NodeJS Taint Tracking - Modeling this.prop and Writing Source Predicates for Parameterless Methods in CodeQL

[dvec01]

I faced an issue when creating a path query for the following JavaScript code:

const { execSync } = require('child_process');

test() {
        execSync(arguments[0]);
}

Here is the query I wrote to detect the test -> execSync path:

import semmle.javascript.dataflow.TaintTracking
import javascript

class Config extends TaintTracking::Configuration {
  Config() { this = "config" }

  override predicate isSource(DataFlow::Node source) {
    exists(Function f |  f.getName() = "test" and f.getAParameter() = source.asExpr()  )
  }

  override predicate isSink(DataFlow::Node sink) {
    DataFlow::moduleMember("child_process", "execSync").getACall().getArgument(0) = sink
  }
}

import DataFlow::PathGraph

from Config dataflow, DataFlow::PathNode source, DataFlow::PathNode sink
where dataflow.hasFlowPath(source, sink)
select sink, source, sink, "This command depends on $@.", source.getNode(), ""

This query doesn’t return any paths because the test method takes no input, hence the isSource predicate fails because it relies on method parameters, which are absent in this case. Omitting the f.getAParameter() = source.asExpr() and replacing it with source.asExpr().getEnclosingFunction() = f clause would help, as it causes all calls in the source method to be marked as sources, which is overly broad. For example if the test method was changed to:

test() {
        execSync(arguments[0]);
        execSync("echo test");
    }

it would also highlight the second call, which uncontrollable/ untainted data.

My questions:
What is the recommended approach to model accesses to arguments, this or super as tainted (similar to https://codeql.github.com/codeql-standard-libraries/java/semmle/code/java/dataflow/FlowSteps.qll/type.FlowSteps$TaintInheritingContent.html)?

What’s the best way to write a source predicate for methods with no parameters?

Many thanks in advance.

[jketema]

Hi @dvec01,

Thanks for your question. It's not completely clear to me what you want your source to be. arguments is accessible through the getArgumentsVariable predicate of the Function class. I'm not sure if that helps?