JS: Decompression Bombs

javascript/ql/lib/semmle/javascript/frameworks/FormParsers.qll

@@ -3,61 +3,177 @@
  */
 
 import javascript
+import semmle.javascript.frameworks.ReadableStream
 
 /**
- * A source of remote flow from the `Busboy` library.
+ * A module for modeling [busboy](https://www.npmjs.com/package/busboy) package
  */
-private class BusBoyRemoteFlow extends RemoteFlowSource {
-  BusBoyRemoteFlow() {
-    this =
-      API::moduleImport("busboy")
-          .getInstance()
-          .getMember("on")
-          .getParameter(1)
-          .getAParameter()
-          .asSource()
+module BusBoy {
+  /**
+   * A source of remote flow from the `Busboy` library.
+   */
+  private class BusBoyRemoteFlow extends RemoteFlowSource {
+    BusBoyRemoteFlow() {
+      exists(API::Node busboyOnEvent |
+        busboyOnEvent = API::moduleImport("busboy").getReturn().getMember("on")
+      |
+        // Files
+        busboyOnEvent.getParameter(0).asSink().mayHaveStringValue("file") and
+        // second param of 'file' event is a Readable stream
+        this = readableStreamDataNode(busboyOnEvent.getParameter(1).getParameter(1))
+        or
+        // Fields
+        busboyOnEvent.getParameter(0).asSink().mayHaveStringValue(["file", "field"]) and
+        this =
+          API::moduleImport("busboy")
+              .getReturn()
+              .getMember("on")
+              .getParameter(1)
+              .getAParameter()
+              .asSource()
+      )
+    }
+
+    override string getSourceType() { result = "parsed user value from Busbuy" }
   }
 
-  override string getSourceType() { result = "parsed user value from Busbuy" }
+  /**
+   * A busboy file data step according to a Readable Stream type
+   */
+  private class AdditionalTaintStep extends TaintTracking::SharedTaintStep {
+    override predicate step(DataFlow::Node pred, DataFlow::Node succ) {
+      exists(API::Node busboyOnEvent |
+        busboyOnEvent = API::moduleImport("busboy").getReturn().getMember("on")
+      |
+        busboyOnEvent.getParameter(0).asSink().mayHaveStringValue("file") and
+        customStreamPipeAdditionalTaintStep(busboyOnEvent.getParameter(1).getParameter(1), pred,
+          succ)
+      )
+    }
+  }
 }
 
 /**
- * A source of remote flow from the `Formidable` library parsing a HTTP request.
+ * A module for modeling [formidable](https://www.npmjs.com/package/formidable) package
  */
-private class FormidableRemoteFlow extends RemoteFlowSource {
-  FormidableRemoteFlow() {
-    exists(API::Node formidable |
-      formidable = API::moduleImport("formidable").getReturn()
-      or
-      formidable = API::moduleImport("formidable").getMember("formidable").getReturn()
-      or
-      formidable =
-        API::moduleImport("formidable").getMember(["IncomingForm", "Formidable"]).getInstance()
-    |
-      this =
-        formidable.getMember("parse").getACall().getABoundCallbackParameter(1, any(int i | i > 0))
-    )
-  }
+module Formidable {
+  /**
+   * A source of remote flow from the `Formidable` library parsing a HTTP request.
+   */
+  private class FormidableRemoteFlow extends RemoteFlowSource {
+    FormidableRemoteFlow() {
+      exists(API::Node formidable |
+        formidable = API::moduleImport("formidable").getReturn()
+        or
+        formidable = API::moduleImport("formidable").getMember("formidable").getReturn()
+        or
+        formidable =
+          API::moduleImport("formidable").getMember(["IncomingForm", "Formidable"]).getInstance()
+      |
+        this =
+          formidable.getMember("parse").getACall().getABoundCallbackParameter(1, any(int i | i > 0))
+        or
+        // if callback is not provide a promise will be returned,
+        // return values contains [fields,files] members
+        exists(API::Node parseMethod |
+          parseMethod = formidable.getMember("parse") and parseMethod.getNumParameter() = 1
+        |
+          this = parseMethod.getReturn().asSource()
+        )
+        or
+        // event handler
+        this = formidable.getMember("on").getParameter(1).getAParameter().asSource()
+      )
+    }
 
-  override string getSourceType() { result = "parsed user value from Formidable" }
+    override string getSourceType() { result = "parsed user value from Formidable" }
+  }
 }
 
