Skip to content

Commit 5c42c0b

Browse files
NapalysNapalys
authored
Merge pull request #19196 from Napalys/js/rimraf
JS: Modeling of `rimraf` functions
2 parents e04075b + 390d9ff commit 5c42c0b

File tree

4 files changed

+109
-0
lines changed

4 files changed

+109
-0
lines changed

‎javascript/ql/lib/change-notes/2025-04-02-rimraf.md

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,4 @@
1+
---
2+
category: minorAnalysis
3+
---
4+
* Added support for additional `rimraf` methods as sinks in path-injection queries.

‎javascript/ql/lib/ext/rimraf.model.yml

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,8 @@
1+
extensions:
2+
- addsTo:
3+
pack: codeql/javascript-all
4+
extensible: sinkModel
5+
data:
6+
- ["rimraf", "Member[sync,native,manual,windows,moveRemove,posix].Argument[0]", "path-injection"]
7+
- ["rimraf", "Member[rimrafSync,nativeSync,manualSync,windowsSync,moveRemoveSync,posixSync].Argument[0]", "path-injection"]
8+
- ["rimraf", "Member[native,manual,windows,moveRemove,posix].Member[sync].Argument[0]", "path-injection"]

‎javascript/ql/test/query-tests/Security/CWE-022/TaintedPath/TaintedPath.expected

