Skip to content

Commit f02783a

Browse files
NapalysNapalys
authored
Merge pull request #19210 from Napalys/js/mkdirp
JS: Modeling of `mkdirp` functions
2 parents 9323f1a + 0e7bff0 commit f02783a

File tree

5 files changed

+73
-13
lines changed

5 files changed

+73
-13
lines changed

‎javascript/ql/lib/change-notes/2025-04-02-mkdirp.md

+4
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,4 @@
1+
---
2+
category: minorAnalysis
3+
---
4+
* Added support for additional `mkdirp` methods as sinks in path-injection queries.

‎javascript/ql/lib/ext/mkdirp.model.yml

+7
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,7 @@
1+
extensions:
2+
- addsTo:
3+
pack: codeql/javascript-all
4+
extensible: sinkModel
5+
data:
6+
- ["mkdirp", "Member[nativeSync,native,manual,manualSync,mkdirpNative,mkdirpManual,mkdirpManualSync,mkdirpNativeSync,mkdirpSync,sync].Argument[0]", "path-injection"]
7+
- ["mkdirp", "Argument[0]", "path-injection"]

‎javascript/ql/lib/semmle/javascript/frameworks/Files.qll

-13
Original file line numberDiff line numberDiff line change
@@ -427,16 +427,3 @@ class Chokidar extends FileNameProducer, FileSystemAccess, API::CallNode {
427427
)
428428
}
429429
}
430-
431-
/**
432-
* A call to the [`mkdirp`](https://www.npmjs.com/package/mkdirp) library.
433-
*/
434-
private class Mkdirp extends FileSystemAccess, API::CallNode {
435-
Mkdirp() {
436-
this = API::moduleImport("mkdirp").getACall()
437-
or
438-
this = API::moduleImport("mkdirp").getMember("sync").getACall()
439-
}
440-
441-
override DataFlow::Node getAPathArgument() { result = this.getArgument(0) }
442-
}

‎javascript/ql/test/query-tests/Security/CWE-022/TaintedPath/TaintedPath.expected

