Skip to content

Commit f84af74

Browse files
asgerfasgerf
committed
JS: Handle more libraries
1 parent c559ab1 commit f84af74

File tree

3 files changed

+88
-4
lines changed

3 files changed

+88
-4
lines changed

‎javascript/ql/src/Security/CWE-400/PrototypePollutionUtility.ql‎

Lines changed: 20 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -121,14 +121,30 @@ class EntriesEnumeratedPropName extends EnumeratedPropName {
121121
}
122122

123123
/**
124-
* Property enumeration through the `for-own` package.
124+
* Gets a function that enumerates object properties when invoked.
125+
*
126+
* Invocations takes the following form:
127+
* ```js
128+
* fn(obj, (value, key, o) => { ... })
129+
* ```
130+
*/
131+
SourceNode propertyEnumerator() {
132+
result = moduleImport("for-own") or
133+
result = moduleImport("for-in") or
134+
result = moduleMember("ramda", "forEachObjIndexed") or
135+
result = LodashUnderscore::member("forEach") or
136+
result = LodashUnderscore::member("each")
137+
}
138+
139+
/**
140+
* Property enumeration through the `for-own` or `for-in` package.
125141
*/
126-
class ForOwnEnumeratedPropName extends EnumeratedPropName {
142+
class LibraryCallbackEnumeratedPropName extends EnumeratedPropName {
127143
CallNode call;
128144
FunctionNode callback;
129145

130-
ForOwnEnumeratedPropName() {
131-
call = moduleImport("for-own").getACall() and
146+
LibraryCallbackEnumeratedPropName() {
147+
call = propertyEnumerator().getACall() and
132148
callback = call.getCallback(1) and
133149
this = callback.getParameter(1)
134150
}

‎javascript/ql/test/query-tests/Security/CWE-400/PrototypePollutionUtility.expected‎

