Skip to content
This repository was archived by the owner on Jan 5, 2023. It is now read-only.

Add CWE-79: HTML template escaping passthrough #493

Merged
smowton merged 20 commits into from
Apr 8, 2021
Merged

Add CWE-79: HTML template escaping passthrough #493

Show file tree
Hide file tree
Changes from 1 commit
Commits
Show all changes
20 commits
Select commit Hold shift + click to select a range
4989434
Add CWE-79: HTML template escaping passthrough
gagliardetto Mar 3, 2021
63d5120
Apply suggestions from code review
gagliardetto Mar 4, 2021
ad91e4a
Remove DummySource
gagliardetto Mar 4, 2021
687e556
Fixes from code review
gagliardetto Mar 5, 2021
963631d
Improve naming.
gagliardetto Mar 8, 2021
7e9f23a
Refactor flow logic to ensure `untrusted` flows to `conversion`, and …
gagliardetto Mar 8, 2021
7b4a748
Remove DummySource
gagliardetto Mar 8, 2021
0bb5ef6
Fix test
gagliardetto Mar 8, 2021
cc31cd2
Fix test
gagliardetto Mar 8, 2021
d5355eb
Cleanup
gagliardetto Mar 8, 2021
b42d21f
Improve comments and naming.
gagliardetto Mar 8, 2021
5351a8e
Use TaintTracking an TaintTracking2
gagliardetto Mar 9, 2021
280ffdf
Fix test
gagliardetto Mar 9, 2021
e2b7c03
Use only one instance of TaintTracking.
gagliardetto Mar 11, 2021
8f124f8
Add missing docs
gagliardetto Mar 11, 2021
541c411
Add isSanitizer predicate to FlowConfFromUntrustedToTemplateExecution…
gagliardetto Mar 11, 2021
1a9b09e
Add NumericType sanitizer
gagliardetto Mar 24, 2021
dc95902
Apply suggestions from code review
gagliardetto Apr 1, 2021
7c35902
Use DataFlow::Node as parameters
gagliardetto Apr 1, 2021
68c0073
Use PassthroughTypeName instead of string
gagliardetto Apr 1, 2021
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
Prev Previous commit
Next Next commit
Add isSanitizer predicate to FlowConfFromUntrustedToTemplateExecution… 
…Call, and a test for it
  • Loading branch information
@gagliardetto @smowton
gagliardetto authored and smowton committed Apr 8, 2021
commit 541c41108657c3c05ff293ef0ec0d481c1a2d3c1
4 changes: 4 additions & 0 deletions ql/src/experimental/CWE-79/HTMLTemplateEscapingPassthrough.ql
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -142,6 +142,10 @@ class FlowConfFromUntrustedToTemplateExecutionCall extends TaintTracking::Config
override predicate isSource(DataFlow::Node source) { source instanceof UntrustedFlowSource }

override predicate isSink(DataFlow::Node sink) { isSinkToTemplateExec(sink, _) }

override predicate isSanitizer(DataFlow::Node sanitizer) {
sanitizer instanceof SharedXss::Sanitizer
}
}

