Skip to content

Commit ff8f4a5

Browse files
jeongsoolee09jeongsoolee09
authored
Merge pull request #116 from advanced-security/jeongsoolee09/log-injection-fortified
Add two log injection applications with custom listeners
2 parents 23aadaf + 91a1d61 commit ff8f4a5

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

49 files changed

+2837
-17319
lines changed

‎.github/workflows/code_scanning.yml

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -56,11 +56,18 @@ jobs:
5656
done
5757
5858
# Initializes the CodeQL tools for scanning.
59+
- name: Extract version from qlt.conf.json
60+
uses: sergeysova/jq-action@v2
61+
id: version
62+
with:
63+
cmd: 'jq .CodeQLCLIBundle qlt.conf.json -r'
64+
5965
- name: Initialize CodeQL
6066
uses: github/codeql-action/init@v3
6167
with:
6268
languages: javascript
6369
config-file: ./.github/codeql/codeql-config.yaml
70+
tools: https://github.com/github/codeql-action/releases/download/${{steps.version.outputs.value}}/codeql-bundle-linux64.tar.gz
6471
debug: true
6572

6673
- name: Perform CodeQL Analysis

‎.github/workflows/javascript.sarif.expected

Lines changed: 2436 additions & 17183 deletions
Large diffs are not rendered by default.

‎javascript/frameworks/cap/ext/qlpack.yml

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -3,7 +3,7 @@ library: true
33
name: advanced-security/javascript-sap-cap-models
44
version: 0.2.0
55
extensionTargets:
6-
codeql/javascript-all: "^0.8.7"
7-
codeql/javascript-queries: "^0.8.7"
6+
codeql/javascript-all: "^0.9.1"
7+
codeql/javascript-queries: "^0.8.16"
88
dataExtensions:
9-
- "*.model.yml"
9+
- "*.model.yml"

‎javascript/frameworks/cap/lib/codeql-pack.lock.yml

Lines changed: 11 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -2,21 +2,23 @@
22
lockVersion: 1.0.0
33
dependencies:
44
codeql/dataflow:
5-
version: 0.1.7
5+
version: 0.2.7
66
codeql/javascript-all:
7-
version: 0.8.7
7+
version: 0.9.1
88
codeql/mad:
9-
version: 0.2.7
9+
version: 0.2.16
1010
codeql/regex:
11-
version: 0.2.7
11+
version: 0.2.16
1212
codeql/ssa:
13-
version: 0.2.7
13+
version: 0.2.16
1414
codeql/tutorial:
15-
version: 0.2.7
15+
version: 0.2.16
1616
codeql/typetracking:
17-
version: 0.2.7
17+
version: 0.2.16
1818
codeql/util:
19-
version: 0.2.7
19+
version: 0.2.16
20+
codeql/xml:
21+
version: 0.0.3
2022
codeql/yaml:
21-
version: 0.2.7
23+
version: 0.2.16
2224
compiled: false

‎javascript/frameworks/cap/lib/qlpack.yml

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -5,5 +5,5 @@ version: 0.2.0
55
suites: codeql-suites
66
extractor: javascript
77
dependencies:
8-
codeql/javascript-all: "^0.8.7"
8+
codeql/javascript-all: "^0.9.1"
99
advanced-security/javascript-sap-cap-models: "^0.2.0"

‎javascript/frameworks/cap/src/codeql-pack.lock.yml

Lines changed: 11 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -2,21 +2,23 @@
22
lockVersion: 1.0.0
33
dependencies:
44
codeql/dataflow:
5-
version: 0.1.7
5+
version: 0.2.7
66
codeql/javascript-all:
7-
version: 0.8.7
7+
version: 0.9.1
88
codeql/mad:
9-
version: 0.2.7
9+
version: 0.2.16
1010
codeql/regex:
11-
version: 0.2.7
11+
version: 0.2.16
1212
codeql/ssa:
13-
version: 0.2.7
13+
version: 0.2.16
1414
codeql/tutorial:
15-
version: 0.2.7
15+
version: 0.2.16
1616
codeql/typetracking:
17-
version: 0.2.7
17+
version: 0.2.16
1818
codeql/util:
19-
version: 0.2.7
19+
version: 0.2.16
20+
codeql/xml:
21+
version: 0.0.3
2022
codeql/yaml:
21-
version: 0.2.7
23+
version: 0.2.16
2224
compiled: false

