Create query for vulnerability not specific to webapp security

javascript/frameworks/ui5/ext/ui5.model.yml

@@ -57,6 +57,13 @@ extensions:
       - ["UI5Control", "sap/ui/richtexteditor/RichTextEditor", ""]
       - ["UI5CodeEditor", "UI5CodeEditor", "Instance"]
       - ["UI5CodeEditor", "sap/ui/codeeditor/CodeEditor", ""]
+      # Classes that provide Path injection APIs
+      - ["UI5ClientStorage", "sap/ui/util/Storage", ""]
+      - ["UI5ClientStorage", "global", "Member[sap].Member[ui].Member[util].Member[Storage]"]
+      - ["UI5ClientStorage", "global", "Member[jQuery].Member[sap].Member[storage]"]
+      - ["UI5ClientStorage", "sap/ui/core/util/File", ""]
+      - ["UI5ClientStorage", "global", "Member[sap].Member[ui].Member[core].Member[util].Member[File]"]
+
 
   - addsTo:
       pack: codeql/javascript-all
@@ -94,6 +101,8 @@ extensions:
       - ["ResourceBundle", "Member[create].Argument[0]", "ui5-path-injection"]
       - ["Properties", "Member[create].Argument[0]", "ui5-path-injection"]
       - ["LoaderExtensions", "Member[registerResourcePath].Argument[1]", "ui5-path-injection"]
+      - ["UI5ClientStorage", "Member[put].Argument[0]", "ui5-path-injection"]
+      - ["UI5ClientStorage", "Member[save].Argument[1]", "ui5-path-injection"]
 
   - addsTo:
       pack: codeql/javascript-all

javascript/frameworks/ui5/lib/advanced_security/javascript/frameworks/ui5/UI5FormulaInjectionQuery.qll

