From e87790b8284254f8e2aaffb526c3d1e632bc495b Mon Sep 17 00:00:00 2001 From: toufik-airane Date: Fri, 23 Oct 2020 15:37:59 +0200 Subject: [PATCH 1/3] Add ElectronShellOpenExternalSink class Add ElectronShellOpenExternalSink class to detect untrusted input interpreted by `openExternal` function call in `electron` module. Based on the #14 Electron Security checklist: https://www.electronjs.org/docs/tutorial/security#14-do-not-use-openexternal-with-untrusted-content --- .../security/dataflow/CodeInjectionCustomizations.qll | 11 +++++++++++ 1 file changed, 11 insertions(+) diff --git a/javascript/ql/src/semmle/javascript/security/dataflow/CodeInjectionCustomizations.qll b/javascript/ql/src/semmle/javascript/security/dataflow/CodeInjectionCustomizations.qll index 40b2951b55ff..af1ba595aed6 100644 --- a/javascript/ql/src/semmle/javascript/security/dataflow/CodeInjectionCustomizations.qll +++ b/javascript/ql/src/semmle/javascript/security/dataflow/CodeInjectionCustomizations.qll @@ -138,4 +138,15 @@ module CodeInjection { API::moduleImport("module").getInstance().getMember("_compile").getACall().getArgument(0) } } + + /** + * Improper use of openExternal can be leveraged to compromise the user's host. + * When openExternal is used with untrusted content, it can be leveraged to execute arbitrary commands. + */ + class ElectronShellOpenExternalSink extends Sink { + ElectronShellOpenExternalSink() { + this = + DataFlow::moduleMember("electron", "shell").getAMemberCall("openExternal").getArgument(0) + } + } } From 3ccdc2c5186aedba0e1bd853d0063b13e31b8017 Mon Sep 17 00:00:00 2001 From: toufik-airane Date: Fri, 23 Oct 2020 17:39:03 +0200 Subject: [PATCH 2/3] Update ElectronShellOpenExternalSink location Move the class ElectronShellOpenExternalSink to ClientSideUrlRedirect.qll. It's been to be a more appropriate location. --- .../security/dataflow/ClientSideUrlRedirect.qll | 11 +++++++++++ .../dataflow/CodeInjectionCustomizations.qll | 13 +------------ 2 files changed, 12 insertions(+), 12 deletions(-) diff --git a/javascript/ql/src/semmle/javascript/security/dataflow/ClientSideUrlRedirect.qll b/javascript/ql/src/semmle/javascript/security/dataflow/ClientSideUrlRedirect.qll index 58f59d1316d5..fe8265284d3b 100644 --- a/javascript/ql/src/semmle/javascript/security/dataflow/ClientSideUrlRedirect.qll +++ b/javascript/ql/src/semmle/javascript/security/dataflow/ClientSideUrlRedirect.qll @@ -60,4 +60,15 @@ module ClientSideUrlRedirect { guard instanceof HostnameSanitizerGuard } } + + /** + * Improper use of openExternal can be leveraged to compromise the user's host. + * When openExternal is used with untrusted content, it can be leveraged to execute arbitrary commands. + */ + class ElectronShellOpenExternalSink extends Sink { + ElectronShellOpenExternalSink() { + this = + DataFlow::moduleMember("electron", "shell").getAMemberCall("openExternal").getArgument(0) + } + } } diff --git a/javascript/ql/src/semmle/javascript/security/dataflow/CodeInjectionCustomizations.qll b/javascript/ql/src/semmle/javascript/security/dataflow/CodeInjectionCustomizations.qll index af1ba595aed6..86300b76f0b0 100644 --- a/javascript/ql/src/semmle/javascript/security/dataflow/CodeInjectionCustomizations.qll +++ b/javascript/ql/src/semmle/javascript/security/dataflow/CodeInjectionCustomizations.qll @@ -138,15 +138,4 @@ module CodeInjection { API::moduleImport("module").getInstance().getMember("_compile").getACall().getArgument(0) } } - - /** - * Improper use of openExternal can be leveraged to compromise the user's host. - * When openExternal is used with untrusted content, it can be leveraged to execute arbitrary commands. - */ - class ElectronShellOpenExternalSink extends Sink { - ElectronShellOpenExternalSink() { - this = - DataFlow::moduleMember("electron", "shell").getAMemberCall("openExternal").getArgument(0) - } - } -} +} \ No newline at end of file From 7d2741a287b7b2552634492e6ef409f290d6e996 Mon Sep 17 00:00:00 2001 From: toufik-airane Date: Fri, 23 Oct 2020 17:42:55 +0200 Subject: [PATCH 3/3] Add newline --- .../security/dataflow/CodeInjectionCustomizations.qll | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/javascript/ql/src/semmle/javascript/security/dataflow/CodeInjectionCustomizations.qll b/javascript/ql/src/semmle/javascript/security/dataflow/CodeInjectionCustomizations.qll index 86300b76f0b0..40b2951b55ff 100644 --- a/javascript/ql/src/semmle/javascript/security/dataflow/CodeInjectionCustomizations.qll +++ b/javascript/ql/src/semmle/javascript/security/dataflow/CodeInjectionCustomizations.qll @@ -138,4 +138,4 @@ module CodeInjection { API::moduleImport("module").getInstance().getMember("_compile").getACall().getArgument(0) } } -} \ No newline at end of file +}