Skip to content

Commit 2ca5d81

Browse files
NapalysNapalys
committed
Added tests and modeling of database-access-result
1 parent 0806bd6 commit 2ca5d81

File tree

7 files changed

+168
-1
lines changed

7 files changed

+168
-1
lines changed

‎javascript/ql/lib/change-notes/2025-07-28-dynamodb.md

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,4 @@
11
---
22
category: minorAnalysis
33
---
4-
* Added support for the `aws-sdk` and `@aws-sdk/client-dynamodb`, `@aws-sdk/client-athena`, `@aws-sdk/client-s3`, and `@aws-sdk/client-rds-data` packages. This enables detection of SQL injection vulnerabilities in DynamoDB PartiQL operations, Athena queries, S3 select expressions, and RDS Data API calls.
4+
* Added support for the `aws-sdk` and `@aws-sdk/client-dynamodb`, `@aws-sdk/client-athena`, `@aws-sdk/client-s3`, and `@aws-sdk/client-rds-data` packages.

‎javascript/ql/lib/ext/athena.model.yml

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -19,3 +19,11 @@ extensions:
1919
data:
2020
- ["AthenaClientV3", "@aws-sdk/client-athena", "Member[AthenaClient]"]
2121
- ["AthenaClientV2", "aws-sdk", "Member[Athena]"]
22+
23+
- addsTo:
24+
pack: codeql/javascript-all
25+
extensible: sourceModel
26+
data:
27+
- ["AthenaClientV3", "ReturnValue.Member[send].ReturnValue.Awaited", "database-access-result"]
28+
- ["AthenaClientV2", "ReturnValue.Member[getQueryResults].ReturnValue.Member[promise].ReturnValue.Awaited", "database-access-result"]
29+
- ["AthenaClientV2", "ReturnValue.Member[getQueryResults].Argument[1].Parameter[1]", "database-access-result"]

‎javascript/ql/lib/ext/client-s3.model.yml

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -18,3 +18,11 @@ extensions:
1818
data:
1919
- ["S3ClientV3", "@aws-sdk/client-s3", "Member[S3Client]"]
2020
- ["S3ClientV2", "aws-sdk", "Member[S3]"]
21+
22+
- addsTo:
23+
pack: codeql/javascript-all
24+
extensible: sourceModel
25+
data:
26+
- ["S3ClientV3", "ReturnValue.Member[send].ReturnValue.Awaited", "database-access-result"]
27+
- ["S3ClientV2", "ReturnValue.Member[getObject].ReturnValue.Member[promise].ReturnValue.Awaited", "database-access-result"]
28+
- ["S3ClientV2", "ReturnValue.Member[getObject].Argument[1].Parameter[1]", "database-access-result"]

‎javascript/ql/lib/ext/dynamodb.model.yml

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -20,3 +20,11 @@ extensions:
2020
data:
2121
- ["DynamoDBClientV3", "@aws-sdk/client-dynamodb", "Member[DynamoDBClient,DynamoDB]"]
2222
- ["DynamoDBClientV2", "aws-sdk", "Member[DynamoDB]"]
23+
24+
- addsTo:
25+
pack: codeql/javascript-all
26+
extensible: sourceModel
27+
data:
28+
- ["DynamoDBClientV3", "ReturnValue.Member[send].ReturnValue.Awaited", "database-access-result"]
29+
- ["DynamoDBClientV2", "ReturnValue.Member[executeStatement,batchExecuteStatement].ReturnValue.Member[promise].ReturnValue.Awaited", "database-access-result"]
30+
- ["DynamoDBClientV2", "ReturnValue.Member[executeStatement,batchExecuteStatement].Argument[1].Parameter[1]", "database-access-result"]

‎javascript/ql/lib/ext/rds-client.model.yml

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -21,3 +21,11 @@ extensions:
2121
data:
2222
- ["RDSDataClientV3", "@aws-sdk/client-rds-data", "Member[RDSDataClient]"]
2323
- ["RDSDataClientV2", "aws-sdk", "Member[RDSDataService]"]
24+
25+
- addsTo:
26+
pack: codeql/javascript-all
27+
extensible: sourceModel
28+
data:
29+
- ["RDSDataClientV3", "ReturnValue.Member[send].ReturnValue.Awaited", "database-access-result"]
30+
- ["RDSDataClientV2", "ReturnValue.Member[executeStatement,batchExecuteStatement].ReturnValue.Member[promise].ReturnValue.Awaited", "database-access-result"]
31+
- ["RDSDataClientV2", "ReturnValue.Member[executeStatement,batchExecuteStatement].Argument[1].Parameter[1]", "database-access-result"]