@@ -0,0 +1,132 @@
+import javascript
+import advanced_security.javascript.frameworks.ui5.dataflow.DataFlow
+
+/**
+ * Call to [`sap.ui.util.Storage.put`](https://sapui5.hana.ondemand.com/sdk/#/api/module:sap/ui/util/Storage%23methods/put)
+ *  or its jQuery counterpart, [`jQuery.sap.Storage.put`](https://sapui5.hana.ondemand.com/sdk/#/api/jQuery.sap.storage%23methods/jQuery.sap.storage.put).
+ */
+private class StoragePutCall extends CallNode {
+  StoragePutCall() {
+    /* 1. This is a call to `sap.ui.util.Storage.put` */
+    // 1-1. Required from `sap/ui/util/Storage`
+    exists(RequiredObject storageClass |
+      this.getReceiver().getALocalSource() = storageClass and
+      this.getCalleeName() = "put"
+    )
+    or
+    // 1-2. Direct call to `sap.ui.util.Storage.put`
+    this =
+      globalVarRef("sap")
+          .getAPropertyRead("ui")
+          .getAPropertyRead("util")
+          .getAPropertyRead("Storage")
+          .getAMemberCall("put")
+    or
+    /* 2. This is a call to `jQuery.sap.storage.put` */
+    this =
+      globalVarRef("jQuery")
+          .getAPropertyRead("sap")
+          .getAPropertyRead("storage")
+          .getAMemberCall("put")
+  }
+
+  string getKeyName() {
+    result = this.getArgument(0).getALocalSource().asExpr().(StringLiteral).getValue()
+  }
+
+  string getContentToBeSaved() {
+    result = this.getArgument(1).getALocalSource().asExpr().(StringLiteral).getValue()
+  }
+}
+
+/**
+ * Call to [`sap.ui.core.util.File.save`](https://sapui5.hana.ondemand.com/sdk/#/api/sap.ui.core.util.File%23methods/sap.ui.core.util.File.save).
+ */
+private class FileSaveCall extends CallNode {
+  FileSaveCall() {
+    /* 1. Required from `sap/ui/core/util/File` */
+    exists(RequiredObject fileClass |
+      this.getReceiver().getALocalSource() = fileClass and
+      this.getCalleeName() = "save"
+    )
+    or
+    /* 2. Direct call to `sap.ui.core.util.File.save` */
+    this =
+      globalVarRef("sap")
+          .getAPropertyRead("ui")
+          .getAPropertyRead("core")
+          .getAPropertyRead("util")
+          .getAPropertyRead("File")
+          .getAMemberCall("save")
+  }
+
+  /**
+   * Gets the MIME type the file will saved under.
+   */
+  string getMimeType() {
+    result = this.getArgument(3).getALocalSource().asExpr().(StringLiteral).getValue()
+  }
+
+  /**
+   * Gets the file extension to be attached to the filename.
+   */
+  string getExtension() {
+    result = this.getArgument(2).getALocalSource().asExpr().(StringLiteral).getValue()
+  }
+
+  /**
+   * Holds if the file MIME type is `"text/csv"`.
+   */
+  predicate mimeTypeIsCsv() { this.getMimeType() = "text/csv" }
+
+  /**
+   * Holds if the file MIME type is `"application/json"`.
+   */
+  predicate mimeTypeIsJson() { this.getMimeType() = "application/json" }
+
+  /**
+   * Holds if the file extension is `"csv"`. It can be used as a fallback
+   * to detect a CSV data being written if `this.mimeTypeIsCsv()` fails.
+   */
+  predicate extensionIsCsv() { this.getExtension() = "csv" }
+
+  /**
+   * Holds if the file extension is `"json"`. It can be used as a fallback
+   * to detect a JSON data being written if `this.mimeTypeIsJson()` fails.
+   */
+  predicate extensionIsJson() { this.getExtension() = "json" }
+
+  /**
+   * Gets the content object to be saved into the file.
+   */
+  DataFlow::Node getContentToBeSaved() { result = this.getArgument(0) }
+
+  /**
+   * Gets the path the file will be saved under.
+   */
+  string getPathToBeSavedUnder() {
+    result = this.getArgument(1).getALocalSource().asExpr().(StringLiteral).getValue()
+  }
+}
+
+class UI5FormulaInjectionConfiguration extends TaintTracking::Configuration {
+  UI5FormulaInjectionConfiguration() { this = "UI5 Formula Injection" }
+
+  override predicate isSource(DataFlow::Node node) { node instanceof RemoteFlowSource }
+
+  override predicate isSink(DataFlow::Node node) {
+    exists(StoragePutCall storagePutCall | node = storagePutCall.getArgument(1))
+    or
+    exists(FileSaveCall fileSaveCall |
+      node = fileSaveCall.getArgument(0) and
+      (
+        /* 1. Primary check: match on the MIME type */
+        fileSaveCall.mimeTypeIsCsv() or
+        fileSaveCall.mimeTypeIsJson() or
+        /* 2. Fallback check: match on the file extension */
+        fileSaveCall.extensionIsCsv() or
+        fileSaveCall.extensionIsJson()
+      )
+    )
+  }
+}

javascript/frameworks/ui5/src/UI5FormulaInjection/UI5FormulaInjection.ql

@@ -0,0 +1,26 @@
+/**
+ * @name UI5 Formula Injection
+ * @description Saving data from an uncontrolled remote source using filesystem or local storage
+ *              leads to disclosure of sensitive information or forgery of entry.
+ * @kind path-problem
+ * @problem.severity error
+ * @security-severity 7.8
+ * @precision medium
+ * @id js/ui5-formula-injection
+ * @tags security
+ *       external/cwe/cwe-1236
+ */
+
+import javascript
+import advanced_security.javascript.frameworks.ui5.dataflow.DataFlow
+import advanced_security.javascript.frameworks.ui5.dataflow.DataFlow::UI5PathGraph
+import advanced_security.javascript.frameworks.ui5.UI5FormulaInjectionQuery
+
+from
+  UI5FormulaInjectionConfiguration config, UI5PathNode source, UI5PathNode sink,
+  UI5PathNode primarySource
+where
+  config.hasFlowPath(source.getPathNode(), sink.getPathNode()) and
+  primarySource = source.getAPrimarySource()
+select sink, primarySource, sink, "The content of a saved file depends on a $@.", primarySource,
+  "user-provided value"

