Skip to content

Commit 9b49f0a

Browse files
jeongsoolee09jeongsoolee09
committed
Debug log-entry-flows-to-sinks/UI5Xss.qlref
1 parent a658843 commit 9b49f0a

File tree

3 files changed

+38
-14
lines changed

3 files changed

+38
-14
lines changed

‎javascript/frameworks/ui5/lib/advanced_security/javascript/frameworks/ui5/dataflow/FlowSteps.qll‎

Lines changed: 16 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -342,3 +342,19 @@ class ResourceBundleGetTextCallArgToReturnValueStep extends DataFlow::SharedFlow
342342
)
343343
}
344344
}
345+
346+
/**
347+
* A step from any argument of a SAP logging function to the `onLogEntry`
348+
* method of a custom log listener in the same application.
349+
*/
350+
class LogArgumentToListener extends DataFlow::SharedFlowStep {
351+
override predicate step(DataFlow::Node start, DataFlow::Node end) {
352+
inSameWebApp(start.getFile(), end.getFile()) and
353+
start =
354+
ModelOutput::getATypeNode("SapLogger")
355+
.getMember(["debug", "error", "fatal", "info", "trace", "warning"])
356+
.getACall()
357+
.getAnArgument() and
358+
end = ModelOutput::getATypeNode("SapLogEntries").asSource()
359+
}
360+
}

‎javascript/frameworks/ui5/src/UI5LogInjection/UI5LogsToHttp.ql‎

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -49,6 +49,14 @@ class UI5LogEntryToHttp extends TaintTracking::Configuration {
4949
preState = postState
5050
)
5151
or
52+
/*
53+
* NOTE: This disjunct is a labeled version of LogArgumentToListener in
54+
* FlowSteps.qll, a DataFlow::SharedFlowStep. As the class is considered
55+
* legacy on version 2.4.0, we leave the two here (labeled) and there
56+
* (unlabeled). This is something we should also tidy up when we migrate
57+
* to the newer APIs.
58+
*/
59+
5260
inSameWebApp(start.getFile(), end.getFile()) and
5361
start =
5462
ModelOutput::getATypeNode("SapLogger")

‎javascript/frameworks/ui5/test/queries/UI5LogInjection/log-entry-flows-to-sinks/UI5Xss.expected‎

