Skip to content

Commit 3a75500

Browse files
NapalysNapalys
committed
JS: Add modeling for call-me-maybe 
1 parent 0d23ab0 commit 3a75500

File tree

3 files changed

+38
-2
lines changed

3 files changed

+38
-2
lines changed

‎javascript/ql/lib/ext/call-me-maybe.model.yml‎

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,6 @@
1+
extensions:
2+
- addsTo:
3+
pack: codeql/javascript-all
4+
extensible: summaryModel
5+
data:
6+
- ["call-me-maybe", "", "Argument[1]", "ReturnValue", "value"]

‎javascript/ql/test/query-tests/Security/CWE-078/CommandInjection/CommandInjection.expected‎

Lines changed: 30 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -101,6 +101,7 @@
101101
| promisification.js:102:27:102:30 | code | promisification.js:99:18:99:25 | req.body | promisification.js:102:27:102:30 | code | This command line depends on a $@. | promisification.js:99:18:99:25 | req.body | user-provided value |
102102
| promisification.js:106:24:106:27 | code | promisification.js:99:18:99:25 | req.body | promisification.js:106:24:106:27 | code | This command line depends on a $@. | promisification.js:99:18:99:25 | req.body | user-provided value |
103103
| promisification.js:109:24:109:27 | code | promisification.js:99:18:99:25 | req.body | promisification.js:109:24:109:27 | code | This command line depends on a $@. | promisification.js:99:18:99:25 | req.body | user-provided value |
104+
| promisification.js:124:17:124:19 | cmd | promisification.js:114:18:114:25 | req.body | promisification.js:124:17:124:19 | cmd | This command line depends on a $@. | promisification.js:114:18:114:25 | req.body | user-provided value |
104105
| promisification.js:133:21:133:24 | code | promisification.js:130:18:130:25 | req.body | promisification.js:133:21:133:24 | code | This command line depends on a $@. | promisification.js:130:18:130:25 | req.body | user-provided value |
105106
| promisification.js:136:15:136:18 | code | promisification.js:130:18:130:25 | req.body | promisification.js:136:15:136:18 | code | This command line depends on a $@. | promisification.js:130:18:130:25 | req.body | user-provided value |
106107
| promisification.js:144:21:144:24 | code | promisification.js:141:18:141:25 | req.body | promisification.js:144:21:144:24 | code | This command line depends on a $@. | promisification.js:141:18:141:25 | req.body | user-provided value |
@@ -316,6 +317,19 @@ edges
316317
| promisification.js:99:11:99:14 | code | promisification.js:106:24:106:27 | code | provenance | |
317318
| promisification.js:99:11:99:14 | code | promisification.js:109:24:109:27 | code | provenance | |
318319
| promisification.js:99:18:99:25 | req.body | promisification.js:99:11:99:14 | code | provenance | |
320+
| promisification.js:114:11:114:14 | code | promisification.js:122:42:122:45 | code | provenance | |
321+
| promisification.js:114:18:114:25 | req.body | promisification.js:114:11:114:14 | code | provenance | |
322+
| promisification.js:116:32:116:34 | cmd | promisification.js:117:16:119:10 | new Pro ... }) [PromiseValue] | provenance | |
323+
| promisification.js:116:32:116:34 | cmd | promisification.js:118:21:118:23 | cmd | provenance | |
324+
| promisification.js:118:13:118:19 | [post update] resolve [resolve-value] | promisification.js:117:29:117:35 | resolve [Return] [resolve-value] | provenance | |
325+
| promisification.js:118:21:118:23 | cmd | promisification.js:118:13:118:19 | [post update] resolve [resolve-value] | provenance | |
326+
| promisification.js:122:11:122:20 | cmdPromise [PromiseValue] | promisification.js:123:17:123:26 | cmdPromise [PromiseValue] | provenance | |
327+
| promisification.js:122:24:122:46 | createE ... e(code) [PromiseValue] | promisification.js:122:11:122:20 | cmdPromise [PromiseValue] | provenance | |
328+
| promisification.js:122:42:122:45 | code | promisification.js:116:32:116:34 | cmd | provenance | |
329+
| promisification.js:122:42:122:45 | code | promisification.js:122:24:122:46 | createE ... e(code) [PromiseValue] | provenance | |
