Skip to content

Commit bb15f30

Browse files
asgerfasgerf
authored
Merge pull request #19192 from asgerf/js/name-resolution-independent-fixes
JS: Some preliminary fixes from name resolution branch
2 parents 52660fa + 6c3bc94 commit bb15f30

File tree

7 files changed

+36
-20
lines changed

7 files changed

+36
-20
lines changed

‎javascript/ql/lib/semmle/javascript/DOM.qll

Lines changed: 4 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -247,7 +247,7 @@ module DOM {
247247
]
248248
|
249249
(
250-
result = documentRef().getAMethodCall(collectionName) or
250+
result = domValueRef().getAMethodCall(collectionName) or
251251
result = DataFlow::globalVarRef(collectionName).getACall()
252252
)
253253
)
@@ -441,10 +441,12 @@ module DOM {
441441
DataFlow::SourceNode domValueRef() {
442442
result = domValueRef(DataFlow::TypeTracker::end())
443443
or
444-
result.hasUnderlyingType("Element")
444+
result.hasUnderlyingType(["Element", "HTMLCollection", "HTMLCollectionOf"])
445445
or
446446
result.hasUnderlyingType(any(string s | s.matches("HTML%Element")))
447447
or
448+
result = documentRef()
449+
or
448450
exists(DataFlow::ClassNode cls |
449451
cls.getASuperClassNode().getALocalSource() =
450452
DataFlow::globalVarRef(any(string s | s.matches("HTML%Element"))) and

‎javascript/ql/src/Security/CWE-327/BadRandomness.ql

Lines changed: 14 additions & 18 deletions
Original file line numberDiff line numberDiff line change
@@ -30,30 +30,26 @@ private int powerOfTwo() {
3030
* Gets a node that has value 2^n for some n.
3131
*/
3232
private DataFlow::Node isPowerOfTwo() {
33-
exists(DataFlow::Node prev |
34-
prev.getIntValue() = powerOfTwo()
35-
or
36-
// Getting around the 32 bit ints in QL. These are some hex values of the form 0x10000000
37-
prev.asExpr().(NumberLiteral).getValue() =
38-
["281474976710656", "17592186044416", "1099511627776", "68719476736", "4294967296"]
39-
|
40-
result = prev.getASuccessor*()
41-
)
33+
result.getIntValue() = powerOfTwo()
34+
or
35+
// Getting around the 32 bit ints in QL. These are some hex values of the form 0x10000000
36+
result.asExpr().(NumberLiteral).getValue() =
37+
["281474976710656", "17592186044416", "1099511627776", "68719476736", "4294967296"]
38+
or
39+
result = isPowerOfTwo().getASuccessor()
4240
}
4341

4442
/**
4543
* Gets a node that has value (2^n)-1 for some n.
4644
*/
4745
private DataFlow::Node isPowerOfTwoMinusOne() {
48-
exists(DataFlow::Node prev |
49-
prev.getIntValue() = powerOfTwo() - 1
50-
or
51-
// Getting around the 32 bit ints in QL. These are some hex values of the form 0xfffffff
52-
prev.asExpr().(NumberLiteral).getValue() =
53-
["281474976710655", "17592186044415", "1099511627775", "68719476735", "4294967295"]
54-
|
55-
result = prev.getASuccessor*()
56-
)
46+
result.getIntValue() = powerOfTwo() - 1
47+
or
48+
// Getting around the 32 bit ints in QL. These are some hex values of the form 0xfffffff
49+
result.asExpr().(NumberLiteral).getValue() =
50+
["281474976710655", "17592186044415", "1099511627775", "68719476735", "4294967295"]
51+
or
52+
result = isPowerOfTwoMinusOne().getASuccessor()
5753
}
5854

5955
/**

‎javascript/ql/src/change-notes/2025-04-02-name-resolution-independent-fixes.md

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,4 @@
1+
---
2+
category: minorAnalysis
3+
---
4+
* Slightly improved detection of DOM element references, leading to XSS results being detected in more cases.

‎javascript/ql/test/library-tests/DOM/Customizations.expected

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -7,20 +7,26 @@ test_documentRef
77
test_locationRef
88
| customization.js:3:3:3:14 | doc.location |
99
test_domValueRef
10+
| customization.js:2:13:2:31 | customGetDocument() |
11+
| customization.js:3:3:3:14 | doc.location |
1012
| customization.js:4:3:4:20 | doc.getElementById |
1113
| customization.js:4:3:4:28 | doc.get ... 'test') |
1214
| event-handler-receiver.html:4:20:4:19 | this |
15+
| event-handler-receiver.js:1:1:1:8 | document |
1316
| event-handler-receiver.js:1:1:1:23 | documen ... entById |
1417
| event-handler-receiver.js:1:1:1:32 | documen ... my-id') |
1518
| event-handler-receiver.js:1:44:1:43 | this |
1619
| event-handler-receiver.js:2:3:2:17 | this.parentNode |
20+
| event-handler-receiver.js:5:1:5:8 | document |
1721
| event-handler-receiver.js:5:1:5:23 | documen ... entById |
1822
| event-handler-receiver.js:5:1:5:32 | documen ... my-id') |
1923
| event-handler-receiver.js:5:60:5:59 | this |
2024
| event-handler-receiver.js:6:3:6:17 | this.parentNode |
25+
| nameditems.js:1:1:1:8 | document |
2126
| nameditems.js:1:1:1:23 | documen ... entById |
2227
| nameditems.js:1:1:1:30 | documen ... ('foo') |
2328
| nameditems.js:1:1:2:19 | documen ... em('x') |
29+
| querySelectorAll.js:2:5:2:12 | document |
2430
| querySelectorAll.js:2:5:2:29 | documen ... ctorAll |
2531
| querySelectorAll.js:2:5:2:36 | documen ... ('foo') |
2632
| querySelectorAll.js:2:46:2:48 | elm |

