Skip to content

Commit c6fa3da

Browse files
knewbury01knewbury01
committed
Upgrade dataflow library XSJSReflectedXss
1 parent c25f324 commit c6fa3da

File tree

3 files changed

+30
-22
lines changed

3 files changed

+30
-22
lines changed

‎javascript/frameworks/xsjs/lib/advanced_security/javascript/frameworks/xsjs/XSJSReflectedXssQuery.qll‎

Lines changed: 8 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -13,13 +13,13 @@ class XSJSResponseSetBodyCall extends MethodCallNode {
1313
XSJSResponse getParentXSJSResponse() { result = response }
1414
}
1515

16-
class Configuration extends ReflectedXssQuery::Configuration {
17-
override predicate isSource(DataFlow::Node start) {
18-
super.isSource(start) or
16+
module Configuration implements DataFlow::ConfigSig {
17+
predicate isSource(DataFlow::Node start) {
18+
ReflectedXssQuery::ReflectedXssConfig::isSource(start) or
1919
start instanceof RemoteFlowSource
2020
}
2121

22-
override predicate isSink(DataFlow::Node end) {
22+
predicate isSink(DataFlow::Node end) {
2323
exists(XSJSResponseSetBodyCall setBody, XSJSResponse thisOrAnotherXSJSResponse |
2424
thisOrAnotherXSJSResponse = setBody.getParentXSJSResponse() or
2525
thisOrAnotherXSJSResponse = setBody.getParentXSJSResponse().getAPredOrSuccResponse()
@@ -31,4 +31,8 @@ class Configuration extends ReflectedXssQuery::Configuration {
3131
)
3232
)
3333
}
34+
35+
predicate isBarrier(DataFlow::Node node) {
36+
ReflectedXssQuery::ReflectedXssConfig::isBarrier(node)
37+
}
3438
}

‎javascript/frameworks/xsjs/src/XSJSReflectedXss/XSJSReflectedXss.ql‎

Lines changed: 6 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -12,8 +12,11 @@
1212

1313
import javascript
1414
import advanced_security.javascript.frameworks.xsjs.XSJSReflectedXssQuery
15-
import DataFlow::PathGraph
1615

17-
from Configuration config, DataFlow::PathNode source, DataFlow::PathNode sink
18-
where config.hasFlowPath(source, sink)
16+
module ConfigurationFlow = TaintTracking::Global<Configuration>;
17+
18+
import ConfigurationFlow::PathGraph
19+
20+
from ConfigurationFlow::PathNode source, ConfigurationFlow::PathNode sink
21+
where ConfigurationFlow::flowPath(source, sink)
1922
select sink, source, sink, "Reflected XSS vulnerability due to $@.", source, "user-provided value"

‎javascript/frameworks/xsjs/test/queries/XSJSReflectedXss/XSJSReflectedXss.expected‎