‎javascript/frameworks/cap/src/qlpack.yml

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -5,7 +5,7 @@ version: 0.2.0
55
suites: codeql-suites
66
extractor: javascript
77
dependencies:
8-
codeql/javascript-all: "^0.8.7"
8+
codeql/javascript-all: "^0.9.1"
99
advanced-security/javascript-sap-cap-models: "^0.2.0"
1010
advanced-security/javascript-sap-cap-all: "^0.2.0"
11-
default-suite-file: codeql-suites/javascript-code-scanning.qls
11+
default-suite-file: codeql-suites/javascript-code-scanning.qls

‎javascript/frameworks/cap/test/codeql-pack.lock.yml

Lines changed: 14 additions & 12 deletions
Original file line numberDiff line numberDiff line change
@@ -2,27 +2,29 @@
22
lockVersion: 1.0.0
33
dependencies:
44
codeql/dataflow:
5-
version: 0.1.7
5+
version: 0.2.7
66
codeql/javascript-all:
7-
version: 0.8.7
7+
version: 0.9.1
88
codeql/javascript-queries:
9-
version: 0.8.7
9+
version: 0.8.16
1010
codeql/mad:
11-
version: 0.2.7
11+
version: 0.2.16
1212
codeql/regex:
13-
version: 0.2.7
13+
version: 0.2.16
1414
codeql/ssa:
15-
version: 0.2.7
15+
version: 0.2.16
1616
codeql/suite-helpers:
17-
version: 0.7.7
17+
version: 0.7.16
1818
codeql/tutorial:
19-
version: 0.2.7
19+
version: 0.2.16
2020
codeql/typetracking:
21-
version: 0.2.7
21+
version: 0.2.16
2222
codeql/typos:
23-
version: 0.2.7
23+
version: 0.2.16
2424
codeql/util:
25-
version: 0.2.7
25+
version: 0.2.16
26+
codeql/xml:
27+
version: 0.0.3
2628
codeql/yaml:
27-
version: 0.2.7
29+
version: 0.2.16
2830
compiled: false

‎javascript/frameworks/cap/test/qlpack.yml

Lines changed: 6 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -1,10 +1,10 @@
11
---
22
name: advanced-security/javascript-sap-cap-queries-tests
3-
version: 0.1.0
3+
version: 0.2.0
44
extractor: javascript
55
dependencies:
6-
codeql/javascript-all: "^0.8.7"
7-
codeql/javascript-queries: "^0.8.7"
8-
advanced-security/javascript-sap-cap-queries: "^0.1.0"
9-
advanced-security/javascript-sap-cap-models: "^0.1.0"
10-
advanced-security/javascript-sap-cap-all: "^0.1.0"
6+
codeql/javascript-all: "^0.9.1"
7+
codeql/javascript-queries: "^0.8.16"
8+
advanced-security/javascript-sap-cap-queries: "^0.2.0"
9+
advanced-security/javascript-sap-cap-models: "^0.2.0"
10+
advanced-security/javascript-sap-cap-all: "^0.2.0"

‎javascript/frameworks/ui5/ext/qlpack.yml

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -3,6 +3,6 @@ library: true
33
name: advanced-security/javascript-sap-ui5-models
44
version: 0.6.0
55
extensionTargets:
6-
codeql/javascript-all: "^0.8.7"
6+
codeql/javascript-all: "^0.9.1"
77
dataExtensions:
88
- "*.model.yml"

‎javascript/frameworks/ui5/lib/advanced_security/javascript/frameworks/ui5/BindingStringParser.qll

Lines changed: 6 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -2,7 +2,8 @@ import javascript as stdlib
22

