8000 Added `searchParams.get` as potential source for SSRF · github/codeql@678eccb · GitHub
[go: up one dir, main page]
Skip to content

Commit 678eccb

Browse files
NapalysNapalys
committed
Added searchParams.get as potential source for SSRF
1 parent 8674b61 commit 678eccb

File tree

3 files changed

+19
-3
lines changed

3 files changed

+19
-3
lines changed

‎javascript/ql/lib/semmle/javascript/frameworks/Next.qll

Lines changed: 11 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -318,7 +318,17 @@ module NextJS {
318318
) and
319319
kind = "body"
320320
or
321-
this = handler.getRequest().getAPropertyRead(["url", "nextUrl"]) and kind = "url"
321+
(
322+
this = handler.getRequest().getAPropertyRead(["url", "nextUrl"])
323+
or
324+
this =
325+
handler
326+
.getRequest()
327+
.getAPropertyRead("nextUrl")
328+
.getAPropertyRead("searchParams")
329+
.getAMemberCall("get")
330+
) and
331+
kind = "url"
322332
or
323333
this = handler.getRequest().getAPropertyRead("headers") and kind = "headers"
324334
}

‎javascript/ql/test/query-tests/Security/CWE-918/Request/middleware.ts

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -2,14 +2,14 @@ import { NextRequest, NextResponse } from 'next/server';
22

33
export async function middleware(req: NextRequest) {
44
const target = req.nextUrl // $ Source[js/request-forgery]
5-
const target2 = target.searchParams.get('target'); // $ MISSING: Source[js/request-forgery]
5+
const target2 = target.searchParams.get('target'); // $ Source[js/request-forgery]
66
if (target) {
77
const res = await fetch(target) // $ Alert[js/request-forgery] Sink[js/request-forgery]
88
const data = await res.text()
99
return new NextResponse(data)
1010
}
1111
if (target2) {
12-
const res = await fetch(target2); // $ MISSING: Alert[js/request-forgery] Sink[js/request-forgery]
12+
const res = await fetch(target2); // $ Alert[js/request-forgery] Sink[js/request-forgery]
1313
const data = await res.text();
1414
return new NextResponse(data);
1515
}

‎javascript/ql/test/query-tests/Security/CWE-918/RequestForgery.expected

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -2,6 +2,7 @@
22
| Request/app/api/proxy/route2.serverSide.ts:5:21:5:30 | fetch(url) | Request/app/api/proxy/route2.serverSide.ts:4:25:4:34 | req.json() | Request/app/api/proxy/route2.serverSide.ts:5:27:5:29 | url | The $@ of this request depends on a $@. | Request/app/api/proxy/route2.serverSide.ts:5:27:5:29 | url | URL | Request/app/api/proxy/route2.serverSide.ts:4:25:4:34 | req.json() | user-provided value |
33
| Request/app/api/proxy/route.serverSide.ts:3:21:3:30 | fetch(url) | Request/app/api/proxy/route.serverSide.ts:2:25:2:34 | req.json() | Request/app/api/proxy/route.serverSide.ts:3:27:3:29 | url | The $@ of this request depends on a $@. | Request/app/api/proxy/route.serverSide.ts:3:27:3:29 | url | URL | Request/app/api/proxy/route.serverSide.ts:2:25:2:34 | req.json() | user-provided value |
44
| Request/middleware.ts:7:25:7:37 | fetch(target) | Request/middleware.ts:4:20:4:30 | req.nextUrl | Request/middleware.ts:7:31:7:36 | target | The $@ of this request depends on a $@. | Request/middleware.ts:7:31:7:36 | target | URL | Request/middleware.ts:4:20:4:30 | req.nextUrl | user-provided value |
5+
| Request/middleware.ts:12:27:12:40 | fetch(target2) | Request/middleware.ts:5:21:5:53 | target. ... arget') | Request/middleware.ts:12:33:12:39 | target2 | The $@ of this request depends on a $@. | Request/middleware.ts:12:33:12:39 | target2 | URL | Request/middleware.ts:5:21:5:53 | target. ... arget') | user-provided value |
56
| apollo.serverSide.ts:8:39:8:64 | get(fil ... => {}) | apollo.serverSide.ts:7:36:7:44 | { files } | apollo.serverSide.ts:8:43:8:50 | file.url | The $@ of this request depends on a $@. | apollo.serverSide.ts:8:43:8:50 | file.url | URL | apollo.serverSide.ts:7:36:7:44 | { files } | user-provided value |
67
| apollo.serverSide.ts:18:37:18:62 | get(fil ... => {}) | apollo.serverSide.ts:17:34:17:42 | { files } | apollo.serverSide.ts:18:41:18:48 | file.url | The $@ of this request depends on a $@. | apollo.serverSide.ts:18:41:18:48 | file.url | URL | apollo.serverSide.ts:17:34:17:42 | { files } | user-provided value |
78
| axiosInterceptors.serverSide.js:11:26:11:40 | userProvidedUrl | axiosInterceptors.serverSide.js:19:21:19:28 | req.body | axiosInterceptors.serverSide.js:11:26:11:40 | userProvidedUrl | The $@ of this request depends on a $@. | axiosInterceptors.serverSide.js:11:26:11:40 | userProvidedUrl | endpoint | axiosInterceptors.serverSide.js:19:21:19:28 | req.body | user-provided value |
@@ -40,6 +41,8 @@ edges
4041
| Request/app/api/proxy/route.serverSide.ts:2:25:2:34 | req.json() | Request/app/api/proxy/route.serverSide.ts:2:19:2:34 | await req.json() | provenance | |
4142
| Request/middleware.ts:4:11:4:30 | target | Request/middleware.ts:7:31:7:36 | target | provenance | |
4243
| Request/middleware.ts:4:20:4:30 | req.nextUrl | Request/middleware.ts:4:11:4:30 | target | provenance | |
44+
| Request/middleware.ts:5:11:5:53 | target2 | Request/middleware.ts:12:33:12:39 | target2 | provenance | |
45+
| Request/middleware.ts:5:21:5:53 | target. ... arget') | Request/middleware.ts:5:11:5:53 | target2 | provenance | |
4346
| apollo.serverSide.ts:7:36:7:44 | files | apollo.serverSide.ts:8:13:8:17 | files | provenance | |
4447
| apollo.serverSide.ts:7:36:7:44 | { files } | apollo.serverSide.ts:7:36:7:44 | files | provenance | |
4548
| apollo.serverSide.ts:8:13:8:17 | files | apollo.serverSide.ts:8:28:8:31 | file | provenance | |
@@ -116,7 +119,10 @@ nodes
116119
| Request/app/api/proxy/route.serverSide.ts:3:27:3:29 | url | semmle.label | url |
117120
| Request/middleware.ts:4:11:4:30 | target | semmle.label | target |
118121
| Request/middleware.ts:4:20:4:30 | req.nextUrl | semmle.label | req.nextUrl |
122+
| Request/middleware.ts:5:11:5:53 | target2 | semmle.label | target2 |
123+
| Request/middleware.ts:5:21:5:53 | target. ... arget') | semmle.label | target. ... arget') |
119124
| Request/middleware.ts:7:31:7:36 | target | semmle.label | target |
125+
| Request/middleware.ts:12:33:12:39 | target2 | semmle.label | target2 |
120126
| apollo.serverSide.ts:7:36:7:44 | files | semmle.label | files |
121127
| apollo.serverSide.ts:7:36:7:44 | { files } | semmle.label | { files } |
122128
| apollo.serverSide.ts:8:13:8:17 | files | semmle.label | files |

0 commit comments

Comments
 (0)
0