JS: add initial version of ServerCrash.ql #3672
Merged
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
|
(ping me if more context is needed, this query is not trivial) |
erik-krogh
reviewed
Jun 10, 2020
Comment on lines
39
to
42
| predicate isDangerousPropertyRead(DataFlow::PropRead read) { | ||
| // TODO use flow labels | ||
| exists(DataFlow::PropRead base | | ||
| base = read.getBase() and |
There was a problem hiding this comment.
How about checking if the property-read is guarded.
E.g. the below is safe, and I think it will be flagged.
function handler(req, res) {
var foo = req.body && req.body.foo && req.body.foo.bar;
}flow-labels can maybe be used in some fancy way to achieve this.
There was a problem hiding this comment.
I have removed that sink now, it was purely speculative. I have added a TODO note above.
3 tasks
erik-krogh
reviewed
Jun 11, 2020
Comment on lines
75
to
77
| class ServerCrasher extends ExprOrStmt { | ||
| HTTP::RouteHandler routeHandler; | ||
| DataFlow::FunctionNode asyncFunction; |
There was a problem hiding this comment.
Does this need to be a class? How about converting it to a predicate:
ExprOrStmt getAServerCrasherStmt(HTTP::RouteHandler routeHandler, DataFlow::FunctionNode asyncFunction)Actually, how about spreading it into 2 predicates, the first returning Function throwingFunction, and the second predicate returning a ExprOrStmt crasher from that throwingFunction.
Rename suggestion: asyncFunction -> asyncCallback?
erik-krogh
approved these changes
Jun 11, 2020
This was referenced Jun 22, 2020
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
CVE-2019-10775: TP/FP
CVE-2017-16014: FN
The FP can be addressed when the (hacky)
Configurationpart of the query is polished.Generally, the alerts can be hard to understand since they talk about a (long) call chain from a route handler, to an asynchronous function invocation, to a line that causes an exception to be thrown. This can be remedied by presenting the remote flow path from the
Configurationpart of the query to the user, and then hacking up a pseudo path for thethrowcase.Polish for later:
JS: remove speculative property access sink from js/server-crash)