Skip to content
This repository was archived by the owner on Jan 5, 2023. It is now read-only.

Add CWE-79: HTML template escaping passthrough #493

Merged
smowton merged 20 commits into from
Apr 8, 2021
Merged

Add CWE-79: HTML template escaping passthrough #493

Changes from 1 commit
Commits
Show all changes
20 commits
Select commit Hold shift + click to select a range
4989434
Add CWE-79: HTML template escaping passthrough
gagliardetto Mar 3, 2021
63d5120
Apply suggestions from code review
gagliardetto Mar 4, 2021
ad91e4a
Remove DummySource
gagliardetto Mar 4, 2021
687e556
Fixes from code review
gagliardetto Mar 5, 2021
963631d
Improve naming.
gagliardetto Mar 8, 2021
7e9f23a
Refactor flow logic to ensure `untrusted` flows to `conversion`, and …
gagliardetto Mar 8, 2021
7b4a748
Remove DummySource
gagliardetto Mar 8, 2021
0bb5ef6
Fix test
gagliardetto Mar 8, 2021
cc31cd2
Fix test
gagliardetto Mar 8, 2021
d5355eb
Cleanup
gagliardetto Mar 8, 2021
b42d21f
Improve comments and naming.
gagliardetto Mar 8, 2021
5351a8e
Use TaintTracking an TaintTracking2
gagliardetto Mar 9, 2021
280ffdf
Fix test
gagliardetto Mar 9, 2021
e2b7c03
Use only one instance of TaintTracking.
gagliardetto Mar 11, 2021
8f124f8
Add missing docs
gagliardetto Mar 11, 2021
541c411
Add isSanitizer predicate to FlowConfFromUntrustedToTemplateExecution…
gagliardetto Mar 11, 2021
1a9b09e
Add NumericType sanitizer
gagliardetto Mar 24, 2021
dc95902
Apply suggestions from code review
gagliardetto Apr 1, 2021
7c35902
Use DataFlow::Node as parameters
gagliardetto Apr 1, 2021
68c0073
Use PassthroughTypeName instead of string
gagliardetto Apr 1, 2021
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
Prev Previous commit
Next Next commit
Use TaintTracking an TaintTracking2
  • Loading branch information
@gagliardetto @smowton
gagliardetto authored and smowton committed Apr 8, 2021
commit 5351a8eeb7143f75e3f1fda90cbd425418e4f833
16 changes: 8 additions & 8 deletions ql/src/experimental/CWE-79/HTMLTemplateEscapingPassthrough.ql
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -18,9 +18,9 @@ import DataFlow::PathGraph
* and `conversionSink` gets populated with the node where the conversion happens.
*/
predicate flowsFromUntrustedToConversion(
DataFlow::PathNode untrusted, string targetType, DataFlow::PathNode conversionSink
DataFlow::PathNode untrusted, string targetType, DataFlow2::PathNode conversionSink
) {
exists(FlowConfFromUntrustedToPassthroughTypeConversion cfg, DataFlow::PathNode source |
exists(FlowConfFromUntrustedToPassthroughTypeConversion cfg, DataFlow2::PathNode source |
cfg.hasFlowPath(source, conversionSink) and
source.getNode() = untrusted.getNode() and
targetType = cfg.getDstTypeName()
Expand All @@ -41,7 +41,7 @@ class PassthroughTypeName extends string {
* this allows the injection of arbitrary content (html, css, js) into the generated
* output of the templates.
*/
class FlowConfFromUntrustedToPassthroughTypeConversion extends TaintTracking::Configuration {
class FlowConfFromUntrustedToPassthroughTypeConversion extends TaintTracking2::Configuration {
string dstTypeName;

FlowConfFromUntrustedToPassthroughTypeConversion() {
Expand All @@ -68,11 +68,11 @@ class FlowConfFromUntrustedToPassthroughTypeConversion extends TaintTracking::Co
* Holds if the provided `conversion` node flows into the provided `execSink`.
*/
predicate flowsFromConversionToExec(
DataFlow::PathNode conversion, string targetType, DataFlow::PathNode execSink
DataFlow2::PathNode conversion, string targetType, DataFlow::PathNode execSink
) {
exists(
FlowConfPassthroughTypeConversionToTemplateExecutionCall cfg, DataFlow::PathNode source,
DataFlow::PathNode execSinkLocal
FlowConfPassthroughTypeConversionToTemplateExecutionCall cfg, DataFlow2::PathNode source,
DataFlow2::PathNode execSinkLocal
|
cfg.hasFlowPath(source, execSinkLocal) and
source.getNode() = conversion.getNode() and
Expand All @@ -85,7 +85,7 @@ predicate flowsFromConversionToExec(
* A taint-tracking configuration for reasoning about when the result of a conversion
* to a PassthroughType flows to a template execution call.
*/
class FlowConfPassthroughTypeConversionToTemplateExecutionCall extends TaintTracking::Configuration {
class FlowConfPassthroughTypeConversionToTemplateExecutionCall extends TaintTracking2::Configuration {
string dstTypeName;

FlowConfPassthroughTypeConversionToTemplateExecutionCall() {
Expand Down Expand Up @@ -147,7 +147,7 @@ predicate flowsFromUntrustedToExec(DataFlow::PathNode untrusted, DataFlow::PathN

from
DataFlow::PathNode untrustedSource, DataFlow::PathNode templateExecCall, string targetTypeName,
DataFlow::PathNode conversion
DataFlow2::PathNode conversion
where
// A = untrusted remote flow source
// B = conversion to PassthroughType
Expand Down