+40
Original file line numberDiff line numberDiff line change
@@ -52,6 +52,17 @@
5252
| handlebars.js:11:32:11:39 | filePath | handlebars.js:29:46:29:60 | req.params.path | handlebars.js:11:32:11:39 | filePath | This path depends on a $@. | handlebars.js:29:46:29:60 | req.params.path | user-provided value |
5353
| handlebars.js:15:25:15:32 | filePath | handlebars.js:43:15:43:29 | req.params.path | handlebars.js:15:25:15:32 | filePath | This path depends on a $@. | handlebars.js:43:15:43:29 | req.params.path | user-provided value |
5454
| hapi.js:15:44:15:51 | filepath | hapi.js:14:30:14:51 | request ... ilepath | hapi.js:15:44:15:51 | filepath | This path depends on a $@. | hapi.js:14:30:14:51 | request ... ilepath | user-provided value |
55+
| mkdirp.js:11:12:11:18 | dirPath | mkdirp.js:9:42:9:59 | req.query.filename | mkdirp.js:11:12:11:18 | dirPath | This path depends on a $@. | mkdirp.js:9:42:9:59 | req.query.filename | user-provided value |
56+
| mkdirp.js:12:17:12:23 | dirPath | mkdirp.js:9:42:9:59 | req.query.filename | mkdirp.js:12:17:12:23 | dirPath | This path depends on a $@. | mkdirp.js:9:42:9:59 | req.query.filename | user-provided value |
57+
| mkdirp.js:13:23:13:29 | dirPath | mkdirp.js:9:42:9:59 | req.query.filename | mkdirp.js:13:23:13:29 | dirPath | This path depends on a $@. | mkdirp.js:9:42:9:59 | req.query.filename | user-provided value |
58+
| mkdirp.js:14:19:14:25 | dirPath | mkdirp.js:9:42:9:59 | req.query.filename | mkdirp.js:14:19:14:25 | dirPath | This path depends on a $@. | mkdirp.js:9:42:9:59 | req.query.filename | user-provided value |
59+
| mkdirp.js:15:19:15:25 | dirPath | mkdirp.js:9:42:9:59 | req.query.filename | mkdirp.js:15:19:15:25 | dirPath | This path depends on a $@. | mkdirp.js:9:42:9:59 | req.query.filename | user-provided value |
60+
| mkdirp.js:16:23:16:29 | dirPath | mkdirp.js:9:42:9:59 | req.query.filename | mkdirp.js:16:23:16:29 | dirPath | This path depends on a $@. | mkdirp.js:9:42:9:59 | req.query.filename | user-provided value |
61+
| mkdirp.js:17:25:17:31 | dirPath | mkdirp.js:9:42:9:59 | req.query.filename | mkdirp.js:17:25:17:31 | dirPath | This path depends on a $@. | mkdirp.js:9:42:9:59 | req.query.filename | user-provided value |
62+
| mkdirp.js:18:25:18:31 | dirPath | mkdirp.js:9:42:9:59 | req.query.filename | mkdirp.js:18:25:18:31 | dirPath | This path depends on a $@. | mkdirp.js:9:42:9:59 | req.query.filename | user-provided value |
63+
| mkdirp.js:19:29:19:35 | dirPath | mkdirp.js:9:42:9:59 | req.query.filename | mkdirp.js:19:29:19:35 | dirPath | This path depends on a $@. | mkdirp.js:9:42:9:59 | req.query.filename | user-provided value |
64+
| mkdirp.js:20:29:20:35 | dirPath | mkdirp.js:9:42:9:59 | req.query.filename | mkdirp.js:20:29:20:35 | dirPath | This path depends on a $@. | mkdirp.js:9:42:9:59 | req.query.filename | user-provided value |
65+
| mkdirp.js:21:23:21:29 | dirPath | mkdirp.js:9:42:9:59 | req.query.filename | mkdirp.js:21:23:21:29 | dirPath | This path depends on a $@. | mkdirp.js:9:42:9:59 | req.query.filename | user-provided value |
5566
| more-fs-extra.js:10:15:10:22 | filename | more-fs-extra.js:8:26:8:33 | req.body | more-fs-extra.js:10:15:10:22 | filename | This path depends on a $@. | more-fs-extra.js:8:26:8:33 | req.body | user-provided value |
5667
| more-fs-extra.js:11:11:11:18 | filename | more-fs-extra.js:8:26:8:33 | req.body | more-fs-extra.js:11:11:11:18 | filename | This path depends on a $@. | more-fs-extra.js:8:26:8:33 | req.body | user-provided value |
5768
| more-fs-extra.js:12:14:12:21 | filename | more-fs-extra.js:8:26:8:33 | req.body | more-fs-extra.js:12:14:12:21 | filename | This path depends on a $@. | more-fs-extra.js:8:26:8:33 | req.body | user-provided value |
@@ -392,6 +403,20 @@ edges
392403
| handlebars.js:43:15:43:29 | req.params.path | handlebars.js:13:73:13:80 | filePath | provenance | |
393404
| hapi.js:14:19:14:51 | filepath | hapi.js:15:44:15:51 | filepath | provenance | |
394405
| hapi.js:14:30:14:51 | request ... ilepath | hapi.js:14:19:14:51 | filepath | provenance | |
406+