‎javascript/ql/test/query-tests/Security/CWE-079/DomBasedXss/XssWithAdditionalSources.expected

Lines changed: 56 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -32,6 +32,34 @@ nodes
3232
| angular-tempate-url.js:13:30:13:31 | ev | semmle.label | ev |
3333
| angular-tempate-url.js:14:26:14:27 | ev | semmle.label | ev |
3434
| angular-tempate-url.js:14:26:14:32 | ev.data | semmle.label | ev.data |
35+
| aws-db.js:15:31:15:37 | results | semmle.label | results |
36+
| aws-db.js:15:31:15:76 | results ... arValue | semmle.label | results ... arValue |
37+
| aws-db.js:20:31:20:38 | response | semmle.label | response |
38+
| aws-db.js:20:31:20:54 | respons ... tring() | semmle.label | respons ... tring() |
39+
| aws-db.js:24:31:24:39 | response2 | semmle.label | response2 |
40+
| aws-db.js:24:31:24:47 | response2.records | semmle.label | response2.records |
41+
| aws-db.js:28:31:28:39 | response3 | semmle.label | response3 |
42+
| aws-db.js:28:31:28:44 | response3.Item | semmle.label | response3.Item |
43+
| aws-db.js:43:31:43:37 | results | semmle.label | results |
44+
| aws-db.js:43:31:43:76 | results ... arValue | semmle.label | results ... arValue |
45+
| aws-db.js:46:35:46:38 | data | semmle.label | data |
46+
| aws-db.js:46:35:46:77 | data.Re ... arValue | semmle.label | data.Re ... arValue |
47+
| aws-db.js:51:31:51:38 | response | semmle.label | response |
48+
| aws-db.js:51:31:51:54 | respons ... tring() | semmle.label | respons ... tring() |
49+
| aws-db.js:54:35:54:38 | data | semmle.label | data |
50+
| aws-db.js:54:35:54:54 | data.Body.toString() | semmle.label | data.Body.toString() |
51+
| aws-db.js:59:31:59:39 | response1 | semmle.label | response1 |
52+
| aws-db.js:59:31:59:47 | response1.records | semmle.label | response1.records |
53+
| aws-db.js:62:35:62:38 | data | semmle.label | data |
54+
| aws-db.js:62:35:62:46 | data.records | semmle.label | data.records |
55+
| aws-db.js:66:31:66:39 | response2 | semmle.label | response2 |
56+
| aws-db.js:66:31:66:53 | respons ... Results | semmle.label | respons ... Results |
57+
| aws-db.js:69:35:69:38 | data | semmle.label | data |
58+
| aws-db.js:69:35:69:52 | data.updateResults | semmle.label | data.updateResults |
59+
| aws-db.js:74:35:74:38 | data | semmle.label | data |
60+
| aws-db.js:74:35:74:43 | data.Item | semmle.label | data.Item |
61+
| aws-db.js:77:35:77:38 | data | semmle.label | data |
62+
| aws-db.js:77:35:77:43 | data.Item | semmle.label | data.Item |
3563
| classnames.js:7:31:7:84 | `<span ... <span>` | semmle.label | `<span ... <span>` |
3664
| classnames.js:7:47:7:69 | classNa ... w.name) | semmle.label | classNa ... w.name) |
3765
| classnames.js:7:58:7:68 | window.name | semmle.label | window.name |
@@ -724,6 +752,20 @@ edges
724752
| angular-tempate-url.js:13:30:13:31 | ev | angular-tempate-url.js:14:26:14:27 | ev | provenance | |
725753
| angular-tempate-url.js:14:26:14:27 | ev | angular-tempate-url.js:14:26:14:32 | ev.data | provenance | |
726754
| angular-tempate-url.js:14:26:14:32 | ev.data | angular-tempate-url.js:9:26:9:45 | Cookie.get("unsafe") | provenance | |
755+
