Skip to content

Commit a8a6fdf

Browse files
NapalysNapalys
committed
Added modeling of rds v2 and v3 for sql injections
1 parent 0588274 commit a8a6fdf

File tree

3 files changed

+71
-7
lines changed

3 files changed

+71
-7
lines changed

‎javascript/ql/lib/ext/rds-client.model.yml

Lines changed: 23 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,23 @@
1+
extensions:
2+
- addsTo:
3+
pack: codeql/javascript-all
4+
extensible: sinkModel
5+
data:
6+
- ["RDSDataClientV3", "ReturnValue.Member[send].Argument[0]", "sql-injection"]
7+
- ["RDSDataClientV2", "ReturnValue.Member[executeStatement,batchExecuteStatement].Argument[0].Member[sql]", "sql-injection"]
8+
- ["RDSDataClientV2", "ReturnValue.Member[batchExecuteStatement].Argument[0].Member[parameterSets].ArrayElement.Member[sql]", "sql-injection"]
9+
10+
- addsTo:
11+
pack: codeql/javascript-all
12+
extensible: summaryModel
13+
data:
14+
- ["@aws-sdk/client-rds-data", "Member[ExecuteStatementCommand,BatchExecuteStatementCommand]", "Argument[0].Member[sql]", "ReturnValue", "taint"]
15+
- ["@aws-sdk/client-rds-data", "Member[BatchExecuteStatementCommand]", "Argument[0].Member[parameterSets].ArrayElement.Member[sql]", "ReturnValue", "taint"]
16+
- ["@aws-sdk/client-rds-data", "Member[ExecuteSqlCommand]", "Argument[0].Member[sqlStatements]", "ReturnValue", "taint"]
17+
18+
- addsTo:
19+
pack: codeql/javascript-all
20+
extensible: typeModel
21+
data:
22+
- ["RDSDataClientV3", "@aws-sdk/client-rds-data", "Member[RDSDataClient]"]
23+
- ["RDSDataClientV2", "aws-sdk", "Member[RDSDataService]"]

