Skip to content

Commit 39b8171

Browse files
jeongsoolee09jeongsoolee09
authored
Merge pull request #180 from advanced-security/jeongsoolee09/remove-duplicate-alerts
Remove dependencies on `isSink` in the taint tracking configurations of the default queries
2 parents 3886d28 + 883aed5 commit 39b8171

File tree

6 files changed

+12
-55
lines changed

6 files changed

+12
-55
lines changed

‎javascript/frameworks/cap/lib/advanced_security/javascript/frameworks/cap/CAPLogInjectionQuery.qll‎

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -45,7 +45,8 @@ class CdsLogSink extends DataFlow::Node {
4545

4646
class CAPLogInjectionConfiguration extends LogInjectionConfiguration {
4747
override predicate isSource(DataFlow::Node start) {
48-
super.isSource(start) or
48+
super.isSource(start)
49+
or
4950
start instanceof RemoteFlowSource
5051
}
5152

‎javascript/frameworks/ui5/lib/advanced_security/javascript/frameworks/ui5/UI5XssQuery.qll‎

Lines changed: 2 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -2,7 +2,6 @@ import javascript
22
import advanced_security.javascript.frameworks.ui5.dataflow.DataFlow as UI5DataFlow
33
import advanced_security.javascript.frameworks.ui5.UI5View
44
import semmle.javascript.security.dataflow.DomBasedXssQuery as DomBasedXss
5-
import semmle.javascript.security.dataflow.ClientSideUrlRedirectCustomizations::ClientSideUrlRedirect as UrlRedirect
65

76
class Configuration extends DomBasedXss::Configuration {
87
override predicate isSource(DataFlow::Node start) {
@@ -56,21 +55,20 @@ class Configuration extends DomBasedXss::Configuration {
5655

5756
override predicate isSink(DataFlow::Node node) {
5857
node instanceof UI5ExtHtmlISink or
59-
node instanceof UrlRedirect::LocationSink or
6058
node instanceof UI5ModelHtmlISink
6159
}
6260
}
6361

6462
/**
6563
* An HTML injection sink associated with a `UI5BoundNode`, typically for library controls acting as sinks.
6664
*/
67-
class UI5ModelHtmlISink extends DomBasedXss::Sink {
65+
class UI5ModelHtmlISink extends DataFlow::Node {
6866
UI5ModelHtmlISink() { exists(UI5View view | view.getAnHtmlISink().getNode() = this) }
6967
}
7068

7169
/**
7270
* An HTML injection sink typically for custom controls whose RenderManager calls acting as sinks.
7371
*/
74-
private class UI5ExtHtmlISink extends DomBasedXss::Sink {
72+
private class UI5ExtHtmlISink extends DataFlow::Node {
7573
UI5ExtHtmlISink() { this = ModelOutput::getASinkNode("ui5-html-injection").asSink() }
7674
}

‎javascript/frameworks/xsjs/lib/advanced_security/javascript/frameworks/xsjs/XSJSReflectedXssQuery.qll‎

Lines changed: 2 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,6 @@
11
import javascript
22
import advanced_security.javascript.frameworks.xsjs.AsyncXSJS
3-
import semmle.javascript.security.dataflow.DomBasedXssQuery as DomBasedXss
3+
import semmle.javascript.security.dataflow.ReflectedXssQuery as ReflectedXssQuery
44

55
class XSJSResponseSetBodyCall extends MethodCallNode {
66
XSJSResponse response;
@@ -13,17 +13,13 @@ class XSJSResponseSetBodyCall extends MethodCallNode {
1313
XSJSResponse getParentXSJSResponse() { result = response }
1414
}
1515

16-
class Configuration extends TaintTracking::Configuration {
17-
Configuration() { this = "XSJS Reflected XSS Query" }
18-
16+
class Configuration extends ReflectedXssQuery::Configuration {
1917
override predicate isSource(DataFlow::Node start) {
2018
super.isSource(start) or
2119
start instanceof RemoteFlowSource
2220
}
2321

2422
override predicate isSink(DataFlow::Node end) {
25-
super.isSink(end)
26-
or
2723
exists(XSJSResponseSetBodyCall setBody, XSJSResponse thisOrAnotherXSJSResponse |
2824
thisOrAnotherXSJSResponse = setBody.getParentXSJSResponse() or
2925
thisOrAnotherXSJSResponse = setBody.getParentXSJSResponse().getAPredOrSuccResponse()

