Skip to content

Commit fd98b25

Browse files
asgerfasgerf
committed
JS: Port InsecureTemporaryFile
1 parent cd1a1e2 commit fd98b25

File tree

3 files changed

+38
-39
lines changed

3 files changed

+38
-39
lines changed

‎javascript/ql/lib/semmle/javascript/security/dataflow/InsecureTemporaryFileQuery.qll‎

Lines changed: 17 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -13,7 +13,23 @@ import InsecureTemporaryFileCustomizations::InsecureTemporaryFile
1313
/**
1414
* A taint-tracking configuration for reasoning about insecure temporary file creation.
1515
*/
16-
class Configuration extends TaintTracking::Configuration {
16+
module InsecureTemporaryFileConfig implements DataFlow::ConfigSig {
17+
predicate isSource(DataFlow::Node source) { source instanceof Source }
18+
19+
predicate isSink(DataFlow::Node sink) { sink instanceof Sink }
20+
21+
predicate isBarrier(DataFlow::Node node) { node instanceof Sanitizer }
22+
}
23+
24+
/**
25+
* Taint-tracking for reasoning about insecure temporary file creation.
26+
*/
27+
module InsecureTemporaryFileFlow = TaintTracking::Global<InsecureTemporaryFileConfig>;
28+
29+
/**
30+
* DEPRECATED. Use the `InsecureTemporaryFileFlow` module instead.
31+
*/
32+
deprecated class Configuration extends TaintTracking::Configuration {
1733
Configuration() { this = "InsecureTemporaryFile" }
1834

1935
override predicate isSource(DataFlow::Node source) { source instanceof Source }

‎javascript/ql/src/Security/CWE-377/InsecureTemporaryFile.ql‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -13,10 +13,10 @@
1313
*/
1414

1515
import javascript
16-
import DataFlow::PathGraph
1716
import semmle.javascript.security.dataflow.InsecureTemporaryFileQuery
17+
import InsecureTemporaryFileFlow::PathGraph
1818

19-
from Configuration cfg, DataFlow::PathNode source, DataFlow::PathNode sink
20-
where cfg.hasFlowPath(source, sink)
19+
from InsecureTemporaryFileFlow::PathNode source, InsecureTemporaryFileFlow::PathNode sink
20+
where InsecureTemporaryFileFlow::flowPath(source, sink)
2121
select sink.getNode(), source, sink, "Insecure creation of file in $@.", source.getNode(),
2222
"the os temp dir"

