-
Notifications
You must be signed in to change notification settings - Fork 2k
JS: Taint propagation from low-level ArrayBuffer to Strings
#19231
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Merged
Merged
Changes from 9 commits
Commits
Show all changes
14 commits
Select commit
Hold shift + click to select a range
9388226
Added test case for `Uint8Array` and `TypedArray.prototype.buffer`
Napalys e23ff9c
Add TypedArrays flow summaries for `Uint8Array` and buffer property
Napalys d689a55
Added test cases for `TypedArray` methods
Napalys ff07ec8
Add flow summaries for TypedArray methods `set` and `subarray`
Napalys 0e09947
Added test cases for `ArrayBuffer` and `SharedArrayBuffer`
Napalys f427720
Add flow summaries and entry points for `ArrayBuffer` and `SharedArra…
Napalys f28478e
Add test cases from `TypedArrays` to strings.
Napalys b97c618
Add flow summaries and entry points for `TextDecoder`
Napalys 873db7c
Added change note
Napalys 4bc3e9e
Addressed comments
Napalys a3e4e62
Removed taint from `ArrayBuffer` constructor as it accepts `length`
Napalys 0c52b5a
Added summary flow for `StringFromCharCode`
Napalys e3f1720
Renamed`DecodeLike` to `Decode` and updated `propagatesFlow`
Napalys d0dcf89
Update javascript/ql/lib/semmle/javascript/internal/flow_summaries/St…
Napalys File filter
Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
There are no files selected for viewing
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,4 @@ | ||
| --- | ||
| category: minorAnalysis | ||
| --- | ||
| * Added taint propagation for `Uint8Array`, `ArrayBuffer`, `SharedArrayBuffer` and `TextDecoder.decode()`. |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
29 changes: 29 additions & 0 deletions
29
javascript/ql/lib/semmle/javascript/internal/flow_summaries/Decoders.qll
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,29 @@ | ||
| private import javascript | ||
| private import semmle.javascript.dataflow.FlowSummary | ||
| private import semmle.javascript.dataflow.InferredTypes | ||
| private import semmle.javascript.dataflow.internal.DataFlowPrivate as Private | ||
| private import FlowSummaryUtil | ||
|
|
||
| private class TextDecoderEntryPoint extends API::EntryPoint { | ||
| TextDecoderEntryPoint() { this = "global.TextDecoder" } | ||
|
|
||
| override DataFlow::SourceNode getASource() { result = DataFlow::globalVarRef("TextDecoder") } | ||
| } | ||
|
|
||
| pragma[nomagic] | ||
| API::Node textDecoderConstructorRef() { result = any(TextDecoderEntryPoint e).getANode() } | ||
|
|
||
| class DecodeLike extends SummarizedCallable { | ||
| DecodeLike() { this = "TextDecoder#decode" } | ||
|
|
||
| override InstanceCall getACall() { | ||
| result = | ||
| textDecoderConstructorRef().getAnInstantiation().getReturn().getMember("decode").getACall() | ||
| } | ||
|
|
||
| override predicate propagatesFlow(string input, string output, boolean preservesValue) { | ||
| preservesValue = true and | ||
|
Napalys marked this conversation as resolved.
Outdated
|
||
| input = "Argument[0]" and | ||
| output = "ReturnValue" | ||
| } | ||
| } | ||
111 changes: 111 additions & 0 deletions
111
javascript/ql/lib/semmle/javascript/internal/flow_summaries/TypedArrays.qll
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,111 @@ | ||
| private import javascript | ||
| private import semmle.javascript.dataflow.FlowSummary | ||
| private import semmle.javascript.dataflow.InferredTypes | ||
| private import semmle.javascript.dataflow.internal.DataFlowPrivate as Private | ||
| private import FlowSummaryUtil | ||
|
|
||
| private class TypedArrayEntryPoint extends API::EntryPoint { | ||
| TypedArrayEntryPoint() { this = "global.Uint8Array" } | ||
|
|
||
| override DataFlow::SourceNode getASource() { result = DataFlow::globalVarRef("Uint8Array") } | ||
| } | ||
|
|
||
| pragma[nomagic] | ||
| API::Node typedArrayConstructorRef() { result = any(TypedArrayEntryPoint e).getANode() } | ||
|
|
||
| class TypedArrayConstructorSummary extends SummarizedCallable { | ||
| TypedArrayConstructorSummary() { this = "TypedArray constructor" } | ||
|
|
||
| override DataFlow::InvokeNode getACall() { | ||
| result = typedArrayConstructorRef().getAnInstantiation() | ||
| } | ||
|
|
||
| override predicate propagatesFlow(string input, string output, boolean preservesValue) { | ||
| preservesValue = true and | ||
| input = "Argument[0].ArrayElement" and | ||
| output = "ReturnValue.ArrayElement" | ||
| } | ||
| } | ||
|
|
||
| class BufferTypedArray extends DataFlow::AdditionalFlowStep { | ||
| override predicate step(DataFlow::Node pred, DataFlow::Node succ) { | ||
| exists(DataFlow::PropRead p | | ||
| p = typedArrayConstructorRef().getInstance().getMember("buffer").asSource() and | ||
| pred = p.getBase() and | ||
| succ = p | ||
| ) | ||
| } | ||
| } | ||
|
|
||
| class SetLike extends SummarizedCallable { | ||
|
Napalys marked this conversation as resolved.
Outdated
|
||
| SetLike() { this = "TypedArray#set" } | ||
|
|
||
| override InstanceCall getACall() { | ||
| result = typedArrayConstructorRef().getAnInstantiation().getReturn().getMember("set").getACall() | ||
|
Napalys marked this conversation as resolved.
