codeql-workshop-introduction-to-javascript/exercises/Exercise11.ql at main · rvermeulen/codeql-workshop-introduction-to-javascript · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
/**
 * @kind path-problem
 */

import javascript
import DataFlow::PathGraph

abstract class ApiHandler extends DataFlow::Node {
  abstract DataFlow::ParameterNode getRequestParameter();
}

abstract class PrototypePollutionSink extends DataFlow::Node { }

class PrototypePollutionConfiguration extends TaintTracking::Configuration {
  PrototypePollutionConfiguration() { this = "PrototypePollutionConfiguration" }

  override predicate isSource(DataFlow::Node source) {
    source = any(ApiHandler h).getRequestParameter()
  }

  override predicate isSink(DataFlow::Node sink) { sink instanceof PrototypePollutionSink }
}

class AddChatHandler extends ApiHandler, DataFlow::FunctionNode {
  AddChatHandler() { none() }

  override DataFlow::ParameterNode getRequestParameter() { none() }
}

from PrototypePollutionConfiguration config, DataFlow::PathNode source, DataFlow::PathNode sink
where config.hasFlowPath(source, sink)
select sink, source, sink, "Prototype pollution"