Skip to content

Commit fafeffd

Browse files
knewbury01knewbury01
committed
Refactor categories utils
1 parent 2e409c3 commit fafeffd

File tree

4 files changed

+70
-43
lines changed

4 files changed

+70
-43
lines changed

‎javascript/frameworks/cap/lib/advanced_security/javascript/frameworks/cap/CAPPathInjectionQuery.qll‎

Lines changed: 24 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -7,7 +7,11 @@
77
import javascript
88
import advanced_security.javascript.frameworks.cap.CDSUtils
99

10-
abstract class UtilsSink extends DataFlow::Node { }
10+
abstract class UtilsAccessedPathSink extends DataFlow::Node { }
11+
12+
abstract class UtilsControlledDataSink extends DataFlow::Node { }
13+
14+
abstract class UtilsControlledPathSink extends DataFlow::Node { }
1115

1216
abstract class UtilsExtraFlow extends DataFlow::Node { }
1317

@@ -21,12 +25,26 @@ abstract class UtilsExtraFlow extends DataFlow::Node { }
2125
* {foo:'bar'}
2226
* ```
2327
*/
24-
class WrittenData extends UtilsSink {
28+
class WrittenData extends UtilsControlledDataSink {
2529
WrittenData() { exists(FileWriters fw | fw.getData() = this) }
2630
}
2731

2832
/**
29-
* This represents the filepath in calls as follows:
33+
* This represents the filepath accessed as an input for the data in calls as follows:
34+
* ```javascript
35+
* await copy('db/data').to('dist/db/data')
36+
* ```
37+
* sinks in this example are:
38+
* ```javascript
39+
* 'db/data'
40+
* ```
41+
*/
42+
class AccessedPath extends UtilsAccessedPathSink {
43+
AccessedPath() { exists(FileReaderWriters fw | fw.getFromPath() = this) }
44+
}
45+
46+
/**
47+
* This represents the filepath where data is written or a file operation is performed in calls as follows:
3048
* ```javascript
3149
* await write ({foo:'bar'}) .to ('some','file.json')
3250
* ```
@@ -36,11 +54,11 @@ class WrittenData extends UtilsSink {
3654
* 'file.json'
3755
* ```
3856
*/
39-
class WrittenPath extends UtilsSink {
40-
WrittenPath() {
57+
class ControlledInputPath extends UtilsControlledPathSink {
58+
ControlledInputPath() {
4159
exists(FileReaders fw | fw.getPath() = this)
4260
or
43-
exists(FileReaderWriters fw | fw.getPath() = this)
61+
exists(FileReaderWriters fw | fw.getToPath() = this)
4462
or
4563
exists(FileWriters fw | fw.getPath() = this)
4664
or

‎javascript/frameworks/cap/lib/advanced_security/javascript/frameworks/cap/CDSUtils.qll‎

Lines changed: 8 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -129,12 +129,17 @@ class FileReaderWriters extends DataFlow::CallNode {
129129
}
130130

131131
/**
132-
* Gets the arguments to these calls that represent a path.
132+
* Gets the arguments to these calls that represent a path from which data is read.
133+
*/
134+
DataFlow::Node getFromPath() { this.getArgument(0) = result }
135+
136+
/**
137+
* Gets the arguments to these calls that represent a path to which data is written.
133138
* Includes arguments to chained calls `to`, where that argument also represents a path.
134139
*/
135-
DataFlow::Node getPath() {
140+
DataFlow::Node getToPath() {
136141
this.getAMemberCall("to").getArgument(_) = result
137142
or
138-
this.getAnArgument() = result
143+
this.getArgument(1) = result
139144
}
140145
}

