Added modeling of dynamodb v3 for sql injections · github/codeql@ae2e8b1 · GitHub
Skip to content

Commit ae2e8b1

Browse files
NapalysNapalys
committed
Added modeling of dynamodb v3 for sql injections
1 parent 0a3343a commit ae2e8b1

3 files changed

Lines changed: 59 additions & 4 deletions

File tree

‎javascript/ql/lib/ext/dynamodb.model.yml‎

Lines changed: 19 additions & 0 deletions

‎javascript/ql/test/query-tests/Security/CWE-089/untyped/SqlInjection.expected‎

Lines changed: 36 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,7 @@
11
#select
2+
| dynamodb.js:15:23:15:29 | command | dynamodb.js:9:26:9:33 | req.body | dynamodb.js:15:23:15:29 | command | This query string depends on a $@. | dynamodb.js:9:26:9:33 | req.body | user-provided value |
3+
| dynamodb.js:21:23:21:35 | updateCommand | dynamodb.js:9:26:9:33 | req.body | dynamodb.js:21:23:21:35 | updateCommand | This query string depends on a $@. | dynamodb.js:9:26:9:33 | req.body | user-provided value |
4+
| dynamodb.js:47:24:47:30 | command | dynamodb.js:9:26:9:33 | req.body | dynamodb.js:47:24:47:30 | command | This query string depends on a $@. | dynamodb.js:9:26:9:33 | req.body | user-provided value |
25
| graphql.js:9:34:19:5 | `\\n ... }\\n ` | graphql.js:8:16:8:28 | req.params.id | graphql.js:9:34:19:5 | `\\n ... }\\n ` | This query string depends on a $@. | graphql.js:8:16:8:28 | req.params.id | user-provided value |
36
| graphql.js:26:30:26:40 | `foo ${id}` | graphql.js:25:16:25:28 | req.params.id | graphql.js:26:30:26:40 | `foo ${id}` | This query string depends on a $@. | graphql.js:25:16:25:28 | req.params.id | user-provided value |
47
| graphql.js:29:32:29:42 | `foo ${id}` | graphql.js:25:16:25:28 | req.params.id | graphql.js:29:32:29:42 | `foo ${id}` | This query string depends on a $@. | graphql.js:25:16:25:28 | req.params.id | user-provided value |
@@ -137,6 +140,22 @@
137140
| tst4.js:8:10:8:66 | 'SELECT ... d + '"' | tst4.js:8:46:8:60 | $routeParams.id | tst4.js:8:10:8:66 | 'SELECT ... d + '"' | This query string depends on a $@. | tst4.js:8:46:8:60 | $routeParams.id | user-provided value |
138141
| tst.js:10:10:10:64 | 'SELECT ... d + '"' | tst.js:10:46:10:58 | req.params.id | tst.js:10:10:10:64 | 'SELECT ... d + '"' | This query string depends on a $@. | tst.js:10:46:10:58 | req.params.id | user-provided value |
139142
edges
143+
| dynamodb.js:9:9:9:22 | maliciousInput | dynamodb.js:11:64:11:77 | maliciousInput | provenance | |
144+
| dynamodb.js:9:9:9:22 | maliciousInput | dynamodb.js:17:80:17:93 | maliciousInput | provenance | |
145+
| dynamodb.js:9:26:9:33 | req.body | dynamodb.js:9:9:9:22 | maliciousInput | provenance | |
146+
| dynamodb.js:11:11:11:19 | statement | dynamodb.js:13:20:13:28 | statement | provenance | |
147+
| dynamodb.js:11:64:11:77 | maliciousInput | dynamodb.js:11:11:11:19 | statement | provenance | |
148+
| dynamodb.js:12:11:12:17 | command | dynamodb.js:15:23:15:29 | command | provenance | |
149+
| dynamodb.js:12:11:12:17 | command | dynamodb.js:47:24:47:30 | command | provenance | |
150+
| dynamodb.js:12:21:14:6 | new Exe ... \\n }) | dynamodb.js:12:11:12:17 | command | provenance | |
151+