Lines changed: 16 additions & 15 deletions
Original file line numberDiff line numberDiff line change
@@ -1,18 +1,19 @@
1-
WARNING: module 'PathGraph' has been deprecated and may be removed in future (XSJSReflectedXss.ql:15,8-27)
2-
WARNING: type 'PathNode' has been deprecated and may be removed in future (XSJSReflectedXss.ql:17,28-46)
3-
WARNING: type 'PathNode' has been deprecated and may be removed in future (XSJSReflectedXss.ql:17,55-73)
4-
nodes
5-
| XSJSReflectedXss.xsjs:11:7:11:67 | someParameterValue1 |
6-
| XSJSReflectedXss.xsjs:11:29:11:67 | request ... eter1") |
7-
| XSJSReflectedXss.xsjs:11:29:11:67 | request ... eter1") |
8-
| XSJSReflectedXss.xsjs:13:22:13:65 | request ... Value1) |
9-
| XSJSReflectedXss.xsjs:13:22:13:65 | request ... Value1) |
10-
| XSJSReflectedXss.xsjs:13:46:13:64 | someParameterValue1 |
111
edges
12-
| XSJSReflectedXss.xsjs:11:7:11:67 | someParameterValue1 | XSJSReflectedXss.xsjs:13:46:13:64 | someParameterValue1 |
13-
| XSJSReflectedXss.xsjs:11:29:11:67 | request ... eter1") | XSJSReflectedXss.xsjs:11:7:11:67 | someParameterValue1 |
14-
| XSJSReflectedXss.xsjs:11:29:11:67 | request ... eter1") | XSJSReflectedXss.xsjs:11:7:11:67 | someParameterValue1 |
15-
| XSJSReflectedXss.xsjs:13:46:13:64 | someParameterValue1 | XSJSReflectedXss.xsjs:13:22:13:65 | request ... Value1) |
16-
| XSJSReflectedXss.xsjs:13:46:13:64 | someParameterValue1 | XSJSReflectedXss.xsjs:13:22:13:65 | request ... Value1) |
2+
| XSJSReflectedXss.xsjs:3:34:3:50 | requestParameters | XSJSReflectedXss.xsjs:4:20:4:36 | requestParameters | provenance | |
3+
| XSJSReflectedXss.xsjs:4:20:4:36 | requestParameters | XSJSReflectedXss.xsjs:4:10:4:47 | "<div>" ... </div>" | provenance | |
4+
| XSJSReflectedXss.xsjs:11:7:11:67 | someParameterValue1 | XSJSReflectedXss.xsjs:13:46:13:64 | someParameterValue1 | provenance | |
5+
| XSJSReflectedXss.xsjs:11:29:11:67 | request ... eter1") | XSJSReflectedXss.xsjs:11:7:11:67 | someParameterValue1 | provenance | |
6+
| XSJSReflectedXss.xsjs:13:46:13:64 | someParameterValue1 | XSJSReflectedXss.xsjs:3:34:3:50 | requestParameters | provenance | |
7+
| XSJSReflectedXss.xsjs:13:46:13:64 | someParameterValue1 | XSJSReflectedXss.xsjs:13:22:13:65 | request ... Value1) | provenance | |
8+
nodes
9+
| XSJSReflectedXss.xsjs:3:34:3:50 | requestParameters | semmle.label | requestParameters |
10+
| XSJSReflectedXss.xsjs:4:10:4:47 | "<div>" ... </div>" | semmle.label | "<div>" ... </div>" |
11+
| XSJSReflectedXss.xsjs:4:20:4:36 | requestParameters | semmle.label | requestParameters |
12+
| XSJSReflectedXss.xsjs:11:7:11:67 | someParameterValue1 | semmle.label | someParameterValue1 |
13+
| XSJSReflectedXss.xsjs:11:29:11:67 | request ... eter1") | semmle.label | request ... eter1") |
14+
| XSJSReflectedXss.xsjs:13:22:13:65 | request ... Value1) | semmle.label | request ... Value1) |
15+
| XSJSReflectedXss.xsjs:13:46:13:64 | someParameterValue1 | semmle.label | someParameterValue1 |
16+
subpaths
17+
| XSJSReflectedXss.xsjs:13:46:13:64 | someParameterValue1 | XSJSReflectedXss.xsjs:3:34:3:50 | requestParameters | XSJSReflectedXss.xsjs:4:10:4:47 | "<div>" ... </div>" | XSJSReflectedXss.xsjs:13:22:13:65 | request ... Value1) |
1718
#select
1819
| XSJSReflectedXss.xsjs:13:22:13:65 | request ... Value1) | XSJSReflectedXss.xsjs:11:29:11:67 | request ... eter1") | XSJSReflectedXss.xsjs:13:22:13:65 | request ... Value1) | Reflected XSS vulnerability due to $@. | XSJSReflectedXss.xsjs:11:29:11:67 | request ... eter1") | user-provided value |

0 commit comments

Comments
 (0)