Skip to content

Commit 08f7b1b

Browse files
knewbury01knewbury01
authored
Merge pull request #207 from advanced-security/knewbury01/cap-sensitive-sources
Add sensitive exposure split query
2 parents 45e004a + 88848a4 commit 08f7b1b

File tree

5 files changed

+131
-0
lines changed

5 files changed

+131
-0
lines changed

‎javascript/frameworks/cap/src/sensitive-exposure/SensitiveExposureHeuristicSource.md

Lines changed: 44 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,44 @@
1+
# CAP Insertion of Sensitive Information into Log File
2+
3+
If sensitive information is written to a log entry using the CAP Node.js logging API, a malicious user may be able to gain access to user data.
4+
5+
Data that may expose system information such as full path names, system information, usernames and passwords should not be logged.
6+
7+
This query is similar to `js/cap-sensitive-log` in that the sinks are CAP logging facilities. The sources however are the same (exclusively) as the out of the box CodeQL query for [clear text logging](https://codeql.github.com/codeql-query-help/javascript/js-clear-text-logging/).
8+
9+
## Recommendation
10+
11+
CAP applications should not log sensitive information. Sensitive information can include: full path names, system information, usernames, passwords or any personally identifiable information. Make sure to log only information that is not sensitive, or obfuscate/encrypt sensitive information any time that it is logged.
12+
13+
## Examples
14+
15+
This CAP service directly logs the sensitive information. Potential attackers may gain access to this sensitive information when the log output is displayed or when the attacker gains access to the log, and the info is not obfuscated or encrypted.
16+
17+
``` javascript
18+
import cds from '@sap/cds'
19+
const LOG = cds.log("logger");
20+
21+
class SampleVulnService extends cds.ApplicationService {
22+
init() {
23+
LOG.info(`[INFO] Environment: ${JSON.stringify(process.env)}`); // CAP log exposure alert
24+
var obj = {
25+
x: password
26+
};
27+
28+
LOG.info(obj); // CAP log exposure alert
29+
30+
LOG.info(obj.x.replace(/./g, "*")); // NO CAP log exposure alert - replace call acts as sanitizer
31+
32+
var user = {
33+
password: encryptLib.encryptPassword(password)
34+
};
35+
LOG.info(user); // NO CAP log exposure alert - the data is encrypted
36+
}
37+
}
38+
```
39+
40+
## References
41+
42+
- OWASP 2021: [Security Logging and Monitoring Failures](https://owasp.org/Top10/A09_2021-Security_Logging_and_Monitoring_Failures/).
43+
- OWASP: [Logging Cheat Sheet](https://cheatsheetseries.owasp.org/cheatsheets/Logging_Cheat_Sheet.html).
44+
- OWASP: [User Privacy Protection Cheat Sheet](https://cheatsheetseries.owasp.org/cheatsheets/User_Privacy_Protection_Cheat_Sheet.html).

‎javascript/frameworks/cap/src/sensitive-exposure/SensitiveExposureHeuristicSource.ql

Lines changed: 48 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,48 @@
1+
/**
2+
* @name Insertion of sensitive information into log files
3+
* @description Writing heuristically sensitive information to log files can allow that
4+
* information to be leaked to an attacker more easily.
5+
* @kind path-problem
6+
* @problem.severity warning
7+
* @security-severity 7.5
8+
* @precision low
9+
* @id js/cap-sensitive-log-heurisitic-source
10+
* @tags security
11+
* external/cwe/cwe-532
12+
*/
13+
14+
import javascript
15+
import advanced_security.javascript.frameworks.cap.CDS
16+
import advanced_security.javascript.frameworks.cap.CAPLogInjectionQuery
17+
private import semmle.javascript.security.dataflow.CleartextLoggingCustomizations::CleartextLogging as CleartextLogging
18+
19+
module SensitiveLogExposureConfig implements DataFlow::ConfigSig {
20+
predicate isSource(DataFlow::Node source) { source instanceof CleartextLogging::Source }
21+
22+
predicate isSink(DataFlow::Node sink) { sink instanceof CdsLogSink }
23+
24+
predicate isAdditionalFlowStep(DataFlow::Node src, DataFlow::Node trg) {
25+
CleartextLogging::isAdditionalTaintStep(src, trg)
26+
}
27+
28+
predicate isBarrier(DataFlow::Node sink) { sink instanceof CleartextLogging::Barrier }
29+
30+
/**
31+
* This predicate is an intentional cartesian product of any sink node and any content that represents a property.
32+
* Normally Cartesian products are bad but in this case it is what we want, to capture all properties of objects that make their way to sinks.
33+
*/
34+
predicate allowImplicitRead(DataFlow::Node node, DataFlow::ContentSet contents) {
35+
// Assume all properties of a logged object are themselves logged.
36+
contents = DataFlow::ContentSet::anyProperty() and
37+
isSink(node)
38+
}
39+
}
40+
41+
module SensitiveLogExposureFlow = TaintTracking::Global<SensitiveLogExposureConfig>;
42+
43+
import SensitiveLogExposureFlow::PathGraph
44+
45+
from SensitiveLogExposureFlow::PathNode source, SensitiveLogExposureFlow::PathNode sink
46+
where SensitiveLogExposureFlow::flowPath(source, sink)
47+
select sink, source, sink, "This logs sensitive data returned by $@ as clear text.",
48+
source.getNode(), source.getNode().(CleartextLogging::Source).describe()