‎javascript/ql/test/query-tests/Security/CWE-089/untyped/SqlInjection.expected

Lines changed: 41 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -137,6 +137,10 @@
137137
| pg-promise.js:60:20:60:24 | query | pg-promise.js:7:16:7:34 | req.params.category | pg-promise.js:60:20:60:24 | query | This query string depends on a $@. | pg-promise.js:7:16:7:34 | req.params.category | user-provided value |
138138
| pg-promise.js:63:23:63:27 | query | pg-promise.js:7:16:7:34 | req.params.category | pg-promise.js:63:23:63:27 | query | This query string depends on a $@. | pg-promise.js:7:16:7:34 | req.params.category | user-provided value |
139139
| pg-promise.js:64:16:64:20 | query | pg-promise.js:7:16:7:34 | req.params.category | pg-promise.js:64:16:64:20 | query | This query string depends on a $@. | pg-promise.js:7:16:7:34 | req.params.category | user-provided value |
140+
| rds-client.js:19:23:19:58 | new Exe ... arams1) | rds-client.js:8:23:8:30 | req.body | rds-client.js:19:23:19:58 | new Exe ... arams1) | This query string depends on a $@. | rds-client.js:8:23:8:30 | req.body | user-provided value |
141+
| rds-client.js:36:23:36:51 | new Exe ... params) | rds-client.js:8:23:8:30 | req.body | rds-client.js:36:23:36:51 | new Exe ... params) | This query string depends on a $@. | rds-client.js:8:23:8:30 | req.body | user-provided value |
142+
| rds-client.js:53:14:53:22 | userQuery | rds-client.js:44:23:44:30 | req.body | rds-client.js:53:14:53:22 | userQuery | This query string depends on a $@. | rds-client.js:44:23:44:30 | req.body | user-provided value |
143+
| rds-client.js:61:50:61:52 | sql | rds-client.js:45:25:45:32 | req.body | rds-client.js:61:50:61:52 | sql | This query string depends on a $@. | rds-client.js:45:25:45:32 | req.body | user-provided value |
140144
| redis.js:10:16:10:27 | req.body.key | redis.js:10:16:10:23 | req.body | redis.js:10:16:10:27 | req.body.key | This query object depends on a $@. | redis.js:10:16:10:23 | req.body | user-provided value |
141145
| redis.js:18:16:18:18 | key | redis.js:12:15:12:22 | req.body | redis.js:18:16:18:18 | key | This query object depends on a $@. | redis.js:12:15:12:22 | req.body | user-provided value |
142146
| redis.js:19:43:19:45 | key | redis.js:12:15:12:22 | req.body | redis.js:19:43:19:45 | key | This query object depends on a $@. | redis.js:12:15:12:22 | req.body | user-provided value |
@@ -563,6 +567,23 @@ edges
563567
| pg-promise.js:22:11:22:15 | query | pg-promise.js:60:20:60:24 | query | provenance | |
564568
| pg-promise.js:22:11:22:15 | query | pg-promise.js:63:23:63:27 | query | provenance | |
565569
| pg-promise.js:22:11:22:15 | query | pg-promise.js:64:16:64:20 | query | provenance | |
570+
| rds-client.js:8:11:8:36 | userQuery | rds-client.js:17:14:17:22 | userQuery | provenance | |
571+
| rds-client.js:8:11:8:36 | userQuery | rds-client.js:33:24:33:32 | userQuery | provenance | |
572+
| rds-client.js:8:23:8:30 | req.body | rds-client.js:8:11:8:36 | userQuery | provenance | |
573+
| rds-client.js:13:11:18:5 | params1 [sql] | rds-client.js:19:51:19:57 | params1 [sql] | provenance | |
574+
| rds-client.js:13:21:18:5 | {\\n ... y\\n } [sql] | rds-client.js:13:11:18:5 | params1 [sql] | provenance | |
575+
| rds-client.js:17:14:17:22 | userQuery | rds-client.js:13:21:18:5 | {\\n ... y\\n } [sql] | provenance | |
576+
| rds-client.js:19:51:19:57 | params1 [sql] | rds-client.js:19:23:19:58 | new Exe ... arams1) | provenance | |
577+
| rds-client.js:29:11:34:5 | params [sqlStatements] | rds-client.js:36:45:36:50 | params [sqlStatements] | provenance | |
578+
| rds-client.js:29:20:34:5 | {\\n ... y\\n } [sqlStatements] | rds-client.js:29:11:34:5 | params [sqlStatements] | provenance | |
579+
| rds-client.js:33:24:33:32 | userQuery | rds-client.js:29:20:34:5 | {\\n ... y\\n } [sqlStatements] | provenance | |
580+
| rds-client.js:36:45:36:50 | params [sqlStatements] | rds-client.js:36:23:36:51 | new Exe ... params) | provenance | |
581+
| rds-client.js:44:11:44:36 | userQuery | rds-client.js:53:14:53:22 | userQuery | provenance | |
582+
| rds-client.js:44:23:44:30 | req.body | rds-client.js:44:11:44:36 | userQuery | provenance | |
583+
| rds-client.js:45:11:45:40 | userQueries | rds-client.js:61:24:61:34 | userQueries | provenance | |
584+
| rds-client.js:45:25:45:32 | req.body | rds-client.js:45:11:45:40 | userQueries | provenance | |
585+
| rds-client.js:61:24:61:34 | userQueries | rds-client.js:61:40:61:42 | sql | provenance | |
586+
| rds-client.js:61:40:61:42 | sql | rds-client.js:61:50:61:52 | sql | provenance | |
566587
| redis.js:10:16:10:23 | req.body | redis.js:10:16:10:27 | req.body.key | provenance | Config |
567588
| redis.js:12:9:12:26 | key | redis.js:13:16:13:18 | key | provenance | |
568589
| redis.js:12:9:12:26 | key | redis.js:18:16:18:18 | key | provenance | |
@@ -940,6 +961,26 @@ nodes
940961
| pg-promise.js:60:20:60:24 | query | semmle.label | query |
941962
| pg-promise.js:63:23:63:27 | query | semmle.label | query |
942963
| pg-promise.js:64:16:64:20 | query | semmle.label | query |
964+
| rds-client.js:8:11:8:36 | userQuery | semmle.label | userQuery |
965+
| rds-client.js:8:23:8:30 | req.body | semmle.label | req.body |
966+
| rds-client.js:13:11:18:5 | params1 [sql] | semmle.label | params1 [sql] |
967+
| rds-client.js:13:21:18:5 | {\\n ... y\\n } [sql] | semmle.label | {\\n ... y\\n } [sql] |
968+
| rds-client.js:17:14:17:22 | userQuery | semmle.label | userQuery |
969+
| rds-client.js:19:23:19:58 | new Exe ... arams1) | semmle.label | new Exe ... arams1) |
970+
| rds-client.js:19:51:19:57 | params1 [sql] | semmle.label | params1 [sql] |
971+
| rds-client.js:29:11:34:5 | params [sqlStatements] | semmle.label | params [sqlStatements] |
972+
| rds-client.js:29:20:34:5 | {\\n ... y\\n } [sqlStatements] | semmle.label | {\\n ... y\\n } [sqlStatements] |
973+
| rds-client.js:33:24:33:32 | userQuery | semmle.label | userQuery |
974+
| rds-client.js:36:23:36:51 | new Exe ... params) | semmle.label | new Exe ... params) |
975+
| rds-client.js:36:45:36:50 | params [sqlStatements] | semmle.label | params [sqlStatements] |
976+
| rds-client.js:44:11:44:36 | userQuery | semmle.label | userQuery |
977+
| rds-client.js:44:23:44:30 | req.body | semmle.label | req.body |
978+
| rds-client.js:45:11:45:40 | userQueries | semmle.label | userQueries |
979+
| rds-client.js:45:25:45:32 | req.body | semmle.label | req.body |
980+
| rds-client.js:53:14:53:22 | userQuery | semmle.label | userQuery |
981+
| rds-client.js:61:24:61:34 | userQueries | semmle.label | userQueries |
982+
| rds-client.js:61:40:61:42 | sql | semmle.label | sql |
983+
| rds-client.js:61:50:61:52 | sql | semmle.label | sql |
943984
| redis.js:10:16:10:23 | req.body | semmle.label | req.body |
944985
| redis.js:10:16:10:27 | req.body.key | semmle.label | req.body.key |
945986
| redis.js:12:9:12:26 | key | semmle.label | key |