javascript/frameworks/ui5/src/UI5PathInjection/UI5PathInjection.ql

@@ -0,0 +1,37 @@
+/**
+ * @name UI5 Path Injection
+ * @description Constructing path from an uncontrolled remote source to be passed
+ *              to a filesystem API allows for manipulation of the local filesystem.
+ * @kind path-problem
+ * @problem.severity error
+ * @security-severity 7.8
+ * @precision medium
+ * @id js/ui5-path-injection
+ * @tags security
+ *       external/cwe/cwe-022
+ *       external/cwe/cwe-035
+ */
+
+import javascript
+import advanced_security.javascript.frameworks.ui5.dataflow.DataFlow
+import advanced_security.javascript.frameworks.ui5.dataflow.DataFlow::UI5PathGraph
+
+// import semmle.javascript.security.dataflow.TaintedPathQuery as TaintedPathQuery
+class UI5PathInjectionConfiguration extends TaintTracking::Configuration {
+  UI5PathInjectionConfiguration() { this = "UI5 Path Injection" }
+
+  override predicate isSource(DataFlow::Node node) { node instanceof RemoteFlowSource }
+
+  override predicate isSink(DataFlow::Node node) {
+    node = ModelOutput::getASinkNode("ui5-path-injection").asSink()
+  }
+}
+
+from
+  UI5PathInjectionConfiguration config, UI5PathNode source, UI5PathNode sink,
+  UI5PathNode primarySource
+where
+  config.hasFlowPath(source.getPathNode(), sink.getPathNode()) and
+  primarySource = source.getAPrimarySource()
+select sink, primarySource, sink, "The path of a saved file depends on a $@.", primarySource,
+  "user-provided value"

javascript/frameworks/ui5/test/models/sink/formulaSinkTest.expected

@@ -0,0 +1,7 @@
+| sink.js:118:36:118:40 | code1 | code1 |
+| sink.js:119:48:119:52 | code1 | code1 |
+| sink.js:120:47:120:51 | code1 | code1 |
+| sink.js:122:27:122:31 | code0 | code0 |
+| sink.js:123:27:123:31 | code0 | code0 |
+| sink.js:125:44:125:48 | code0 | code0 |
+| sink.js:126:44:126:48 | code0 | code0 |

javascript/frameworks/ui5/test/models/sink/formulaSinkTest.ql

@@ -0,0 +1,14 @@
+/**
+ * @id formula-injection-sinks
+ * @name Formula injection sinks
+ * @kind problem
+ * @problem.severity error
+ */
+
+import javascript
+import advanced_security.javascript.frameworks.ui5.UI5FormulaInjectionQuery
+import advanced_security.javascript.frameworks.ui5.dataflow.DataFlow as UI5DataFlow
+
+from UI5FormulaInjectionConfiguration config, DataFlow::Node sink
+where config.isSink(sink)
+select sink, sink.toString()