| aws-db.js:15:31:15:37 | results | aws-db.js:15:31:15:76 | results ... arValue | provenance | |
756+
| aws-db.js:20:31:20:38 | response | aws-db.js:20:31:20:54 | respons ... tring() | provenance | |
757+
| aws-db.js:24:31:24:39 | response2 | aws-db.js:24:31:24:47 | response2.records | provenance | |
758+
| aws-db.js:28:31:28:39 | response3 | aws-db.js:28:31:28:44 | response3.Item | provenance | |
759+
| aws-db.js:43:31:43:37 | results | aws-db.js:43:31:43:76 | results ... arValue | provenance | |
760+
| aws-db.js:46:35:46:38 | data | aws-db.js:46:35:46:77 | data.Re ... arValue | provenance | |
761+
| aws-db.js:51:31:51:38 | response | aws-db.js:51:31:51:54 | respons ... tring() | provenance | |
762+
| aws-db.js:54:35:54:38 | data | aws-db.js:54:35:54:54 | data.Body.toString() | provenance | |
763+
| aws-db.js:59:31:59:39 | response1 | aws-db.js:59:31:59:47 | response1.records | provenance | |
764+
| aws-db.js:62:35:62:38 | data | aws-db.js:62:35:62:46 | data.records | provenance | |
765+
| aws-db.js:66:31:66:39 | response2 | aws-db.js:66:31:66:53 | respons ... Results | provenance | |
766+
| aws-db.js:69:35:69:38 | data | aws-db.js:69:35:69:52 | data.updateResults | provenance | |
767+
| aws-db.js:74:35:74:38 | data | aws-db.js:74:35:74:43 | data.Item | provenance | |
768+
| aws-db.js:77:35:77:38 | data | aws-db.js:77:35:77:43 | data.Item | provenance | |
727769
| classnames.js:7:47:7:69 | classNa ... w.name) | classnames.js:7:31:7:84 | `<span ... <span>` | provenance | |
728770
| classnames.js:7:58:7:68 | window.name | classnames.js:7:47:7:69 | classNa ... w.name) | provenance | |
729771
| classnames.js:8:47:8:70 | classNa ... w.name) | classnames.js:8:31:8:85 | `<span ... <span>` | provenance | |
@@ -1319,6 +1361,20 @@ subpaths
13191361
| various-concat-obfuscations.js:21:17:21:46 | documen ... h.attrs | various-concat-obfuscations.js:17:24:17:28 | attrs | various-concat-obfuscations.js:18:10:18:105 | '<div a ... /div>') | various-concat-obfuscations.js:21:4:21:47 | indirec ... .attrs) |
13201362
| various-concat-obfuscations.js:21:17:21:46 | documen ... h.attrs | various-concat-obfuscations.js:17:24:17:28 | attrs | various-concat-obfuscations.js:18:10:18:105 | '<div a ... /div>') [ArrayElement] | various-concat-obfuscations.js:21:4:21:47 | indirec ... .attrs) |
13211363
#select
1364+
| aws-db.js:15:31:15:76 | results ... arValue | aws-db.js:15:31:15:37 | results | aws-db.js:15:31:15:76 | results ... arValue | Cross-site scripting vulnerability due to $@. | aws-db.js:15:31:15:37 | results | user-provided value |
1365+
| aws-db.js:20:31:20:54 | respons ... tring() | aws-db.js:20:31:20:38 | response | aws-db.js:20:31:20:54 | respons ... tring() | Cross-site scripting vulnerability due to $@. | aws-db.js:20:31:20:38 | response | user-provided value |
1366+
| aws-db.js:24:31:24:47 | response2.records | aws-db.js:24:31:24:39 | response2 | aws-db.js:24:31:24:47 | response2.records | Cross-site scripting vulnerability due to $@. | aws-db.js:24:31:24:39 | response2 | user-provided value |
1367+
