Add sensitive exposure split query

Author: knewbury01

javascript/frameworks/cap/src/sensitive-exposure/SensitiveExposureLikely.md

@@ -0,0 +1,30 @@
+# CAP Insertion of Sensitive Information into Log File
+
+If sensitive information is written to a log entry using the CAP Node.js logging API, a malicious user may be able to gain access to user data.
+
+Data that may expose system information such as full path names, system information, usernames and passwords should not be logged.
+
+## Recommendation
+
+CAP applications should not log sensitive information.
+
+## Examples
+
+This CAP service directly logs the sensitive information.
+
+``` javascript
+import cds from '@sap/cds'
+const LOG = cds.log("logger");
+
+class SampleVulnService extends cds.ApplicationService {
+    init() {
+        LOG.info(`[INFO] Environment: ${JSON.stringify(process.env)}`); // CAP log exposure alert
+    }
+}
+```
+
+## References
+
+- OWASP 2021: [Security Logging and Monitoring Failures](https://owasp.org/Top10/A09_2021-Security_Logging_and_Monitoring_Failures/).
+- OWASP: [Logging Cheat Sheet](https://cheatsheetseries.owasp.org/cheatsheets/Logging_Cheat_Sheet.html).
+- OWASP: [User Privacy Protection Cheat Sheet](https://cheatsheetseries.owasp.org/cheatsheets/User_Privacy_Protection_Cheat_Sheet.html).

javascript/frameworks/cap/src/sensitive-exposure/SensitiveExposureLikely.ql

@@ -0,0 +1,31 @@
+/**
+ * @name Insertion of sensitive information into log files
+ * @description Writing heuristically sensitive information to log files can allow that
+ *              information to be leaked to an attacker more easily.
+ * @kind path-problem
+ * @problem.severity warning
+ * @security-severity 7.5
+ * @precision low
+ * @id js/cap-sensitive-log-likely
+ * @tags security
+ *       external/cwe/cwe-532
+ */
+
+import javascript
+import advanced_security.javascript.frameworks.cap.CDS
+import advanced_security.javascript.frameworks.cap.CAPLogInjectionQuery
+private import semmle.javascript.security.dataflow.CleartextLoggingCustomizations::CleartextLogging as CleartextLogging
+import DataFlow::PathGraph
+
+class SensitiveLogExposureConfig extends TaintTracking::Configuration {
+  SensitiveLogExposureConfig() { this = "SensitiveLogExposure" }
+
+  override predicate isSource(DataFlow::Node source) { source instanceof CleartextLogging::Source }
+
+  override predicate isSink(DataFlow::Node sink) { sink instanceof CdsLogSink }
+}
+
+from SensitiveLogExposureConfig config, DataFlow::PathNode source, DataFlow::PathNode sink
+where config.hasFlowPath(source, sink)
+select sink, source, sink, "This logs sensitive data returned by $@ as clear text.",
+  source.getNode(), source.getNode().(CleartextLogging::Source).describe()

javascript/frameworks/cap/test/queries/sensitive-exposure/sensitive-exposure-js-all-sinks/sensitive-exposure-likely.expected

@@ -0,0 +1,17 @@
+WARNING: module 'PathGraph' has been deprecated and may be removed in future (SensitiveExposureLikely.ql:18,8-27)
+WARNING: type 'Configuration' has been deprecated and may be removed in future (SensitiveExposureLikely.ql:20,42-70)
+WARNING: type 'PathNode' has been deprecated and may be removed in future (SensitiveExposureLikely.ql:28,41-59)
+WARNING: type 'PathNode' has been deprecated and may be removed in future (SensitiveExposureLikely.ql:28,68-86)
+nodes
+| sensitive-exposure-likely.js:6:18:6:69 | `[INFO] ... .env)}` |
+| sensitive-exposure-likely.js:6:18:6:69 | `[INFO] ... .env)}` |
+| sensitive-exposure-likely.js:6:41:6:67 | JSON.st ... ss.env) |
+| sensitive-exposure-likely.js:6:56:6:66 | process.env |
+| sensitive-exposure-likely.js:6:56:6:66 | process.env |
+edges
+| sensitive-exposure-likely.js:6:41:6:67 | JSON.st ... ss.env) | sensitive-exposure-likely.js:6:18:6:69 | `[INFO] ... .env)}` |
+| sensitive-exposure-likely.js:6:41:6:67 | JSON.st ... ss.env) | sensitive-exposure-likely.js:6:18:6:69 | `[INFO] ... .env)}` |
+| sensitive-exposure-likely.js:6:56:6:66 | process.env | sensitive-exposure-likely.js:6:41:6:67 | JSON.st ... ss.env) |
+| sensitive-exposure-likely.js:6:56:6:66 | process.env | sensitive-exposure-likely.js:6:41:6:67 | JSON.st ... ss.env) |
+#select
+| sensitive-exposure-likely.js:6:18:6:69 | `[INFO] ... .env)}` | sensitive-exposure-likely.js:6:56:6:66 | process.env | sensitive-exposure-likely.js:6:18:6:69 | `[INFO] ... .env)}` | This logs sensitive data returned by $@ as clear text. | sensitive-exposure-likely.js:6:56:6:66 | process.env | process environment |

javascript/frameworks/cap/test/queries/sensitive-exposure/sensitive-exposure-js-all-sinks/sensitive-exposure-likely.js

@@ -0,0 +1,8 @@
+import cds from '@sap/cds'
+const LOG = cds.log("logger");
+
+class SampleVulnService extends cds.ApplicationService {
+    init() {
+        LOG.info(`[INFO] Environment: ${JSON.stringify(process.env)}`); // CAP log exposure alert
+    }
+}

javascript/frameworks/cap/test/queries/sensitive-exposure/sensitive-exposure-js-all-sinks/sensitive-exposure-likely.qlref

@@ -0,0 +1 @@
+sensitive-exposure/SensitiveExposureLikely.ql