| dynamodb.js:12:49:14:5 | {\\n ... t\\n } [Statement] | dynamodb.js:12:21:14:6 | new Exe ... \\n }) | provenance | |
152+
| dynamodb.js:13:20:13:28 | statement | dynamodb.js:12:49:14:5 | {\\n ... t\\n } [Statement] | provenance | |
153+
| dynamodb.js:17:11:17:25 | updateStatement | dynamodb.js:19:20:19:34 | updateStatement | provenance | |
154+
| dynamodb.js:17:80:17:93 | maliciousInput | dynamodb.js:17:11:17:25 | updateStatement | provenance | |
155+
| dynamodb.js:18:11:18:23 | updateCommand | dynamodb.js:21:23:21:35 | updateCommand | provenance | |
156+
| dynamodb.js:18:27:20:6 | new Exe ... \\n }) | dynamodb.js:18:11:18:23 | updateCommand | provenance | |
157+
| dynamodb.js:18:55:20:5 | {\\n ... t\\n } [Statement] | dynamodb.js:18:27:20:6 | new Exe ... \\n }) | provenance | |
158+
| dynamodb.js:19:20:19:34 | updateStatement | dynamodb.js:18:55:20:5 | {\\n ... t\\n } [Statement] | provenance | |
140159
| graphql.js:8:11:8:12 | id | graphql.js:11:46:11:47 | id | provenance | |
141160
| graphql.js:8:16:8:28 | req.params.id | graphql.js:8:11:8:12 | id | provenance | |
142161
| graphql.js:11:46:11:47 | id | graphql.js:9:34:19:5 | `\\n ... }\\n ` | provenance | |
@@ -518,6 +537,23 @@ edges
518537
| tst4.js:8:46:8:60 | $routeParams.id | tst4.js:8:10:8:66 | 'SELECT ... d + '"' | provenance | |
519538
| tst.js:10:46:10:58 | req.params.id | tst.js:10:10:10:64 | 'SELECT ... d + '"' | provenance | |
520539
nodes
540+
| dynamodb.js:9:9:9:22 | maliciousInput | semmle.label | maliciousInput |
541+
| dynamodb.js:9:26:9:33 | req.body | semmle.label | req.body |
542+
| dynamodb.js:11:11:11:19 | statement | semmle.label | statement |
543+
| dynamodb.js:11:64:11:77 | maliciousInput | semmle.label | maliciousInput |
544+
| dynamodb.js:12:11:12:17 | command | semmle.label | command |
545+
| dynamodb.js:12:21:14:6 | new Exe ... \\n }) | semmle.label | new Exe ... \\n }) |
546+
| dynamodb.js:12:49:14:5 | {\\n ... t\\n } [Statement] | semmle.label | {\\n ... t\\n } [Statement] |
547+
| dynamodb.js:13:20:13:28 | statement | semmle.label | statement |
548+
| dynamodb.js:15:23:15:29 | command | semmle.label | command |
549+
| dynamodb.js:17:11:17:25 | updateStatement | semmle.label | updateStatement |
550+
| dynamodb.js:17:80:17:93 | maliciousInput | semmle.label | maliciousInput |
551+
| dynamodb.js:18:11:18:23 | updateCommand | semmle.label | updateCommand |
552+
| dynamodb.js:18:27:20:6 | new Exe ... \\n }) | semmle.label | new Exe ... \\n }) |
553+
| dynamodb.js:18:55:20:5 | {\\n ... t\\n } [Statement] | semmle.label | {\\n ... t\\n } [Statement] |
554+
| dynamodb.js:19:20:19:34 | updateStatement | semmle.label | updateStatement |
555+
| dynamodb.js:21:23:21:35 | updateCommand | semmle.label | updateCommand |
556+
| dynamodb.js:47:24:47:30 | command | semmle.label | command |
521557
| graphql.js:8:11:8:12 | id | semmle.label | id |
522558
| graphql.js:8:16:8:28 | req.params.id | semmle.label | req.params.id |
523559
| graphql.js:9:34:19:5 | `\\n ... }\\n ` | semmle.label | `\\n ... }\\n ` |

‎javascript/ql/test/query-tests/Security/CWE-089/untyped/dynamodb.js‎

Lines changed: 4 additions & 4 deletions

0 commit comments

Comments
 (0)