| aws-db.js:28:31:28:44 | response3.Item | aws-db.js:28:31:28:39 | response3 | aws-db.js:28:31:28:44 | response3.Item | Cross-site scripting vulnerability due to $@. | aws-db.js:28:31:28:39 | response3 | user-provided value |
1368+
| aws-db.js:43:31:43:76 | results ... arValue | aws-db.js:43:31:43:37 | results | aws-db.js:43:31:43:76 | results ... arValue | Cross-site scripting vulnerability due to $@. | aws-db.js:43:31:43:37 | results | user-provided value |
1369+
| aws-db.js:46:35:46:77 | data.Re ... arValue | aws-db.js:46:35:46:38 | data | aws-db.js:46:35:46:77 | data.Re ... arValue | Cross-site scripting vulnerability due to $@. | aws-db.js:46:35:46:38 | data | user-provided value |
1370+
| aws-db.js:51:31:51:54 | respons ... tring() | aws-db.js:51:31:51:38 | response | aws-db.js:51:31:51:54 | respons ... tring() | Cross-site scripting vulnerability due to $@. | aws-db.js:51:31:51:38 | response | user-provided value |
1371+
| aws-db.js:54:35:54:54 | data.Body.toString() | aws-db.js:54:35:54:38 | data | aws-db.js:54:35:54:54 | data.Body.toString() | Cross-site scripting vulnerability due to $@. | aws-db.js:54:35:54:38 | data | user-provided value |
1372+
| aws-db.js:59:31:59:47 | response1.records | aws-db.js:59:31:59:39 | response1 | aws-db.js:59:31:59:47 | response1.records | Cross-site scripting vulnerability due to $@. | aws-db.js:59:31:59:39 | response1 | user-provided value |
1373+
| aws-db.js:62:35:62:46 | data.records | aws-db.js:62:35:62:38 | data | aws-db.js:62:35:62:46 | data.records | Cross-site scripting vulnerability due to $@. | aws-db.js:62:35:62:38 | data | user-provided value |
1374+
| aws-db.js:66:31:66:53 | respons ... Results | aws-db.js:66:31:66:39 | response2 | aws-db.js:66:31:66:53 | respons ... Results | Cross-site scripting vulnerability due to $@. | aws-db.js:66:31:66:39 | response2 | user-provided value |
1375+
| aws-db.js:69:35:69:52 | data.updateResults | aws-db.js:69:35:69:38 | data | aws-db.js:69:35:69:52 | data.updateResults | Cross-site scripting vulnerability due to $@. | aws-db.js:69:35:69:38 | data | user-provided value |
1376+
| aws-db.js:74:35:74:43 | data.Item | aws-db.js:74:35:74:38 | data | aws-db.js:74:35:74:43 | data.Item | Cross-site scripting vulnerability due to $@. | aws-db.js:74:35:74:38 | data | user-provided value |
1377+
| aws-db.js:77:35:77:43 | data.Item | aws-db.js:77:35:77:38 | data | aws-db.js:77:35:77:43 | data.Item | Cross-site scripting vulnerability due to $@. | aws-db.js:77:35:77:38 | data | user-provided value |
13221378
| hana.js:11:37:11:51 | rows[0].comment | hana.js:11:37:11:40 | rows | hana.js:11:37:11:51 | rows[0].comment | Cross-site scripting vulnerability due to $@. | hana.js:11:37:11:40 | rows | user-provided value |
13231379
| hana.js:16:37:16:51 | rows[0].comment | hana.js:16:37:16:40 | rows | hana.js:16:37:16:51 | rows[0].comment | Cross-site scripting vulnerability due to $@. | hana.js:16:37:16:40 | rows | user-provided value |
13241380
| hana.js:19:37:19:51 | rows[0].comment | hana.js:19:37:19:40 | rows | hana.js:19:37:19:51 | rows[0].comment | Cross-site scripting vulnerability due to $@. | hana.js:19:37:19:40 | rows | user-provided value |