‎javascript/ql/test/query-tests/Security/CWE-079/DomBasedXss/Xss.expected

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -53,6 +53,7 @@
5353
| dates.js:57:31:57:101 | `Time i ... aint)}` | dates.js:54:36:54:55 | window.location.hash | dates.js:57:31:57:101 | `Time i ... aint)}` | Cross-site scripting vulnerability due to $@. | dates.js:54:36:54:55 | window.location.hash | user-provided value |
5454
| dates.js:59:31:59:87 | `Time i ... aint)}` | dates.js:54:36:54:55 | window.location.hash | dates.js:59:31:59:87 | `Time i ... aint)}` | Cross-site scripting vulnerability due to $@. | dates.js:54:36:54:55 | window.location.hash | user-provided value |
5555
| dates.js:61:31:61:88 | `Time i ... aint)}` | dates.js:54:36:54:55 | window.location.hash | dates.js:61:31:61:88 | `Time i ... aint)}` | Cross-site scripting vulnerability due to $@. | dates.js:54:36:54:55 | window.location.hash | user-provided value |
56+
| dom.js:4:20:4:30 | window.name | dom.js:4:20:4:30 | window.name | dom.js:4:20:4:30 | window.name | Cross-site scripting vulnerability due to $@. | dom.js:4:20:4:30 | window.name | user-provided value |
5657
| dragAndDrop.ts:15:25:15:28 | html | dragAndDrop.ts:8:18:8:50 | dataTra ... /html') | dragAndDrop.ts:15:25:15:28 | html | Cross-site scripting vulnerability due to $@. | dragAndDrop.ts:8:18:8:50 | dataTra ... /html') | user-provided value |
5758
| dragAndDrop.ts:24:23:24:57 | e.dataT ... /html') | dragAndDrop.ts:24:23:24:57 | e.dataT ... /html') | dragAndDrop.ts:24:23:24:57 | e.dataT ... /html') | Cross-site scripting vulnerability due to $@. | dragAndDrop.ts:24:23:24:57 | e.dataT ... /html') | user-provided value |
5859
| dragAndDrop.ts:29:19:29:53 | e.dataT ... /html') | dragAndDrop.ts:29:19:29:53 | e.dataT ... /html') | dragAndDrop.ts:29:19:29:53 | e.dataT ... /html') | Cross-site scripting vulnerability due to $@. | dragAndDrop.ts:29:19:29:53 | e.dataT ... /html') | user-provided value |
@@ -937,6 +938,7 @@ nodes
937938
| dates.js:61:31:61:88 | `Time i ... aint)}` | semmle.label | `Time i ... aint)}` |
938939
| dates.js:61:42:61:86 | dayjs.s ... (taint) | semmle.label | dayjs.s ... (taint) |
939940
| dates.js:61:81:61:85 | taint | semmle.label | taint |
941+
| dom.js:4:20:4:30 | window.name | semmle.label | window.name |
940942
| dragAndDrop.ts:8:11:8:50 | html | semmle.label | html |
941943
| dragAndDrop.ts:8:18:8:50 | dataTra ... /html') | semmle.label | dataTra ... /html') |
942944
| dragAndDrop.ts:15:25:15:28 | html | semmle.label | html |

‎javascript/ql/test/query-tests/Security/CWE-079/DomBasedXss/XssWithAdditionalSources.expected

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -138,6 +138,7 @@ nodes
138138
| dates.js:61:31:61:88 | `Time i ... aint)}` | semmle.label | `Time i ... aint)}` |
139139
| dates.js:61:42:61:86 | dayjs.s ... (taint) | semmle.label | dayjs.s ... (taint) |
140140
| dates.js:61:81:61:85 | taint | semmle.label | taint |
141+
| dom.js:4:20:4:30 | window.name | semmle.label | window.name |
141142
| dragAndDrop.ts:8:11:8:50 | html | semmle.label | html |
142143
| dragAndDrop.ts:8:18:8:50 | dataTra ... /html') | semmle.label | dataTra ... /html') |
143144
| dragAndDrop.ts:15:25:15:28 | html | semmle.label | html |

‎javascript/ql/test/query-tests/Security/CWE-079/DomBasedXss/dom.js

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,5 @@
1+
function t1() {
2+
const elm = document.getElementById("foo");
3+
const e2 = elm.getElementsByTagName("bar")[0];
4+
e2.innerHTML = window.name; // $ Alert
5+
}

0 commit comments

Comments
 (0)