Skip to content

Commit de8a328

Browse files
NapalysNapalys
authored
Merge pull request #19118 from Napalys/js/hana_db_client
JS: support `hana` db client
2 parents ee867e9 + 32d6ac8 commit de8a328

File tree

6 files changed

+362
-0
lines changed

6 files changed

+362
-0
lines changed

‎javascript/ql/lib/change-notes/2025-03-26-hana-db-client.md

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,4 @@
1+
---
2+
category: minorAnalysis
3+
---
4+
* Added support for the `@sap/hana-client`, `@sap/hdbext` and `hdb` packages.

‎javascript/ql/lib/ext/hana-db-client.model.yml

Lines changed: 27 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,27 @@
1+
extensions:
2+
- addsTo:
3+
pack: codeql/javascript-all
4+
extensible: sinkModel
5+
data:
6+
- ["@sap/hana-client", "Member[createConnection].ReturnValue.Member[exec,prepare].Argument[0]", "sql-injection"]
7+
- ["hdb.Client", "Member[exec,prepare,execute].Argument[0]", "sql-injection"]
8+
- ["@sap/hdbext", "Member[loadProcedure].Argument[2]", "sql-injection"]
9+
- ["@sap/hana-client/extension/Stream", "Member[createProcStatement].Argument[1]", "sql-injection"]
10+
11+
- addsTo:
12+
pack: codeql/javascript-all
13+
extensible: typeModel
14+
data:
15+
- ["hdb.Client", "hdb", "Member[createClient].ReturnValue"]
16+
- ["hdb.Client", "@sap/hdbext", "Member[middleware].ReturnValue.GuardedRouteHandler.Parameter[0].Member[db]"]
17+
18+
- addsTo:
19+
pack: codeql/javascript-all
20+
extensible: sourceModel
21+
data:
22+
- ['@sap/hana-client', 'Member[createConnection].ReturnValue.Member[exec].Argument[1].Parameter[1]', 'database-access-result']
23+
- ['@sap/hana-client', 'Member[createConnection].ReturnValue.Member[prepare].ReturnValue.Member[execBatch,exec,execQuery].Argument[1].Parameter[1]', 'database-access-result']
24+
- ['hdb.Client', 'Member[exec,execute].Argument[1..2].Parameter[1]', 'database-access-result']
25+
- ['hdb.Client', 'Member[prepare].Argument[1].Parameter[1].Member[exec].Argument[1].Parameter[2..]', 'database-access-result']
26+
- ["@sap/hana-client/extension/Stream", "Member[createProcStatement].Argument[2].Parameter[1].Member[exec].Argument[1].Parameter[2..]", "database-access-result"]
27+
- ['@sap/hdbext', 'Member[loadProcedure].Argument[3].Parameter[1].Argument[2].Parameter[2..]', 'database-access-result']

‎javascript/ql/test/query-tests/Security/CWE-079/DomBasedXss/XssWithAdditionalSources.expected

