codeql_for_gadgets/query.ql at master · msrkp/codeql_for_gadgets · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
import javascript
import semmle.javascript.security.dataflow.DOM

/*
$( "#" + $.escapeSelector(window.location.hash.substr(1)) + "" ).trigger( 'click' );
*/

 class Source extends DataFlow::Node  {
    Source() { this = DOM::locationSource() }
  }

/*
from DataFlow::SourceNode n, DataFlow::CallNode call, JQuery::MethodCall mc
where
  n = jquery() and
  call = n.getACall() and
  mc = call.getAChainedMethodCall("trigger") and
mc.getArgument(0).toString().matches("%click%")
select call.getArgument(0), mc.getArgument(0).toString()
*/
 class Configuration extends TaintTracking::Configuration {

   Configuration() { this = "gadgets1" }

   override predicate isSource(DataFlow::Node source) {
       source instanceof Source
   }

   override predicate isSink(DataFlow::Node sink) {
     exists( DataFlow::SourceNode n, DataFlow::CallNode call, JQuery::MethodCall mc |
       n = jquery() and
       call = n.getACall() and
       mc = call.getAChainedMethodCall("trigger") and
       mc.getArgument(0).toString().matches("%click%") and
		sink = call.getArgument(0)

     )
   }
}

from Configuration cfg, DataFlow::PathNode source, DataFlow::PathNode sink
where cfg.hasFlowPath(source, sink)
select sink.getNode(), source, sink, "Found a gadget"