javascript/frameworks/ui5/test/models/sink/logSinkTest.expected

@@ -1,56 +1,56 @@
-| sink.js:20:38:20:42 | code0 | SAP UI5 log injection sink with kind: ui5-log-injection |
-| sink.js:20:45:20:49 | code1 | SAP UI5 log injection sink with kind: ui5-log-injection |
-| sink.js:20:52:20:56 | code2 | SAP UI5 log injection sink with kind: ui5-log-injection |
-| sink.js:21:38:21:42 | code0 | SAP UI5 log injection sink with kind: ui5-log-injection |
-| sink.js:21:45:21:49 | code1 | SAP UI5 log injection sink with kind: ui5-log-injection |
-| sink.js:21:52:21:56 | code2 | SAP UI5 log injection sink with kind: ui5-log-injection |
-| sink.js:23:40:23:44 | code0 | SAP UI5 log injection sink with kind: ui5-log-injection |
-| sink.js:23:47:23:51 | code1 | SAP UI5 log injection sink with kind: ui5-log-injection |
-| sink.js:23:54:23:58 | code2 | SAP UI5 log injection sink with kind: ui5-log-injection |
-| sink.js:25:37:25:41 | code0 | SAP UI5 log injection sink with kind: ui5-log-injection |
-| sink.js:25:44:25:48 | code1 | SAP UI5 log injection sink with kind: ui5-log-injection |
-| sink.js:25:51:25:55 | code2 | SAP UI5 log injection sink with kind: ui5-log-injection |
-| sink.js:27:38:27:42 | code0 | SAP UI5 log injection sink with kind: ui5-log-injection |
-| sink.js:27:45:27:49 | code1 | SAP UI5 log injection sink with kind: ui5-log-injection |
-| sink.js:27:52:27:56 | code2 | SAP UI5 log injection sink with kind: ui5-log-injection |
-| sink.js:29:38:29:42 | code0 | SAP UI5 log injection sink with kind: ui5-log-injection |
-| sink.js:29:45:29:49 | code1 | SAP UI5 log injection sink with kind: ui5-log-injection |
-| sink.js:29:52:29:56 | code2 | SAP UI5 log injection sink with kind: ui5-log-injection |
-| sink.js:33:27:33:31 | code0 | SAP UI5 log injection sink with kind: ui5-log-injection |
-| sink.js:33:34:33:38 | code1 | SAP UI5 log injection sink with kind: ui5-log-injection |
-| sink.js:33:41:33:45 | code2 | SAP UI5 log injection sink with kind: ui5-log-injection |
-| sink.js:35:27:35:31 | code0 | SAP UI5 log injection sink with kind: ui5-log-injection |
-| sink.js:35:34:35:38 | code1 | SAP UI5 log injection sink with kind: ui5-log-injection |
-| sink.js:35:41:35:45 | code2 | SAP UI5 log injection sink with kind: ui5-log-injection |
-| sink.js:37:29:37:33 | code0 | SAP UI5 log injection sink with kind: ui5-log-injection |
-| sink.js:37:36:37:40 | code1 | SAP UI5 log injection sink with kind: ui5-log-injection |
-| sink.js:37:43:37:47 | code2 | SAP UI5 log injection sink with kind: ui5-log-injection |
-| sink.js:39:26:39:30 | code0 | SAP UI5 log injection sink with kind: ui5-log-injection |
-| sink.js:39:33:39:37 | code1 | SAP UI5 log injection sink with kind: ui5-log-injection |
-| sink.js:39:40:39:44 | code2 | SAP UI5 log injection sink with kind: ui5-log-injection |
-| sink.js:41:27:41:31 | code0 | SAP UI5 log injection sink with kind: ui5-log-injection |
-| sink.js:41:34:41:38 | code1 | SAP UI5 log injection sink with kind: ui5-log-injection |
-| sink.js:41:41:41:45 | code2 | SAP UI5 log injection sink with kind: ui5-log-injection |
-| sink.js:43:27:43:31 | code0 | SAP UI5 log injection sink with kind: ui5-log-injection |
-| sink.js:43:34:43:38 | code1 | SAP UI5 log injection sink with kind: ui5-log-injection |
