Skip to content

Commit 4b2580a

Browse files
jeongsoolee09jeongsoolee09
authored
Merge pull request #144 from advanced-security/mbaluda/xsjs-access
Adds XSJS CSRF and authorization queries
2 parents 0c89db4 + 32e3e78 commit 4b2580a

File tree

15 files changed

+188
-1
lines changed

15 files changed

+188
-1
lines changed

‎.github/workflows/javascript.sarif.expected

Lines changed: 1 addition & 1 deletion
Large diffs are not rendered by default.

‎javascript/frameworks/xsjs/lib/advanced_security/javascript/frameworks/xsjs/Xsaccess.qll

Lines changed: 13 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,13 @@
1+
import javascript
2+
3+
class ExposedServiceAccessSpec extends File {
4+
ExposedServiceAccessSpec() {
5+
this.getBaseName() = "xs-app.json"
6+
or
7+
// we are only interested in exposed services
8+
this.getBaseName() = ".xsaccess" and
9+
exists(JsonValue v | this = v.getJsonFile() |
10+
v.getPropValue("exposed").getBooleanValue() = false
11+
)
12+
}
13+
}

‎javascript/frameworks/xsjs/src/XSJSAuthentication/XSJSAuthentication.md

Lines changed: 28 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,28 @@
1+
# Broken XSJS authentication
2+
3+
If you choose to use server-side JavaScript to write your application code, you need to bear in mind the potential for (and risk of) attack against authentication infrastructure. Leaks or flaws in the authentication or session management functions allow attackers to impersonate users and gain access to unauthorized systems and data.
4+
5+
## Recommendation
6+
7+
Use the built-in SAP HANA XS authentication mechanism and session management (cookies).
8+
- In `XS Advanced` authentication is enabled by default, the `authenticationMethod` property indicates which authentication will be applied. If set to `none` than all routes are not protected.
9+
- In `XS Classic` use the `authentication` keyword in the application's `.xsaccess` file to enable authentication and set it according to the method you want implement (`LogonTicket`, `Form`, or `Basic`) to ensure that all objects in the application path are available only to authenticated users.
10+
11+
## Example
12+
13+
The following `xs-app.json` fragment shows disabled XSJS authentication.
14+
15+
```json
16+
{
17+
"welcomeFile": "index.html",
18+
"authenticationMethod": "none",
19+
...
20+
}
21+
```
22+
23+
## References
24+
25+
* SAP: [Server-Side JavaScript Security Considerations](https://help.sap.com/docs/SAP_HANA_PLATFORM/d89d4595fae647eabc14002c0340a999/2040c1b7e478448cb9904c55ac06cac8.html).
26+
* XS Advanced: [Application Router Configuration](https://help.sap.com/docs/SAP_HANA_PLATFORM/4505d0bdaf4948449b7f7379d24d0f0d/5f77e58ec01b46f6b64ee1e2afe3ead7.html#authenticationmethod)
27+
* XS Classic: [Authentication](https://help.sap.com/docs/SAP_HANA_PLATFORM/b3d0daf2a98e49ada00bf31b7ca7a42e/a9fc5c220d744180850996e2f5d34d6c.html?version=2.0.03&locale=en-US#authentication)
28+
* Common Weakness Enumeration: [CWE-306](https://cwe.mitre.org/data/definitions/306.html).

‎javascript/frameworks/xsjs/src/XSJSAuthentication/XSJSAuthentication.ql

Lines changed: 38 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,38 @@
1+
/**
2+
* @name Broken XSJS authentication
3+
* @description Disabling XSJS authentication makes the application vulnerable to unauthorized access.
4+
* @kind problem
5+
* @problem.severity warning
6+
* @security-severity 7.5
7+
* @precision medium
8+
* @id js/xsjs-broken-authentication
9+
* @tags security
10+
* external/cwe/cwe-306
11+
*/
12+
13+
import javascript
14+
import advanced_security.javascript.frameworks.xsjs.Xsaccess
15+
16+
from JsonValue value, string msg
17+
where
18+
value.getJsonFile() instanceof ExposedServiceAccessSpec and
19+
(
20+
msg = "Authentication should not be disabled." and
21+
exists(JsonValue v |
22+
value = v.getPropValue(["authentication", "authenticationMethod", "authenticationType"])
23+
|
24+
value.getStringValue() = "none"
25+
or
26+
value instanceof JsonNull
27+
)
28+
or
29+
// the authentication specification is missing from .xsaccess
30+
msg = "Authentication is missing from the configuration." and
31+
value.isTopLevel() and
32+
value.getJsonFile().getBaseName() = ".xsaccess" and
33+
not exists(JsonValue p |
34+
p.getJsonFile() = value.getJsonFile() and
35+
exists(p.getPropValue("authentication"))
36+
)
37+
)
38+
select value, msg

