteils klar
Anfängerfreundlichkeit
25/100

Neue Issues direkt in Ihr Postfach

Eine kurze Übersicht über anfängerfreundliche GitHub-Issues.