Skip to content

JS: recognize reading/wrinting calls to fstream#3451

Merged
semmle-qlci merged 3 commits into
github:masterfrom
erik-krogh:fstreamWrite
May 12, 2020
Merged

JS: recognize reading/wrinting calls to fstream#3451
semmle-qlci merged 3 commits into
github:masterfrom
erik-krogh:fstreamWrite

Conversation

@erik-krogh
Copy link
Copy Markdown
Contributor

Recognizes code like the below as a writing file-system call (and likewise for reading calls):

var Writer = require('fstream').Writer;
Writer({path: somePath});

This recognizes the sink in CVE-2018-1002203.

@erik-krogh erik-krogh requested a review from a team as a code owner May 12, 2020 12:24
@erik-krogh erik-krogh added the JS label May 12, 2020
@esbena
Copy link
Copy Markdown
Contributor

esbena commented May 12, 2020

LGTM. I wonder how many other missing extends FileSystemWriteAccess we are missing in general. I would have expected extends FileSystemAccess to be sufficient.

@semmle-qlci semmle-qlci merged commit 6fb047a into github:master May 12, 2020
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants