JS: add typeof sanitizer to js/shell-command-constructed-from-input #4862
Conversation
esbena
left a comment
esbena
left a comment
There was a problem hiding this comment.
The idea seems fine, I have a few suggestions.
.../ql/src/semmle/javascript/security/dataflow/UnsafeShellCommandConstructionCustomizations.qll
Outdated
Show resolved
Hide resolved
| * A check of the form `type x === "X"`, where x is "number", or "boolean", | ||
| * which sanitized `x` in its "then" branch. | ||
| */ | ||
| class TypeOfSanitizer extends TaintTracking::SanitizerGuardNode, DataFlow::ValueNode { |
There was a problem hiding this comment.
(It could be useful to have this as a public class in TaintTracking.qll, perhaps configurable. UnsafeJQueryPluginCustomizations could also use it in its treatment of typeof guards.)
There was a problem hiding this comment.
Turns out we have a lot of places with a typeof guard.
I made a TaintTracking::isTypeofGuard predicate, and used that throughout our project.
There was a problem hiding this comment.
great initiative. Lets wait proper performance evaluation of that change then.
There was a problem hiding this comment.
| exists(StringLiteral str, TypeofExpr typeof | astNode.hasOperands(str, typeof) | | ||
| str.getValue() = ["number", "boolean"] and // "undefined" is already handled in TaintTracking.qll | ||
| typeof.getOperand() = x |
There was a problem hiding this comment.
A slightly more general and robust formulation is found here:
…ellCommandConstructionCustomizations.qll Co-authored-by: Esben Sparre Andreasen <esbena@github.com>
| str.getValue() = ["number", "boolean"] and // "undefined" is already handled in TaintTracking.qll | ||
| exists(Expr str, TypeofExpr typeof | astNode.hasOperands(str, typeof) | | ||
| str.mayHaveStringValue(any(InferredType t | | ||
| t = TTUndefined() or t = TTNumber() or t = TTBoolean() |
There was a problem hiding this comment.
TTUndefined causes this to be out of sync with the qldoc above - I will let you decide on the solution.
There was a problem hiding this comment.
I removed it from the list.
TaintTracking::TypeOfUndefinedSanitizer takes care of that case.
erik-krogh
force-pushed
the
shellSanitizer
branch
from
009afa7 to
530a4ae
Compare
esbena
added
the
Awaiting evaluation
|
Minor: the many string constants that f7f8868 motivates seem a bit dangerous, the stringiness of |
I want to keep the string constants. |
erik-krogh
removed
the
Awaiting evaluation
|
Looks fine https://git.semmle.com/erik/dist-compare-reports/tree/eriks-profile-machine_1608843110557 |
3 participants
Fixes an FP that was found while looking into CVE-2020-7781.