Skip to content

Commit 119a6bc

Browse files
elizabethtlelizabethtl
committed
rename queries folder
1 parent 30b7870 commit 119a6bc

44 files changed

Lines changed: 1744 additions & 0 deletions

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

‎queries/codeql-pack.lock.yml‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,4 @@
1+
---
2+
lockVersion: 1.0.0
3+
dependencies: {}
4+
compiled: false

‎queries/dataflow/README.md‎

Lines changed: 25 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,25 @@
1+
# Dataflow Queries
2+
3+
The dataflow queries identify data flows from taint sources to taint sinks.
4+
5+
Files are named as: [source]-to-[sink].ql
6+
7+
The four taint sources are
8+
- workspace settings (config)
9+
- file reads (fileRead)
10+
- network responses (network)
11+
- web servers (webServer)
12+
13+
The three taint sinks are
14+
- shell commands (shell)
15+
- eval (eval)
16+
- file writes (fileWrite)
17+
18+
## Filters
19+
20+
The filters for the following are integrated into the corresponding queries.
21+
- file reads
22+
- network response
23+
- eval
24+
25+
Filters for the taint sink *file write* are implemented separately in [filter-file-write](./filter-file-write/). They identify flows to the filepath and content argument of a file write. Files are named as: [filepath]-[content].ql

‎queries/dataflow/config-to-eval.ql‎

Lines changed: 40 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,40 @@
1+
/////////////////////////////////
2+
// this query requires preprocessing to identify a workspace configuration node
3+
/////////////////////////////////
4+
5+
import javascript
6+
import DataFlow::PathGraph
7+
8+
class Configuration extends TaintTracking::Configuration {
9+
Configuration() { this = "Configuration" }
10+
11+
override predicate isSource(DataFlow::Node source) { any() }
12+
13+
override predicate isSink(DataFlow::Node sink) {
14+
exists(DirectEval eval | sink.getAstNode() = eval.getAChild())
15+
}
16+
}
17+
18+
from
19+
Configuration cfg,
20+
DataFlow::PathNode source,
21+
DataFlow::PathNode sink
22+
23+
24+
////////////////////////////////////////////////////////////
25+
// if preprocessing identified a workspace configuration node
26+
// the fileName can be replaced by the file where node was identified
27+
// the getConfiguration_node can be replaced by the line where node was identified
28+
////////////////////////////////////////////////////////////
29+
where
30+
source.getNode().getFile().getStem().toString().matches("%fileName%")
31+
and
32+
source.getNode().getStartLine() = ${getConfiguration_node}
33+
and
34+
source.getNode().toString().matches("%vscode%")
35+
and
36+
cfg.hasFlowPath(source, sink)
37+
38+
select
39+
sink.getNode(), source, sink, "eval depends on $@.",
40+
source.getNode(), "config"

‎queries/dataflow/config-to-fileWrite.ql‎

Lines changed: 39 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,39 @@
1+
/////////////////////////////////
2+
// this query requires preprocessing to identify a workspace configuration node
3+
/////////////////////////////////
4+
5+
import javascript
6+
import DataFlow::PathGraph
7+
8+
class Configuration extends TaintTracking::Configuration {
9+
Configuration() { this = "Configuration" }
10+
11+
override predicate isSource(DataFlow::Node source) { any() }
12+
13+
override predicate isSink(DataFlow::Node sink) {
14+
exists(FileSystemWriteAccess file | sink = file.getADataNode())
15+
}
16+
}
17+
18+
from
19+
Configuration cfg,
20+
DataFlow::PathNode source,
21+
DataFlow::PathNode sink
22+
23+
////////////////////////////////////////////////////////////
24+
// if preprocessing identified a workspace configuration node
25+
// the fileName can be replaced by the file where node was identified
26+
// the getConfiguration_node can be replaced by the line where node was identified
27+
////////////////////////////////////////////////////////////
28+
where
29+
source.getNode().getFile().getStem().toString().matches("%fileName%")
30+
and
31+
source.getNode().getStartLine() = ${getConfiguration_node}
32+
and
33+
source.getNode().toString().matches("%vscode%")
34+
and
35+
cfg.hasFlowPath(source, sink)
36+
37+
select
38+
sink.getNode(), source, sink, "file write depends on $@.",
39+
source.getNode(), "config"

