Skip to content

Commit 9ca4773

Browse files
NapalysNapalys
committed
Added modeling for CreatePreparedStatementCommand 
1 parent 872b6d8 commit 9ca4773

File tree

3 files changed

+24
-5
lines changed

3 files changed

+24
-5
lines changed

‎javascript/ql/lib/ext/aws-sdk.model.yml‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -30,6 +30,7 @@ extensions:
3030
extensible: summaryModel
3131
data:
3232
- ["@aws-sdk/client-athena", "Member[StartQueryExecutionCommand,CreateNamedQueryCommand,UpdateNamedQueryCommand]", "Argument[0].Member[QueryString]", "ReturnValue", "taint"]
33+
- ["@aws-sdk/client-athena", "Member[CreatePreparedStatementCommand]", "Argument[0].Member[QueryStatement]", "ReturnValue", "taint"]
3334
- ["@aws-sdk/client-s3", "Member[SelectObjectContentCommand]", "Argument[0].Member[Expression]", "ReturnValue", "taint"]
3435
- ["@aws-sdk/client-rds-data", "Member[ExecuteStatementCommand,BatchExecuteStatementCommand]", "Argument[0].Member[sql]", "ReturnValue", "taint"]
3536
- ["@aws-sdk/client-rds-data", "Member[BatchExecuteStatementCommand]", "Argument[0].Member[parameterSets].ArrayElement.Member[sql]", "ReturnValue", "taint"]