‎javascript/ql/test/query-tests/Security/CWE-377/InsecureTemporaryFile.expected‎

Lines changed: 18 additions & 35 deletions
Original file line numberDiff line numberDiff line change
@@ -1,50 +1,33 @@
1-
nodes
2-
| insecure-temporary-file.js:7:9:11:5 | tmpLocation |
3-
| insecure-temporary-file.js:7:23:11:5 | path.jo ... )\\n ) |
4-
| insecure-temporary-file.js:8:9:8:45 | os.tmpd ... mpDir() |
5-
| insecure-temporary-file.js:8:21:8:31 | os.tmpdir() |
6-
| insecure-temporary-file.js:8:21:8:31 | os.tmpdir() |
7-
| insecure-temporary-file.js:13:22:13:32 | tmpLocation |
8-
| insecure-temporary-file.js:13:22:13:32 | tmpLocation |
9-
| insecure-temporary-file.js:15:9:15:34 | tmpPath |
10-
| insecure-temporary-file.js:15:19:15:34 | "/tmp/something" |
11-
| insecure-temporary-file.js:15:19:15:34 | "/tmp/something" |
12-
| insecure-temporary-file.js:17:22:17:49 | path.jo ... /foo/") |
13-
| insecure-temporary-file.js:17:22:17:49 | path.jo ... /foo/") |
14-
| insecure-temporary-file.js:17:32:17:38 | tmpPath |
15-
| insecure-temporary-file.js:23:22:23:49 | path.jo ... /foo/") |
16-
| insecure-temporary-file.js:23:22:23:49 | path.jo ... /foo/") |
17-
| insecure-temporary-file.js:23:32:23:38 | tmpPath |
18-
| insecure-temporary-file.js:25:11:25:92 | tmpPath2 |
19-
| insecure-temporary-file.js:25:22:25:92 | path.jo ... )}.md`) |
20-
| insecure-temporary-file.js:25:32:25:42 | os.tmpdir() |
21-
| insecure-temporary-file.js:25:32:25:42 | os.tmpdir() |
22-
| insecure-temporary-file.js:26:22:26:29 | tmpPath2 |
23-
| insecure-temporary-file.js:26:22:26:29 | tmpPath2 |
24-
| insecure-temporary-file.js:28:17:28:24 | tmpPath2 |
25-
| insecure-temporary-file.js:28:17:28:24 | tmpPath2 |
261
edges
272
| insecure-temporary-file.js:7:9:11:5 | tmpLocation | insecure-temporary-file.js:13:22:13:32 | tmpLocation |
28-
| insecure-temporary-file.js:7:9:11:5 | tmpLocation | insecure-temporary-file.js:13:22:13:32 | tmpLocation |
293
| insecure-temporary-file.js:7:23:11:5 | path.jo ... )\\n ) | insecure-temporary-file.js:7:9:11:5 | tmpLocation |
30-
| insecure-temporary-file.js:8:9:8:45 | os.tmpd ... mpDir() | insecure-temporary-file.js:7:23:11:5 | path.jo ... )\\n ) |
31-
| insecure-temporary-file.js:8:21:8:31 | os.tmpdir() | insecure-temporary-file.js:8:9:8:45 | os.tmpd ... mpDir() |
32-
| insecure-temporary-file.js:8:21:8:31 | os.tmpdir() | insecure-temporary-file.js:8:9:8:45 | os.tmpd ... mpDir() |
4+
| insecure-temporary-file.js:8:21:8:31 | os.tmpdir() | insecure-temporary-file.js:7:23:11:5 | path.jo ... )\\n ) |
335
| insecure-temporary-file.js:15:9:15:34 | tmpPath | insecure-temporary-file.js:17:32:17:38 | tmpPath |
346
| insecure-temporary-file.js:15:9:15:34 | tmpPath | insecure-temporary-file.js:23:32:23:38 | tmpPath |
357
| insecure-temporary-file.js:15:19:15:34 | "/tmp/something" | insecure-temporary-file.js:15:9:15:34 | tmpPath |
36-
| insecure-temporary-file.js:15:19:15:34 | "/tmp/something" | insecure-temporary-file.js:15:9:15:34 | tmpPath |
378
| insecure-temporary-file.js:17:32:17:38 | tmpPath | insecure-temporary-file.js:17:22:17:49 | path.jo ... /foo/") |
38-
| insecure-temporary-file.js:17:32:17:38 | tmpPath | insecure-temporary-file.js:17:22:17:49 | path.jo ... /foo/") |
39-
| insecure-temporary-file.js:23:32:23:38 | tmpPath | insecure-temporary-file.js:23:22:23:49 | path.jo ... /foo/") |
409
| insecure-temporary-file.js:23:32:23:38 | tmpPath | insecure-temporary-file.js:23:22:23:49 | path.jo ... /foo/") |
4110
| insecure-temporary-file.js:25:11:25:92 | tmpPath2 | insecure-temporary-file.js:26:22:26:29 | tmpPath2 |
42-
| insecure-temporary-file.js:25:11:25:92 | tmpPath2 | insecure-temporary-file.js:26:22:26:29 | tmpPath2 |
43-
| insecure-temporary-file.js:25:11:25:92 | tmpPath2 | insecure-temporary-file.js:28:17:28:24 | tmpPath2 |
4411
| insecure-temporary-file.js:25:11:25:92 | tmpPath2 | insecure-temporary-file.js:28:17:28:24 | tmpPath2 |
4512
| insecure-temporary-file.js:25:22:25:92 | path.jo ... )}.md`) | insecure-temporary-file.js:25:11:25:92 | tmpPath2 |
4613
| insecure-temporary-file.js:25:32:25:42 | os.tmpdir() | insecure-temporary-file.js:25:22:25:92 | path.jo ... )}.md`) |
47-
| insecure-temporary-file.js:25:32:25:42 | os.tmpdir() | insecure-temporary-file.js:25:22:25:92 | path.jo ... )}.md`) |
14+
nodes
15+
| insecure-temporary-file.js:7:9:11:5 | tmpLocation | semmle.label | tmpLocation |
16+
| insecure-temporary-file.js:7:23:11:5 | path.jo ... )\\n ) | semmle.label | path.jo ... )\\n ) |
17+
| insecure-temporary-file.js:8:21:8:31 | os.tmpdir() | semmle.label | os.tmpdir() |
18+
| insecure-temporary-file.js:13:22:13:32 | tmpLocation | semmle.label | tmpLocation |
19+
| insecure-temporary-file.js:15:9:15:34 | tmpPath | semmle.label | tmpPath |
20+
| insecure-temporary-file.js:15:19:15:34 | "/tmp/something" | semmle.label | "/tmp/something" |
21+
| insecure-temporary-file.js:17:22:17:49 | path.jo ... /foo/") | semmle.label | path.jo ... /foo/") |
22+
| insecure-temporary-file.js:17:32:17:38 | tmpPath | semmle.label | tmpPath |
23+
| insecure-temporary-file.js:23:22:23:49 | path.jo ... /foo/") | semmle.label | path.jo ... /foo/") |
24+
| insecure-temporary-file.js:23:32:23:38 | tmpPath | semmle.label | tmpPath |
25+
| insecure-temporary-file.js:25:11:25:92 | tmpPath2 | semmle.label | tmpPath2 |
26+
| insecure-temporary-file.js:25:22:25:92 | path.jo ... )}.md`) | semmle.label | path.jo ... )}.md`) |
27+
| insecure-temporary-file.js:25:32:25:42 | os.tmpdir() | semmle.label | os.tmpdir() |
28+
| insecure-temporary-file.js:26:22:26:29 | tmpPath2 | semmle.label | tmpPath2 |
29+
| insecure-temporary-file.js:28:17:28:24 | tmpPath2 | semmle.label | tmpPath2 |
30+
subpaths
4831
#select
4932
| insecure-temporary-file.js:13:22:13:32 | tmpLocation | insecure-temporary-file.js:8:21:8:31 | os.tmpdir() | insecure-temporary-file.js:13:22:13:32 | tmpLocation | Insecure creation of file in $@. | insecure-temporary-file.js:8:21:8:31 | os.tmpdir() | the os temp dir |
5033
| insecure-temporary-file.js:17:22:17:49 | path.jo ... /foo/") | insecure-temporary-file.js:15:19:15:34 | "/tmp/something" | insecure-temporary-file.js:17:22:17:49 | path.jo ... /foo/") | Insecure creation of file in $@. | insecure-temporary-file.js:15:19:15:34 | "/tmp/something" | the os temp dir |

0 commit comments

Comments
 (0)