Skip to content

Commit 09360bc

Browse files
erik-krogherik-krogh
authored
Merge pull request #9085 from erik-krogh/cash
JS: add model for the cash library
2 parents 2421076 + e80ee46 commit 09360bc

File tree

4 files changed

+32
-4
lines changed

4 files changed

+32
-4
lines changed

‎javascript/ql/lib/change-notes/2022-05-09-cash.md

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,5 @@
1+
---
2+
category: minorAnalysis
3+
---
4+
* The [cash](https://github.com/fabiospampinato/cash) library is now modelled as an alias for JQuery.
5+
Sinks and sources from cash should now be handled by all XSS queries.

‎javascript/ql/lib/semmle/javascript/frameworks/jQuery.qll

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -406,11 +406,11 @@ module JQuery {
406406

407407
private class DefaultRange extends Range {
408408
DefaultRange() {
409-
// either a reference to a global variable `$` or `jQuery`
410-
this = DataFlow::globalVarRef(any(string jq | jq = "$" or jq = "jQuery"))
409+
// either a reference to a global variable `$`, `jQuery`, or `cash`
410+
this = DataFlow::globalVarRef(["$", "jQuery", "cash"])
411411
or
412-
// or imported from a module named `jquery` or `zepto`
413-
this = DataFlow::moduleImport(["jquery", "zepto"])
412+
// or imported from a module named `jquery`, `zepto`, or `cash-dom`
413+
this = DataFlow::moduleImport(["jquery", "zepto", "cash-dom"])
414414
or
415415
this.hasUnderlyingType("JQueryStatic")
416416
}

‎javascript/ql/test/query-tests/Security/CWE-079/XssThroughDom/XssThroughDom.expected

Lines changed: 15 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -150,6 +150,13 @@ nodes
150150
| xss-through-dom.js:131:19:131:26 | linkText |
151151
| xss-through-dom.js:132:16:132:23 | linkText |
152152
| xss-through-dom.js:132:16:132:23 | linkText |
153+
| xss-through-dom.js:139:11:139:52 | src |
154+
| xss-through-dom.js:139:17:139:52 | documen ... k").src |
155+
| xss-through-dom.js:139:17:139:52 | documen ... k").src |
156+
| xss-through-dom.js:140:19:140:21 | src |
157+
| xss-through-dom.js:140:19:140:21 | src |
158+
| xss-through-dom.js:141:25:141:27 | src |
159+
| xss-through-dom.js:141:25:141:27 | src |
153160
edges
154161
| forms.js:8:23:8:28 | values | forms.js:9:31:9:36 | values |
155162
| forms.js:8:23:8:28 | values | forms.js:9:31:9:36 | values |
@@ -246,6 +253,12 @@ edges
246253
| xss-through-dom.js:130:17:130:68 | wSelect ... ) \|\| '' | xss-through-dom.js:130:6:130:68 | linkText |
247254
| xss-through-dom.js:130:42:130:62 | dSelect ... tring() | xss-through-dom.js:130:17:130:62 | wSelect ... tring() |
248255
| xss-through-dom.js:130:42:130:62 | dSelect ... tring() | xss-through-dom.js:130:17:130:62 | wSelect ... tring() |
256+
| xss-through-dom.js:139:11:139:52 | src | xss-through-dom.js:140:19:140:21 | src |
257+
| xss-through-dom.js:139:11:139:52 | src | xss-through-dom.js:140:19:140:21 | src |
258+
| xss-through-dom.js:139:11:139:52 | src | xss-through-dom.js:141:25:141:27 | src |
259+
| xss-through-dom.js:139:11:139:52 | src | xss-through-dom.js:141:25:141:27 | src |
260+
| xss-through-dom.js:139:17:139:52 | documen ... k").src | xss-through-dom.js:139:11:139:52 | src |
261+
| xss-through-dom.js:139:17:139:52 | documen ... k").src | xss-through-dom.js:139:11:139:52 | src |
249262
#select
250263
| forms.js:9:31:9:40 | values.foo | forms.js:8:23:8:28 | values | forms.js:9:31:9:40 | values.foo | $@ is reinterpreted as HTML without escaping meta-characters. | forms.js:8:23:8:28 | values | DOM text |
251264
| forms.js:12:31:12:40 | values.bar | forms.js:11:24:11:29 | values | forms.js:12:31:12:40 | values.bar | $@ is reinterpreted as HTML without escaping meta-characters. | forms.js:11:24:11:29 | values | DOM text |
@@ -287,3 +300,5 @@ edges
287300
| xss-through-dom.js:131:19:131:26 | linkText | xss-through-dom.js:130:42:130:62 | dSelect ... tring() | xss-through-dom.js:131:19:131:26 | linkText | $@ is reinterpreted as HTML without escaping meta-characters. | xss-through-dom.js:130:42:130:62 | dSelect ... tring() | DOM text |
288301
| xss-through-dom.js:132:16:132:23 | linkText | xss-through-dom.js:130:17:130:37 | wSelect ... tring() | xss-through-dom.js:132:16:132:23 | linkText | $@ is reinterpreted as HTML without escaping meta-characters. | xss-through-dom.js:130:17:130:37 | wSelect ... tring() | DOM text |
289302
| xss-through-dom.js:132:16:132:23 | linkText | xss-through-dom.js:130:42:130:62 | dSelect ... tring() | xss-through-dom.js:132:16:132:23 | linkText | $@ is reinterpreted as HTML without escaping meta-characters. | xss-through-dom.js:130:42:130:62 | dSelect ... tring() | DOM text |
303+
| xss-through-dom.js:140:19:140:21 | src | xss-through-dom.js:139:17:139:52 | documen ... k").src | xss-through-dom.js:140:19:140:21 | src | $@ is reinterpreted as HTML without escaping meta-characters. | xss-through-dom.js:139:17:139:52 | documen ... k").src | DOM text |
304+
| xss-through-dom.js:141:25:141:27 | src | xss-through-dom.js:139:17:139:52 | documen ... k").src | xss-through-dom.js:141:25:141:27 | src | $@ is reinterpreted as HTML without escaping meta-characters. | xss-through-dom.js:139:17:139:52 | documen ... k").src | DOM text |

‎javascript/ql/test/query-tests/Security/CWE-079/XssThroughDom/xss-through-dom.js

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -131,4 +131,12 @@ class Sub extends Super {
131131
elem.innerHTML = linkText; // NOT OK
132132
$("#id").html(linkText); // NOT OK
133133
elem.innerText = linkText; // OK
134+
})();
135+
136+
const cashDom = require("cash-dom");
137+
138+
(function () {
139+
const src = document.getElementById("#link").src;
140+
cash("#id").html(src); // NOT OK.
141+
cashDom("#id").html(src); // NOT OK
134142
})();

0 commit comments

Comments
 (0)