Outdated
|
||
| } | ||
|
|
||
| override predicate propagatesFlow(string input, string output, boolean preservesValue) { | ||
| preservesValue = true and | ||
| input = "Argument[0].ArrayElement" and | ||
| output = "Argument[this].ArrayElement" | ||
| } | ||
| } | ||
|
|
||
| class SubArrayLike extends SummarizedCallable { | ||
|
Napalys marked this conversation as resolved.
Outdated
|
||
| SubArrayLike() { this = "TypedArray#subarray" } | ||
|
|
||
| override InstanceCall getACall() { | ||
| result = | ||
| typedArrayConstructorRef().getAnInstantiation().getReturn().getMember("subarray").getACall() | ||
|
Napalys marked this conversation as resolved.
Outdated
|
||
| } | ||
|
|
||
| override predicate propagatesFlow(string input, string output, boolean preservesValue) { | ||
| preservesValue = true and | ||
| input = "Argument[this].ArrayElement" and | ||
| output = "ReturnValue.ArrayElement" | ||
| } | ||
| } | ||
|
|
||
| private class ArrayBufferEntryPoint extends API::EntryPoint { | ||
| ArrayBufferEntryPoint() { this = ["global.ArrayBuffer", "global.SharedArrayBuffer"] } | ||
|
|
||
| override DataFlow::SourceNode getASource() { | ||
| result = DataFlow::globalVarRef(["ArrayBuffer", "SharedArrayBuffer"]) | ||
| } | ||
| } | ||
|
|
||
| pragma[nomagic] | ||
| API::Node arrayBufferConstructorRef() { result = any(ArrayBufferEntryPoint a).getANode() } | ||
|
|
||
| class ArrayBufferConstructorSummary extends SummarizedCallable { | ||
| ArrayBufferConstructorSummary() { this = "ArrayBuffer constructor" } | ||
|
|
||
| override DataFlow::InvokeNode getACall() { | ||
| result = arrayBufferConstructorRef().getAnInstantiation() | ||
| } | ||
|
|
||
| override predicate propagatesFlow(string input, string output, boolean preservesValue) { | ||
| preservesValue = true and | ||
| input = "Argument[0].ArrayElement" and | ||
| output = "ReturnValue.ArrayElement" | ||
|
Napalys marked this conversation as resolved.
Outdated
|
||
| } | ||
| } | ||
|
|
||
| class TransferLike extends SummarizedCallable { | ||
| TransferLike() { this = "ArrayBuffer#transfer" } | ||
|
|
||
| override InstanceCall getACall() { | ||
| result = | ||
| arrayBufferConstructorRef() | ||
| .getAnInstantiation() | ||
| .getReturn() | ||
| .getMember(["transfer", "transferToFixedLength"]) | ||
| .getACall() | ||
|
Napalys marked this conversation as resolved.
Outdated
|
||
| } | ||
|
|
||
| override predicate propagatesFlow(string input, string output, boolean preservesValue) { | ||
| preservesValue = true and | ||
| input = "Argument[this].ArrayElement" and | ||
| output = "ReturnValue.ArrayElement" | ||
| } | ||
| } | ||
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
51 changes: 51 additions & 0 deletions
51
javascript/ql/test/library-tests/TaintTracking/typed-arrays.js
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,51 @@ | ||
| function test() { | ||
| let x = source(); | ||
|
|
||
| let y = new Uint8Array(x); | ||
| sink(y); // NOT OK | ||
|
|
||
| sink(y.buffer); // NOT OK | ||
| sink(y.length); | ||
|
|
||
| var arr = new Uint8Array(y.buffer, y.byteOffset, y.byteLength); | ||
| sink(arr); // NOT OK | ||
|
|
||
| const z = new Uint8Array([1, 2, 3]); | ||
| z.set(y, 3); | ||
| sink(z); // NOT OK | ||
|
|
||
| const sub = y.subarray(1, 3) | ||
| sink(sub); // NOT OK | ||
|
|
||
| const buffer = new ArrayBuffer(x); | ||
|
Napalys marked this conversation as resolved.
Outdated
|
||
| const view = new Uint8Array(buffer); | ||
| sink(view); // NOT OK | ||
|
|
||
| const sharedBuffer = new SharedArrayBuffer(x); | ||
| const view1 = new Uint8Array(sharedBuffer); | ||
| sink(view1); // NOT OK | ||
|
|
||
| const transfered = buffer.transfer(); | ||
| const transferedView = new Uint8Array(transfered); | ||
| sink(transferedView); // NOT OK | ||
|
|
||
| const transfered2 = buffer.transferToFixedLength(); | ||
| const transferedView2 = new Uint8Array(transfered2); | ||
| sink(transferedView2); // NOT OK | ||
|
|
||
| var typedArrayToString = (function () { | ||
| return function (a) { return String.fromCharCode.apply(null, a); }; | ||
| })(); | ||
|
|
||
| sink(typedArrayToString(y)); // NOT OK -- Should be flagged but it is not. | ||
|
Napalys marked this conversation as resolved.
Outdated
|
||
|
|
||
| let str = ''; | ||
| for (let i = 0; i < y.length; i++) | ||
| str += String.fromCharCode(y[i]); | ||
|
|
||
| sink(str); // NOT OK | ||
|
|
||
| const decoder = new TextDecoder('utf-8'); | ||
| const str2 = decoder.decode(y); | ||
| sink(str2); // NOT OK | ||
| } | ||
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Uh oh!
There was an error while loading. Please reload this page.