Skip to content

[javascript] CodeQL query to detect Log Injection#3734

Merged
semmle-qlci merged 6 commits into
github:masterfrom
dellalibera:loginjection
Jun 25, 2020
Merged

[javascript] CodeQL query to detect Log Injection#3734
semmle-qlci merged 6 commits into
github:masterfrom
dellalibera:loginjection

Conversation

@dellalibera
Copy link
Copy Markdown
Contributor

@dellalibera dellalibera commented Jun 17, 2020 •
edited
Loading

Log Injection query is available in c# query but it is not available in javascript query.
I created a query to detect a log injection vulnerability in javascript code.

This query addresses the scenario where user controlled input is logged-as is.

Examples of scenarios detected:

const http = require('http');
const url = require('url');

const server = http.createServer((req, res) => {
    let q = url.parse(req.url, true);

    let username = q.query.username;
    console.info(`[INFO] User: ${username}`); // BAD

})

or

const http = require('http');
const url = require('url');

const logger = {
    log: console.log
}

const another_logger = console.log

const server = http.createServer((req, res) => {
    let q = url.parse(req.url, true);

    let username = q.query.username;
    logger.log('[INFO] User:', username); // BAD
    another_logger('[INFO] User:', username); // BAD
})

Any feedback is welcome.
I hope this will help.

@dellalibera dellalibera requested a review from a team as a code owner June 17, 2020 19:19
@dellalibera dellalibera mentioned this pull request Jun 17, 2020
Closed
1 task
Marcono1234
Marcono1234 reviewed Jun 17, 2020
View reviewed changes
Comment thread javascript/ql/src/experimental/Security/CWE-117/LogInjection.help Outdated
Comment thread javascript/ql/src/experimental/Security/CWE-117/LogInjection.qll Outdated
@asgerf
Copy link
Copy Markdown
Contributor

asgerf commented Jun 18, 2020 •
edited
Loading

Hi @dellalibera, thanks for the contribution! We'll take a closer look at the query next week.

dellalibera and others added 2 commits June 18, 2020 19:29
@dellalibera @Marcono1234
Update javascript/ql/src/experimental/Security/CWE-117/LogInjection.help
b4f2551 
Co-authored-by: Marcono1234 <Marcono1234@users.noreply.github.com>
@dellalibera @Marcono1234
Update javascript/ql/src/experimental/Security/CWE-117/LogInjection.qll
cc91026 
Co-authored-by: Marcono1234 <Marcono1234@users.noreply.github.com>
@esbena esbena self-assigned this Jun 22, 2020
esbena
esbena reviewed Jun 22, 2020
View reviewed changes
Copy link
Copy Markdown
Contributor

@esbena esbena left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Thank you for another contribution.
Since we already have the query for C#, I think this should be straight-forward to merge. I have two super-minor comments for you to consider.

Comment thread javascript/ql/src/experimental/Security/CWE-117/LogInjection.qll
this = node.getAPropertyRead(propName).getACall()
)
or
this = any(LoggerCall call)
Copy link
Copy Markdown
Contributor

@esbena esbena Jun 22, 2020

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This is mostly a comment.

This last conjunct should cover the two cases above if

codeql/javascript/ql/src/semmle/javascript/frameworks/Logging.qll

Line 57 in 7a5aae7

this = console().getAMethodCall(name)
was console().getAMemberCall(name).

(I think console.log used to require a binding with Function.prototype.bind in order for it to work when invoked as a non-method call, but that appears to have changed now).

Copy link
Copy Markdown
Contributor Author

@dellalibera dellalibera Jun 22, 2020

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Thank you for your review and feedback.

Yes, if it would be console().getAMemberCall(name) I could avoid the first case
this = any(ConsoleSource console).getAMemberCall(getAStandardLoggerMethodName())

but not the second one.

The second check

      exists(DataFlow::SourceNode node, string propName |
        any(ConsoleSource console).getAPropertyRead() = node.getAPropertySource(propName) and
        this = node.getAPropertyRead(propName).getACall()
      )

detects cases where the console.log (for example) is assigned to a property of another object.
For example, consider the following case:

const my_logger = {
    log: console.log
}
my_logger.log("hi")

Though the Logging.dll will be updated to console().getAMemberCall(name), I will still miss the above case (please, do not hesitate to correct me if I am wrong).

Copy link
Copy Markdown
Contributor

@esbena esbena Jun 23, 2020

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I have opened #3767 to address the first case, so lets drop that case in this PR.

For the second case, we have a bit better machinery for tracking special values of interest through properties and even calls ("type tracking"), but lets just keep the second case as is.
Let me know if you want to try out the "type tracking" feature later.

Copy link
Copy Markdown
Contributor Author

@dellalibera dellalibera Jun 24, 2020 •
edited
Loading

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Sorry for the late reply and thank you again for your feedback.
I am really happy that I inspire the other PR. Since now it is merged, I remove the first case, and leave as is the second one.

Let me know if there is something else I can do.

About the "type tracking" feature is something that I will investigate.

Comment thread javascript/ql/src/experimental/Security/CWE-117/LogInjection.qll Outdated
@dellalibera @esbena
Update javascript/ql/src/experimental/Security/CWE-117/LogInjection.qll
a759905 
Co-authored-by: Esben Sparre Andreasen <esbena@github.com>
@esbena esbena mentioned this pull request Jun 23, 2020
Merged
esbena
esbena approved these changes Jun 25, 2020
View reviewed changes
Copy link
Copy Markdown
Contributor

@esbena esbena left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Thanks. I will merge when the tests go green.

@semmle-qlci semmle-qlci merged commit b24fba8 into github:master Jun 25, 2020
@esbena esbena mentioned this pull request Jun 25, 2020
Merged
@dellalibera
Copy link
Copy Markdown
Contributor Author

dellalibera commented Jun 25, 2020

Thanks @esbena. I am really happy that this PR is merged!

@dellalibera dellalibera mentioned this pull request Jun 26, 2020
Merged
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@esbena esbena esbena approved these changes

+1 more reviewer

@Marcono1234 Marcono1234 Marcono1234 left review comments

Reviewers whose approvals may not affect merge requirements

Assignees

@esbena esbena

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

5 participants

@dellalibera @asgerf @esbena @Marcono1234 @semmle-qlci