Lines changed: 67 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -168,6 +168,26 @@
168168
| prettier.js:11:44:11:44 | p | prettier.js:6:13:6:13 | p | prettier.js:11:44:11:44 | p | This path depends on a $@. | prettier.js:6:13:6:13 | p | user-provided value |
169169
| pupeteer.js:9:28:9:34 | tainted | pupeteer.js:5:28:5:53 | parseTo ... t).name | pupeteer.js:9:28:9:34 | tainted | This path depends on a $@. | pupeteer.js:5:28:5:53 | parseTo ... t).name | user-provided value |
170170
| pupeteer.js:13:37:13:43 | tainted | pupeteer.js:5:28:5:53 | parseTo ... t).name | pupeteer.js:13:37:13:43 | tainted | This path depends on a $@. | pupeteer.js:5:28:5:53 | parseTo ... t).name | user-provided value |
171+
| rimraf.js:10:17:10:20 | path | rimraf.js:8:22:8:29 | req.body | rimraf.js:10:17:10:20 | path | This path depends on a $@. | rimraf.js:8:22:8:29 | req.body | user-provided value |
172+
| rimraf.js:11:23:11:26 | path | rimraf.js:8:22:8:29 | req.body | rimraf.js:11:23:11:26 | path | This path depends on a $@. | rimraf.js:8:22:8:29 | req.body | user-provided value |
173+
| rimraf.js:12:19:12:22 | path | rimraf.js:8:22:8:29 | req.body | rimraf.js:12:19:12:22 | path | This path depends on a $@. | rimraf.js:8:22:8:29 | req.body | user-provided value |
174+
| rimraf.js:13:25:13:28 | path | rimraf.js:8:22:8:29 | req.body | rimraf.js:13:25:13:28 | path | This path depends on a $@. | rimraf.js:8:22:8:29 | req.body | user-provided value |
175+
| rimraf.js:14:24:14:27 | path | rimraf.js:8:22:8:29 | req.body | rimraf.js:14:24:14:27 | path | This path depends on a $@. | rimraf.js:8:22:8:29 | req.body | user-provided value |
176+
| rimraf.js:15:23:15:26 | path | rimraf.js:8:22:8:29 | req.body | rimraf.js:15:23:15:26 | path | This path depends on a $@. | rimraf.js:8:22:8:29 | req.body | user-provided value |
177+
| rimraf.js:16:25:16:28 | path | rimraf.js:8:22:8:29 | req.body | rimraf.js:16:25:16:28 | path | This path depends on a $@. | rimraf.js:8:22:8:29 | req.body | user-provided value |
178+
| rimraf.js:17:19:17:22 | path | rimraf.js:8:22:8:29 | req.body | rimraf.js:17:19:17:22 | path | This path depends on a $@. | rimraf.js:8:22:8:29 | req.body | user-provided value |
179+
| rimraf.js:18:24:18:27 | path | rimraf.js:8:22:8:29 | req.body | rimraf.js:18:24:18:27 | path | This path depends on a $@. | rimraf.js:8:22:8:29 | req.body | user-provided value |
180+
| rimraf.js:19:23:19:26 | path | rimraf.js:8:22:8:29 | req.body | rimraf.js:19:23:19:26 | path | This path depends on a $@. | rimraf.js:8:22:8:29 | req.body | user-provided value |
181+
| rimraf.js:20:26:20:29 | path | rimraf.js:8:22:8:29 | req.body | rimraf.js:20:26:20:29 | path | This path depends on a $@. | rimraf.js:8:22:8:29 | req.body | user-provided value |
182+
| rimraf.js:21:20:21:23 | path | rimraf.js:8:22:8:29 | req.body | rimraf.js:21:20:21:23 | path | This path depends on a $@. | rimraf.js:8:22:8:29 | req.body | user-provided value |
183+
| rimraf.js:22:25:22:28 | path | rimraf.js:8:22:8:29 | req.body | rimraf.js:22:25:22:28 | path | This path depends on a $@. | rimraf.js:8:22:8:29 | req.body | user-provided value |
184+
| rimraf.js:23:24:23:27 | path | rimraf.js:8:22:8:29 | req.body | rimraf.js:23:24:23:27 | path | This path depends on a $@. | rimraf.js:8:22:8:29 | req.body | user-provided value |
185+
| rimraf.js:24:23:24:26 | path | rimraf.js:8:22:8:29 | req.body | rimraf.js:24:23:24:26 | path | This path depends on a $@. | rimraf.js:8:22:8:29 | req.body | user-provided value |
186+
| rimraf.js:25:28:25:31 | path | rimraf.js:8:22:8:29 | req.body | rimraf.js:25:28:25:31 | path | This path depends on a $@. | rimraf.js:8:22:8:29 | req.body | user-provided value |
187+
| rimraf.js:26:27:26:30 | path | rimraf.js:8:22:8:29 | req.body | rimraf.js:26:27:26:30 | path | This path depends on a $@. | rimraf.js:8:22:8:29 | req.body | user-provided value |
188+
| rimraf.js:27:22:27:25 | path | rimraf.js:8:22:8:29 | req.body | rimraf.js:27:22:27:25 | path | This path depends on a $@. | rimraf.js:8:22:8:29 | req.body | user-provided value |
189+
| rimraf.js:28:18:28:21 | path | rimraf.js:8:22:8:29 | req.body | rimraf.js:28:18:28:21 | path | This path depends on a $@. | rimraf.js:8:22:8:29 | req.body | user-provided value |
190+
| rimraf.js:29:23:29:26 | path | rimraf.js:8:22:8:29 | req.body | rimraf.js:29:23:29:26 | path | This path depends on a $@. | rimraf.js:8:22:8:29 | req.body | user-provided value |
171191
| sharedlib-repro.js:22:18:22:25 | filepath | sharedlib-repro.js:13:22:13:43 | req.par ... spaceId | sharedlib-repro.js:22:18:22:25 | filepath | This path depends on a $@. | sharedlib-repro.js:13:22:13:43 | req.par ... spaceId | user-provided value |
172192
| tainted-access-paths.js:8:19:8:22 | path | tainted-access-paths.js:6:24:6:30 | req.url | tainted-access-paths.js:8:19:8:22 | path | This path depends on a $@. | tainted-access-paths.js:6:24:6:30 | req.url | user-provided value |