 /**
- * A source of remote flow from the `Multiparty` library.
+ * A module for modeling [multiparty](https://www.npmjs.com/package/multiparty) package
  */
-private class MultipartyRemoteFlow extends RemoteFlowSource {
-  MultipartyRemoteFlow() {
-    exists(API::Node form | form = API::moduleImport("multiparty").getMember("Form").getInstance() |
-      exists(API::CallNode parse | parse = form.getMember("parse").getACall() |
-        this = parse.getParameter(1).getAParameter().asSource()
+module Multiparty {
+  /**
+   * A source of remote flow from the `Multiparty` library.
+   */
+  private class MultipartyRemoteFlow extends RemoteFlowSource {
+    MultipartyRemoteFlow() {
+      exists(API::Node form |
+        form = API::moduleImport("multiparty").getMember("Form").getInstance()
+      |
+        exists(API::CallNode parse | parse = form.getMember("parse").getACall() |
+          this = parse.getParameter(1).getParameter([1, 2]).asSource()
+        )
+        or
+        exists(API::Node on | on = form.getMember("on") |
+          (
+            on.getParameter(0).asSink().mayHaveStringValue(["file", "field"]) and
+            this = on.getParameter(1).getParameter([0, 1]).asSource()
+            or
+            on.getParameter(0).asSink().mayHaveStringValue("part") and
+            this = readableStreamDataNode(on.getParameter(1).getParameter(0))
+          )
+        )
       )
-      or
-      exists(API::CallNode on | on = form.getMember("on").getACall() |
-        on.getArgument(0).mayHaveStringValue(["part", "file", "field"]) and
-        this = on.getParameter(1).getAParameter().asSource()
+    }
+
+    override string getSourceType() { result = "parsed user value from Multiparty" }
+  }
+
+  /**
+   * A multiparty part data step according to a Readable Stream type
+   */
+  private class AdditionalTaintStep extends TaintTracking::SharedTaintStep {
+    override predicate step(DataFlow::Node pred, DataFlow::Node succ) {
+      exists(API::Node multipartyOnEvent |
+        multipartyOnEvent =
+          API::moduleImport("multiparty").getMember("Form").getInstance().getMember("on")
+      |
+        multipartyOnEvent.getParameter(0).asSink().mayHaveStringValue("part") and
+        customStreamPipeAdditionalTaintStep(multipartyOnEvent.getParameter(1).getParameter(0), pred,
+          succ)
       )
-    )
+    }
   }
+}
+
+/**
+ * A module for modeling [dicer](https://www.npmjs.com/package/dicer) package
+ */
+module Dicer {
+  /**
+   * A source of remote flow from the `dicer` library.
+   */
+  private class DicerRemoteFlow extends RemoteFlowSource {
+    DicerRemoteFlow() {
+      exists(API::Node dicer | dicer = API::moduleImport("dicer").getInstance() |
+        exists(API::Node on | on = dicer.getMember("on") |
+          on.getParameter(0).asSink().mayHaveStringValue("part") and
+          this = readableStreamDataNode(on.getParameter(1).getParameter(0))
+          or
+          exists(API::Node onPart | onPart = on.getParameter(1).getParameter(0).getMember("on") |
+            onPart.getParameter(0).asSink().mayHaveStringValue("header") and
+            this = onPart.getParameter(1).getParameter(0).asSource()
+          )
+        )
+      )
+    }
 
-  override string getSourceType() { result = "parsed user value from Multiparty" }
+    override string getSourceType() { result = "parsed user value from Dicer" }
+  }
+
+  /**
+   * A dicer part data step according to a Readable Stream type
+   */
+  private class AdditionalTaintStep extends TaintTracking::SharedTaintStep {
+    override predicate step(DataFlow::Node pred, DataFlow::Node succ) {
+      exists(API::Node onEvent |
+        onEvent = API::moduleImport("dicer").getInstance().getMember("on")
+      |
+        onEvent.getParameter(0).asSink().mayHaveStringValue("part") and
+        customStreamPipeAdditionalTaintStep(onEvent.getParameter(1).getParameter(0), pred, succ)
+      )
+    }
+  }
 }

