Skip to content

Commit df2faae

Browse files
NapalysNapalys
committed
Enhance Firebase model with push, order* and limitToFirst members.
1 parent 009ff29 commit df2faae

File tree

4 files changed

+33
-5
lines changed

4 files changed

+33
-5
lines changed

Diff for: ‎javascript/ql/lib/ext/firebase.model.yml

+5-5
Original file line numberDiff line numberDiff line change
@@ -5,15 +5,15 @@ extensions:
55
data:
66
- ["FirebaseDBRef", "firebase/app", "Member[database].ReturnValue"]
77
- ["FirebaseDBRef", "FirebaseDBRef", "Member[ref,refFromURL].ReturnValue"]
8-
- ["FirebaseDBRef", "FirebaseDBRef", "Member[child,once,on].ReturnValue"]
8+
- ["FirebaseDBRef", "FirebaseDBRef", "Member[child,once,on,push].ReturnValue"]
99
- ["FirebaseDBRef", "FirebaseDBRef", "Member[ref,root,parent,before,after]"]
10-
- ["FirebaseDBRef", "FirebaseDBRef", "Member[endAt,startAt,orderByChild,orderByKey,equalTo,limitToLast].ReturnValue"]
10+
- ["FirebaseDBRef", "FirebaseDBRef", "Member[endAt,startAt,orderByChild,orderByKey,orderByValue,orderByPriority,equalTo,limitToLast,limitToFirst].ReturnValue"]
1111
- ["FirebaseDBRef", "FirebaseDBRef", "Member[onCreate,onUpdate,onWrite,onDelete,transaction,then,forEach].Argument[0].Parameter[0]"]
1212
- ["FirebaseDBRef", "FirebaseDBRef", "Member[once,on].Argument[1].Parameter[0]"]
13-
- ["FirebaseDBRef", "firebase-functions", "Member[database].Member[ref,refFromURL].ReturnValue"]
14-
- ["FirebaseDBRef", "firebase-admin", "Member[database].ReturnValue.Member[ref,refFromURL].ReturnValue"]
13+
- ["FirebaseDBRef", "firebase-functions", "Member[database]"]
14+
- ["FirebaseDBRef", "firebase-admin", "Member[database].ReturnValue"]
1515
- ["FirebaseApp", "firebase-admin", "Member[initializeApp,app].ReturnValue"]
16-
- ["FirebaseDBRef", "FirebaseApp", "Member[database].ReturnValue.Member[ref,refFromURL].ReturnValue"]
16+
- ["FirebaseDBRef", "FirebaseApp", "Member[database].ReturnValue"]
1717

1818
- addsTo:
1919
pack: codeql/javascript-all

Diff for: ‎javascript/ql/test/query-tests/Security/CWE-079/DomBasedXss/Xss.expected

+8
Original file line numberDiff line numberDiff line change
@@ -74,6 +74,7 @@
7474
| firebase-client.js:38:56:38:67 | userData.bio | firebase-client.js:37:22:37:35 | snapshot.val() | firebase-client.js:38:56:38:67 | userData.bio | Cross-site scripting vulnerability due to $@. | firebase-client.js:37:22:37:35 | snapshot.val() | user-provided value |
7575
| firebase-client.js:44:55:44:74 | parentSnapshot.val() | firebase-client.js:44:55:44:74 | parentSnapshot.val() | firebase-client.js:44:55:44:74 | parentSnapshot.val() | Cross-site scripting vulnerability due to $@. | firebase-client.js:44:55:44:74 | parentSnapshot.val() | user-provided value |
7676
| firebase-client.js:52:57:52:70 | snapshot.val() | firebase-client.js:52:57:52:70 | snapshot.val() | firebase-client.js:52:57:52:70 | snapshot.val() | Cross-site scripting vulnerability due to $@. | firebase-client.js:52:57:52:70 | snapshot.val() | user-provided value |
77+
| firebase-client.js:66:34:66:57 | "<p>" + ... "</p>" | firebase-client.js:65:23:65:36 | snapshot.val() | firebase-client.js:66:34:66:57 | "<p>" + ... "</p>" | Cross-site scripting vulnerability due to $@. | firebase-client.js:65:23:65:36 | snapshot.val() | user-provided value |
7778
| jquery.js:7:5:7:34 | "<div i ... + "\\">" | jquery.js:2:17:2:40 | documen ... .search | jquery.js:7:5:7:34 | "<div i ... + "\\">" | Cross-site scripting vulnerability due to $@. | jquery.js:2:17:2:40 | documen ... .search | user-provided value |
7879
| jquery.js:8:18:8:34 | "XSS: " + tainted | jquery.js:2:17:2:40 | documen ... .search | jquery.js:8:18:8:34 | "XSS: " + tainted | Cross-site scripting vulnerability due to $@. | jquery.js:2:17:2:40 | documen ... .search | user-provided value |
7980
| jquery.js:10:5:10:40 | "<b>" + ... "</b>" | jquery.js:10:13:10:20 | location | jquery.js:10:5:10:40 | "<b>" + ... "</b>" | Cross-site scripting vulnerability due to $@. | jquery.js:10:13:10:20 | location | user-provided value |
@@ -373,6 +374,9 @@ edges
373374
| firebase-client.js:37:11:37:35 | userData | firebase-client.js:38:56:38:63 | userData | provenance | |
374375
| firebase-client.js:37:22:37:35 | snapshot.val() | firebase-client.js:37:11:37:35 | userData | provenance | |
375376
| firebase-client.js:38:56:38:63 | userData | firebase-client.js:38:56:38:67 | userData.bio | provenance | |
377+
| firebase-client.js:65:13:65:44 | message | firebase-client.js:66:42:66:48 | message | provenance | |
378+
| firebase-client.js:65:23:65:36 | snapshot.val() | firebase-client.js:65:13:65:44 | message | provenance | |
379+
| firebase-client.js:66:42:66:48 | message | firebase-client.js:66:34:66:57 | "<p>" + ... "</p>" | provenance | |
376380
| jquery.js:2:7:2:40 | tainted | jquery.js:4:5:4:11 | tainted | provenance | |
377381
| jquery.js:2:7:2:40 | tainted | jquery.js:5:13:5:19 | tainted | provenance | |
378382
| jquery.js:2:7:2:40 | tainted | jquery.js:6:11:6:17 | tainted | provenance | |
@@ -996,6 +1000,10 @@ nodes
9961000
| firebase-client.js:38:56:38:67 | userData.bio | semmle.label | userData.bio |
9971001
| firebase-client.js:44:55:44:74 | parentSnapshot.val() | semmle.label | parentSnapshot.val() |
9981002
| firebase-client.js:52:57:52:70 | snapshot.val() | semmle.label | snapshot.val() |
1003+
| firebase-client.js:65:13:65:44 | message | semmle.label | message |
1004+
| firebase-client.js:65:23:65:36 | snapshot.val() | semmle.label | snapshot.val() |
1005+
| firebase-client.js:66:34:66:57 | "<p>" + ... "</p>" | semmle.label | "<p>" + ... "</p>" |
1006+
| firebase-client.js:66:42:66:48 | message | semmle.label | message |
9991007
| jquery.js:2:7:2:40 | tainted | semmle.label | tainted |
10001008
| jquery.js:2:17:2:40 | documen ... .search | semmle.label | documen ... .search |
10011009
| jquery.js:4:5:4:11 | tainted | semmle.label | tainted |