173193
| tainted-access-paths.js:12:19:12:25 | obj.sub | tainted-access-paths.js:6:24:6:30 | req.url | tainted-access-paths.js:12:19:12:25 | obj.sub | This path depends on a $@. | tainted-access-paths.js:6:24:6:30 | req.url | user-provided value |
@@ -594,6 +614,29 @@ edges
594614
| pupeteer.js:5:9:5:71 | tainted | pupeteer.js:13:37:13:43 | tainted | provenance | |
595615
| pupeteer.js:5:19:5:71 | "dir/" ... t.data" | pupeteer.js:5:9:5:71 | tainted | provenance | |
596616
| pupeteer.js:5:28:5:53 | parseTo ... t).name | pupeteer.js:5:19:5:71 | "dir/" ... t.data" | provenance | Config |
617+
| rimraf.js:8:11:8:18 | { path } | rimraf.js:8:13:8:16 | path | provenance | Config |
618+
| rimraf.js:8:11:8:29 | path | rimraf.js:10:17:10:20 | path | provenance | |
619+
| rimraf.js:8:11:8:29 | path | rimraf.js:11:23:11:26 | path | provenance | |
620+
| rimraf.js:8:11:8:29 | path | rimraf.js:12:19:12:22 | path | provenance | |
621+
| rimraf.js:8:11:8:29 | path | rimraf.js:13:25:13:28 | path | provenance | |
622+
| rimraf.js:8:11:8:29 | path | rimraf.js:14:24:14:27 | path | provenance | |
623+
| rimraf.js:8:11:8:29 | path | rimraf.js:15:23:15:26 | path | provenance | |
624+
| rimraf.js:8:11:8:29 | path | rimraf.js:16:25:16:28 | path | provenance | |
625+
| rimraf.js:8:11:8:29 | path | rimraf.js:17:19:17:22 | path | provenance | |
626+
| rimraf.js:8:11:8:29 | path | rimraf.js:18:24:18:27 | path | provenance | |
627+
| rimraf.js:8:11:8:29 | path | rimraf.js:19:23:19:26 | path | provenance | |
628+
| rimraf.js:8:11:8:29 | path | rimraf.js:20:26:20:29 | path | provenance | |
629+
| rimraf.js:8:11:8:29 | path | rimraf.js:21:20:21:23 | path | provenance | |
630+
| rimraf.js:8:11:8:29 | path | rimraf.js:22:25:22:28 | path | provenance | |
631+
| rimraf.js:8:11:8:29 | path | rimraf.js:23:24:23:27 | path | provenance | |
632+
| rimraf.js:8:11:8:29 | path | rimraf.js:24:23:24:26 | path | provenance | |
633+
| rimraf.js:8:11:8:29 | path | rimraf.js:25:28:25:31 | path | provenance | |
634+
| rimraf.js:8:11:8:29 | path | rimraf.js:26:27:26:30 | path | provenance | |
635+
| rimraf.js:8:11:8:29 | path | rimraf.js:27:22:27:25 | path | provenance | |
636+
| rimraf.js:8:11:8:29 | path | rimraf.js:28:18:28:21 | path | provenance | |
637+
| rimraf.js:8:11:8:29 | path | rimraf.js:29:23:29:26 | path | provenance | |
638+
| rimraf.js:8:13:8:16 | path | rimraf.js:8:11:8:29 | path | provenance | |
639+
| rimraf.js:8:22:8:29 | req.body | rimraf.js:8:11:8:18 | { path } | provenance | |
597640
| sharedlib-repro.js:13:22:13:43 | req.par ... spaceId | sharedlib-repro.js:21:27:21:34 | filepath | provenance | |
598641
| sharedlib-repro.js:21:27:21:34 | filepath | sharedlib-repro.js:22:18:22:25 | filepath | provenance | |
599642
| tainted-access-paths.js:6:7:6:48 | path | tainted-access-paths.js:8:19:8:22 | path | provenance | |
@@ -1133,6 +1176,30 @@ nodes
11331176
| pupeteer.js:5:28:5:53 | parseTo ... t).name | semmle.label | parseTo ... t).name |
11341177
| pupeteer.js:9:28:9:34 | tainted | semmle.label | tainted |
11351178
| pupeteer.js:13:37:13:43 | tainted | semmle.label | tainted |
1179+
| rimraf.js:8:11:8:18 | { path } | semmle.label | { path } |
1180+
| rimraf.js:8:11:8:29 | path | semmle.label | path |
1181+
| rimraf.js:8:13:8:16 | path | semmle.label | path |
1182+
| rimraf.js:8:22:8:29 | req.body | semmle.label | req.body |
1183+
| rimraf.js:10:17:10:20 | path | semmle.label | path |
1184+
| rimraf.js:11:23:11:26 | path | semmle.label | path |
1185+
| rimraf.js:12:19:12:22 | path | semmle.label | path |
1186+
| rimraf.js:13:25:13:28 | path | semmle.label | path |
1187+
| rimraf.js:14:24:14:27 | path | semmle.label | path |
1188+
| rimraf.js:15:23:15:26 | path | semmle.label | path |
1189+
| rimraf.js:16:25:16:28 | path | semmle.label | path |
1190+
| rimraf.js:17:19:17:22 | path | semmle.label | path |
1191+
| rimraf.js:18:24:18:27 | path | semmle.label | path |
1192+
| rimraf.js:19:23:19:26 | path | semmle.label | path |
1193+
| rimraf.js:20:26:20:29 | path | semmle.label | path |
1194+
| rimraf.js:21:20:21:23 | path | semmle.label | path |
1195+
| rimraf.js:22:25:22:28 | path | semmle.label | path |
1196+
| rimraf.js:23:24:23:27 | path | semmle.label | path |
1197+
| rimraf.js:24:23:24:26 | path | semmle.label | path |
1198+
| rimraf.js:25:28:25:31 | path | semmle.label | path |
1199+
| rimraf.js:26:27:26:30 | path | semmle.label | path |
1200+
| rimraf.js:27:22:27:25 | path | semmle.label | path |
1201+
| rimraf.js:28:18:28:21 | path | semmle.label | path |
1202+
| rimraf.js:29:23:29:26 | path | semmle.label | path |
11361203
| sharedlib-repro.js:13:22:13:43 | req.par ... spaceId | semmle.label | req.par ... spaceId |
11371204
| sharedlib-repro.js:21:27:21:34 | filepath | semmle.label | filepath |
11381205
| sharedlib-repro.js:22:18:22:25 | filepath | semmle.label | filepath |

