Skip to content

Commit ee1af43

Browse files
NapalysNapalys
committed
Added modeling of client-s3 v2 and v3
1 parent 5e6118e commit ee1af43

File tree

3 files changed

+69
-5
lines changed

3 files changed

+69
-5
lines changed

‎javascript/ql/lib/ext/client-s3.model.yml‎

Lines changed: 20 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,20 @@
1+
extensions:
2+
- addsTo:
3+
pack: codeql/javascript-all
4+
extensible: sinkModel
5+
data:
6+
- ["S3ClientV3", "ReturnValue.Member[send].Argument[0]", "sql-injection"]
7+
- ["S3ClientV2", "ReturnValue.Member[selectObjectContent].Argument[0].Member[Expression]", "sql-injection"]
8+
9+
- addsTo:
10+
pack: codeql/javascript-all
11+
extensible: summaryModel
12+
data:
13+
- ["@aws-sdk/client-s3", "Member[SelectObjectContentCommand]", "Argument[0].Member[Expression]", "ReturnValue", "taint"]
14+
15+
- addsTo:
16+
pack: codeql/javascript-all
17+
extensible: typeModel
18+
data:
19+
- ["S3ClientV3", "@aws-sdk/client-s3", "Member[S3Client]"]
20+
- ["S3ClientV2", "aws-sdk", "Member[S3]"]