| mkdirp.js:9:11:9:76 | dirPath | mkdirp.js:11:12:11:18 | dirPath | provenance | |
407+
| mkdirp.js:9:11:9:76 | dirPath | mkdirp.js:12:17:12:23 | dirPath | provenance | |
408+
| mkdirp.js:9:11:9:76 | dirPath | mkdirp.js:13:23:13:29 | dirPath | provenance | |
409+
| mkdirp.js:9:11:9:76 | dirPath | mkdirp.js:14:19:14:25 | dirPath | provenance | |
410+
| mkdirp.js:9:11:9:76 | dirPath | mkdirp.js:15:19:15:25 | dirPath | provenance | |
411+
| mkdirp.js:9:11:9:76 | dirPath | mkdirp.js:16:23:16:29 | dirPath | provenance | |
412+
| mkdirp.js:9:11:9:76 | dirPath | mkdirp.js:17:25:17:31 | dirPath | provenance | |
413+
| mkdirp.js:9:11:9:76 | dirPath | mkdirp.js:18:25:18:31 | dirPath | provenance | |
414+
| mkdirp.js:9:11:9:76 | dirPath | mkdirp.js:19:29:19:35 | dirPath | provenance | |
415+
| mkdirp.js:9:11:9:76 | dirPath | mkdirp.js:20:29:20:35 | dirPath | provenance | |
416+
| mkdirp.js:9:11:9:76 | dirPath | mkdirp.js:21:23:21:29 | dirPath | provenance | |
417+
| mkdirp.js:9:21:9:76 | path.jo ... ltDir') | mkdirp.js:9:11:9:76 | dirPath | provenance | |
418+
| mkdirp.js:9:42:9:59 | req.query.filename | mkdirp.js:9:42:9:75 | req.que ... ultDir' | provenance | |
419+
| mkdirp.js:9:42:9:75 | req.que ... ultDir' | mkdirp.js:9:21:9:76 | path.jo ... ltDir') | provenance | Config |
395420
| more-fs-extra.js:8:11:8:22 | { filename } | more-fs-extra.js:8:13:8:20 | filename | provenance | Config |
396421
| more-fs-extra.js:8:11:8:33 | filename | more-fs-extra.js:10:15:10:22 | filename | provenance | |
397422
| more-fs-extra.js:8:11:8:33 | filename | more-fs-extra.js:11:11:11:18 | filename | provenance | |
@@ -924,6 +949,21 @@ nodes
924949
| hapi.js:14:19:14:51 | filepath | semmle.label | filepath |
925950
| hapi.js:14:30:14:51 | request ... ilepath | semmle.label | request ... ilepath |
926951
| hapi.js:15:44:15:51 | filepath | semmle.label | filepath |
952+
| mkdirp.js:9:11:9:76 | dirPath | semmle.label | dirPath |
953+
| mkdirp.js:9:21:9:76 | path.jo ... ltDir') | semmle.label | path.jo ... ltDir') |
954+
| mkdirp.js:9:42:9:59 | req.query.filename | semmle.label | req.query.filename |
955+
| mkdirp.js:9:42:9:75 | req.que ... ultDir' | semmle.label | req.que ... ultDir' |
956+
| mkdirp.js:11:12:11:18 | dirPath | semmle.label | dirPath |
957+
| mkdirp.js:12:17:12:23 | dirPath | semmle.label | dirPath |
958+
| mkdirp.js:13:23:13:29 | dirPath | semmle.label | dirPath |
959+
| mkdirp.js:14:19:14:25 | dirPath | semmle.label | dirPath |
960+
| mkdirp.js:15:19:15:25 | dirPath | semmle.label | dirPath |
961+
| mkdirp.js:16:23:16:29 | dirPath | semmle.label | dirPath |
962+
| mkdirp.js:17:25:17:31 | dirPath | semmle.label | dirPath |
963+
| mkdirp.js:18:25:18:31 | dirPath | semmle.label | dirPath |
964+
| mkdirp.js:19:29:19:35 | dirPath | semmle.label | dirPath |
965+
| mkdirp.js:20:29:20:35 | dirPath | semmle.label | dirPath |
966+
| mkdirp.js:21:23:21:29 | dirPath | semmle.label | dirPath |
927967
| more-fs-extra.js:8:11:8:22 | { filename } | semmle.label | { filename } |
928968
| more-fs-extra.js:8:11:8:33 | filename | semmle.label | filename |
929969
| more-fs-extra.js:8:13:8:20 | filename | semmle.label | filename |

‎javascript/ql/test/query-tests/Security/CWE-022/TaintedPath/mkdirp.js

+22
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,22 @@
1+
const express = require('express');
2+
const mkdirp = require('mkdirp');
3+
const path = require('path');
4+
5+
const app = express();
6+
app.use(express.json());
7+
8+
app.post('/foo', async (req, res) => {
9+
const dirPath = path.join(__dirname, req.query.filename || 'defaultDir'); // $ Source
10+
11+
mkdirp(dirPath); // $ Alert
12+
mkdirp.sync(dirPath); // $ Alert
13+
mkdirp.nativeSync(dirPath); // $ Alert
14+
mkdirp.native(dirPath); // $ Alert
15+
mkdirp.manual(dirPath); // $ Alert
16+
mkdirp.manualSync(dirPath); // $ Alert
17+
mkdirp.mkdirpNative(dirPath); // $ Alert
18+
mkdirp.mkdirpManual(dirPath); // $ Alert
19+
mkdirp.mkdirpManualSync(dirPath); // $ Alert
20+
mkdirp.mkdirpNativeSync(dirPath); // $ Alert
21+
mkdirp.mkdirpSync(dirPath); // $ Alert
22+
});

0 commit comments

Comments
 (0)