Skip to content

Commit 06ab918

Browse files
NapalysNapalys
committed
Added modeling for V2 of dynamoDB
1 parent ae2e8b1 commit 06ab918

File tree

3 files changed

+27
-6
lines changed

3 files changed

+27
-6
lines changed

‎javascript/ql/lib/ext/dynamodb.model.yml‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -4,6 +4,8 @@ extensions:
44
extensible: sinkModel
55
data:
66
- ["DynamoDBClientV3", "ReturnValue.Member[send].Argument[0]", "sql-injection"]
7+
- ["DynamoDBClientV2", "ReturnValue.Member[executeStatement].Argument[0].Member[Statement]", "sql-injection"]
8+
- ["DynamoDBClientV2", "ReturnValue.Member[batchExecuteStatement].Argument[0].Member[Statements].ArrayElement.Member[Statement]", "sql-injection"]
79

810
- addsTo:
911
pack: codeql/javascript-all
@@ -17,3 +19,4 @@ extensions:
1719
extensible: typeModel
1820
data:
1921
- ["DynamoDBClientV3", "@aws-sdk/client-dynamodb", "Member[DynamoDBClient,DynamoDB]"]
22+
- ["DynamoDBClientV2", "aws-sdk", "Member[DynamoDB]"]

‎javascript/ql/test/query-tests/Security/CWE-089/untyped/SqlInjection.expected‎

Lines changed: 18 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -2,6 +2,9 @@
22
| dynamodb.js:15:23:15:29 | command | dynamodb.js:9:26:9:33 | req.body | dynamodb.js:15:23:15:29 | command | This query string depends on a $@. | dynamodb.js:9:26:9:33 | req.body | user-provided value |
33
| dynamodb.js:21:23:21:35 | updateCommand | dynamodb.js:9:26:9:33 | req.body | dynamodb.js:21:23:21:35 | updateCommand | This query string depends on a $@. | dynamodb.js:9:26:9:33 | req.body | user-provided value |
44
| dynamodb.js:47:24:47:30 | command | dynamodb.js:9:26:9:33 | req.body | dynamodb.js:47:24:47:30 | command | This query string depends on a $@. | dynamodb.js:9:26:9:33 | req.body | user-provided value |
5+
| dynamodb.js:58:20:58:77 | `SELECT ... nput}'` | dynamodb.js:56:26:56:33 | req.body | dynamodb.js:58:20:58:77 | `SELECT ... nput}'` | This query string depends on a $@. | dynamodb.js:56:26:56:33 | req.body | user-provided value |
6+
| dynamodb.js:64:28:64:85 | `SELECT ... nput}'` | dynamodb.js:56:26:56:33 | req.body | dynamodb.js:64:28:64:85 | `SELECT ... nput}'` | This query string depends on a $@. | dynamodb.js:56:26:56:33 | req.body | user-provided value |
7+
| dynamodb.js:67:28:67:85 | `SELECT ... nput}'` | dynamodb.js:56:26:56:33 | req.body | dynamodb.js:67:28:67:85 | `SELECT ... nput}'` | This query string depends on a $@. | dynamodb.js:56:26:56:33 | req.body | user-provided value |
58
| graphql.js:9:34:19:5 | `\\n ... }\\n ` | graphql.js:8:16:8:28 | req.params.id | graphql.js:9:34:19:5 | `\\n ... }\\n ` | This query string depends on a $@. | graphql.js:8:16:8:28 | req.params.id | user-provided value |
69
| graphql.js:26:30:26:40 | `foo ${id}` | graphql.js:25:16:25:28 | req.params.id | graphql.js:26:30:26:40 | `foo ${id}` | This query string depends on a $@. | graphql.js:25:16:25:28 | req.params.id | user-provided value |
710
| graphql.js:29:32:29:42 | `foo ${id}` | graphql.js:25:16:25:28 | req.params.id | graphql.js:29:32:29:42 | `foo ${id}` | This query string depends on a $@. | graphql.js:25:16:25:28 | req.params.id | user-provided value |
@@ -156,6 +159,13 @@ edges
156159
| dynamodb.js:18:27:20:6 | new Exe ... \\n }) | dynamodb.js:18:11:18:23 | updateCommand | provenance | |
157160
| dynamodb.js:18:55:20:5 | {\\n ... t\\n } [Statement] | dynamodb.js:18:27:20:6 | new Exe ... \\n }) | provenance | |
158161
| dynamodb.js:19:20:19:34 | updateStatement | dynamodb.js:18:55:20:5 | {\\n ... t\\n } [Statement] | provenance | |
162+
| dynamodb.js:56:9:56:22 | maliciousInput | dynamodb.js:58:61:58:74 | maliciousInput | provenance | |
163+
| dynamodb.js:56:9:56:22 | maliciousInput | dynamodb.js:64:69:64:82 | maliciousInput | provenance | |
164+
| dynamodb.js:56:9:56:22 | maliciousInput | dynamodb.js:67:69:67:82 | maliciousInput | provenance | |
165+
| dynamodb.js:56:26:56:33 | req.body | dynamodb.js:56:9:56:22 | maliciousInput | provenance | |
166+
| dynamodb.js:58:61:58:74 | maliciousInput | dynamodb.js:58:20:58:77 | `SELECT ... nput}'` | provenance | |
167+
| dynamodb.js:64:69:64:82 | maliciousInput | dynamodb.js:64:28:64:85 | `SELECT ... nput}'` | provenance | |
168+
| dynamodb.js:67:69:67:82 | maliciousInput | dynamodb.js:67:28:67:85 | `SELECT ... nput}'` | provenance | |
159169
| graphql.js:8:11:8:12 | id | graphql.js:11:46:11:47 | id | provenance | |
160170
| graphql.js:8:16:8:28 | req.params.id | graphql.js:8:11:8:12 | id | provenance | |
161171
| graphql.js:11:46:11:47 | id | graphql.js:9:34:19:5 | `\\n ... }\\n ` | provenance | |
@@ -554,6 +564,14 @@ nodes
554564
| dynamodb.js:19:20:19:34 | updateStatement | semmle.label | updateStatement |
555565
| dynamodb.js:21:23:21:35 | updateCommand | semmle.label | updateCommand |
556566
| dynamodb.js:47:24:47:30 | command | semmle.label | command |
567+
| dynamodb.js:56:9:56:22 | maliciousInput | semmle.label | maliciousInput |
568+
| dynamodb.js:56:26:56:33 | req.body | semmle.label | req.body |
569+
| dynamodb.js:58:20:58:77 | `SELECT ... nput}'` | semmle.label | `SELECT ... nput}'` |
570+
| dynamodb.js:58:61:58:74 | maliciousInput | semmle.label | maliciousInput |
571+
| dynamodb.js:64:28:64:85 | `SELECT ... nput}'` | semmle.label | `SELECT ... nput}'` |
572+
| dynamodb.js:64:69:64:82 | maliciousInput | semmle.label | maliciousInput |
573+
| dynamodb.js:67:28:67:85 | `SELECT ... nput}'` | semmle.label | `SELECT ... nput}'` |
574+
| dynamodb.js:67:69:67:82 | maliciousInput | semmle.label | maliciousInput |
557575
| graphql.js:8:11:8:12 | id | semmle.label | id |
558576
| graphql.js:8:16:8:28 | req.params.id | semmle.label | req.params.id |
559577
| graphql.js:9:34:19:5 | `\\n ... }\\n ` | semmle.label | `\\n ... }\\n ` |