Lines changed: 56 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -153,6 +153,34 @@ nodes
153153
| event-handler-receiver.js:2:31:2:83 | '<h2><a ... ></h2>' | semmle.label | '<h2><a ... ></h2>' |
154154
| event-handler-receiver.js:2:49:2:61 | location.href | semmle.label | location.href |
155155
| express.js:6:15:6:33 | req.param("wobble") | semmle.label | req.param("wobble") |
156+
| hana.js:11:37:11:40 | rows | semmle.label | rows |
157+
| hana.js:11:37:11:51 | rows[0].comment | semmle.label | rows[0].comment |
158+
| hana.js:16:37:16:40 | rows | semmle.label | rows |
159+
| hana.js:16:37:16:51 | rows[0].comment | semmle.label | rows[0].comment |
160+
| hana.js:19:37:19:40 | rows | semmle.label | rows |
161+
| hana.js:19:37:19:51 | rows[0].comment | semmle.label | rows[0].comment |
162+
| hana.js:22:37:22:38 | rs | semmle.label | rs |
163+
| hana.js:22:37:22:49 | rs[0].comment | semmle.label | rs[0].comment |
164+
| hana.js:38:31:38:32 | rs | semmle.label | rs |
165+
| hana.js:38:31:38:43 | rs[0].comment | semmle.label | rs[0].comment |
166+
| hana.js:43:33:43:41 | dummyRows | semmle.label | dummyRows |
167+
| hana.js:43:33:43:52 | dummyRows[0].comment | semmle.label | dummyRows[0].comment |
168+
| hana.js:44:33:44:42 | tablesRows | semmle.label | tablesRows |
169+
| hana.js:44:33:44:53 | tablesR ... comment | semmle.label | tablesR ... comment |
170+
| hana.js:50:33:50:41 | dummyRows | semmle.label | dummyRows |
171+
| hana.js:50:33:50:52 | dummyRows[0].comment | semmle.label | dummyRows[0].comment |
172+
| hana.js:51:33:51:42 | tablesRows | semmle.label | tablesRows |
173+
| hana.js:51:33:51:53 | tablesR ... comment | semmle.label | tablesR ... comment |
174+
| hana.js:70:33:70:36 | rows | semmle.label | rows |
175+
| hana.js:70:33:70:47 | rows[0].comment | semmle.label | rows[0].comment |
176+
| hana.js:73:33:73:36 | rows | semmle.label | rows |
177+
| hana.js:73:33:73:47 | rows[0].comment | semmle.label | rows[0].comment |
178+
| hana.js:84:35:84:43 | dummyRows | semmle.label | dummyRows |
179+
| hana.js:84:35:84:54 | dummyRows[0].comment | semmle.label | dummyRows[0].comment |
180+
| hana.js:85:35:85:43 | tableRows | semmle.label | tableRows |
181+
| hana.js:85:35:85:54 | tableRows[0].comment | semmle.label | tableRows[0].comment |
182+
| hana.js:90:33:90:34 | rs | semmle.label | rs |
183+
| hana.js:90:33:90:45 | rs[0].comment | semmle.label | rs[0].comment |
156184
| jquery.js:2:7:2:40 | tainted | semmle.label | tainted |
157185
| jquery.js:2:17:2:40 | documen ... .search | semmle.label | documen ... .search |
158186
| jquery.js:4:5:4:11 | tainted | semmle.label | tainted |
@@ -791,6 +819,20 @@ edges
791819
| dragAndDrop.ts:71:27:71:61 | e.dataT ... /html') | dragAndDrop.ts:71:13:71:61 | droppedHtml | provenance | |
792820
| event-handler-receiver.js:2:49:2:61 | location.href | event-handler-receiver.js:2:31:2:83 | '<h2><a ... ></h2>' | provenance | |
793821
| event-handler-receiver.js:2:49:2:61 | location.href | event-handler-receiver.js:2:31:2:83 | '<h2><a ... ></h2>' | provenance | Config |
822+
| hana.js:11:37:11:40 | rows | hana.js:11:37:11:51 | rows[0].comment | provenance | |
823+
| hana.js:16:37:16:40 | rows | hana.js:16:37:16:51 | rows[0].comment | provenance | |
824+
| hana.js:19:37:19:40 | rows | hana.js:19:37:19:51 | rows[0].comment | provenance | |
825+
| hana.js:22:37:22:38 | rs | hana.js:22:37:22:49 | rs[0].comment | provenance | |
826+
| hana.js:38:31:38:32 | rs | hana.js:38:31:38:43 | rs[0].comment | provenance | |
827+
| hana.js:43:33:43:41 | dummyRows | hana.js:43:33:43:52 | dummyRows[0].comment | provenance | |
828+
| hana.js:44:33:44:42 | tablesRows | hana.js:44:33:44:53 | tablesR ... comment | provenance | |
829+
| hana.js:50:33:50:41 | dummyRows | hana.js:50:33:50:52 | dummyRows[0].comment | provenance | |
830+
| hana.js:51:33:51:42 | tablesRows | hana.js:51:33:51:53 | tablesR ... comment | provenance | |
831+
| hana.js:70:33:70:36 | rows | hana.js:70:33:70:47 | rows[0].comment | provenance | |
832+
| hana.js:73:33:73:36 | rows | hana.js:73:33:73:47 | rows[0].comment | provenance | |
833+
| hana.js:84:35:84:43 | dummyRows | hana.js:84:35:84:54 | dummyRows[0].comment | provenance | |
834+
| hana.js:85:35:85:43 | tableRows | hana.js:85:35:85:54 | tableRows[0].comment | provenance | |
835+
| hana.js:90:33:90:34 | rs | hana.js:90:33:90:45 | rs[0].comment | provenance | |
794836
| jquery.js:2:7:2:40 | tainted | jquery.js:4:5:4:11 | tainted | provenance | |
795837