Diff for: ‎javascript/ql/test/query-tests/Security/CWE-079/DomBasedXss/XssWithAdditionalSources.expected

+7
Original file line numberDiff line numberDiff line change
@@ -175,6 +175,10 @@ nodes
175175
| firebase-client.js:38:56:38:67 | userData.bio | semmle.label | userData.bio |
176176
| firebase-client.js:44:55:44:74 | parentSnapshot.val() | semmle.label | parentSnapshot.val() |
177177
| firebase-client.js:52:57:52:70 | snapshot.val() | semmle.label | snapshot.val() |
178+
| firebase-client.js:65:13:65:44 | message | semmle.label | message |
179+
| firebase-client.js:65:23:65:36 | snapshot.val() | semmle.label | snapshot.val() |
180+
| firebase-client.js:66:34:66:57 | "<p>" + ... "</p>" | semmle.label | "<p>" + ... "</p>" |
181+
| firebase-client.js:66:42:66:48 | message | semmle.label | message |
178182
| hana.js:11:37:11:40 | rows | semmle.label | rows |
179183
| hana.js:11:37:11:51 | rows[0].comment | semmle.label | rows[0].comment |
180184
| hana.js:16:37:16:40 | rows | semmle.label | rows |
@@ -850,6 +854,9 @@ edges
850854
| firebase-client.js:37:11:37:35 | userData | firebase-client.js:38:56:38:63 | userData | provenance | |
851855
| firebase-client.js:37:22:37:35 | snapshot.val() | firebase-client.js:37:11:37:35 | userData | provenance | |
852856
| firebase-client.js:38:56:38:63 | userData | firebase-client.js:38:56:38:67 | userData.bio | provenance | |
857+
| firebase-client.js:65:13:65:44 | message | firebase-client.js:66:42:66:48 | message | provenance | |
858+
| firebase-client.js:65:23:65:36 | snapshot.val() | firebase-client.js:65:13:65:44 | message | provenance | |
859+
| firebase-client.js:66:42:66:48 | message | firebase-client.js:66:34:66:57 | "<p>" + ... "</p>" | provenance | |
853860
| hana.js:11:37:11:40 | rows | hana.js:11:37:11:51 | rows[0].comment | provenance | |
854861
| hana.js:16:37:16:40 | rows | hana.js:16:37:16:51 | rows[0].comment | provenance | |
855862
| hana.js:19:37:19:40 | rows | hana.js:19:37:19:51 | rows[0].comment | provenance | |

Diff for: ‎javascript/ql/test/query-tests/Security/CWE-079/DomBasedXss/firebase-client.js

+13
Original file line numberDiff line numberDiff line change
@@ -53,3 +53,16 @@ function fun2(category){
5353
return dbRef.remove();
5454
});
5555
}
56+
57+
function fun3(){
58+
const messagesRef = firebase.database().ref("messages");
59+
const userInput = "<script>alert('XSS');</script>";
60+
const newMessageRef = messagesRef.push({
61+
message: userInput
62+
});
63+
64+
newMessageRef.once("value", (snapshot) => {
65+
const message = snapshot.val().message; // $ Source
66+
document.body.innerHTML += "<p>" + message + "</p>"; // $ Alert
67+
});
68+
}

0 commit comments

Comments
 (0)