‎javascript/ql/test/query-tests/Security/CWE-079/DomBasedXss/aws-db.js

Lines changed: 79 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,79 @@
1+
const { AthenaClient, GetQueryResultsCommand } = require('@aws-sdk/client-athena');
2+
const { S3Client, GetObjectCommand } = require("@aws-sdk/client-s3");
3+
const { RDSDataClient, ExecuteStatementCommand } = require("@aws-sdk/client-rds-data");
4+
const { DynamoDBClient, GetItemCommand } = require("@aws-sdk/client-dynamodb");
5+
6+
7+
const express = require('express');
8+
const bodyParser = require('body-parser');
9+
const app = express();
10+
app.use(bodyParser.json());
11+
12+
app.post('/v3/all', async (req, res) => {
13+
const client = new AthenaClient({ region: "us-east-1" });
14+
const results = await client.send(new GetQueryResultsCommand({ QueryExecutionId }));
15+
document.body.innerHTML = results.ResultSet.Rows[0].Data[0].VarCharValue; // $ Alert[js/xss-additional-sources-dom-test]
16+
17+
const s3 = new S3Client({ region: "us-east-1" });
18+
const command = new GetObjectCommand({ Bucket: bucket, Key: key });
19+
const response = await s3.send(command);
20+
document.body.innerHTML = response.Body.toString(); // $ Alert[js/xss-additional-sources-dom-test]
21+
22+
const clientRDS = new RDSDataClient({ region: "us-east-1" });
23+
const response2 = await clientRDS.send(new ExecuteStatementCommand(command));
24+
document.body.innerHTML = response2.records; // $ Alert[js/xss-additional-sources-dom-test]
25+
26+
const clientDyamo = new DynamoDBClient({ region: "us-east-1" });
27+
const response3 = await clientDyamo.send(new GetItemCommand(command));
28+
document.body.innerHTML = response3.Item; // $ Alert[js/xss-additional-sources-dom-test]
29+
30+
});
31+
32+
33+
app.post('/v2/all', async (req, res) => {
34+
const AWS = require('aws-sdk');
35+
const athena = new AWS.Athena();
36+
const params = {
37+
QueryString: 'SELECT * FROM my_table',
38+
ResultConfiguration: { OutputLocation: 's3://bucket/prefix/' }
39+
};
40+
const { QueryExecutionId } = await athena.startQueryExecution(params).promise();
41+
42+
const results = await athena.getQueryResults({ QueryExecutionId }).promise();
43+
document.body.innerHTML = results.ResultSet.Rows[0].Data[0].VarCharValue; // $ Alert[js/xss-additional-sources-dom-test]
44+
45+
athena.getQueryResults({ QueryExecutionId }, (err, data) => {
46+
document.body.innerHTML = data.ResultSet.Rows[0].Data[0].VarCharValue; // $ Alert[js/xss-additional-sources-dom-test]
47+
});
48+
49+
const s3 = new AWS.S3({ region: "us-east-1" });
50+
const response = await s3.getObject({ Bucket: "bucket", Key: "key" }).promise();
51+
document.body.innerHTML = response.Body.toString(); // $ Alert[js/xss-additional-sources-dom-test]
52+
53+
s3.getObject({ Bucket: "bucket", Key: "key" }, (err, data) => {
54+
document.body.innerHTML = data.Body.toString(); // $ Alert[js/xss-additional-sources-dom-test]
55+
});
56+
57+
const rdsData = new AWS.RDSDataService({ region: "us-east-1" });
58+
const response1 = await rdsData.executeStatement(params).promise();
59+
document.body.innerHTML = response1.records; // $ Alert[js/xss-additional-sources-dom-test]
60+
61+
rdsData.executeStatement(params, function(err, data) {
62+
document.body.innerHTML = data.records; // $ Alert[js/xss-additional-sources-dom-test]
63+
});
64+
65+
const response2 = await rdsData.batchExecuteStatement(params).promise();
66+
document.body.innerHTML = response2.updateResults; // $ Alert[js/xss-additional-sources-dom-test]
67+
68+
rdsData.batchExecuteStatement(params, function(err, data) {
69+
document.body.innerHTML = data.updateResults; // $ Alert[js/xss-additional-sources-dom-test]
70+
});
71+
72+
const dynamodb = new AWS.DynamoDB({ region: "us-east-1" });
73+
dynamodb.executeStatement(params, (err, data) => {
74+
document.body.innerHTML = data.Item; // $ Alert[js/xss-additional-sources-dom-test]
75+
});
76+
dynamodb.executeStatement(params).promise().then(data => {
77+
document.body.innerHTML = data.Item; // $ Alert[js/xss-additional-sources-dom-test]
78+
});
79+
});

0 commit comments

Comments
 (0)