Lines changed: 58 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1017,6 +1017,31 @@ nodes
10171017
| PrototypePollutionUtility/tests.js:451:41:451:45 | value |
10181018
| PrototypePollutionUtility/tests.js:451:41:451:45 | value |
10191019
| PrototypePollutionUtility/tests.js:451:41:451:45 | value |
1020+
| PrototypePollutionUtility/tests.js:456:38:456:40 | dst |
1021+
| PrototypePollutionUtility/tests.js:456:38:456:40 | dst |
1022+
| PrototypePollutionUtility/tests.js:457:18:457:22 | value |
1023+
| PrototypePollutionUtility/tests.js:457:18:457:22 | value |
1024+
| PrototypePollutionUtility/tests.js:457:18:457:22 | value |
1025+
| PrototypePollutionUtility/tests.js:457:25:457:27 | key |
1026+
| PrototypePollutionUtility/tests.js:457:25:457:27 | key |
1027+
| PrototypePollutionUtility/tests.js:457:25:457:27 | key |
1028+
| PrototypePollutionUtility/tests.js:459:41:459:43 | dst |
1029+
| PrototypePollutionUtility/tests.js:459:41:459:43 | dst |
1030+
| PrototypePollutionUtility/tests.js:459:41:459:48 | dst[key] |
1031+
| PrototypePollutionUtility/tests.js:459:41:459:48 | dst[key] |
1032+
| PrototypePollutionUtility/tests.js:459:41:459:48 | dst[key] |
1033+
| PrototypePollutionUtility/tests.js:459:41:459:48 | dst[key] |
1034+
| PrototypePollutionUtility/tests.js:459:45:459:47 | key |
1035+
| PrototypePollutionUtility/tests.js:459:45:459:47 | key |
1036+
| PrototypePollutionUtility/tests.js:461:13:461:15 | dst |
1037+
| PrototypePollutionUtility/tests.js:461:13:461:15 | dst |
1038+
| PrototypePollutionUtility/tests.js:461:13:461:15 | dst |
1039+
| PrototypePollutionUtility/tests.js:461:17:461:19 | key |
1040+
| PrototypePollutionUtility/tests.js:461:17:461:19 | key |
1041+
| PrototypePollutionUtility/tests.js:461:17:461:19 | key |
1042+
| PrototypePollutionUtility/tests.js:461:24:461:28 | value |
1043+
| PrototypePollutionUtility/tests.js:461:24:461:28 | value |
1044+
| PrototypePollutionUtility/tests.js:461:24:461:28 | value |
10201045
| examples/PrototypePollutionUtility.js:1:16:1:18 | dst |
10211046
| examples/PrototypePollutionUtility.js:1:16:1:18 | dst |
10221047
| examples/PrototypePollutionUtility.js:1:21:1:23 | src |
@@ -2400,6 +2425,38 @@ edges
24002425
| PrototypePollutionUtility/tests.js:450:43:450:45 | key | PrototypePollutionUtility/tests.js:450:41:450:46 | o[key] |
24012426
| PrototypePollutionUtility/tests.js:450:43:450:45 | key | PrototypePollutionUtility/tests.js:450:41:450:46 | o[key] |
24022427
| PrototypePollutionUtility/tests.js:450:43:450:45 | key | PrototypePollutionUtility/tests.js:450:41:450:46 | o[key] |
2428+
| PrototypePollutionUtility/tests.js:456:38:456:40 | dst | PrototypePollutionUtility/tests.js:459:41:459:43 | dst |
2429+
| PrototypePollutionUtility/tests.js:456:38:456:40 | dst | PrototypePollutionUtility/tests.js:459:41:459:43 | dst |
2430+
| PrototypePollutionUtility/tests.js:456:38:456:40 | dst | PrototypePollutionUtility/tests.js:461:13:461:15 | dst |
2431+
| PrototypePollutionUtility/tests.js:456:38:456:40 | dst | PrototypePollutionUtility/tests.js:461:13:461:15 | dst |
2432+
| PrototypePollutionUtility/tests.js:456:38:456:40 | dst | PrototypePollutionUtility/tests.js:461:13:461:15 | dst |
2433+
| PrototypePollutionUtility/tests.js:456:38:456:40 | dst | PrototypePollutionUtility/tests.js:461:13:461:15 | dst |
2434+
| PrototypePollutionUtility/tests.js:457:18:457:22 | value | PrototypePollutionUtility/tests.js:461:24:461:28 | value |
2435+
| PrototypePollutionUtility/tests.js:457:18:457:22 | value | PrototypePollutionUtility/tests.js:461:24:461:28 | value |
2436+
| PrototypePollutionUtility/tests.js:457:18:457:22 | value | PrototypePollutionUtility/tests.js:461:24:461:28 | value |
2437+
| PrototypePollutionUtility/tests.js:457:18:457:22 | value | PrototypePollutionUtility/tests.js:461:24:461:28 | value |
2438+
| PrototypePollutionUtility/tests.js:457:18:457:22 | value | PrototypePollutionUtility/tests.js:461:24:461:28 | value |
2439+
| PrototypePollutionUtility/tests.js:457:18:457:22 | value | PrototypePollutionUtility/tests.js:461:24:461:28 | value |
2440+
| PrototypePollutionUtility/tests.js:457:18:457:22 | value | PrototypePollutionUtility/tests.js:461:24:461:28 | value |
2441+
| PrototypePollutionUtility/tests.js:457:25:457:27 | key | PrototypePollutionUtility/tests.js:459:45:459:47 | key |
2442+
| PrototypePollutionUtility/tests.js:457:25:457:27 | key | PrototypePollutionUtility/tests.js:459:45:459:47 | key |
2443+
| PrototypePollutionUtility/tests.js:457:25:457:27 | key | PrototypePollutionUtility/tests.js:459:45:459:47 | key |
2444+
| PrototypePollutionUtility/tests.js:457:25:457:27 | key | PrototypePollutionUtility/tests.js:459:45:459:47 | key |
2445+