33
signature class BindingStringReaderSig {
44
string getBindingString();
5-
stdlib::Location getLocation();
5+
6+
stdlib::DbLocation getLocation();
67

78
// Get a dataflow node associated with the binding string, if any.
89
// Note that not all location from which we can obtain a binding string
@@ -51,7 +52,8 @@ module BindingStringParser<BindingStringReaderSig BindingStringReader> {
5152
value = ":"
5253
} or
5354
MkNumberToken(int begin, int end, string value, BindingStringReader reader) {
54-
value = reader.getBindingString().regexpFind("-?[1-9]\\d*(\\.\\d+)?((e|E)?(\\+|-)?\\d+)?", _, begin) and
55+
value =
56+
reader.getBindingString().regexpFind("-?[1-9]\\d*(\\.\\d+)?((e|E)?(\\+|-)?\\d+)?", _, begin) and
5557
begin + value.length() - 1 = end
5658
} or
5759
MkStringToken(int begin, int end, string value, BindingStringReader reader) {
@@ -95,9 +97,9 @@ module BindingStringParser<BindingStringReaderSig BindingStringReader> {
9597
.getBindingString()
9698
.regexpFind("(?:#|#@)?(?:[a-zA-Z][a-zA-Z0-9_]*|[a-zA-Z0-9][a-zA-Z0-9_]:[a-zA-Z0-9_]+)(?:\\([^\\)]*\\))?",
9799
_, begin) and
98-
begin + value.length() - 1 = end
100+
begin + value.length() - 1 = end and
99101
// exclude keyword
100-
and not value in ["true", "false", "null"]
102+
not value in ["true", "false", "null"]
101103
} or
102104
MkGreaterThanToken(int begin, int end, string value, BindingStringReader reader) {
103105
begin = reader.getBindingString().indexOf(">") and

‎javascript/frameworks/ui5/lib/advanced_security/javascript/frameworks/ui5/Bindings.qll

Lines changed: 5 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -60,7 +60,7 @@ private class BindingStringReader extends TBindingString {
6060
)
6161
}
6262

63-
Location getLocation() {
63+
DbLocation getLocation() {
6464
exists(StringLiteral stringLiteral |
6565
this = TBindingStringFromLiteral(stringLiteral) and
6666
result = stringLiteral.getLocation()
@@ -221,10 +221,10 @@ private predicate earlyPropertyBinding(
221221
or
222222
// Composite binding https://ui5.sap.com/#/topic/a2fe8e763014477e87990ff50657a0d0
223223
exists(
224-
DataFlow::ObjectLiteralNode objectLiteral,
225-
DataFlow::ObjectLiteralNode valueLiteral, DataFlow::PropWrite partWrite,
226-
DataFlow::ArrayLiteralNode partsArray, DataFlow::ObjectLiteralNode partsElement,
227-
DataFlow::PropWrite pathWrite, DataFlow::ValueNode pathValue
224+
DataFlow::ObjectLiteralNode objectLiteral, DataFlow::ObjectLiteralNode valueLiteral,
225+
DataFlow::PropWrite partWrite, DataFlow::ArrayLiteralNode partsArray,
226+
DataFlow::ObjectLiteralNode partsElement, DataFlow::PropWrite pathWrite,
227+
DataFlow::ValueNode pathValue
228228
|
229229
objectLiteral.getAPropertyWrite() = bindingTarget and
230230
bindingTarget.writes(_, "value", binding) and

‎javascript/frameworks/ui5/lib/advanced_security/javascript/frameworks/ui5/RemoteFlowSources.qll

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -7,7 +7,7 @@ private class DataFromRemoteControlReference extends RemoteFlowSource, MethodCal
77
DataFromRemoteControlReference() {
88
exists(UI5Control sourceControl, string typeAlias, ControlReference controlReference |
99
ApiGraphModelsExtensions::typeModel(typeAlias, sourceControl.getImportPath(), _) and
10-
ApiGraphModelsExtensions::sourceModel(typeAlias, _, "remote") and
10+
ApiGraphModelsExtensions::sourceModel(typeAlias, _, "remote", _) and
1111
sourceControl.getAReference() = controlReference and
1212
controlReference.flowsTo(this.getReceiver()) and
1313
this.getMethodName() = "getValue"