‎javascript/ql/test/query-tests/Security/CWE-022/TaintedPath/rimraf.js

Lines changed: 30 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,30 @@
1+
const express = require('express');
2+
const rimraf = require('rimraf');
3+
4+
const app = express();
5+
app.use(express.json());
6+
7+
app.post('/rmsync', async (req, res) => {
8+
const { path } = req.body; // $ Source
9+
10+
rimraf.sync(path); // $ Alert
11+
rimraf.rimrafSync(path); // $ Alert
12+
rimraf.native(path); // $ Alert
13+
await rimraf.native(path); // $ Alert
14+
rimraf.native.sync(path); // $ Alert
15+
rimraf.nativeSync(path); // $ Alert
16+
await rimraf.manual(path); // $ Alert
17+
rimraf.manual(path); // $ Alert
18+
rimraf.manual.sync(path); // $ Alert
19+
rimraf.manualSync(path); // $ Alert
20+
await rimraf.windows(path); // $ Alert
21+
rimraf.windows(path); // $ Alert
22+
rimraf.windows.sync(path); // $ Alert
23+
rimraf.windowsSync(path); // $ Alert
24+
rimraf.moveRemove(path); // $ Alert
25+
rimraf.moveRemove.sync(path); // $ Alert
26+
rimraf.moveRemoveSync(path); // $ Alert
27+
rimraf.posixSync(path); // $ Alert
28+
rimraf.posix(path); // $ Alert
29+
rimraf.posix.sync(path); // $ Alert
30+
});

0 commit comments

Comments
 (0)