Identifying Sanitizer/Barrier nodes in a query

[DhvanilSanghvi]

I'm trying to identify Sanitizer/Barrier/SanitizerGuard/BarrierGuard nodes in a JavaScript repository. I want to print these nodes' information in the select query along with the source and the sink for any JavaScript vulnerability.
How can I achieve this?

[hvitved]

Hi

If you are simply looking for all, say, BarrierGuards for a given data flow configuration Config, you can write a simple predicate

predicate barrierGuard(BarrierGuard bg, Config config) {
  config.isBarrierGuard(bg)
}

and then quick-eval that in VS Code.

I am not quite sure what you mean by "along with the source and sink": If there is flow from a source to a sink it means that there is a path that does not go through any (barrier)guard, so none of the paths reported will contain a guard.

[DhvanilSanghvi]

Hey Tom @hvitved ,
Thanks a lot for replying.
The quick-eval idea seems to work.
But, is it possible to invoke a quick-eval via the command line (maybe a new query file aimed to find sanitizers)? The codeql database I am working on is really huge and VSCode crashes. I also want to export the generated result to a sarif file so that I have the location references stored.

By "along with the source and sink", I mean:

1. Ignore the sanitizer/barrier nodes and consider path from source to sink, which I can find by removing the overrided predicates isBarrier/isSanitizer in the query files.
2. Now, in the path from source to sink, if there exists a node which will be a potential sanitizer if we enable the predicates isBarrier/isSanitizer, I want to select that node too.

Basically, ignoring the sanitizer while seeking source and sink paths, and then check if any node which falls on the source->sink path can be a potential sanitizer/barrier.

[hvitved]

But, is it possible to invoke a quick-eval via the command line (maybe a new query file aimed to find sanitizers)? The codeql database I am working on is really huge and VSCode crashes. I also want to export the generated result to a sarif file so that I have the location references stored.

In that case you should probably just create a separate query and then run that with codeql query run (or, if you need SARIF, codeql database analyze).

By "along with the source and sink", I mean:

1. Ignore the sanitizer/barrier nodes and consider path from source to sink, which I can find by removing the overrided predicates isBarrier/isSanitizer in the query files.
2. Now, in the path from source to sink, if there exists a node which will be a potential sanitizer if we enable the predicates isBarrier/isSanitizer, I want to select that node too.

Basically, ignoring the sanitizer while seeking source and sink paths, and then check if any node which falls on the source->sink path can be a potential sanitizer/barrier.

That is an interesting scenario. You are right that you would have to remove the overriden santizer/barrier predicates, and then you could add another query predicate for the barriers that occur on some path between a source and sink:

query predicate barriers(
  DefaultValueFlowConf conf, DataFlow::PathNode barrier, DataFlow::PathNode source,
  DataFlow::PathNode sink
) {
  isBarrier(barrier.getNode()) and
  conf.hasFlowPath(source, sink) and
  source.getASuccessor*() = barrier and
  barrier.getASuccessor*() = sink
}

[DhvanilSanghvi]

Hey Tom @hvitved ,
Thank you so much. This works perfectly for my use case.
I appreciate all your help.

[DhvanilSanghvi]

Hey Tom @hvitved ,
I tried the approach for the example files in UnsafeJqueryPlugin JavaScript vulnerability.
Here is the UnsafeJqueryPlugin.ql file:

import javascript
import semmle.javascript.security.dataflow.UnsafeJQueryPluginQueryWOS
import DataFlow::PathGraph

from
  Configuration cfg, DataFlow::PathNode source, DataFlow::PathNode sink, DataFlow::PathNode potential_barrier,
  JQuery::JQueryPluginMethod plugin
where
  cfg.hasFlowPath(source, sink) and
  source.getNode().(Source).getPlugin() = plugin and
  cfg.pseudoBarriers(potential_barrier.getNode()) and
  source.getASuccessor*() = potential_barrier and
  potential_barrier.getASuccessor+() = sink
select potential_barrier, source, sink, "Potential XSS vulnerability in the $@. $@ is a potential barrier for it.", plugin,
  "'$.fn." + plugin.getPluginName() + "' plugin", potential_barrier.getNode(), potential_barrier.getNode().toString()

Here is the UnsafeJQueryPluginWOS.qll file:

class Configuration extends TaintTracking::Configuration {
  Configuration() { this = "UnsafeJQueryPlugin" }
  override predicate isSource(DataFlow::Node source) { source instanceof Source }
  override predicate isSink(DataFlow::Node sink) { sink instanceof Sink }

  predicate pseudoSanitizer(DataFlow::Node node) {
     super.isSanitizer(node)
     or
     node instanceof DomBasedXss::Sanitizer
     or
     node instanceof Sanitizer
   }

   predicate pseudoBarriers(DataFlow::Node node) {
      pseudoSanitizer(node)
      or
      pseudoSanitizerGuard(node)
   }

  override predicate isAdditionalTaintStep(DataFlow::Node src, DataFlow::Node sink) {
    // jQuery plugins tend to be implemented as classes that store data in fields initialized by the constructor.
    DataFlow::localFieldStep(src, sink) or
    aliasPropertyPresenceStep(src, sink)
  }

  predicate pseudoSanitizerEdge(DataFlow::Node pred, DataFlow::Node succ) {
    // prefixing prevents forced html/css confusion:
    // prefixing through concatenation:
    StringConcatenation::taintStep(pred, succ, _, any(int i | i >= 1))
    or
    // prefixing through a poor-mans templating system:
    exists(StringReplaceCall replace |
      replace = succ and
      pred = replace.getRawReplacement()
    )
  }

  predicate pseudoSanitizerGuard(TaintTracking::SanitizerGuardNode node) {
    super.isSanitizerGuard(node) or
    node instanceof IsElementSanitizer or
    node instanceof PropertyPresenceSanitizer
  }
}

The two files I tested on are:
UnsafeJqueryPlugin.js

jQuery.fn.copyText = function(options) {
	// BAD may evaluate "options.sourceSelector" as HTML
	var source = jQuery(options.sourceSelector),
	    text = source.text();
	jQuery(this).text(text);
}

And UnsafeJqueryPlugin_safe.js

jQuery.fn.copyText = function(options) {
	// GOOD may not evaluate "options.sourceSelector" as HTML
	var source = jQuery.find(options.sourceSelector),
	    text = source.text();
	jQuery(this).text(text);
}

The results produced by the query just marked the UnsafeJqueryPlugin.js file saying "options.sourceSelector" is a potential sanitizer.
Can you please help me understand why the query is not working?

1. It doesn't mark ".find" in the UnsafeJqueryPlugin_safe.js as a potential sanitizer.
2. It marks "options.sourceSelector" as a potential sanitizer whereas the file UnsafeJqueryPlugin.js is still vulnerable.