add dataflow barrier for if(xrandr)

erik-krogh · erik-krogh · commit 1f7dda7fbc07 · 2020-02-06T12:55:44.000+01:00
diff --git a/javascript/ql/src/Security/CWE-400/PrototypePollutionUtility.ql b/javascript/ql/src/Security/CWE-400/PrototypePollutionUtility.ql
@@ -348,17 +348,6 @@ class PropNameTracking extends DataFlow::Configuration {
     )
   }
 
-  override predicate isBarrier(DataFlow::Node node) {
-    super.isBarrier(node)
-    or
-    exists(ConditionGuardNode guard, SsaRefinementNode refinement |
-      node = DataFlow::ssaDefinitionNode(refinement) and
-      refinement.getGuard() = guard and
-      guard.getTest() instanceof VarAccess and
-      guard.getOutcome() = false
-    )
-  }
-
   override predicate isBarrierGuard(DataFlow::BarrierGuardNode node) {
     node instanceof BlacklistEqualityGuard or
     node instanceof WhitelistEqualityGuard or
diff --git a/javascript/ql/src/semmle/javascript/dataflow/Configuration.qll b/javascript/ql/src/semmle/javascript/dataflow/Configuration.qll
@@ -1480,3 +1480,18 @@ private class AdditionalBarrierGuardCall extends AdditionalBarrierGuardNode, Dat
 
   override predicate appliesTo(Configuration cfg) { f.appliesTo(cfg) }
 }
+
+/** A check of the `if(x)`, which sanitizes `x` in its "else" branch. */
+private class VarAccessBarrierGuard extends AdditionalBarrierGuardNode, DataFlow::Node {
+  VarAccess var;
+
+  VarAccessBarrierGuard() {
+    var = this.getEnclosingExpr()
+  }
+
+  override predicate blocks(boolean outcome, Expr e) {
+    var = e and outcome = false
+  }
+
+  override predicate appliesTo(Configuration cfg) { any() }
+}
diff --git a/javascript/ql/test/query-tests/Security/CWE-022/TaintedPath/TaintedPath.js b/javascript/ql/test/query-tests/Security/CWE-022/TaintedPath/TaintedPath.js
@@ -114,3 +114,27 @@ var server = http.createServer(function(req, res) {
 	               );
 
 });
+
+var server = http.createServer(function(req, res) {
+  let path = url.parse(req.url, true).query.path;
+  
+  if (path) { // sanitization
+    path = path.replace(/[\]\[*,;'"`<>\\?\/]/g, ''); // remove all invalid characters from states plus slashes
+    path = path.replace(/\.\./g, ''); // remove all ".."
+  }
+  
+  res.write(fs.readFileSync(path));  // OK. Is sanitized above.
+});
+
+var server = http.createServer(function(req, res) {
+  let path = url.parse(req.url, true).query.path;
+  
+  if (!path) {
+    
+  } else { // sanitization
+	  path = path.replace(/[\]\[*,;'"`<>\\?\/]/g, ''); // remove all invalid characters from states plus slashes
+    path = path.replace(/\.\./g, ''); // remove all ".."
+  }
+  
+  res.write(fs.readFileSync(path));  // OK. Is sanitized above.
+});