‎javascript/frameworks/xsjs/lib/advanced_security/javascript/frameworks/xsjs/XSJSSqlInjectionQuery.qll‎

Lines changed: 3 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -12,16 +12,14 @@ class XSJSDBConnectionPrepareStatementArgument extends DataFlow::ValueNode {
1212
predicate isConcatenated() { this.getAPredecessor+() instanceof StringOps::ConcatenationNode }
1313
}
1414

15-
class Configuration extends TaintTracking::Configuration {
16-
Configuration() { this = "XSJS SQL Injection Query" }
17-
15+
class Configuration extends SqlInjection::Configuration {
1816
override predicate isSource(DataFlow::Node start) {
19-
super.isSource(start) or
17+
super.isSource(start)
18+
or
2019
start instanceof RemoteFlowSource
2120
}
2221

2322
override predicate isSink(DataFlow::Node end) {
24-
super.isSink(end) or
2523
end.(XSJSDBConnectionPrepareStatementArgument).isConcatenated()
2624
}
2725
}

‎javascript/frameworks/xsjs/lib/advanced_security/javascript/frameworks/xsjs/XSJSUrlRedirectQuery.qll‎

Lines changed: 3 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -2,17 +2,14 @@ import javascript
22
import advanced_security.javascript.frameworks.xsjs.AsyncXSJS
33
import semmle.javascript.security.dataflow.ServerSideUrlRedirectQuery as UrlRedirect
44

5-
class Configuration extends TaintTracking::Configuration {
6-
Configuration() { this = "XSJS URL Redirect Query" }
7-
5+
class Configuration extends UrlRedirect::Configuration {
86
override predicate isSource(DataFlow::Node start) {
9-
super.isSource(start) or
7+
super.isSource(start)
8+
or
109
start instanceof RemoteFlowSource
1110
}
1211

1312
override predicate isSink(DataFlow::Node end) {
14-
super.isSink(end)
15-
or
1613
exists(XSJSRequestOrResponseHeaders headers |
1714
end = headers.getHeaderSetCall("location").getArgument(1)
1815
)

‎javascript/frameworks/xsjs/test/queries/XSJSReflectedXss/XSJSReflectedXss.expected‎