/**
Expand Down
24 changes: 24 additions & 0 deletions ql/test/experimental/CWE-79/HTMLTemplateEscapingPassthrough.expected
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -92,6 +92,14 @@ edges
| HTMLTemplateEscapingPassthrough.go:74:17:74:31 | call to UserAgent : string | HTMLTemplateEscapingPassthrough.go:75:38:75:44 | escaped |
| HTMLTemplateEscapingPassthrough.go:80:10:80:24 | call to UserAgent : string | HTMLTemplateEscapingPassthrough.go:81:16:81:33 | type conversion |
| HTMLTemplateEscapingPassthrough.go:80:10:80:24 | call to UserAgent : string | HTMLTemplateEscapingPassthrough.go:83:38:83:40 | src |
| HTMLTemplateEscapingPassthrough.go:88:10:88:24 | call to UserAgent : string | HTMLTemplateEscapingPassthrough.go:90:16:90:77 | type conversion |
| HTMLTemplateEscapingPassthrough.go:90:16:90:77 | type conversion : HTML | HTMLTemplateEscapingPassthrough.go:91:38:91:46 | converted |
| HTMLTemplateEscapingPassthrough.go:90:16:90:77 | type conversion : HTML | HTMLTemplateEscapingPassthrough.go:91:38:91:46 | converted |
| HTMLTemplateEscapingPassthrough.go:90:16:90:77 | type conversion : HTML | HTMLTemplateEscapingPassthrough.go:91:38:91:46 | converted |
| HTMLTemplateEscapingPassthrough.go:90:16:90:77 | type conversion : HTML | HTMLTemplateEscapingPassthrough.go:91:38:91:46 | converted |
| HTMLTemplateEscapingPassthrough.go:90:16:90:77 | type conversion : HTML | HTMLTemplateEscapingPassthrough.go:91:38:91:46 | converted |
| HTMLTemplateEscapingPassthrough.go:90:16:90:77 | type conversion : HTML | HTMLTemplateEscapingPassthrough.go:91:38:91:46 | converted |
| HTMLTemplateEscapingPassthrough.go:90:16:90:77 | type conversion : HTML | HTMLTemplateEscapingPassthrough.go:91:38:91:46 | converted |
nodes
| HTMLTemplateEscapingPassthrough.go:28:12:28:41 | type conversion | semmle.label | type conversion |
| HTMLTemplateEscapingPassthrough.go:28:12:28:41 | type conversion : HTML | semmle.label | type conversion : HTML |
Expand Down Expand Up @@ -270,6 +278,22 @@ nodes
| HTMLTemplateEscapingPassthrough.go:80:10:80:24 | call to UserAgent : string | semmle.label | call to UserAgent : string |
| HTMLTemplateEscapingPassthrough.go:81:16:81:33 | type conversion | semmle.label | type conversion |
| HTMLTemplateEscapingPassthrough.go:83:38:83:40 | src | semmle.label | src |
| HTMLTemplateEscapingPassthrough.go:88:10:88:24 | call to UserAgent : string | semmle.label | call to UserAgent : string |
| HTMLTemplateEscapingPassthrough.go:90:16:90:77 | type conversion | semmle.label | type conversion |
| HTMLTemplateEscapingPassthrough.go:90:16:90:77 | type conversion : HTML | semmle.label | type conversion : HTML |
| HTMLTemplateEscapingPassthrough.go:90:16:90:77 | type conversion : HTML | semmle.label | type conversion : HTML |
| HTMLTemplateEscapingPassthrough.go:90:16:90:77 | type conversion : HTML | semmle.label | type conversion : HTML |
| HTMLTemplateEscapingPassthrough.go:90:16:90:77 | type conversion : HTML | semmle.label | type conversion : HTML |
| HTMLTemplateEscapingPassthrough.go:90:16:90:77 | type conversion : HTML | semmle.label | type conversion : HTML |
| HTMLTemplateEscapingPassthrough.go:90:16:90:77 | type conversion : HTML | semmle.label | type conversion : HTML |
| HTMLTemplateEscapingPassthrough.go:90:16:90:77 | type conversion : HTML | semmle.label | type conversion : HTML |
| HTMLTemplateEscapingPassthrough.go:91:38:91:46 | converted | semmle.label | converted |
| HTMLTemplateEscapingPassthrough.go:91:38:91:46 | converted | semmle.label | converted |
| HTMLTemplateEscapingPassthrough.go:91:38:91:46 | converted | semmle.label | converted |
| HTMLTemplateEscapingPassthrough.go:91:38:91:46 | converted | semmle.label | converted |
| HTMLTemplateEscapingPassthrough.go:91:38:91:46 | converted | semmle.label | converted |
| HTMLTemplateEscapingPassthrough.go:91:38:91:46 | converted | semmle.label | converted |
| HTMLTemplateEscapingPassthrough.go:91:38:91:46 | converted | semmle.label | converted |
#select
| HTMLTemplateEscapingPassthrough.go:29:39:29:39 | a | HTMLTemplateEscapingPassthrough.go:28:26:28:40 | call to UserAgent : string | HTMLTemplateEscapingPassthrough.go:29:39:29:39 | a | Data from an $@ will not be auto-escaped because it was $@ to template.HTML | HTMLTemplateEscapingPassthrough.go:28:26:28:40 | call to UserAgent | untrusted source | HTMLTemplateEscapingPassthrough.go:28:12:28:41 | type conversion | converted |
| HTMLTemplateEscapingPassthrough.go:35:40:35:40 | a | HTMLTemplateEscapingPassthrough.go:34:23:34:37 | call to UserAgent : string | HTMLTemplateEscapingPassthrough.go:35:40:35:40 | a | Data from an $@ will not be auto-escaped because it was $@ to template.HTML | HTMLTemplateEscapingPassthrough.go:34:23:34:37 | call to UserAgent | untrusted source | HTMLTemplateEscapingPassthrough.go:34:9:34:38 | type conversion | converted |
Expand Down
8 changes: 8 additions & 0 deletions ql/test/experimental/CWE-79/HTMLTemplateEscapingPassthrough.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -82,4 +82,12 @@ func good(req *http.Request) {
_ = converted
checkError(tmpl.Execute(os.Stdout, src))
}
{
// The untrusted input is sanitized before use.
tmpl, _ := template.New("test").Parse(`<div>Your user agent is {{.}}</div>`)
src := req.UserAgent()

converted := template.HTML("<b>" + template.HTMLEscapeString(src) + "</b>")
checkError(tmpl.Execute(os.Stdout, converted))
}
}