Lines changed: 14 additions & 14 deletions
Original file line numberDiff line numberDiff line change
@@ -1,8 +1,8 @@
11
nodes
2-
| webapp/controller/app.controller.js:8:11:8:21 | input: null |
3-
| webapp/controller/app.controller.js:14:13:14:48 | input |
4-
| webapp/controller/app.controller.js:14:21:14:48 | oModel. ... input") |
5-
| webapp/controller/app.controller.js:15:30:15:34 | input |
2+
| webapp/controller/app.controller.js:11:11:11:21 | input: null |
3+
| webapp/controller/app.controller.js:17:13:17:48 | input |
4+
| webapp/controller/app.controller.js:17:21:17:48 | oModel. ... input") |
5+
| webapp/controller/app.controller.js:18:30:18:34 | input |
66
| webapp/utils/CustomLogListener.js:9:29:9:34 | oEvent |
77
| webapp/utils/CustomLogListener.js:15:24:15:29 | oEvent |
88
| webapp/utils/CustomLogListener.js:15:24:15:37 | oEvent.message |
@@ -11,19 +11,19 @@ nodes
1111
| webapp/view/app.view.xml:5:5:7:28 | value={/input} |
1212
| webapp/view/app.view.xml:8:5:8:37 | content={/output} |
1313
edges
14-
| webapp/controller/app.controller.js:8:11:8:21 | input: null | webapp/controller/app.controller.js:14:21:14:48 | oModel. ... input") |
15-
| webapp/controller/app.controller.js:8:11:8:21 | input: null | webapp/view/app.view.xml:5:5:7:28 | value={/input} |
16-
| webapp/controller/app.controller.js:9:11:9:22 | output: null | webapp/view/app.view.xml:8:5:8:37 | content={/output} |
17-
| webapp/controller/app.controller.js:11:22:11:41 | new JSONModel(oData) | webapp/view/app.view.xml:8:5:8:37 | content={/output} |
18-
| webapp/controller/app.controller.js:14:13:14:48 | input | webapp/controller/app.controller.js:15:30:15:34 | input |
19-
| webapp/controller/app.controller.js:14:21:14:48 | oModel. ... input") | webapp/controller/app.controller.js:14:13:14:48 | input |
20-
| webapp/controller/app.controller.js:15:30:15:34 | input | webapp/utils/CustomLogListener.js:9:29:9:34 | oEvent |
14+
| webapp/controller/app.controller.js:11:11:11:21 | input: null | webapp/controller/app.controller.js:17:21:17:48 | oModel. ... input") |
15+
| webapp/controller/app.controller.js:11:11:11:21 | input: null | webapp/view/app.view.xml:5:5:7:28 | value={/input} |
16+
| webapp/controller/app.controller.js:12:11:12:22 | output: null | webapp/view/app.view.xml:8:5:8:37 | content={/output} |
17+
| webapp/controller/app.controller.js:14:22:14:41 | new JSONModel(oData) | webapp/view/app.view.xml:8:5:8:37 | content={/output} |
18+
| webapp/controller/app.controller.js:17:13:17:48 | input | webapp/controller/app.controller.js:18:30:18:34 | input |
19+
| webapp/controller/app.controller.js:17:21:17:48 | oModel. ... input") | webapp/controller/app.controller.js:17:13:17:48 | input |
20+
| webapp/controller/app.controller.js:18:30:18:34 | input | webapp/utils/CustomLogListener.js:9:29:9:34 | oEvent |
2121
| webapp/utils/CustomLogListener.js:9:29:9:34 | oEvent | webapp/utils/CustomLogListener.js:15:24:15:29 | oEvent |
2222
| webapp/utils/CustomLogListener.js:9:29:9:34 | oEvent | webapp/utils/CustomLogListener.js:16:31:16:36 | oEvent |
2323
| webapp/utils/CustomLogListener.js:15:24:15:29 | oEvent | webapp/utils/CustomLogListener.js:15:24:15:37 | oEvent.message |
2424
| webapp/utils/CustomLogListener.js:16:31:16:36 | oEvent | webapp/utils/CustomLogListener.js:16:31:16:44 | oEvent.message |
25-
| webapp/view/app.view.xml:5:5:7:28 | value={/input} | webapp/controller/app.controller.js:8:11:8:21 | input: null |
26-
| webapp/view/app.view.xml:5:5:7:28 | value={/input} | webapp/controller/app.controller.js:11:22:11:41 | new JSONModel(oData) |
27-
| webapp/view/app.view.xml:8:5:8:37 | content={/output} | webapp/controller/app.controller.js:9:11:9:22 | output: null |
25+
| webapp/view/app.view.xml:5:5:7:28 | value={/input} | webapp/controller/app.controller.js:11:11:11:21 | input: null |
26+
| webapp/view/app.view.xml:5:5:7:28 | value={/input} | webapp/controller/app.controller.js:14:22:14:41 | new JSONModel(oData) |
27+
| webapp/view/app.view.xml:8:5:8:37 | content={/output} | webapp/controller/app.controller.js:12:11:12:22 | output: null |
2828
#select
2929
| webapp/utils/CustomLogListener.js:16:31:16:44 | oEvent.message | webapp/view/app.view.xml:5:5:7:28 | value={/input} | webapp/utils/CustomLogListener.js:16:31:16:44 | oEvent.message | XSS vulnerability due to $@. | webapp/view/app.view.xml:5:5:7:28 | value={/input} | user-provided value |

0 commit comments

Comments
 (0)