InsecureUrlWhitelist.ql

/**
 * @name Insecure URL whitelist
 * @description URL whitelists that are too permissive can cause security vulnerabilities.
 * @kind problem
 * @problem.severity warning
 * @security-severity 7.5
 * @precision very-high
 * @id js/angular/insecure-url-whitelist
 * @tags security
 * frameworks/angularjs
 * external/cwe/cwe-183
 * external/cwe/cwe-625
 */

import javascript

/**
 * Holds if `setupCall` is a call to `$sceDelegateProvider.resourceUrlWhitelist` with
 * argument `list`.
 */
predicateisResourceUrlWhitelist(
 DataFlow::MethodCallNodesetupCall, DataFlow::ArrayCreationNodelist
){
exists(AngularJS::ServiceReferenceservice|
service.getName()="$sceDelegateProvider"and
setupCall=service.getAMethodCall("resourceUrlWhitelist")and
list.flowsTo(setupCall.getArgument(0))
)
}

/**
 * An entry in a resource URL whitelist.
 */
classResourceUrlWhitelistEntryextendsExpr{
 DataFlow::MethodCallNodesetupCall;
stringpattern;

ResourceUrlWhitelistEntry(){
exists(DataFlow::ArrayCreationNodewhitelist|
isResourceUrlWhitelist(setupCall,whitelist)and
this=whitelist.getAnElement().asExpr()and
this.mayHaveStringValue(pattern)
)
}

/**
 * Gets the method call that sets up this whitelist.
 */
 DataFlow::MethodCallNodegetSetupCall(){result=setupCall}

/**
 * Holds if this expression is insecure to use in an URL pattern whitelist due
 * to the reason given by `explanation`.
 */
predicateisInsecure(stringexplanation){
exists(stringcomponentName,stringcomponent|
exists(intcomponentNumber|
componentName="scheme"andcomponentNumber=1
or
componentName="domain"andcomponentNumber=2
or
componentName="TLD"andcomponentNumber=4
|
component=pattern.regexpCapture("(.*?)://(.*?(\\.(.*?))?)(:\\d+)?(/.*)?",componentNumber)
)and
explanation="the "+componentName+" '"+component+"' is insecurely specified"
|
componentName="scheme"andcomponent.matches("%*%")
or
componentName="domain"andcomponent.matches("%**%")
or
componentName="TLD"andcomponent="*"
)
}
}

fromResourceUrlWhitelistEntryentry, DataFlow::MethodCallNodesetupCall,stringexplanation
where
entry.isInsecure(explanation)and
setupCall=entry.getSetupCall()
selectsetupCall,"$@ is not a secure whitelist entry, because "+explanation+".",entry,
entry.toString()