‎javascript/ql/test/query-tests/Security/CWE-089/untyped/SqlInjection.expected‎

Lines changed: 44 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,7 @@
11
#select
2+
| clients3.js:18:23:18:60 | new Sel ... params) | clients3.js:10:26:10:33 | req.body | clients3.js:18:23:18:60 | new Sel ... params) | This query string depends on a $@. | clients3.js:10:26:10:33 | req.body | user-provided value |
3+
| clients3.js:29:21:29:68 | "SELECT ... usInput | clients3.js:23:26:23:33 | req.body | clients3.js:29:21:29:68 | "SELECT ... usInput | This query string depends on a $@. | clients3.js:23:26:23:33 | req.body | user-provided value |
4+
| clients3.js:38:21:38:68 | "SELECT ... usInput | clients3.js:23:26:23:33 | req.body | clients3.js:38:21:38:68 | "SELECT ... usInput | This query string depends on a $@. | clients3.js:23:26:23:33 | req.body | user-provided value |
25
| dynamodb.js:15:23:15:29 | command | dynamodb.js:9:26:9:33 | req.body | dynamodb.js:15:23:15:29 | command | This query string depends on a $@. | dynamodb.js:9:26:9:33 | req.body | user-provided value |
36
| dynamodb.js:21:23:21:35 | updateCommand | dynamodb.js:9:26:9:33 | req.body | dynamodb.js:21:23:21:35 | updateCommand | This query string depends on a $@. | dynamodb.js:9:26:9:33 | req.body | user-provided value |
47
| dynamodb.js:47:24:47:30 | command | dynamodb.js:9:26:9:33 | req.body | dynamodb.js:47:24:47:30 | command | This query string depends on a $@. | dynamodb.js:9:26:9:33 | req.body | user-provided value |
@@ -143,6 +146,7 @@
143146
| tst4.js:8:10:8:66 | 'SELECT ... d + '"' | tst4.js:8:46:8:60 | $routeParams.id | tst4.js:8:10:8:66 | 'SELECT ... d + '"' | This query string depends on a $@. | tst4.js:8:46:8:60 | $routeParams.id | user-provided value |
144147
| tst.js:10:10:10:64 | 'SELECT ... d + '"' | tst.js:10:46:10:58 | req.params.id | tst.js:10:10:10:64 | 'SELECT ... d + '"' | This query string depends on a $@. | tst.js:10:46:10:58 | req.params.id | user-provided value |
145148
edges
149+
<<<<<<< HEAD
146150
| dynamodb.js:9:9:9:22 | maliciousInput | dynamodb.js:11:64:11:77 | maliciousInput | provenance | |
147151
| dynamodb.js:9:9:9:22 | maliciousInput | dynamodb.js:17:80:17:93 | maliciousInput | provenance | |
148152
| dynamodb.js:9:26:9:33 | req.body | dynamodb.js:9:9:9:22 | maliciousInput | provenance | |
@@ -151,6 +155,28 @@ edges
151155
| dynamodb.js:12:11:12:17 | command | dynamodb.js:15:23:15:29 | command | provenance | |
152156
| dynamodb.js:12:11:12:17 | command | dynamodb.js:47:24:47:30 | command | provenance | |
153157
| dynamodb.js:12:21:14:6 | new Exe ... \\n }) | dynamodb.js:12:11:12:17 | command | provenance | |
158+
=======
159+
| clients3.js:10:9:10:40 | maliciousInput | clients3.js:16:55:16:68 | maliciousInput | provenance | |
160+
| clients3.js:10:26:10:33 | req.body | clients3.js:10:9:10:40 | maliciousInput | provenance | |
161+
| clients3.js:12:11:17:5 | params [Expression] | clients3.js:18:54:18:59 | params [Expression] | provenance | |
162+
| clients3.js:12:20:17:5 | {\\n ... ,\\n } [Expression] | clients3.js:12:11:17:5 | params [Expression] | provenance | |
163+
| clients3.js:16:21:16:68 | "SELECT ... usInput | clients3.js:12:20:17:5 | {\\n ... ,\\n } [Expression] | provenance | |
164+
| clients3.js:16:55:16:68 | maliciousInput | clients3.js:16:21:16:68 | "SELECT ... usInput | provenance | |
165+
| clients3.js:18:54:18:59 | params [Expression] | clients3.js:18:23:18:60 | new Sel ... params) | provenance | |
166+
| clients3.js:23:9:23:40 | maliciousInput | clients3.js:29:55:29:68 | maliciousInput | provenance | |
167+
| clients3.js:23:9:23:40 | maliciousInput | clients3.js:38:55:38:68 | maliciousInput | provenance | |
168+
| clients3.js:23:26:23:33 | req.body | clients3.js:23:9:23:40 | maliciousInput | provenance | |
169+
| clients3.js:29:55:29:68 | maliciousInput | clients3.js:29:21:29:68 | "SELECT ... usInput | provenance | |
170+
| clients3.js:38:55:38:68 | maliciousInput | clients3.js:38:21:38:68 | "SELECT ... usInput | provenance | |
171+
| dynamodb.js:9:9:9:38 | maliciousInput | dynamodb.js:11:64:11:77 | maliciousInput | provenance | |
172+
| dynamodb.js:9:9:9:38 | maliciousInput | dynamodb.js:17:80:17:93 | maliciousInput | provenance | |
173+
| dynamodb.js:9:26:9:33 | req.body | dynamodb.js:9:9:9:38 | maliciousInput | provenance | |
174+
| dynamodb.js:11:11:11:80 | statement | dynamodb.js:13:20:13:28 | statement | provenance | |
175+
| dynamodb.js:11:64:11:77 | maliciousInput | dynamodb.js:11:11:11:80 | statement | provenance | |
176+
| dynamodb.js:12:11:14:6 | command | dynamodb.js:15:23:15:29 | command | provenance | |
177+
| dynamodb.js:12:11:14:6 | command | dynamodb.js:47:24:47:30 | command | provenance | |
178+
| dynamodb.js:12:21:14:6 | new Exe ... \\n }) | dynamodb.js:12:11:14:6 | command | provenance | |
179+
>>>>>>> 1af289cd7d4 (Added modeling of client-s3 v2 and v3)
154180
| dynamodb.js:12:49:14:5 | {\\n ... t\\n } [Statement] | dynamodb.js:12:21:14:6 | new Exe ... \\n }) | provenance | |
155181
| dynamodb.js:13:20:13:28 | statement | dynamodb.js:12:49:14:5 | {\\n ... t\\n } [Statement] | provenance | |
156182
| dynamodb.js:17:11:17:25 | updateStatement | dynamodb.js:19:20:19:34 | updateStatement | provenance | |
@@ -547,7 +573,25 @@ edges
547573
| tst4.js:8:46:8:60 | $routeParams.id | tst4.js:8:10:8:66 | 'SELECT ... d + '"' | provenance | |
548574
| tst.js:10:46:10:58 | req.params.id | tst.js:10:10:10:64 | 'SELECT ... d + '"' | provenance | |
549575
nodes
576+
<<<<<<< HEAD
550577
| dynamodb.js:9:9:9:22 | maliciousInput | semmle.label | maliciousInput |
578+
=======
579+
| clients3.js:10:9:10:40 | maliciousInput | semmle.label | maliciousInput |
580+
| clients3.js:10:26:10:33 | req.body | semmle.label | req.body |
581+
| clients3.js:12:11:17:5 | params [Expression] | semmle.label | params [Expression] |
582+
| clients3.js:12:20:17:5 | {\\n ... ,\\n } [Expression] | semmle.label | {\\n ... ,\\n } [Expression] |
583+
| clients3.js:16:21:16:68 | "SELECT ... usInput | semmle.label | "SELECT ... usInput |
584+
| clients3.js:16:55:16:68 | maliciousInput | semmle.label | maliciousInput |
585+
| clients3.js:18:23:18:60 | new Sel ... params) | semmle.label | new Sel ... params) |
586+
| clients3.js:18:54:18:59 | params [Expression] | semmle.label | params [Expression] |
587+
| clients3.js:23:9:23:40 | maliciousInput | semmle.label | maliciousInput |
588+
| clients3.js:23:26:23:33 | req.body | semmle.label | req.body |
589+
| clients3.js:29:21:29:68 | "SELECT ... usInput | semmle.label | "SELECT ... usInput |
590+
| clients3.js:29:55:29:68 | maliciousInput | semmle.label | maliciousInput |
591+
| clients3.js:38:21:38:68 | "SELECT ... usInput | semmle.label | "SELECT ... usInput |
592+
| clients3.js:38:55:38:68 | maliciousInput | semmle.label | maliciousInput |
593+
| dynamodb.js:9:9:9:38 | maliciousInput | semmle.label | maliciousInput |
594+
>>>>>>> 1af289cd7d4 (Added modeling of client-s3 v2 and v3)
551595
| dynamodb.js:9:26:9:33 | req.body | semmle.label | req.body |
552596
| dynamodb.js:11:11:11:19 | statement | semmle.label | statement |
553597
| dynamodb.js:11:64:11:77 | maliciousInput | semmle.label | maliciousInput |