‎javascript/ql/test/query-tests/Security/CWE-089/untyped/rds-client.js

Lines changed: 7 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -5,7 +5,7 @@ const app = express();
55
app.use(bodyParser.json());
66

77
app.post('/v3/rds/all', async (req, res) => {
8-
const userQuery = req.body.query; // $ MISSING: Source
8+
const userQuery = req.body.query; // $ Source
99
const userQueries = req.body.queries; // $ MISSING: Source
1010

1111
const client = new RDSDataClient({ region: "us-east-1" });
@@ -16,7 +16,7 @@ app.post('/v3/rds/all', async (req, res) => {
1616
database: "userDatabase",
1717
sql: userQuery
1818
};
19-
await client.send(new ExecuteStatementCommand(params1)); // $ MISSING: Alert
19+
await client.send(new ExecuteStatementCommand(params1)); // $ Alert
2020

2121
const params2 = {
2222
resourceArn: "arn:aws:rds:us-east-1:123456789012:cluster:my-aurora-cluster",
@@ -33,32 +33,32 @@ app.post('/v3/rds/all', async (req, res) => {
3333
sqlStatements: userQuery
3434
};
3535

36-
await client.send(new ExecuteSqlCommand(params)); // $ MISSING: Alert
36+
await client.send(new ExecuteSqlCommand(params)); // $ Alert
3737

3838
res.end();
3939
});
4040

4141
const AWS = require('aws-sdk');
4242

4343
app.post('/v2/rds/all', async (req, res) => {
44-
const userQuery = req.body.query; // $ MISSING: Source
45-
const userQueries = req.body.queries; // $ MISSING: Source
44+
const userQuery = req.body.query; // $ Source
45+
const userQueries = req.body.queries; // $ Source
4646

4747
const rdsData = new AWS.RDSDataService({ region: "us-east-1" });
4848

4949
const params1 = {
5050
resourceArn: "arn:aws:rds:us-east-1:123456789012:cluster:my-aurora-cluster",
5151
secretArn: "arn:aws:secretsmanager:us-east-1:123456789012:secret:my-secret",
5252
database: "userDatabase",
53-
sql: userQuery // $ MISSING: Alert
53+
sql: userQuery // $ Alert
5454
};
5555
await rdsData.executeStatement(params1).promise();
5656

5757
const params2 = {
5858
resourceArn: "arn:aws:rds:us-east-1:123456789012:cluster:my-aurora-cluster",
5959
secretArn: "arn:aws:secretsmanager:us-east-1:123456789012:secret:my-secret",
6060
database: "userDatabase",
61-
parameterSets: userQueries.map(sql => ({ sql })) // $ MISSING: Alert
61+
parameterSets: userQueries.map(sql => ({ sql })) // $ Alert
6262
};
6363
await rdsData.batchExecuteStatement(params2).promise();
6464

0 commit comments

Comments
 (0)