‎queries/dataflow/config-to-shell.ql‎

Lines changed: 39 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,39 @@
1+
/////////////////////////////////
2+
// this query requires preprocessing to identify a workspace configuration node
3+
/////////////////////////////////import javascript
4+
5+
import javascript
6+
import DataFlow::PathGraph
7+
8+
class Configuration extends TaintTracking::Configuration {
9+
Configuration() { this = "Configuration" }
10+
11+
override predicate isSource(DataFlow::Node source) { any() }
12+
13+
override predicate isSink(DataFlow::Node sink) {
14+
exists(SystemCommandExecution shell | sink = shell.getACommandArgument())
15+
}
16+
}
17+
18+
from
19+
Configuration cfg,
20+
DataFlow::PathNode source,
21+
DataFlow::PathNode sink
22+
23+
////////////////////////////////////////////////////////////
24+
// if preprocessing identified a workspace configuration node
25+
// the fileName can be replaced by the file where node was identified
26+
// the getConfiguration_node can be replaced by the line where node was identified
27+
////////////////////////////////////////////////////////////
28+
where
29+
source.getNode().getFile().getStem().toString().matches("%fileName%")
30+
and
31+
source.getNode().getStartLine() = ${getConfiguration_node}
32+
and
33+
source.getNode().toString().matches("%vscode%")
34+
and
35+
cfg.hasFlowPath(source, sink)
36+
37+
select
38+
sink.getNode(), source, sink, "shell command depends on $@.",
39+
source.getNode(), "config"

‎queries/dataflow/fileRead-to-eval.ql‎

Lines changed: 54 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,54 @@
1+
import javascript
2+
import DataFlow::PathGraph
3+
4+
class Configuration extends TaintTracking::Configuration {
5+
Configuration() { this = "Configuration" }
6+
7+
override predicate isSource(DataFlow::Node source) {
8+
exists(FileSystemReadAccess src | source = src.getADataNode().getALocalSource())
9+
}
10+
11+
override predicate isSink(DataFlow::Node sink) {
12+
exists(DirectEval eval | sink.getAstNode() = eval.getAChild())
13+
}
14+
}
15+
16+
class FlowToRead extends TaintTracking::Configuration{
17+
FlowToRead(){ this = "FlowToRead" }
18+
19+
override predicate isSource(DataFlow::Node source) {
20+
exists(DataFlow::SourceNode src | source = src)
21+
}
22+
23+
override predicate isSink(DataFlow::Node sink) {
24+
exists(FileSystemReadAccess read | sink = read.getAPathArgument())
25+
}
26+
27+
}
28+
29+
from
30+
Configuration cfg,
31+
FlowToRead flowToRead,
32+
DataFlow::PathNode flow_source,
33+
DataFlow::PathNode flow_sink,
34+
DataFlow::PathNode read_source,
35+
DataFlow::PathNode read_sink,
36+
FileSystemReadAccess read
37+
38+
39+
where
40+
cfg.hasFlowPath(flow_source, flow_sink)
41+
and
42+
flowToRead.hasFlowPath(read_source, read_sink)
43+
and
44+
not flow_source.getNode() = flow_sink.getNode()
45+
and
46+
read.getAPathArgument() = read_sink.getNode()
47+
and
48+
read = flow_source.getNode()
49+
50+
select
51+
read_sink.getNode(), read_source, read_sink, "eval depends on $@. $@. $@",
52+
read_source.getNode(), "read source",
53+
flow_source.getNode(), "file",
54+
flow_sink.getNode(), "eval"

‎queries/dataflow/fileRead-to-fileWrite.ql‎

Lines changed: 54 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,54 @@
1+
import javascript
2+
import DataFlow::PathGraph
3+
4+
class Configuration extends TaintTracking::Configuration {
5+
Configuration() { this = "Configuration" }
6+
7+
override predicate isSource(DataFlow::Node source) {
8+
exists(FileSystemReadAccess src | source = src.getADataNode().getALocalSource())
9+
}
10+
11+
override predicate isSink(DataFlow::Node sink) {
12+
exists(FileSystemWriteAccess write | sink = write.getADataNode())
13+
}
14+
}
15+
16+
class FlowToRead extends TaintTracking::Configuration{
17+
FlowToRead(){ this = "FlowToRead" }
18+
19+
override predicate isSource(DataFlow::Node source) {
20+
exists(DataFlow::SourceNode src | source = src)
21+
}
22+
23+
override predicate isSink(DataFlow::Node sink) {
24+
exists(FileSystemReadAccess read | sink = read.getAPathArgument())
25+
}
26+
27+
}
28+
29+
from
30+
Configuration cfg,
31+
FlowToRead flowToRead,
32+
DataFlow::PathNode flow_source,
33+
DataFlow::PathNode flow_sink,
34+
DataFlow::PathNode read_source,
35+
DataFlow::PathNode read_sink,
36+
FileSystemReadAccess read
37+
38+
39+
where
40+
cfg.hasFlowPath(flow_source, flow_sink)
41+
and
42+
flowToRead.hasFlowPath(read_source, read_sink)
43+
and
44+
not flow_source.getNode() = flow_sink.getNode()
45+
and
46+
read.getAPathArgument() = read_sink.getNode()
47+
and
48+
read = flow_source.getNode()
49+
50+
select
51+
read_sink.getNode(), read_source, read_sink, "file write depends on $@. $@. $@",
52+
read_source.getNode(), "read source",
53+
flow_source.getNode(), "file read",
54+
flow_sink.getNode(), "file write"

