07_ReflectedXssWithSanitizer.ql

/**
 * @name Reflected cross-site scripting vulnerability
 * @kind path-problem
 * @problem.severity warning
 * @id js/reflected-xss
 */

import javascript
import semmle.javascript.security.dataflow.ReflectedXss::ReflectedXss
import DataFlow::PathGraph

/** Gets a data flow node that represents an instance of `swagger-node`. */
DataFlow::Node swaggerInstance() {
  result = DataFlow::moduleImport("swagger-node-express")
  or
  result.getAPredecessor() = swaggerInstance()
  or
  result.(DataFlow::CallNode).getACallee().getAReturnedExpr() = swaggerInstance().asExpr()
  or
  result.(DataFlow::MethodCallNode).calls(swaggerInstance(), "createNew")
}

/** An Express route handler installed via `swagger-node`. */
class SwaggerRouteHandler extends Express::RouteHandler, DataFlow::FunctionNode {
  SwaggerRouteHandler() {
    exists(DataFlow::MethodCallNode addGet, DataFlow::ObjectLiteralNode resource |
      addGet.calls(swaggerInstance(), "addGet") and
      resource = addGet.getArgument(0).getALocalSource() and
      this = resource.getAPropertySource("action")
    )
  }

  override SimpleParameter getRouteHandlerParameter(string kind) {
    kind = "request" and result = getParameter(0).getParameter()
    or
    kind = "response" and result = getParameter(1).getParameter()
  }

  override HTTP::HeaderDefinition getAResponseHeader(string name) { none() }
}

/** Holds if `name` may be an alias for the `send` method on `res`. */
predicate sendMethodName(HTTP::Servers::ResponseSource res, string name) {
	name = "send"
	or
	exists (DataFlow::PropWrite pw |
	  res.flowsTo(pw.getBase()) and
	  pw.getPropertyName() = name and
	  sendMethodRef(pw.getRhs(), res)
	)
}

/** Holds if `pr` may be an access to the `send` method on `res`. */
predicate sendMethodRef(DataFlow::PropRead pr, HTTP::Servers::ResponseSource res) {
	res.flowsTo(pr.getBase()) and
	sendMethodName(res, pr.getPropertyName())
}

/** Recognize potentially aliased calls to `send`. */
class PotentiallyAliasedResponseSendArgument extends HTTP::ResponseSendArgument {
	HTTP::RouteHandler rh;

	PotentiallyAliasedResponseSendArgument() {
		exists (DataFlow::CallNode call, HTTP::Servers::ResponseSource res |
		  sendMethodRef(call.getCalleeNode(), res) and
		  rh = res.getRouteHandler() and
		  this = call.getArgument(0).asExpr()
		)
	}

	override HTTP::RouteHandler getRouteHandler() {
		result = rh
	}
}

/** A call to `is-var-name`, considered as a sanitizer for untrusted user input. */
class IsVarNameSanitizer extends TaintTracking::AdditionalSanitizerGuardNode, DataFlow::CallNode {
  IsVarNameSanitizer() {
    this = DataFlow::moduleImport("is-var-name").getACall()
  }

  override predicate appliesTo(TaintTracking::Configuration cfg) {
    any()
  }

  override predicate sanitizes(boolean outcome, Expr e) {
     outcome = true and
     e = getArgument(0).asExpr()
  }
}

from Configuration cfg, DataFlow::PathNode source, DataFlow::PathNode sink
where cfg.hasFlowPath(source, sink)
select sink.getNode(), source, sink, "Cross-site scripting vulnerability due to $@.",
       source.getNode(), "user-provided value"