‎javascript/ql/test/query-tests/Security/CWE-089/untyped/SqlInjection.expected‎

Lines changed: 21 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -5,6 +5,7 @@
55
| athena.js:48:22:48:30 | userQuery | athena.js:43:23:43:30 | req.body | athena.js:48:22:48:30 | userQuery | This query string depends on a $@. | athena.js:43:23:43:30 | req.body | user-provided value |
66
| athena.js:57:22:57:30 | userQuery | athena.js:43:23:43:30 | req.body | athena.js:57:22:57:30 | userQuery | This query string depends on a $@. | athena.js:43:23:43:30 | req.body | user-provided value |
77
| athena.js:66:22:66:30 | userQuery | athena.js:43:23:43:30 | req.body | athena.js:66:22:66:30 | userQuery | This query string depends on a $@. | athena.js:43:23:43:30 | req.body | user-provided value |
8+
| athena.js:84:23:84:29 | command | athena.js:75:32:75:39 | req.body | athena.js:84:23:84:29 | command | This query string depends on a $@. | athena.js:75:32:75:39 | req.body | user-provided value |
89
| clients3.js:18:23:18:60 | new Sel ... params) | clients3.js:10:26:10:33 | req.body | clients3.js:18:23:18:60 | new Sel ... params) | This query string depends on a $@. | clients3.js:10:26:10:33 | req.body | user-provided value |
910
| clients3.js:29:21:29:68 | "SELECT ... usInput | clients3.js:23:26:23:33 | req.body | clients3.js:29:21:29:68 | "SELECT ... usInput | This query string depends on a $@. | clients3.js:23:26:23:33 | req.body | user-provided value |
1011
| clients3.js:38:21:38:68 | "SELECT ... usInput | clients3.js:23:26:23:33 | req.body | clients3.js:38:21:38:68 | "SELECT ... usInput | This query string depends on a $@. | clients3.js:23:26:23:33 | req.body | user-provided value |
@@ -161,8 +162,8 @@ edges
161162
| athena.js:9:11:9:19 | userQuery | athena.js:33:22:33:30 | userQuery | provenance | |
162163
| athena.js:9:23:9:30 | req.body | athena.js:9:11:9:19 | userQuery | provenance | |
163164
| athena.js:13:11:13:17 | params1 [QueryString] | athena.js:18:46:18:52 | params1 [QueryString] | provenance | |
164-
| athena.js:13:21:17:5 | {\\n ... }\\n } [QueryString] | athena.js:13:11:13:17 | params1 [QueryString] | provenance | |
165-
| athena.js:14:22:14:38 | "SQL" + userQuery | athena.js:13:21:17:5 | {\\n ... }\\n } [QueryString] | provenance | |
165+
| athena.js:13:21:17:5 | { \\n ... }\\n } [QueryString] | athena.js:13:11:13:17 | params1 [QueryString] | provenance | |
166+
| athena.js:14:22:14:38 | "SQL" + userQuery | athena.js:13:21:17:5 | { \\n ... }\\n } [QueryString] | provenance | |
166167
| athena.js:14:30:14:38 | userQuery | athena.js:14:22:14:38 | "SQL" + userQuery | provenance | |
167168
| athena.js:18:11:18:11 | p | athena.js:19:23:19:23 | p | provenance | |
168169
| athena.js:18:15:18:53 | new Sta ... arams1) | athena.js:18:11:18:11 | p | provenance | |
@@ -179,6 +180,14 @@ edges
179180
| athena.js:43:11:43:19 | userQuery | athena.js:57:22:57:30 | userQuery | provenance | |
180181
| athena.js:43:11:43:19 | userQuery | athena.js:66:22:66:30 | userQuery | provenance | |
181182
| athena.js:43:23:43:30 | req.body | athena.js:43:11:43:19 | userQuery | provenance | |
183+
| athena.js:75:11:75:28 | userQueryStatement | athena.js:80:25:80:42 | userQueryStatement | provenance | |
184+
| athena.js:75:32:75:39 | req.body | athena.js:75:11:75:28 | userQueryStatement | provenance | |
185+
| athena.js:77:11:77:15 | input [QueryStatement] | athena.js:83:56:83:60 | input [QueryStatement] | provenance | |
186+
| athena.js:77:19:82:5 | {\\n ... ,\\n } [QueryStatement] | athena.js:77:11:77:15 | input [QueryStatement] | provenance | |
187+
| athena.js:80:25:80:42 | userQueryStatement | athena.js:77:19:82:5 | {\\n ... ,\\n } [QueryStatement] | provenance | |
188+
| athena.js:83:11:83:17 | command | athena.js:84:23:84:29 | command | provenance | |
189+
| athena.js:83:21:83:61 | new Cre ... (input) | athena.js:83:11:83:17 | command | provenance | |
190+
| athena.js:83:56:83:60 | input [QueryStatement] | athena.js:83:21:83:61 | new Cre ... (input) | provenance | |
182191
| clients3.js:10:9:10:22 | maliciousInput | clients3.js:16:55:16:68 | maliciousInput | provenance | |
183192
| clients3.js:10:26:10:33 | req.body | clients3.js:10:9:10:22 | maliciousInput | provenance | |
184193
| clients3.js:12:11:12:16 | params [Expression] | clients3.js:18:54:18:59 | params [Expression] | provenance | |
@@ -615,7 +624,7 @@ nodes
615624
| athena.js:9:11:9:19 | userQuery | semmle.label | userQuery |
616625
| athena.js:9:23:9:30 | req.body | semmle.label | req.body |
617626
| athena.js:13:11:13:17 | params1 [QueryString] | semmle.label | params1 [QueryString] |
618-
| athena.js:13:21:17:5 | {\\n ... }\\n } [QueryString] | semmle.label | {\\n ... }\\n } [QueryString] |
627+
| athena.js:13:21:17:5 | { \\n ... }\\n } [QueryString] | semmle.label | { \\n ... }\\n } [QueryString] |
619628
| athena.js:14:22:14:38 | "SQL" + userQuery | semmle.label | "SQL" + userQuery |
620629
| athena.js:14:30:14:38 | userQuery | semmle.label | userQuery |
621630
| athena.js:18:11:18:11 | p | semmle.label | p |
@@ -637,6 +646,15 @@ nodes
637646
| athena.js:48:22:48:30 | userQuery | semmle.label | userQuery |
638647
| athena.js:57:22:57:30 | userQuery | semmle.label | userQuery |
639648
| athena.js:66:22:66:30 | userQuery | semmle.label | userQuery |
649+
| athena.js:75:11:75:28 | userQueryStatement | semmle.label | userQueryStatement |
650+
| athena.js:75:32:75:39 | req.body | semmle.label | req.body |
651+
| athena.js:77:11:77:15 | input [QueryStatement] | semmle.label | input [QueryStatement] |
652+
| athena.js:77:19:82:5 | {\\n ... ,\\n } [QueryStatement] | semmle.label | {\\n ... ,\\n } [QueryStatement] |
653+
| athena.js:80:25:80:42 | userQueryStatement | semmle.label | userQueryStatement |
654+
| athena.js:83:11:83:17 | command | semmle.label | command |
655+
| athena.js:83:21:83:61 | new Cre ... (input) | semmle.label | new Cre ... (input) |
656+
| athena.js:83:56:83:60 | input [QueryStatement] | semmle.label | input [QueryStatement] |
657+
| athena.js:84:23:84:29 | command | semmle.label | command |
640658
| clients3.js:10:9:10:22 | maliciousInput | semmle.label | maliciousInput |
641659
| clients3.js:10:26:10:33 | req.body | semmle.label | req.body |
642660
| clients3.js:12:11:12:16 | params [Expression] | semmle.label | params [Expression] |

‎javascript/ql/test/query-tests/Security/CWE-089/untyped/athena.js‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -72,7 +72,7 @@ app.post('/v2/athena/all', async (req, res) => {
7272
});
7373

7474
app.post('/dynamodb-v3', async (req, res) => {
75-
const userQueryStatement = req.body.query; // $ MISSING: Source
75+
const userQueryStatement = req.body.query; // $ Source
7676
const client = new AthenaClient({ region: "us-east-1" });
7777
const input = {
7878
StatementName: "STRING_VALUE",
@@ -81,5 +81,5 @@ app.post('/dynamodb-v3', async (req, res) => {
8181
Description: "STRING_VALUE",
8282
};
8383
const command = new CreatePreparedStatementCommand(input);
84-
await client.send(command); // $ MISSING: Alert
84+
await client.send(command); // $ Alert
8585
});

0 commit comments

Comments
 (0)