‎javascript/frameworks/cap/test/queries/sensitive-exposure/sensitive-exposure-js-all-sinks/sensitive-exposure-heuristic-source.expected

Lines changed: 18 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,18 @@
1+
edges
2+
| sensitive-exposure-heuristic-source.js:6:41:6:67 | JSON.st ... ss.env) | sensitive-exposure-heuristic-source.js:6:18:6:69 | `[INFO] ... .env)}` | provenance | |
3+
| sensitive-exposure-heuristic-source.js:6:56:6:66 | process.env | sensitive-exposure-heuristic-source.js:6:41:6:67 | JSON.st ... ss.env) | provenance | |
4+
| sensitive-exposure-heuristic-source.js:8:13:10:9 | obj [x] | sensitive-exposure-heuristic-source.js:11:18:11:20 | obj | provenance | |
5+
| sensitive-exposure-heuristic-source.js:8:19:10:9 | {\\n ... } [x] | sensitive-exposure-heuristic-source.js:8:13:10:9 | obj [x] | provenance | |
6+
| sensitive-exposure-heuristic-source.js:9:16:9:23 | password | sensitive-exposure-heuristic-source.js:8:19:10:9 | {\\n ... } [x] | provenance | |
7+
nodes
8+
| sensitive-exposure-heuristic-source.js:6:18:6:69 | `[INFO] ... .env)}` | semmle.label | `[INFO] ... .env)}` |
9+
| sensitive-exposure-heuristic-source.js:6:41:6:67 | JSON.st ... ss.env) | semmle.label | JSON.st ... ss.env) |
10+
| sensitive-exposure-heuristic-source.js:6:56:6:66 | process.env | semmle.label | process.env |
11+
| sensitive-exposure-heuristic-source.js:8:13:10:9 | obj [x] | semmle.label | obj [x] |
12+
| sensitive-exposure-heuristic-source.js:8:19:10:9 | {\\n ... } [x] | semmle.label | {\\n ... } [x] |
13+
| sensitive-exposure-heuristic-source.js:9:16:9:23 | password | semmle.label | password |
14+
| sensitive-exposure-heuristic-source.js:11:18:11:20 | obj | semmle.label | obj |
15+
subpaths
16+
#select
17+
| sensitive-exposure-heuristic-source.js:6:18:6:69 | `[INFO] ... .env)}` | sensitive-exposure-heuristic-source.js:6:56:6:66 | process.env | sensitive-exposure-heuristic-source.js:6:18:6:69 | `[INFO] ... .env)}` | This logs sensitive data returned by $@ as clear text. | sensitive-exposure-heuristic-source.js:6:56:6:66 | process.env | process environment |
18+
| sensitive-exposure-heuristic-source.js:11:18:11:20 | obj | sensitive-exposure-heuristic-source.js:9:16:9:23 | password | sensitive-exposure-heuristic-source.js:11:18:11:20 | obj | This logs sensitive data returned by $@ as clear text. | sensitive-exposure-heuristic-source.js:9:16:9:23 | password | an access to password |

‎javascript/frameworks/cap/test/queries/sensitive-exposure/sensitive-exposure-js-all-sinks/sensitive-exposure-heuristic-source.js

Lines changed: 20 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,20 @@
1+
import cds from '@sap/cds'
2+
const LOG = cds.log("logger");
3+
4+
class SampleVulnService extends cds.ApplicationService {
5+
init() {
6+
LOG.info(`[INFO] Environment: ${JSON.stringify(process.env)}`); // CAP log exposure alert
7+
8+
var obj = {
9+
x: password
10+
};
11+
LOG.info(obj); // CAP log exposure alert
12+
13+
LOG.info(obj.x.replace(/./g, "*")); // NO CAP log exposure alert - replace as sanitizer
14+
15+
var user = {
16+
password: encryptLib.encryptPassword(password)
17+
};
18+
LOG.info(user); // NO CAP log exposure alert - encrypted data is fine
19+
}
20+
}

‎javascript/frameworks/cap/test/queries/sensitive-exposure/sensitive-exposure-js-all-sinks/sensitive-exposure-heuristic-source.qlref

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1 @@
1+
sensitive-exposure/SensitiveExposureHeuristicSource.ql

0 commit comments

Comments
 (0)