|
| 1 | +/** |
| 2 | + * Module for working with uses of the [Trusted Types API](https://developer.mozilla.org/en-US/docs/Web/API/Trusted_Types_API) |
| 3 | + */ |
| 4 | + |
| 5 | +private import javascript |
| 6 | +private import semmle.javascript.security.dataflow.Xss |
| 7 | +private import semmle.javascript.security.dataflow.ClientSideUrlRedirectCustomizations |
| 8 | +private import semmle.javascript.security.dataflow.CodeInjectionCustomizations |
| 9 | + |
| 10 | +/** |
| 11 | + * Module for working with uses of the [Trusted Types API](https://developer.mozilla.org/en-US/docs/Web/API/Trusted_Types_API). |
| 12 | + */ |
| 13 | +module TrustedTypes { |
| 14 | + private class TrustedTypesEntry extends API::EntryPoint { |
| 15 | + TrustedTypesEntry() { this = "TrustedTypesEntry" } |
| 16 | + |
| 17 | + override DataFlow::SourceNode getAUse() { result = DataFlow::globalVarRef("trustedTypes") } |
| 18 | + |
| 19 | + override DataFlow::Node getARhs() { none() } |
| 20 | + } |
| 21 | + |
| 22 | + private API::Node trustedTypesObj() { result = any(TrustedTypesEntry entry).getNode() } |
| 23 | + |
| 24 | + /** A call to `trustedTypes.createPolicy`. */ |
| 25 | + class PolicyCreation extends API::CallNode { |
| 26 | + PolicyCreation() { this = trustedTypesObj().getMember("createPolicy").getACall() } |
| 27 | + |
| 28 | + /** Gets the function passed as the given option. */ |
| 29 | + DataFlow::FunctionNode getPolicyCallback(string method) { |
| 30 | + // Require local callback to avoid potential call/return mismatch in the uses below |
| 31 | + result = getOptionArgument(1, method).getALocalSource() |
| 32 | + } |
| 33 | + } |
| 34 | + |
| 35 | + /** |
| 36 | + * A data-flow step from the use of a policy to its callback. |
| 37 | + */ |
| 38 | + private class PolicyInputStep extends DataFlow::SharedFlowStep { |
| 39 | + override predicate step(DataFlow::Node pred, DataFlow::Node succ) { |
| 40 | + exists(PolicyCreation policy, string method | |
| 41 | + pred = policy.getReturn().getMember(method).getParameter(0).getARhs() and |
| 42 | + succ = policy.getPolicyCallback(method).getParameter(0) |
| 43 | + ) |
| 44 | + } |
| 45 | + } |
| 46 | + |
| 47 | + /** |
| 48 | + * The creation of a trusted HTML object, as an XSS sink. |
| 49 | + */ |
| 50 | + private class XssSink extends DomBasedXss::Sink { |
| 51 | + XssSink() { this = any(PolicyCreation creation).getPolicyCallback("createHTML").getAReturn() } |
| 52 | + } |
| 53 | + |
| 54 | + /** |
| 55 | + * The creation of a trusted script, as a code-injection sink. |
| 56 | + */ |
| 57 | + private class CodeInjectionSink extends CodeInjection::Sink { |
| 58 | + CodeInjectionSink() { |
| 59 | + this = any(PolicyCreation creation).getPolicyCallback("createScript").getAReturn() |
| 60 | + } |
| 61 | + } |
| 62 | + |
| 63 | + /** |
| 64 | + * The creation of a trusted script URL, as a URL redirection sink. |
| 65 | + * |
| 66 | + * This is currently handled by the client-side URL redirection query, as this checks for untrusted hostname in the URL. |
| 67 | + */ |
| 68 | + private class UrlSink extends ClientSideUrlRedirect::Sink { |
| 69 | + UrlSink() { |
| 70 | + this = any(PolicyCreation creation).getPolicyCallback("createScriptURL").getAReturn() |
| 71 | + } |
| 72 | + } |
| 73 | +} |
0 commit comments