Repository navigation
New experimental query: Clipboard-based XSS #422
Description
Query
Link to pull request with your CodeQL query:
Relevant PR: github/codeql#6498
CVE ID(s)
- CVE-2021-37700
- https://about.gitlab.com/releases/2021/07/01/security-release-gitlab-14-0-2-released/#clipboard-dom-based-xss (CVE still needs to be assigned)
Report
The Javascript clipboard api is a source of user input not currently covered by CodeQL's official XSS queries. The proposed query is an answer to this gap and has already been used to find vulnerabilities in relevant projects as listed above.
- Are you planning to discuss this vulnerability submission publicly? (Blog Post, social networks, etc).
Result(s)
Limitations
Although the process of creating this query led me to find CVE-2021-37700, the current query does not cover its case. For some reason, although the reference to event.clipboardData is found at https://github.com/github/paste-markdown/blob/v0.3.3/src/paste-markdown-table.ts#L40 by the clipboardDataTransferSource predicate, its use in https://github.com/github/paste-markdown/blob/v0.3.3/src/paste-markdown-table.ts#L91 is not detected by the clipboardDataSource predicate. Any help with this would be appreciated.
Activity
intrigus-lgtm commentedon Aug 17, 2021
Do you plan to apply for the "Bug Slayer" bounty?
bananabr commentedon Aug 17, 2021
I would need at least four vulnerabilities on real-world projects right @intrigus-lgtm? So I think I am sticking to the "All For One" program for now.
bananabr commentedon Aug 17, 2021
I found a couple of minor projects with this type of vulnerability where the current version does not work but the following simplified query does https://gist.github.com/bananabr/f16274b0d0d4afa9c63d5de761f7f520. Here is a sample vulnerable function that exemplifies this case https://gist.github.com/bananabr/8a40858d9abec3e5ce60f9e3e81384df.
Any idea why the submitted query does not detect this case?
Thanks!
ghsecuritylab commentedon Aug 26, 2021
Your submission is now in status Generate Query Results.
For information, the evaluation workflow is the following:
SecLab review > Generate Query Results > FP Check > CodeQL review > SecLab finalize > Pay > Closed
bananabr commentedon Aug 30, 2021
I want to inform I wrote an article about CodeQL and the query submitted here at https://medium.com/codex/hunting-for-xss-with-codeql-57f70763b938
bananabr commentedon Sep 7, 2021
Hey team,
Any idea how much more time the generate results step should take?
anticomputer commentedon Sep 7, 2021
Hi @bananabr I've pinged the review team to ask for a status update on your behalf.
bananabr commentedon Sep 7, 2021
thanks @anticomputer
bananabr commentedon Sep 17, 2021
I see my change proposal has already been merged in github/codeql#6584 and I have already been referenced in fixes for vulnerabilities found using this query. Is this still the "Generate Query Results" step? This is my first time contributing to the program so I am still unfamiliar with the process.
ghsecuritylab commentedon Sep 17, 2021
Your submission is now in status FP Check.
For information, the evaluation workflow is the following:
SecLab review > Generate Query Results > FP Check > CodeQL review > SecLab finalize > Pay > Closed
ghsecuritylab commentedon Sep 20, 2021
Your submission is now in status CodeQL review.
For information, the evaluation workflow is the following:
SecLab review > Generate Query Results > FP Check > CodeQL review > SecLab finalize > Pay > Closed
ghsecuritylab commentedon Sep 20, 2021
Your submission is now in status SecLab finalize.
For information, the evaluation workflow is the following:
SecLab review > Generate Query Results > FP Check > CodeQL review > SecLab finalize > Pay > Closed
xcorail commentedon Sep 20, 2021
Hello @bananabr
Can you please provide a public email address or send me one privately? It's used for the reward payment
Thanks
bananabr commentedon Sep 20, 2021
Just sent you an email @xcorail
ghsecuritylab commentedon Sep 20, 2021
Your submission is now in status Pay.
For information, the evaluation workflow is the following:
SecLab review > Generate Query Results > FP Check > CodeQL review > SecLab finalize > Pay > Closed
xcorail commentedon Sep 20, 2021
Created Hackerone report 1345484 for bounty 335989 : [422] New experimental query: Clipboard-based XSS
ghsecuritylab commentedon Sep 20, 2021
Your submission is now in status Closed.
For information, the evaluation workflow is the following:
SecLab review > Generate Query Results > FP Check > CodeQL review > SecLab finalize > Pay > Closed