‎javascript/frameworks/ui5/lib/advanced_security/javascript/frameworks/ui5/UI5View.qll

Lines changed: 9 additions & 13 deletions
Original file line numberDiff line numberDiff line change
@@ -182,10 +182,6 @@ abstract class UI5BindingPath extends BindingPath {
182182

183183
class XmlControlProperty extends XmlAttribute {
184184
XmlControlProperty() { exists(UI5Control control | this.getElement() = control.asXmlControl()) }
185-
186-
override string getName() { result = XmlAttribute.super.getName() }
187-
188-
override string getValue() { result = XmlAttribute.super.getValue() }
189185
}
190186

191187
bindingset[qualifiedTypeUri]
@@ -333,7 +329,7 @@ class JsView extends UI5View {
333329
exists(DataFlow::ObjectLiteralNode control, string type, string path, string property |
334330
this = control.getFile() and
335331
type = result.getControlTypeName() and
336-
ApiGraphModelsExtensions::sourceModel(getASuperType(type), path, "remote") and
332+
ApiGraphModelsExtensions::sourceModel(getASuperType(type), path, "remote", _) and
337333
property = path.replaceAll(" ", "").regexpCapture("Member\\[([^\\]]+)\\]", 1) and
338334
result.getBinding().getBindingTarget().asDataFlowNode() = control.getAPropertyWrite(property)
339335
)
@@ -343,7 +339,7 @@ class JsView extends UI5View {
343339
exists(DataFlow::ObjectLiteralNode control, string type, string path, string property |
344340
this = control.getFile() and
345341
type = result.getControlTypeName() and
346-
ApiGraphModelsExtensions::sinkModel(getASuperType(type), path, "ui5-html-injection") and
342+
ApiGraphModelsExtensions::sinkModel(getASuperType(type), path, "ui5-html-injection", _) and
347343
property = path.replaceAll(" ", "").regexpCapture("Member\\[([^\\]]+)\\]", 1) and
348344
result.getBinding().getBindingTarget().asDataFlowNode() = control.getAPropertyWrite(property)
349345
)
@@ -386,7 +382,7 @@ class JsonView extends UI5View {
386382
exists(JsonObject control, string type, string path, string property |
387383
root = control.getParent+() and
388384
type = result.getControlTypeName() and
389-
ApiGraphModelsExtensions::sourceModel(getASuperType(type), path, "remote") and
385+
ApiGraphModelsExtensions::sourceModel(getASuperType(type), path, "remote", _) and
390386
property = path.replaceAll(" ", "").regexpCapture("Member\\[([^\\]]+)\\]", 1) and
391387
result.getBindingTarget() = control
392388
)
@@ -396,7 +392,7 @@ class JsonView extends UI5View {
396392
exists(JsonObject control, string type, string path, string property |
397393
root = control.getParent+() and
398394
type = result.getControlTypeName() and
399-
ApiGraphModelsExtensions::sinkModel(getASuperType(type), path, "ui5-html-injection") and
395+
ApiGraphModelsExtensions::sinkModel(getASuperType(type), path, "ui5-html-injection", _) and
400396
property = path.replaceAll(" ", "").regexpCapture("Member\\[([^\\]]+)\\]", 1) and
401397
result.getBindingTarget() = control
402398
)
@@ -537,7 +533,7 @@ class HtmlView extends UI5View, HTML::HtmlFile {
537533
exists(HTML::Element control, string type, string path, string property |
538534
this = control.getFile() and
539535
type = result.getControlTypeName() and
540-
ApiGraphModelsExtensions::sourceModel(getASuperType(type), path, "remote") and
536+
ApiGraphModelsExtensions::sourceModel(getASuperType(type), path, "remote", _) and
541537
property = path.replaceAll(" ", "").regexpCapture("Member\\[([^\\]]+)\\]", 1) and
542538
result.getBindingTarget() = control.getAttributeByName("data-" + property)
543539
)
@@ -547,7 +543,7 @@ class HtmlView extends UI5View, HTML::HtmlFile {
547543
exists(HTML::Element control, string type, string path, string property |
548544
this = control.getFile() and
549545
type = result.getControlTypeName() and
550-
ApiGraphModelsExtensions::sinkModel(getASuperType(type), path, "ui5-html-injection") and
546+
ApiGraphModelsExtensions::sinkModel(getASuperType(type), path, "ui5-html-injection", _) and
551547
property = path.replaceAll(" ", "").regexpCapture("Member\\[([^\\]]+)\\]", 1) and
552548
result.getBindingTarget() = control.getAttributeByName("data-" + property)
553549
)
@@ -638,7 +634,7 @@ class XmlRootElement extends XmlElement {
638634
}
639635
}
640636