| jquery.js:2:7:2:40 | tainted | jquery.js:5:13:5:19 | tainted | provenance | |
796838
| jquery.js:2:7:2:40 | tainted | jquery.js:6:11:6:17 | tainted | provenance | |
@@ -1274,6 +1316,20 @@ subpaths
12741316
| various-concat-obfuscations.js:21:17:21:46 | documen ... h.attrs | various-concat-obfuscations.js:17:24:17:28 | attrs | various-concat-obfuscations.js:18:10:18:105 | '<div a ... /div>') | various-concat-obfuscations.js:21:4:21:47 | indirec ... .attrs) |
12751317
| various-concat-obfuscations.js:21:17:21:46 | documen ... h.attrs | various-concat-obfuscations.js:17:24:17:28 | attrs | various-concat-obfuscations.js:18:10:18:105 | '<div a ... /div>') [ArrayElement] | various-concat-obfuscations.js:21:4:21:47 | indirec ... .attrs) |
12761318
#select
1319+
| hana.js:11:37:11:51 | rows[0].comment | hana.js:11:37:11:40 | rows | hana.js:11:37:11:51 | rows[0].comment | Cross-site scripting vulnerability due to $@. | hana.js:11:37:11:40 | rows | user-provided value |
1320+
| hana.js:16:37:16:51 | rows[0].comment | hana.js:16:37:16:40 | rows | hana.js:16:37:16:51 | rows[0].comment | Cross-site scripting vulnerability due to $@. | hana.js:16:37:16:40 | rows | user-provided value |
1321+
| hana.js:19:37:19:51 | rows[0].comment | hana.js:19:37:19:40 | rows | hana.js:19:37:19:51 | rows[0].comment | Cross-site scripting vulnerability due to $@. | hana.js:19:37:19:40 | rows | user-provided value |
1322+
| hana.js:22:37:22:49 | rs[0].comment | hana.js:22:37:22:38 | rs | hana.js:22:37:22:49 | rs[0].comment | Cross-site scripting vulnerability due to $@. | hana.js:22:37:22:38 | rs | user-provided value |
1323+
| hana.js:38:31:38:43 | rs[0].comment | hana.js:38:31:38:32 | rs | hana.js:38:31:38:43 | rs[0].comment | Cross-site scripting vulnerability due to $@. | hana.js:38:31:38:32 | rs | user-provided value |
1324+
| hana.js:43:33:43:52 | dummyRows[0].comment | hana.js:43:33:43:41 | dummyRows | hana.js:43:33:43:52 | dummyRows[0].comment | Cross-site scripting vulnerability due to $@. | hana.js:43:33:43:41 | dummyRows | user-provided value |
1325+
| hana.js:44:33:44:53 | tablesR ... comment | hana.js:44:33:44:42 | tablesRows | hana.js:44:33:44:53 | tablesR ... comment | Cross-site scripting vulnerability due to $@. | hana.js:44:33:44:42 | tablesRows | user-provided value |
1326+
| hana.js:50:33:50:52 | dummyRows[0].comment | hana.js:50:33:50:41 | dummyRows | hana.js:50:33:50:52 | dummyRows[0].comment | Cross-site scripting vulnerability due to $@. | hana.js:50:33:50:41 | dummyRows | user-provided value |
1327+
| hana.js:51:33:51:53 | tablesR ... comment | hana.js:51:33:51:42 | tablesRows | hana.js:51:33:51:53 | tablesR ... comment | Cross-site scripting vulnerability due to $@. | hana.js:51:33:51:42 | tablesRows | user-provided value |
1328+
| hana.js:70:33:70:47 | rows[0].comment | hana.js:70:33:70:36 | rows | hana.js:70:33:70:47 | rows[0].comment | Cross-site scripting vulnerability due to $@. | hana.js:70:33:70:36 | rows | user-provided value |
1329+
| hana.js:73:33:73:47 | rows[0].comment | hana.js:73:33:73:36 | rows | hana.js:73:33:73:47 | rows[0].comment | Cross-site scripting vulnerability due to $@. | hana.js:73:33:73:36 | rows | user-provided value |
1330+
| hana.js:84:35:84:54 | dummyRows[0].comment | hana.js:84:35:84:43 | dummyRows | hana.js:84:35:84:54 | dummyRows[0].comment | Cross-site scripting vulnerability due to $@. | hana.js:84:35:84:43 | dummyRows | user-provided value |
1331+
| hana.js:85:35:85:54 | tableRows[0].comment | hana.js:85:35:85:43 | tableRows | hana.js:85:35:85:54 | tableRows[0].comment | Cross-site scripting vulnerability due to $@. | hana.js:85:35:85:43 | tableRows | user-provided value |
1332+
| hana.js:90:33:90:45 | rs[0].comment | hana.js:90:33:90:34 | rs | hana.js:90:33:90:45 | rs[0].comment | Cross-site scripting vulnerability due to $@. | hana.js:90:33:90:34 | rs | user-provided value |
12771333
| jwt.js:6:14:6:20 | decoded | jwt.js:4:36:4:39 | data | jwt.js:6:14:6:20 | decoded | Cross-site scripting vulnerability due to $@. | jwt.js:4:36:4:39 | data | user-provided value |
12781334
| typeahead.js:10:16:10:18 | loc | typeahead.js:9:28:9:30 | loc | typeahead.js:10:16:10:18 | loc | Cross-site scripting vulnerability due to $@. | typeahead.js:9:28:9:30 | loc | user-provided value |
12791335
| xmlRequest.js:9:28:9:39 | json.message | xmlRequest.js:8:31:8:46 | xhr.responseText | xmlRequest.js:9:28:9:39 | json.message | Cross-site scripting vulnerability due to $@. | xmlRequest.js:8:31:8:46 | xhr.responseText | user-provided value |

