CodeQL Editor

A simple online editor for CodeQL files.
untitled.ql — CodeQL Editor
/**
 * @name Taint-tracking to 'eval' calls
 * @description Tracks user-controlled values into 'eval' calls (special case of js/code-injection).
 * @kind problem
 * @problem.severity error
 * @tags security
 * @id js/examples/eval-taint
 */

import javascript
import DataFlow

class EvalTaint extends TaintTracking::Configuration {
  EvalTaint() { this = "EvalTaint" }

  override predicate isSource(Node node) { node instanceof RemoteFlowSource }

  override predicate isSink(Node node) { node = globalVarRef("eval").getACall().getArgument(0) }
}

from EvalTaint cfg, Node source, Node sink
where cfg.hasFlow(source, sink)
select sink, "Eval with user-controlled input from $@.", source, "here"1
/**
2
 * @name Taint-tracking to 'eval' calls
3
 * @description Tracks user-controlled values into 'eval' calls (special case of js/code-injection).
4
 * @kind problem
5
 * @problem.severity error
6
 * @tags security
7
 * @id js/examples/eval-taint
8
 */
9

10
import javascript
11
import DataFlow
12

13
class EvalTaint extends TaintTracking::Configuration {
14
  EvalTaint() { this = "EvalTaint" }
15

16
  override predicate isSource(Node node) { node instanceof RemoteFlowSource }
17

18
  override predicate isSink(Node node) { node = globalVarRef("eval").getACall().getArgument(0) }
19
}
20

21
from EvalTaint cfg, Node source, Node sink
22
where cfg.hasFlow(source, sink)
23
select sink, "Eval with user-controlled input from $@.", source, "here"