Lines changed: 0 additions & 33 deletions
Original file line numberDiff line numberDiff line change
@@ -3,49 +3,16 @@ WARNING: type 'PathNode' has been deprecated and may be removed in future (XSJSR
33
WARNING: type 'PathNode' has been deprecated and may be removed in future (XSJSReflectedXss.ql:17,55-73)
44
nodes
55
| XSJSReflectedXss.xsjs:11:7:11:67 | someParameterValue1 |
6-
| XSJSReflectedXss.xsjs:11:7:11:67 | someParameterValue1 |
7-
| XSJSReflectedXss.xsjs:11:29:11:67 | request ... eter1") |
8-
| XSJSReflectedXss.xsjs:11:29:11:67 | request ... eter1") |
96
| XSJSReflectedXss.xsjs:11:29:11:67 | request ... eter1") |
107
| XSJSReflectedXss.xsjs:11:29:11:67 | request ... eter1") |
118
| XSJSReflectedXss.xsjs:13:22:13:65 | request ... Value1) |
129
| XSJSReflectedXss.xsjs:13:22:13:65 | request ... Value1) |
13-
| XSJSReflectedXss.xsjs:13:22:13:65 | request ... Value1) |
14-
| XSJSReflectedXss.xsjs:13:22:13:65 | request ... Value1) |
15-
| XSJSReflectedXss.xsjs:13:46:13:64 | someParameterValue1 |
1610
| XSJSReflectedXss.xsjs:13:46:13:64 | someParameterValue1 |
17-
| XSJSReflectedXss.xsjs:21:7:21:67 | someParameterValue2 |
18-
| XSJSReflectedXss.xsjs:21:29:21:67 | request ... eter2") |
19-
| XSJSReflectedXss.xsjs:21:29:21:67 | request ... eter2") |
20-
| XSJSReflectedXss.xsjs:23:22:23:65 | request ... Value2) |
21-
| XSJSReflectedXss.xsjs:23:22:23:65 | request ... Value2) |
22-
| XSJSReflectedXss.xsjs:23:46:23:64 | someParameterValue2 |
23-
| XSJSReflectedXss.xsjs:31:7:31:67 | someParameterValue3 |
24-
| XSJSReflectedXss.xsjs:31:29:31:67 | request ... eter3") |
25-
| XSJSReflectedXss.xsjs:31:29:31:67 | request ... eter3") |
26-
| XSJSReflectedXss.xsjs:32:22:32:65 | request ... Value3) |
27-
| XSJSReflectedXss.xsjs:32:22:32:65 | request ... Value3) |
28-
| XSJSReflectedXss.xsjs:32:46:32:64 | someParameterValue3 |
2911
edges
3012
| XSJSReflectedXss.xsjs:11:7:11:67 | someParameterValue1 | XSJSReflectedXss.xsjs:13:46:13:64 | someParameterValue1 |
31-
| XSJSReflectedXss.xsjs:11:7:11:67 | someParameterValue1 | XSJSReflectedXss.xsjs:13:46:13:64 | someParameterValue1 |
32-
| XSJSReflectedXss.xsjs:11:29:11:67 | request ... eter1") | XSJSReflectedXss.xsjs:11:7:11:67 | someParameterValue1 |
33-
| XSJSReflectedXss.xsjs:11:29:11:67 | request ... eter1") | XSJSReflectedXss.xsjs:11:7:11:67 | someParameterValue1 |
3413
| XSJSReflectedXss.xsjs:11:29:11:67 | request ... eter1") | XSJSReflectedXss.xsjs:11:7:11:67 | someParameterValue1 |
3514
| XSJSReflectedXss.xsjs:11:29:11:67 | request ... eter1") | XSJSReflectedXss.xsjs:11:7:11:67 | someParameterValue1 |
3615
| XSJSReflectedXss.xsjs:13:46:13:64 | someParameterValue1 | XSJSReflectedXss.xsjs:13:22:13:65 | request ... Value1) |
3716
| XSJSReflectedXss.xsjs:13:46:13:64 | someParameterValue1 | XSJSReflectedXss.xsjs:13:22:13:65 | request ... Value1) |
38-
| XSJSReflectedXss.xsjs:13:46:13:64 | someParameterValue1 | XSJSReflectedXss.xsjs:13:22:13:65 | request ... Value1) |
39-
| XSJSReflectedXss.xsjs:13:46:13:64 | someParameterValue1 | XSJSReflectedXss.xsjs:13:22:13:65 | request ... Value1) |
40-
| XSJSReflectedXss.xsjs:21:7:21:67 | someParameterValue2 | XSJSReflectedXss.xsjs:23:46:23:64 | someParameterValue2 |
41-
| XSJSReflectedXss.xsjs:21:29:21:67 | request ... eter2") | XSJSReflectedXss.xsjs:21:7:21:67 | someParameterValue2 |
42-
| XSJSReflectedXss.xsjs:21:29:21:67 | request ... eter2") | XSJSReflectedXss.xsjs:21:7:21:67 | someParameterValue2 |
43-
| XSJSReflectedXss.xsjs:23:46:23:64 | someParameterValue2 | XSJSReflectedXss.xsjs:23:22:23:65 | request ... Value2) |
44-
| XSJSReflectedXss.xsjs:23:46:23:64 | someParameterValue2 | XSJSReflectedXss.xsjs:23:22:23:65 | request ... Value2) |
45-
| XSJSReflectedXss.xsjs:31:7:31:67 | someParameterValue3 | XSJSReflectedXss.xsjs:32:46:32:64 | someParameterValue3 |
46-
| XSJSReflectedXss.xsjs:31:29:31:67 | request ... eter3") | XSJSReflectedXss.xsjs:31:7:31:67 | someParameterValue3 |
47-
| XSJSReflectedXss.xsjs:31:29:31:67 | request ... eter3") | XSJSReflectedXss.xsjs:31:7:31:67 | someParameterValue3 |
48-
| XSJSReflectedXss.xsjs:32:46:32:64 | someParameterValue3 | XSJSReflectedXss.xsjs:32:22:32:65 | request ... Value3) |
49-
| XSJSReflectedXss.xsjs:32:46:32:64 | someParameterValue3 | XSJSReflectedXss.xsjs:32:22:32:65 | request ... Value3) |
5017
#select
5118
| XSJSReflectedXss.xsjs:13:22:13:65 | request ... Value1) | XSJSReflectedXss.xsjs:11:29:11:67 | request ... eter1") | XSJSReflectedXss.xsjs:13:22:13:65 | request ... Value1) | Reflected XSS vulnerability due to $@. | XSJSReflectedXss.xsjs:11:29:11:67 | request ... eter1") | user-provided value |

0 commit comments

Comments
 (0)