| PrototypePollutionUtility/tests.js:457:25:457:27 | key | PrototypePollutionUtility/tests.js:461:17:461:19 | key |
2446+
| PrototypePollutionUtility/tests.js:457:25:457:27 | key | PrototypePollutionUtility/tests.js:461:17:461:19 | key |
2447+
| PrototypePollutionUtility/tests.js:457:25:457:27 | key | PrototypePollutionUtility/tests.js:461:17:461:19 | key |
2448+
| PrototypePollutionUtility/tests.js:457:25:457:27 | key | PrototypePollutionUtility/tests.js:461:17:461:19 | key |
2449+
| PrototypePollutionUtility/tests.js:457:25:457:27 | key | PrototypePollutionUtility/tests.js:461:17:461:19 | key |
2450+
| PrototypePollutionUtility/tests.js:457:25:457:27 | key | PrototypePollutionUtility/tests.js:461:17:461:19 | key |
2451+
| PrototypePollutionUtility/tests.js:457:25:457:27 | key | PrototypePollutionUtility/tests.js:461:17:461:19 | key |
2452+
| PrototypePollutionUtility/tests.js:459:41:459:43 | dst | PrototypePollutionUtility/tests.js:459:41:459:48 | dst[key] |
2453+
| PrototypePollutionUtility/tests.js:459:41:459:43 | dst | PrototypePollutionUtility/tests.js:459:41:459:48 | dst[key] |
2454+
| PrototypePollutionUtility/tests.js:459:41:459:48 | dst[key] | PrototypePollutionUtility/tests.js:456:38:456:40 | dst |
2455+
| PrototypePollutionUtility/tests.js:459:41:459:48 | dst[key] | PrototypePollutionUtility/tests.js:456:38:456:40 | dst |
2456+
| PrototypePollutionUtility/tests.js:459:41:459:48 | dst[key] | PrototypePollutionUtility/tests.js:456:38:456:40 | dst |
2457+
| PrototypePollutionUtility/tests.js:459:41:459:48 | dst[key] | PrototypePollutionUtility/tests.js:456:38:456:40 | dst |
2458+
| PrototypePollutionUtility/tests.js:459:45:459:47 | key | PrototypePollutionUtility/tests.js:459:41:459:48 | dst[key] |
2459+
| PrototypePollutionUtility/tests.js:459:45:459:47 | key | PrototypePollutionUtility/tests.js:459:41:459:48 | dst[key] |
24032460
| examples/PrototypePollutionUtility.js:1:16:1:18 | dst | examples/PrototypePollutionUtility.js:5:19:5:21 | dst |
24042461
| examples/PrototypePollutionUtility.js:1:16:1:18 | dst | examples/PrototypePollutionUtility.js:5:19:5:21 | dst |
24052462
| examples/PrototypePollutionUtility.js:1:16:1:18 | dst | examples/PrototypePollutionUtility.js:7:13:7:15 | dst |
@@ -2525,4 +2582,5 @@ edges
25252582
| PrototypePollutionUtility/tests.js:449:30:449:32 | dst | PrototypePollutionUtility/tests.js:444:25:444:27 | key | PrototypePollutionUtility/tests.js:449:30:449:32 | dst | Properties are copied from $@ to $@ without guarding against prototype pollution. | PrototypePollutionUtility/tests.js:444:12:444:14 | src | src | PrototypePollutionUtility/tests.js:449:30:449:32 | dst | dst |
25262583
| PrototypePollutionUtility/tests.js:450:30:450:32 | dst | PrototypePollutionUtility/tests.js:444:25:444:27 | key | PrototypePollutionUtility/tests.js:450:30:450:32 | dst | Properties are copied from $@ to $@ without guarding against prototype pollution. | PrototypePollutionUtility/tests.js:444:12:444:14 | src | src | PrototypePollutionUtility/tests.js:450:30:450:32 | dst | dst |
25272584
| PrototypePollutionUtility/tests.js:451:30:451:32 | dst | PrototypePollutionUtility/tests.js:444:25:444:27 | key | PrototypePollutionUtility/tests.js:451:30:451:32 | dst | Properties are copied from $@ to $@ without guarding against prototype pollution. | PrototypePollutionUtility/tests.js:444:12:444:14 | src | src | PrototypePollutionUtility/tests.js:451:30:451:32 | dst | dst |
2585+
| PrototypePollutionUtility/tests.js:461:13:461:15 | dst | PrototypePollutionUtility/tests.js:457:25:457:27 | key | PrototypePollutionUtility/tests.js:461:13:461:15 | dst | Properties are copied from $@ to $@ without guarding against prototype pollution. | PrototypePollutionUtility/tests.js:457:12:457:14 | src | src | PrototypePollutionUtility/tests.js:461:13:461:15 | dst | dst |
25282586
| examples/PrototypePollutionUtility.js:7:13:7:15 | dst | examples/PrototypePollutionUtility.js:2:14:2:16 | key | examples/PrototypePollutionUtility.js:7:13:7:15 | dst | Properties are copied from $@ to $@ without guarding against prototype pollution. | examples/PrototypePollutionUtility.js:2:21:2:23 | src | src | examples/PrototypePollutionUtility.js:7:13:7:15 | dst | dst |

‎javascript/ql/test/query-tests/Security/CWE-400/PrototypePollutionUtility/tests.js‎

Lines changed: 10 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -452,3 +452,13 @@ function copyUsingForOwn(dst, src) {
452452
}
453453
});
454454
}
455+
456+
function copyUsingUnderscoreOrLodash(dst, src) {
457+
_.each(src, (value, key, o) => {
458+
if (dst[key]) {
459+
copyUsingUnderscoreOrLodash(dst[key], src[key]);
460+
} else {
461+
dst[key] = value; // NOT OK
462+
}
463+
});
464+
}

0 commit comments

Comments
 (0)