javascript/ql/lib/semmle/javascript/frameworks/ReadableStream.qll

@@ -0,0 +1,147 @@
+/**
+ * Provides helper predicates to work with any Readable Stream in dataflow queries
+ *
+ * main predicate in which you can use by passing a Readable Stream is `customStreamPipeAdditionalTaintStep`
+ */
+
+import javascript
+
+/**
+ * Holds if there is a step between `fs.createReadStream` and `stream.Readable.from` first parameters to all other piped parameters
+ *
+ * It can be global additional step too
+ */
+predicate readablePipeAdditionalTaintStep(DataFlow::Node pred, DataFlow::Node succ) {
+  exists(API::Node receiver |
+    receiver =
+      [
+        API::moduleImport("fs").getMember("createReadStream"),
+        API::moduleImport("stream").getMember("Readable").getMember("from")
+      ]
+  |
+    customStreamPipeAdditionalTaintStep(receiver, pred, succ)
+    or
+    pred = receiver.getParameter(0).asSink() and
+    succ = receiver.getReturn().asSource()
+  )
+}
+
+/**
+ * additional taint steps for piped stream from `createReadStream` method of `fs/promises.open`
+ *
+ * It can be global additional step too
+ */
+predicate promisesFileHandlePipeAdditionalTaintStep(DataFlow::Node pred, DataFlow::Node succ) {
+  exists(API::Node receiver | receiver = nodeJsPromisesFileSystem().getMember("open") |
+    customStreamPipeAdditionalTaintStep(receiver, pred, succ)
+    or
+    pred = receiver.getParameter(0).asSink() and
+    succ = receiver.getReturn().asSource()
+  )
+}
+
+/**
+ * Gets nodejs `fs` Promises API
+ */
+API::Node nodeJsPromisesFileSystem() {
+  result = [API::moduleImport("fs").getMember("promises"), API::moduleImport("fs/promises")]
+}
+
+/**
+ * Holds if
+ * or `receiver.pipe(pred).pipe(sth).pipe(succ)`
+ *
+ * or `receiver.pipe(sth).pipe(pred).pipe(succ)`
+ *
+ * or `receiver.pipe(succ)` and receiver is pred
+ *
+ * Receiver is a Readable Stream object
+ */
+predicate customStreamPipeAdditionalTaintStep(
+  API::Node receiver, DataFlow::Node pred, DataFlow::Node succ
+) {
+  // following connect the first pipe parameter to the last pipe parameter
+  exists(API::Node firstPipe | firstPipe = receiver.getMember("pipe") |
+    pred = firstPipe.getParameter(0).asSink() and
+    succ = firstPipe.getASuccessor*().getMember("pipe").getParameter(0).asSink()
+  )
+  or
+  // following connect a pipe parameter to the next pipe parameter
+  exists(API::Node cn | cn = receiver.getASuccessor+() |
+    pred = cn.getParameter(0).asSink() and
+    succ = cn.getReturn().getMember("pipe").getParameter(0).asSink()
+  )
+  or
+  // it is a function that its return value is a Readable stream object
+  pred = receiver.getReturn().asSource() and
+  succ = receiver.getReturn().getMember("pipe").getParameter(0).asSink()
+  or
+  // it is a Readable stream object
+  pred = receiver.asSource() and
+  succ = receiver.getMember("pipe").getParameter(0).asSink()
+}
+
+/**
+ * Holds if
+ *
+ * ```js
+ * await pipeline(
+ *        pred,
+ *        succ_or_pred,
+ *        succ
+ *    )
+ * ```
+ *
+ * It can be global additional step too
+ */
+predicate streamPipelineAdditionalTaintStep(DataFlow::Node pred, DataFlow::Node succ) {
+  // this step connect the a pipeline parameter to the next pipeline parameter
+  exists(API::CallNode cn, int i |
+    // we assume that there are maximum 10 pipes mostly or maybe less
+    i in [0 .. 10] and
+    cn = nodeJsStream().getMember("pipeline").getACall()
+  |
+    pred = cn.getParameter(i).asSink() and
+    succ = cn.getParameter(i + 1).asSink()
+  )
+  or
+  // this step connect the first pipeline parameter to the next parameters
+  exists(API::CallNode cn, int i |
+    // we assume that there are maximum 10 pipes mostly or maybe less
+    i in [1 .. 10] and
+    cn = nodeJsStream().getMember("pipeline").getACall()
+  |
+    pred = cn.getParameter(0).asSink() and
+    succ = cn.getParameter(i).asSink()
+  )
+}
+
+/**
+ * Gets `stream` Promises API
+ */
+API::Node nodeJsStream() {
+  result = [API::moduleImport("stream/promises"), API::moduleImport("stream").getMember("promises")]
+}
+
+/**
+ * Gets a Readable stream object,
+ * and returns all nodes responsible for a data read of this Readable stream
+ */
+DataFlow::Node readableStreamDataNode(API::Node stream) {
+  result = stream.asSource()
+  or
+  // 'data' event
+  exists(API::CallNode onEvent | onEvent = stream.getMember("on").getACall() |
+    result = onEvent.getParameter(1).getParameter(0).asSource() and
+    onEvent.getParameter(0).asSink().mayHaveStringValue("data")
+  )
+  or
+  // 'Readable' event
+  exists(API::CallNode onEvent | onEvent = stream.getMember("on").getACall() |
+    (
+      result = onEvent.getParameter(1).getReceiver().getMember("read").getReturn().asSource() or
+      result = stream.getMember("read").getReturn().asSource()
+    ) and
+    onEvent.getParameter(0).asSink().mayHaveStringValue("readable")
+  )
+}