‎javascript/ql/test/query-tests/Security/CWE-089/untyped/clients3.js‎

Lines changed: 5 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -7,26 +7,26 @@ const app = express();
77
app.use(bodyParser.json());
88

99
app.post('/client/v3/execute', async (req, res) => {
10-
let maliciousInput = req.body.filter; // $ MISSING: Source
10+
let maliciousInput = req.body.filter; // $ Source
1111
const client = new S3Client({ region: "us-east-1" });
1212
const params = {
1313
Bucket: "my-bucket",
1414
Key: "data.csv",
1515
ExpressionType: "SQL",
1616
Expression: "SELECT * FROM S3Object WHERE " + maliciousInput,
1717
};
18-
await client.send(new SelectObjectContentCommand(params)); // $ MISSING: Alert
18+
await client.send(new SelectObjectContentCommand(params)); // $ Alert
1919
res.end();
2020
});
2121

2222
app.post('/client/v2/execute', async (req, res) => {
23-
let maliciousInput = req.body.filter; // $ MISSING: Source
23+
let maliciousInput = req.body.filter; // $ Source
2424
const s3 = new AWS.S3({ region: "us-east-1" });
2525
const params = {
2626
Bucket: "my-bucket",
2727
Key: "data.csv",
2828
ExpressionType: "SQL",
29-
Expression: "SELECT * FROM S3Object WHERE " + maliciousInput, // $ MISSING: Alert
29+
Expression: "SELECT * FROM S3Object WHERE " + maliciousInput, // $ Alert
3030
};
3131
await s3.selectObjectContent(params).promise();
3232
res.end();
@@ -35,7 +35,7 @@ app.post('/client/v2/execute', async (req, res) => {
3535
Bucket: "my-bucket",
3636
Key: "data.csv",
3737
ExpressionType: "SQL",
38-
Expression: "SELECT * FROM S3Object WHERE " + maliciousInput, // $ MISSING: Alert
38+
Expression: "SELECT * FROM S3Object WHERE " + maliciousInput, // $ Alert
3939
};
4040

4141
s3.selectObjectContent(params1, (err, data) => {

0 commit comments

Comments
 (0)