641-
class XmlView extends UI5View, XmlFile {
637+
class XmlView extends UI5View instanceof XmlFile {
642638
XmlRootElement root;
643639

644640
XmlView() {
@@ -663,7 +659,7 @@ class XmlView extends UI5View, XmlFile {
663659
exists(XmlElement control, string type, string path, string property |
664660
this = control.getFile() and
665661
type = result.getControlTypeName() and
666-
ApiGraphModelsExtensions::sourceModel(getASuperType(type), path, "remote") and
662+
ApiGraphModelsExtensions::sourceModel(getASuperType(type), path, "remote", _) and
667663
property = path.replaceAll(" ", "").regexpCapture("Member\\[([^\\]]+)\\]", 1) and
668664
result.getBindingTarget() = control.getAttribute(property)
669665
)
@@ -673,7 +669,7 @@ class XmlView extends UI5View, XmlFile {
673669
exists(XmlElement control, string type, string path, string property |
674670
this = control.getFile() and
675671
type = result.getControlTypeName() and
676-
ApiGraphModelsExtensions::sinkModel(getASuperType(type), path, "ui5-html-injection") and
672+
ApiGraphModelsExtensions::sinkModel(getASuperType(type), path, "ui5-html-injection", _) and
677673
property = path.replaceAll(" ", "").regexpCapture("Member\\[([^\\]]+)\\]", 1) and
678674
result.getBindingTarget() = control.getAttribute(property) and
679675
/* If the control is an `sap.ui.core.HTML` then the control should be missing the `sanitizeContent` attribute */

‎javascript/frameworks/ui5/lib/codeql-pack.lock.yml

Lines changed: 11 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -2,21 +2,23 @@
22
lockVersion: 1.0.0
33
dependencies:
44
codeql/dataflow:
5-
version: 0.1.7
5+
version: 0.2.7
66
codeql/javascript-all:
7-
version: 0.8.7
7+
version: 0.9.1
88
codeql/mad:
9-
version: 0.2.7
9+
version: 0.2.16
1010
codeql/regex:
11-
version: 0.2.7
11+
version: 0.2.16
1212
codeql/ssa:
13-
version: 0.2.7
13+
version: 0.2.16
1414
codeql/tutorial:
15-
version: 0.2.7
15+
version: 0.2.16
1616
codeql/typetracking:
17-
version: 0.2.7
17+
version: 0.2.16
1818
codeql/util:
19-
version: 0.2.7
19+
version: 0.2.16
20+
codeql/xml:
21+
version: 0.0.3
2022
codeql/yaml:
21-
version: 0.2.7
23+
version: 0.2.16
2224
compiled: false

‎javascript/frameworks/ui5/lib/qlpack.yml

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -5,5 +5,5 @@ version: 0.6.0
55
suites: codeql-suites
66
extractor: javascript
77
dependencies:
8-
codeql/javascript-all: "^0.8.7"
8+
codeql/javascript-all: "^0.9.1"
99
advanced-security/javascript-sap-ui5-models: "^0.6.0"

0 commit comments

Comments
 (0)