-| sink.js:43:41:43:45 | code2 | SAP UI5 log injection sink with kind: ui5-log-injection |
-| sink.js:45:42:45:46 | code1 | SAP UI5 log injection sink with kind: ui5-log-injection |
-| sink.js:74:36:74:40 | code0 | SAP UI5 log injection sink with kind: ui5-log-injection |
-| sink.js:74:43:74:47 | code1 | SAP UI5 log injection sink with kind: ui5-log-injection |
-| sink.js:74:50:74:54 | code2 | SAP UI5 log injection sink with kind: ui5-log-injection |
-| sink.js:75:36:75:40 | code0 | SAP UI5 log injection sink with kind: ui5-log-injection |
-| sink.js:75:43:75:47 | code1 | SAP UI5 log injection sink with kind: ui5-log-injection |
-| sink.js:75:50:75:54 | code2 | SAP UI5 log injection sink with kind: ui5-log-injection |
-| sink.js:76:38:76:42 | code0 | SAP UI5 log injection sink with kind: ui5-log-injection |
-| sink.js:76:45:76:49 | code1 | SAP UI5 log injection sink with kind: ui5-log-injection |
-| sink.js:76:52:76:56 | code2 | SAP UI5 log injection sink with kind: ui5-log-injection |
-| sink.js:77:35:77:39 | code0 | SAP UI5 log injection sink with kind: ui5-log-injection |
-| sink.js:77:42:77:46 | code1 | SAP UI5 log injection sink with kind: ui5-log-injection |
-| sink.js:77:49:77:53 | code2 | SAP UI5 log injection sink with kind: ui5-log-injection |
+| sink.js:24:38:24:42 | code0 | SAP UI5 log injection sink with kind: ui5-log-injection |
+| sink.js:24:45:24:49 | code1 | SAP UI5 log injection sink with kind: ui5-log-injection |
+| sink.js:24:52:24:56 | code2 | SAP UI5 log injection sink with kind: ui5-log-injection |
+| sink.js:25:38:25:42 | code0 | SAP UI5 log injection sink with kind: ui5-log-injection |
+| sink.js:25:45:25:49 | code1 | SAP UI5 log injection sink with kind: ui5-log-injection |
+| sink.js:25:52:25:56 | code2 | SAP UI5 log injection sink with kind: ui5-log-injection |
+| sink.js:27:40:27:44 | code0 | SAP UI5 log injection sink with kind: ui5-log-injection |
+| sink.js:27:47:27:51 | code1 | SAP UI5 log injection sink with kind: ui5-log-injection |
+| sink.js:27:54:27:58 | code2 | SAP UI5 log injection sink with kind: ui5-log-injection |
+| sink.js:29:37:29:41 | code0 | SAP UI5 log injection sink with kind: ui5-log-injection |
+| sink.js:29:44:29:48 | code1 | SAP UI5 log injection sink with kind: ui5-log-injection |
+| sink.js:29:51:29:55 | code2 | SAP UI5 log injection sink with kind: ui5-log-injection |
+| sink.js:31:38:31:42 | code0 | SAP UI5 log injection sink with kind: ui5-log-injection |
+| sink.js:31:45:31:49 | code1 | SAP UI5 log injection sink with kind: ui5-log-injection |
+| sink.js:31:52:31:56 | code2 | SAP UI5 log injection sink with kind: ui5-log-injection |
+| sink.js:33:38:33:42 | code0 | SAP UI5 log injection sink with kind: ui5-log-injection |
+| sink.js:33:45:33:49 | code1 | SAP UI5 log injection sink with kind: ui5-log-injection |
+| sink.js:33:52:33:56 | code2 | SAP UI5 log injection sink with kind: ui5-log-injection |
+| sink.js:37:27:37:31 | code0 | SAP UI5 log injection sink with kind: ui5-log-injection |
+| sink.js:37:34:37:38 | code1 | SAP UI5 log injection sink with kind: ui5-log-injection |
+| sink.js:37:41:37:45 | code2 | SAP UI5 log injection sink with kind: ui5-log-injection |