330+
| promisification.js:123:5:123:27 | maybe(n ... romise) [PromiseValue] | promisification.js:123:34:123:36 | cmd | provenance | |
331+
| promisification.js:123:17:123:26 | cmdPromise [PromiseValue] | promisification.js:123:5:123:27 | maybe(n ... romise) [PromiseValue] | provenance | |
332+
| promisification.js:123:34:123:36 | cmd | promisification.js:124:17:124:19 | cmd | provenance | |
319333
| promisification.js:130:11:130:14 | code | promisification.js:133:21:133:24 | code | provenance | |
320334
| promisification.js:130:11:130:14 | code | promisification.js:136:15:136:18 | code | provenance | |
321335
| promisification.js:130:18:130:25 | req.body | promisification.js:130:11:130:14 | code | provenance | |
@@ -550,6 +564,20 @@ nodes
550564
| promisification.js:102:27:102:30 | code | semmle.label | code |
551565
| promisification.js:106:24:106:27 | code | semmle.label | code |
552566
| promisification.js:109:24:109:27 | code | semmle.label | code |
567+
| promisification.js:114:11:114:14 | code | semmle.label | code |
568+
| promisification.js:114:18:114:25 | req.body | semmle.label | req.body |
569+
| promisification.js:116:32:116:34 | cmd | semmle.label | cmd |
570+
| promisification.js:117:16:119:10 | new Pro ... }) [PromiseValue] | semmle.label | new Pro ... }) [PromiseValue] |
571+
| promisification.js:117:29:117:35 | resolve [Return] [resolve-value] | semmle.label | resolve [Return] [resolve-value] |
572+
| promisification.js:118:13:118:19 | [post update] resolve [resolve-value] | semmle.label | [post update] resolve [resolve-value] |
573+
| promisification.js:118:21:118:23 | cmd | semmle.label | cmd |
574+
| promisification.js:122:11:122:20 | cmdPromise [PromiseValue] | semmle.label | cmdPromise [PromiseValue] |
575+
| promisification.js:122:24:122:46 | createE ... e(code) [PromiseValue] | semmle.label | createE ... e(code) [PromiseValue] |
576+
| promisification.js:122:42:122:45 | code | semmle.label | code |
577+
| promisification.js:123:5:123:27 | maybe(n ... romise) [PromiseValue] | semmle.label | maybe(n ... romise) [PromiseValue] |
578+
| promisification.js:123:17:123:26 | cmdPromise [PromiseValue] | semmle.label | cmdPromise [PromiseValue] |
579+
| promisification.js:123:34:123:36 | cmd | semmle.label | cmd |
580+
| promisification.js:124:17:124:19 | cmd | semmle.label | cmd |
553581
| promisification.js:130:11:130:14 | code | semmle.label | code |
554582
| promisification.js:130:18:130:25 | req.body | semmle.label | req.body |
555583
| promisification.js:133:21:133:24 | code | semmle.label | code |
@@ -564,3 +592,5 @@ nodes
564592
| third-party-command-injection.js:5:20:5:26 | command | semmle.label | command |
565593
| third-party-command-injection.js:6:21:6:27 | command | semmle.label | command |
566594
subpaths
595+
| promisification.js:116:32:116:34 | cmd | promisification.js:118:21:118:23 | cmd | promisification.js:117:29:117:35 | resolve [Return] [resolve-value] | promisification.js:117:16:119:10 | new Pro ... }) [PromiseValue] |
596+
| promisification.js:122:42:122:45 | code | promisification.js:116:32:116:34 | cmd | promisification.js:117:16:119:10 | new Pro ... }) [PromiseValue] | promisification.js:122:24:122:46 | createE ... e(code) [PromiseValue] |

‎javascript/ql/test/query-tests/Security/CWE-078/CommandInjection/promisification.js‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -111,7 +111,7 @@ app.post('/eval', async (req, res) => {
111111

112112
app.post('/eval', async (req, res) => {
113113
const maybe = require('call-me-maybe');
114-
const code = req.body; // $ MISSING: Source
114+
const code = req.body; // $ Source
115115

116116
function createExecPromise(cmd) {
117117
return new Promise((resolve) => {
@@ -121,7 +121,7 @@ app.post('/eval', async (req, res) => {
121121

122122
const cmdPromise = createExecPromise(code);
123123
maybe(null, cmdPromise).then(cmd => {
124-
cp.exec(cmd); // $ MISSING: Alert
124+
cp.exec(cmd); // $ Alert
125125
});
126126
});
127127

0 commit comments

Comments
 (0)