‎javascript/frameworks/cap/test/models/cds/utils/utils.expected‎

Lines changed: 33 additions & 33 deletions
Original file line numberDiff line numberDiff line change
@@ -3,36 +3,36 @@
33
| utils.js:9:18:9:27 | "%E0%A4%A" | "%E0%A4%A": additional flow step |
44
| utils.js:13:17:13:21 | 'app' | 'app': additional flow step |
55
| utils.js:15:19:15:32 | 'package.json' | 'package.json': additional flow step |
6-
| utils.js:17:22:17:35 | 'package.json' | 'package.json': sink |
7-
| utils.js:19:26:19:39 | 'package.json' | 'package.json': sink |
8-
| utils.js:21:20:21:33 | 'package.json' | 'package.json': sink |
9-
| utils.js:23:20:23:33 | 'package.json' | 'package.json': sink |
10-
| utils.js:25:14:25:22 | 'db/data' | 'db/data': sink |
11-
| utils.js:25:28:25:41 | 'dist/db/data' | 'dist/db/data': sink |
12-
| utils.js:26:14:26:22 | 'db/data' | 'db/data': sink |
13-
| utils.js:26:25:26:38 | 'dist/db/data' | 'dist/db/data': sink |
14-
| utils.js:28:12:28:20 | 'db/data' | 'db/data': sink |
15-
| utils.js:28:26:28:39 | 'dist/db/data' | 'dist/db/data': sink |
16-
| utils.js:29:12:29:20 | 'db/data' | 'db/data': sink |
17-
| utils.js:29:23:29:36 | 'dist/db/data' | 'dist/db/data': sink |
18-
| utils.js:31:13:31:26 | { foo: 'bar' } | { foo: 'bar' }: sink |
19-
| utils.js:31:32:31:47 | 'some/file.json' | 'some/file.json': sink |
20-
| utils.js:32:13:32:28 | 'some/file.json' | 'some/file.json': sink |
21-
| utils.js:32:31:32:44 | { foo: 'bar' } | { foo: 'bar' }: sink |
22-
| utils.js:34:14:34:19 | 'dist' | 'dist': sink |
23-
| utils.js:34:22:34:25 | 'db' | 'db': sink |
24-
| utils.js:34:28:34:33 | 'data' | 'data': sink |
25-
| utils.js:35:14:35:27 | 'dist/db/data' | 'dist/db/data': sink |
26-
| utils.js:37:13:37:18 | 'dist' | 'dist': sink |
27-
| utils.js:37:21:37:24 | 'db' | 'db': sink |
28-
| utils.js:37:27:37:32 | 'data' | 'data': sink |
29-
| utils.js:38:13:38:26 | 'dist/db/data' | 'dist/db/data': sink |
30-
| utils.js:40:14:40:19 | 'dist' | 'dist': sink |
31-
| utils.js:40:22:40:25 | 'db' | 'db': sink |
32-
| utils.js:40:28:40:33 | 'data' | 'data': sink |
33-
| utils.js:41:14:41:27 | 'dist/db/data' | 'dist/db/data': sink |
34-
| utils.js:43:10:43:15 | 'dist' | 'dist': sink |
35-
| utils.js:43:18:43:21 | 'db' | 'db': sink |
36-
| utils.js:43:24:43:29 | 'data' | 'data': sink |
37-
| utils.js:44:10:44:23 | 'dist/db/data' | 'dist/db/data': sink |
38-
| utils.js:52:20:52:28 | 'db/data' | 'db/data': sink |
6+
| utils.js:17:22:17:35 | 'package.json' | 'package.json': controlled path sink |
7+
| utils.js:19:26:19:39 | 'package.json' | 'package.json': controlled path sink |
8+
| utils.js:21:20:21:33 | 'package.json' | 'package.json': controlled path sink |
9+
| utils.js:23:20:23:33 | 'package.json' | 'package.json': controlled path sink |
10+
| utils.js:25:14:25:22 | 'db/data' | 'db/data': controlled data sink |
11+
| utils.js:25:28:25:41 | 'dist/db/data' | 'dist/db/data': controlled path sink |
12+
| utils.js:26:14:26:22 | 'db/data' | 'db/data': controlled path sink |
13+
| utils.js:26:25:26:38 | 'dist/db/data' | 'dist/db/data': controlled data sink |
14+
| utils.js:28:12:28:20 | 'db/data' | 'db/data': accessed path sink |
15+
| utils.js:28:26:28:39 | 'dist/db/data' | 'dist/db/data': controlled path sink |
16+
| utils.js:29:12:29:20 | 'db/data' | 'db/data': accessed path sink |
17+
| utils.js:29:23:29:36 | 'dist/db/data' | 'dist/db/data': controlled path sink |
18+
| utils.js:31:13:31:26 | { foo: 'bar' } | { foo: 'bar' }: controlled data sink |
19+
| utils.js:31:32:31:47 | 'some/file.json' | 'some/file.json': controlled path sink |
20+
| utils.js:32:13:32:28 | 'some/file.json' | 'some/file.json': controlled path sink |
21+
| utils.js:32:31:32:44 | { foo: 'bar' } | { foo: 'bar' }: controlled data sink |
22+
| utils.js:34:14:34:19 | 'dist' | 'dist': controlled path sink |
23+
| utils.js:34:22:34:25 | 'db' | 'db': controlled path sink |
24+
| utils.js:34:28:34:33 | 'data' | 'data': controlled path sink |
25+
| utils.js:35:14:35:27 | 'dist/db/data' | 'dist/db/data': controlled path sink |
26+
| utils.js:37:13:37:18 | 'dist' | 'dist': controlled path sink |
27+
| utils.js:37:21:37:24 | 'db' | 'db': controlled path sink |
28+
| utils.js:37:27:37:32 | 'data' | 'data': controlled path sink |
29+
| utils.js:38:13:38:26 | 'dist/db/data' | 'dist/db/data': controlled path sink |
30+
| utils.js:40:14:40:19 | 'dist' | 'dist': controlled path sink |
31+
| utils.js:40:22:40:25 | 'db' | 'db': controlled path sink |
32+
| utils.js:40:28:40:33 | 'data' | 'data': controlled path sink |
33+
| utils.js:41:14:41:27 | 'dist/db/data' | 'dist/db/data': controlled path sink |
34+
| utils.js:43:10:43:15 | 'dist' | 'dist': controlled path sink |
35+
| utils.js:43:18:43:21 | 'db' | 'db': controlled path sink |
36+
| utils.js:43:24:43:29 | 'data' | 'data': controlled path sink |
37+
| utils.js:44:10:44:23 | 'dist/db/data' | 'dist/db/data': controlled path sink |
38+
| utils.js:52:20:52:28 | 'db/data' | 'db/data': controlled data sink |

‎javascript/frameworks/cap/test/models/cds/utils/utils.ql‎

Lines changed: 5 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -3,7 +3,11 @@ import advanced_security.javascript.frameworks.cap.CAPPathInjectionQuery
33

44
from DataFlow::Node node, string str, string strfull
55
where
6-
node.(UtilsSink).toString() = str and strfull = str + ": sink"
6+
node.(UtilsControlledPathSink).toString() = str and strfull = str + ": controlled path sink"
7+
or
8+
node.(UtilsAccessedPathSink).toString() = str and strfull = str + ": accessed path sink"
9+
or
10+
node.(UtilsControlledDataSink).toString() = str and strfull = str + ": controlled data sink"
711
or
812
node.(UtilsExtraFlow).toString() = str and strfull = str + ": additional flow step"
913
select node, strfull

0 commit comments

Comments
 (0)