+| sink.js:39:27:39:31 | code0 | SAP UI5 log injection sink with kind: ui5-log-injection |
+| sink.js:39:34:39:38 | code1 | SAP UI5 log injection sink with kind: ui5-log-injection |
+| sink.js:39:41:39:45 | code2 | SAP UI5 log injection sink with kind: ui5-log-injection |
+| sink.js:41:29:41:33 | code0 | SAP UI5 log injection sink with kind: ui5-log-injection |
+| sink.js:41:36:41:40 | code1 | SAP UI5 log injection sink with kind: ui5-log-injection |
+| sink.js:41:43:41:47 | code2 | SAP UI5 log injection sink with kind: ui5-log-injection |
+| sink.js:43:26:43:30 | code0 | SAP UI5 log injection sink with kind: ui5-log-injection |
+| sink.js:43:33:43:37 | code1 | SAP UI5 log injection sink with kind: ui5-log-injection |
+| sink.js:43:40:43:44 | code2 | SAP UI5 log injection sink with kind: ui5-log-injection |
+| sink.js:45:27:45:31 | code0 | SAP UI5 log injection sink with kind: ui5-log-injection |
+| sink.js:45:34:45:38 | code1 | SAP UI5 log injection sink with kind: ui5-log-injection |
+| sink.js:45:41:45:45 | code2 | SAP UI5 log injection sink with kind: ui5-log-injection |
+| sink.js:47:27:47:31 | code0 | SAP UI5 log injection sink with kind: ui5-log-injection |
+| sink.js:47:34:47:38 | code1 | SAP UI5 log injection sink with kind: ui5-log-injection |
+| sink.js:47:41:47:45 | code2 | SAP UI5 log injection sink with kind: ui5-log-injection |
+| sink.js:49:42:49:46 | code1 | SAP UI5 log injection sink with kind: ui5-log-injection |
 | sink.js:78:36:78:40 | code0 | SAP UI5 log injection sink with kind: ui5-log-injection |
 | sink.js:78:43:78:47 | code1 | SAP UI5 log injection sink with kind: ui5-log-injection |
 | sink.js:78:50:78:54 | code2 | SAP UI5 log injection sink with kind: ui5-log-injection |
 | sink.js:79:36:79:40 | code0 | SAP UI5 log injection sink with kind: ui5-log-injection |
 | sink.js:79:43:79:47 | code1 | SAP UI5 log injection sink with kind: ui5-log-injection |
 | sink.js:79:50:79:54 | code2 | SAP UI5 log injection sink with kind: ui5-log-injection |
-| sink.js:86:40:86:44 | code1 | SAP UI5 log injection sink with kind: ui5-log-injection |
+| sink.js:80:38:80:42 | code0 | SAP UI5 log injection sink with kind: ui5-log-injection |
+| sink.js:80:45:80:49 | code1 | SAP UI5 log injection sink with kind: ui5-log-injection |
+| sink.js:80:52:80:56 | code2 | SAP UI5 log injection sink with kind: ui5-log-injection |
+| sink.js:81:35:81:39 | code0 | SAP UI5 log injection sink with kind: ui5-log-injection |
+| sink.js:81:42:81:46 | code1 | SAP UI5 log injection sink with kind: ui5-log-injection |
+| sink.js:81:49:81:53 | code2 | SAP UI5 log injection sink with kind: ui5-log-injection |
+| sink.js:82:36:82:40 | code0 | SAP UI5 log injection sink with kind: ui5-log-injection |
+| sink.js:82:43:82:47 | code1 | SAP UI5 log injection sink with kind: ui5-log-injection |
+| sink.js:82:50:82:54 | code2 | SAP UI5 log injection sink with kind: ui5-log-injection |
+| sink.js:83:36:83:40 | code0 | SAP UI5 log injection sink with kind: ui5-log-injection |
+| sink.js:83:43:83:47 | code1 | SAP UI5 log injection sink with kind: ui5-log-injection |
+| sink.js:83:50:83:54 | code2 | SAP UI5 log injection sink with kind: ui5-log-injection |
+| sink.js:90:40:90:44 | code1 | SAP UI5 log injection sink with kind: ui5-log-injection |