‎javascript/ql/test/query-tests/Security/CWE-079/DomBasedXss/hana.js

Lines changed: 93 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,93 @@
1+
const hana = require('@sap/hana-client');
2+
const express = require('express');
3+
4+
const app = express();
5+
const connectionParams = {};
6+
const query = ``;
7+
app.post('/documents/find', (req, res) => {
8+
const conn = hana.createConnection();
9+
conn.connect(connectionParams, (err) => {
10+
conn.exec(query, (err, rows) => {
11+
document.body.innerHTML = rows[0].comment; // $ Alert[js/xss-additional-sources-dom-test]
12+
});
13+
14+
const stmt = conn.prepare(query);
15+
stmt.exec([0], (err, rows) => {
16+
document.body.innerHTML = rows[0].comment; // $ Alert[js/xss-additional-sources-dom-test]
17+
});
18+
stmt.execBatch([[1, "a"], [2, "b"]], function(err, rows) {
19+
document.body.innerHTML = rows[0].comment; // $ Alert[js/xss-additional-sources-dom-test]
20+
});
21+
stmt.execQuery([100, "a"], function(err, rs) {
22+
document.body.innerHTML = rs[0].comment; // $ Alert[js/xss-additional-sources-dom-test]
23+
});
24+
});
25+
});
26+
27+
var hdbext = require('@sap/hdbext');
28+
var express = require('express');
29+
var dbStream = require('@sap/hana-client/extension/Stream');
30+
31+
var app1 = express();
32+
const hanaConfig = {};
33+
app1.use(hdbext.middleware(hanaConfig));
34+
35+
app1.get('/execute-query', function (req, res) {
36+
var client = req.db;
37+
client.exec(query, function (err, rs) {
38+
document.body.innerHTML = rs[0].comment; // $ Alert[js/xss-additional-sources-dom-test]
39+
});
40+
41+
dbStream.createProcStatement(client, query, function (err, stmt) {
42+
stmt.exec({ A: 1, B: 4 }, function (err, params, dummyRows, tablesRows) {
43+
document.body.innerHTML = dummyRows[0].comment; // $ Alert[js/xss-additional-sources-dom-test]
44+
document.body.innerHTML = tablesRows[0].comment; // $ Alert[js/xss-additional-sources-dom-test]
45+
});
46+
});
47+
48+
hdbext.loadProcedure(client, null, query, function(err, sp) {
49+
sp(3, maliciousInput, function(err, parameters, dummyRows, tablesRows) {
50+
document.body.innerHTML = dummyRows[0].comment; // $ Alert[js/xss-additional-sources-dom-test]
51+
document.body.innerHTML = tablesRows[0].comment; // $ Alert[js/xss-additional-sources-dom-test]
52+
});
53+
});
54+
});
55+
56+
57+
var hdb = require('hdb');
58+
const async = require('async');
59+
const { q } = require('underscore.string');
60+
61+
const options = {};
62+
const app2 = express();
63+
64+
app2.post('/documents/find', (req, res) => {
65+
var client = hdb.createClient(options);
66+
67+
client.connect(function onconnect(err) {
68+
69+
client.exec(query, function (err, rows) {
70+
document.body.innerHTML = rows[0].comment; // $ Alert[js/xss-additional-sources-dom-test]
71+
});
72+
client.exec(query, options, function(err, rows) {
73+
document.body.innerHTML = rows[0].comment; // $ Alert[js/xss-additional-sources-dom-test]
74+
});
75+
76+
client.prepare(query, function (err, statement){
77+
statement.exec([1], function (err, rows) {
78+
document.body.innerHTML = rows[0].comment; // $ Alert[js/xss-additional-sources-dom-test]
79+
});
80+
});
81+
82+
client.prepare(query, function(err, statement){
83+
statement.exec({A: 3, B: 1}, function(err, parameters, dummyRows, tableRows) {
84+
document.body.innerHTML = dummyRows[0].comment; // $ Alert[js/xss-additional-sources-dom-test]
85+
document.body.innerHTML = tableRows[0].comment; // $ Alert[js/xss-additional-sources-dom-test]
86+
});
87+
});
88+
89+
client.execute(query, function(err, rs) {
90+
document.body.innerHTML = rs[0].comment; // $ Alert[js/xss-additional-sources-dom-test]
91+
});
92+
});
93+
});

0 commit comments

Comments
 (0)