‎queries/dataflow/fileRead-to-shell.ql‎

Lines changed: 54 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,54 @@
1+
import javascript
2+
import DataFlow::PathGraph
3+
4+
class Configuration extends TaintTracking::Configuration {
5+
Configuration() { this = "Configuration" }
6+
7+
override predicate isSource(DataFlow::Node source) {
8+
exists(FileSystemReadAccess src | source = src.getADataNode())
9+
}
10+
11+
override predicate isSink(DataFlow::Node sink) {
12+
exists(SystemCommandExecution shell | sink = shell.getACommandArgument())
13+
}
14+
}
15+
16+
class FlowToRead extends TaintTracking::Configuration{
17+
FlowToRead(){ this = "FlowToRead" }
18+
19+
override predicate isSource(DataFlow::Node source) {
20+
exists(DataFlow::SourceNode src | source = src)
21+
}
22+
23+
override predicate isSink(DataFlow::Node sink) {
24+
exists(FileSystemReadAccess read | sink = read.getAPathArgument())
25+
}
26+
27+
}
28+
29+
from
30+
Configuration cfg,
31+
FlowToRead flowToRead,
32+
DataFlow::PathNode flow_source,
33+
DataFlow::PathNode flow_sink,
34+
DataFlow::PathNode read_source,
35+
DataFlow::PathNode read_sink,
36+
FileSystemReadAccess read
37+
38+
39+
where
40+
cfg.hasFlowPath(flow_source, flow_sink)
41+
and
42+
flowToRead.hasFlowPath(read_source, read_sink)
43+
and
44+
not flow_source.getNode() = flow_sink.getNode()
45+
and
46+
read.getAPathArgument() = read_sink.getNode()
47+
and
48+
read = flow_source.getNode()
49+
50+
select
51+
read_sink.getNode(), read_source, read_sink, "shell command depends on $@. $@. $@",
52+
read_source.getNode(), "read source",
53+
flow_source.getNode(), "file",
54+
flow_sink.getNode(), "shell"

‎queries/dataflow/filter-file-write/README.md‎

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,5 @@
1+
this directory includes the combined queries to identify flows to two arguments of a file write
2+
- filepath
3+
- content
4+
5+
the files are named as: [filepath-source]-[content-source].ql

‎queries/dataflow/filter-file-write/config-config.ql‎

Lines changed: 57 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,57 @@
1+
// module in root folder
2+
import workspaceConfig
3+
4+
import javascript
5+
import DataFlow::PathGraph
6+
7+
8+
class FlowToWritePath extends TaintTracking::Configuration {
9+
FlowToWritePath() { this = "FlowToWritePath" }
10+
11+
override predicate isSource(DataFlow::Node source) {
12+
exists(VSCodeWorkspaceConfig config, DataFlow::SourceNode src |
13+
src.getFile() = config.getFile() and src.getStartLine() = config.getStartLine() |
14+
source = src)
15+
}
16+
17+
override predicate isSink(DataFlow::Node sink) {
18+
exists(FileSystemWriteAccess write | sink = write.getAPathArgument())
19+
}
20+
}
21+
class FlowToWriteContent extends TaintTracking::Configuration {
22+
FlowToWriteContent() { this = "FlowToWriteContent" }
23+
24+
override predicate isSource(DataFlow::Node source) {
25+
exists(VSCodeWorkspaceConfig config, DataFlow::SourceNode src |
26+
src.getFile() = config.getFile() and src.getStartLine() = config.getStartLine() |
27+
source = src)
28+
}
29+
30+
override predicate isSink(DataFlow::Node sink) {
31+
exists(FileSystemWriteAccess write | sink = write.getADataNode())
32+
}
33+
}
34+
35+
36+
from
37+
FlowToWritePath writepath, FlowToWriteContent writecontent,
38+
DataFlow::PathNode source_path, DataFlow::PathNode source_content,
39+
DataFlow::PathNode sink_path, DataFlow::PathNode sink_content,
40+
FileSystemWriteAccess filewrite_func
41+
42+
43+
where
44+
writepath.hasFlowPath(source_path, sink_path)
45+
and
46+
writecontent.hasFlowPath(source_content, sink_content)
47+
and
48+
filewrite_func.getADataNode() = sink_content.getNode()
49+
and
50+
filewrite_func.getAPathArgument() = sink_path.getNode()
51+
52+
53+
select
54+
sink_path.getNode(), source_path, sink_path, "file read or write depends on $@. $@. $@.",
55+
source_path.getNode(), "path source",
56+
source_content.getNode(), "content source",
57+
sink_content.getNode(), "content sink"

0 commit comments

Comments
 (0)