CodeQL unable to find out sources of a chosen dataflow node in Javascript
- Ngôn ngữ chính
- CodeQL
- Star
- 10.1k
- Fork
- 2.1k
- Merge trung bình
- 2 ngày 15 giờ
- Pull request đã merge (30 ngày)
- 141
Mô tả
Hi, for the following snippet i'm interested in finding out what nodes flow to `s + c` node.
```javascript
function main() {
let s = window.location;
let c = "";
let input = s + c;
eval(input);
}
```
By looking at the snippet, the answer clearly consists of five dataflow nodes. `s + c` itself, c , "" , s , window.location.
The followings are methods i tried so far.
CodeQL query for locating `s + c` explicitly by providing location
```codeql
import javascript
class SinkNode extends DataFlow::Node {
SinkNode() {
exists(DataFlow::Node node |
node.hasLocationInfo("filepath to the snippet",
4, 15, 4, 19) and
this = node
)
}
}
```
```codeql
class TestSucessor extends DataFlow::Node {
TestSucessor() {
exists(DataFlow::Node node |
node instanceof Sink and
exists(DataFlow::Node source |
source.getASuccessor*() = node and
this = source
)
)
}
}
```
This would only mark `s + c` as a predecessor.

```codeql
class TestPredecessor extends DataFlow::Node {
TestPredecessor() {
exists(DataFlow::Node node |
node instanceof Sink and
this = node.getAPredecessor*()
)
}
}
```
This would only mark `s + c` as a predecessor.
```codeql
class TestLocalSource extends DataFlow::Node {
TestLocalSource() {
exists(DataFlow::Node node |
this = node.getALocalSource*() and
node instanceof Sink
)
}
}
class TestLocalUse extends DataFlow::SourceNode {
TestLocalUse() {
exists(DataFlow::SourceNode src |
exists(DataFlow::Node node |
node instanceof Sink and
src.getALocalUse() = node and
this = src
)
)
}
}
```
Neither mark anything out.
I would see that an overkill for this issue is simply using tainted analysis. Mark `s+c` as sink and use `any()` for the source. However, i want to keep it simple. Any idea how to do it simply?
Many thanks.
Hướng dẫn đóng góp
Hướng nghiên cứu
Start by reproducing the JavaScript snippet and the supplied CodeQL queries, then read the DataFlow::Node APIs mentioned: getASuccessor*, getAPredecessor*, getALocalSource* and getALocalUse. Done means a simple query identifies the five expected nodes flowing into s + c: the expression, c, "", s, and window.location.
Do mô hình lập chỉ mục viết ra từ nội dung của issue.
Đánh giá
- Công nghệ
- javascript
- Lĩnh vực
- devtools, security
- Loại issue
- Lỗi
- Độ khó
- 4/5
- Thời gian dự kiến
- 3-5 ngày
- Mức độ hoạt động
- Đình trệ
- Độ rõ ràng
- Khá rõ ràng
- Mức phù hợp với người mới
- 25/100