‎javascript/frameworks/xsjs/src/XSJSCsrfDisabled/XSJSCsrfDisabled.md

Lines changed: 33 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,33 @@
1+
# Disabled XSJS CSRF protection
2+
3+
A web server that receives a request from a client without verifying that it was intentionally sent might be vulnerable to Cross Site Request Forgery (CSRF). An attacker can trick a client into making an unintended request to the web server that will be treated as an authentic request. This can be done via a URL, image load, XMLHttpRequest, etc. and can result in exposure of data or unintended code execution.
4+
5+
## Recommendation
6+
7+
SAP’s recommendation is to use CSRF protection for any request that could be processed by a browser client by normal users.
8+
- In `XS Advanced` CSRF protection is enabled by default and should not be disabled.
9+
- In `XS Classic` CSRF protection should be enabled explicitly.
10+
11+
## Example
12+
13+
The following `xs-app.json` fragment enables CSRF protection in XSJS.
14+
15+
```json
16+
"routes": [
17+
{
18+
"source": "/bad/(.*)",
19+
"destination": "srv_api",
20+
"csrfProtection": true,
21+
...
22+
}
23+
]
24+
...
25+
}
26+
]
27+
```
28+
29+
## References
30+
31+
* SAP: [Server-Side JavaScript Security Considerations](https://help.sap.com/docs/SAP_HANA_PLATFORM/d89d4595fae647eabc14002c0340a999/e8a6bc904c0c48a182288604f467e84a.html).
32+
* OWASP: [Cross-Site Request Forgery (CSRF)](https://www.owasp.org/index.php/Cross-Site_Request_Forgery_(CSRF)).
33+
* Common Weakness Enumeration: [CWE-352](https://cwe.mitre.org/data/definitions/352.html).

‎javascript/frameworks/xsjs/src/XSJSCsrfDisabled/XSJSCsrfDisabled.ql

Lines changed: 35 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,35 @@
1+
/**
2+
* @name Disabled XSJS CSRF protection
3+
* @description Disabling CSRF protection makes the application vulnerable to a Cross-Site Request Forgery (CSRF) attack.
4+
* @kind problem
5+
* @problem.severity error
6+
* @security-severity 8.8
7+
* @precision high
8+
* @id js/xsjs-disabled-csrf-protection
9+
* @tags security
10+
* external/cwe/cwe-352
11+
*/
12+
13+
import javascript
14+
import advanced_security.javascript.frameworks.xsjs.Xsaccess
15+
16+
from JsonValue value, string msg
17+
where
18+
value.getJsonFile() instanceof ExposedServiceAccessSpec and
19+
(
20+
msg = "CSRF protection should not be disabled." and
21+
exists(JsonValue v |
22+
value = v.getPropValue(["prevent_xsrf", "csrfProtection"]) and
23+
value.getBooleanValue() = false
24+
)
25+
or
26+
// the CSRF protection is missing from .xsaccess
27+
msg = "CSRF protection is missing from the configuration." and
28+
value.isTopLevel() and
29+
value.getJsonFile().getBaseName() = ".xsaccess" and
30+
not exists(JsonValue p |
31+
p.getJsonFile() = value.getJsonFile() and
32+
exists(p.getPropValue("prevent_xsrf"))
33+
)
34+
)
35+
select value, msg

‎javascript/frameworks/xsjs/test/queries/XSJSAccess/XSJSAuthentication.expected

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,4 @@
1+
| service/exposed/.xsaccess:3:23:3:26 | null | Authentication should not be disabled. |
2+
| service/missing_auth/.xsaccess:1:1:4:1 | {\\n " ... true\\n} | Authentication is missing from the configuration. |
3+
| service/xs-app.json:3:29:3:34 | "none" | Authentication should not be disabled. |
4+
| service/xs-app.json:15:35:15:40 | "none" | Authentication should not be disabled. |

‎javascript/frameworks/xsjs/test/queries/XSJSAccess/XSJSAuthentication.qlref

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1 @@
1+
XSJSAuthentication/XSJSAuthentication.ql

‎javascript/frameworks/xsjs/test/queries/XSJSAccess/XSJSCsrfDisabled.expected

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,2 @@
1+
| service/exposed/.xsaccess:1:1:4:1 | {\\n " ... null\\n} | CSRF protection is missing from the configuration. |
2+
| service/xs-app.json:14:31:14:35 | false | CSRF protection should not be disabled. |

‎javascript/frameworks/xsjs/test/queries/XSJSAccess/XSJSCsrfDisabled.qlref

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1 @@
1+
XSJSCsrfDisabled/XSJSCsrfDisabled.ql

‎javascript/frameworks/xsjs/test/queries/XSJSAccess/service/.xsaccess

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,5 @@
1+
{
2+
"exposed": true,
3+
"prevent_xsrf": false,
4+
"authentication": null
5+
}

‎javascript/frameworks/xsjs/test/queries/XSJSAccess/service/exposed/.xsaccess

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,4 @@
1+
{
2+
"exposed": false,
3+
"authentication": null
4+
}

‎javascript/frameworks/xsjs/test/queries/XSJSAccess/service/missing_auth/.xsaccess

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,4 @@
1+
{
2+
"exposed": false,
3+
"prevent_xsrf": true
4+
}

‎javascript/frameworks/xsjs/test/queries/XSJSAccess/service/service.xsjs

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1 @@
1+
var webRequest1 = $.request;

‎javascript/frameworks/xsjs/test/queries/XSJSAccess/service/xs-app.json

Lines changed: 18 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,18 @@
1+
{
2+
"welcomeFile": "index.html",
3+
"authenticationMethod": "none",
4+
"routes": [
5+
{
6+
"source": "/good/(.*)",
7+
"destination": "srv_api",
8+
"csrfProtection": true,
9+
"authenticationType": "xsuaa"
10+
},
11+
{
12+
"source": "/bad/(.*)",
13+
"destination": "srv_api",
14+
"csrfProtection": false,
15+
"authenticationType": "none"
16+
}
17+
]
18+
}

0 commit comments

Comments
 (0)