‎javascript/ql/test/query-tests/Security/CWE-089/untyped/dynamodb.js‎

Lines changed: 6 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -53,21 +53,21 @@ app.post('/partiql/v2/execute', async (req, res) => {
5353
const dynamodb = new AWS.DynamoDB({
5454
region: 'us-east-1'
5555
});
56-
let maliciousInput = req.body.data; // $ MISSING: Source
56+
let maliciousInput = req.body.data; // $ Source
5757
const params = {
58-
Statement: `SELECT * FROM Users WHERE username = '${maliciousInput}'`
58+
Statement: `SELECT * FROM Users WHERE username = '${maliciousInput}'` // $ Alert
5959
};
6060

61-
dynamodb.executeStatement(params, function(err, data) {}); // $ MISSING: Alert
61+
dynamodb.executeStatement(params, function(err, data) {});
6262
const params2 = {
6363
Statements: [{
64-
Statement: `SELECT * FROM Users WHERE username = '${maliciousInput}'`
64+
Statement: `SELECT * FROM Users WHERE username = '${maliciousInput}'` // $ Alert
6565
},
6666
{
67-
Statement: `SELECT * FROM Users WHERE username = '${maliciousInput}'`
67+
Statement: `SELECT * FROM Users WHERE username = '${maliciousInput}'` // $ Alert
6868
}
6969
]
7070
};
7171

72-
dynamodb.batchExecuteStatement(params2, function(err, data) {}); // $ MISSING: Alert
72+
dynamodb.batchExecuteStatement(params2, function(err, data) {});
7373
});

0 commit comments

Comments
 (0)