Skip to content
This repository was archived by the owner on Dec 4, 2021. It is now read-only.

Commit ba647cf

Browse files
Caleb HooverCaleb Hoover
Caleb Hoover
authored and
Caleb Hoover
committed
changes
1 parent c359672 commit ba647cf

File tree

5 files changed

+82
-63
lines changed

5 files changed

+82
-63
lines changed

‎bin/check

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -43,7 +43,7 @@ var check = require('../check.js');
4343
check.setFlags({
4444
verbose: argv.v,
4545
recursive: argv.r,
46-
json: argv.j,
46+
json: !argv.j && !argv.v,
4747
debug: argv.d
4848
});
4949
var Scope = check.Scope;
@@ -65,4 +65,4 @@ if (ast) {
6565
} else
6666
console.log(colors.green('No vulneralbities found'));
6767
}
68-
}
68+
}

‎bin/checkall

Lines changed: 5 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -19,9 +19,9 @@ files.forEach(function (i) {
1919
return;
2020

2121
try {
22-
// if (!fs.existsSync(i + '/src'))
23-
// return;
24-
// i += '/src';
22+
if (!fs.existsSync(i + '/src'))
23+
return;
24+
i += '/src';
2525
if (!fs.existsSync(folder + i + '/package.json'))
2626
return;
2727
pkgJson = require(folder + i + '/package.json');
@@ -55,6 +55,8 @@ files.forEach(function (i) {
5555
}
5656
}
5757

58+
check.reports = [];
59+
5860
} catch (e) {
5961
console.error(e);
6062
}

‎check.js

Lines changed: 25 additions & 25 deletions
Original file line numberDiff line numberDiff line change
@@ -27,10 +27,10 @@ var reports = module.exports.reports = [];
2727
var lookupTable = {};
2828

2929
module.exports.setFlags = function(newFlags) {
30-
flags.verbose = newFlags.verbose;
31-
flags.recursive = newFlags.recursive;
32-
flags.json = newFlags.json || true;
33-
flags.debug = newFlags.debug;
30+
Scope.flags.verbose = flags.verbose = newFlags.verbose;
31+
Scope.flags.recursive = flags.recursive = newFlags.recursive;
32+
Scope.flags.json = flags.json = newFlags.json;
33+
Scope.flags.debug = flags.debug = newFlags.debug;
3434

3535
if (flags.recursive) {
3636
// function to handle loading and traversing a file upon require()
@@ -108,14 +108,16 @@ module.exports.setFlags = function(newFlags) {
108108
Scope.Scope.log = function(type, node, name, value) {
109109
if (typeof value !== 'string')
110110
return;
111+
if (!type)
112+
return;
111113
switch(type) {
112114
case 'SOURCE':
113115
source = find(this.reports, value);
114116
if (!source)
115117
this.reports.push({
116118
source: {
117119
name: value,
118-
line: 'file://' + this.file + ':' + pos(node)
120+
line: this.file + ':' + pos(node)
119121
}
120122
});
121123
break;
@@ -128,7 +130,7 @@ module.exports.setFlags = function(newFlags) {
128130
source.chain.push({
129131
name: name,
130132
value: value,
131-
line: 'file://' + this.file + ':' + pos(node)
133+
line: this.file + ':' + pos(node)
132134
});
133135
}
134136
break;
@@ -139,7 +141,7 @@ module.exports.setFlags = function(newFlags) {
139141
if (source)
140142
source.sink = {
141143
name: name,
142-
line: 'file://' + this.file + ':' + pos(node)
144+
line: this.file + ':' + pos(node)
143145
};
144146

145147
// Flush the report. After finding the sink, we don't want to track it anymore.
@@ -176,10 +178,13 @@ module.exports.setFlags = function(newFlags) {
176178
Scope.Scope.log = function(type, node, name, value) {
177179
var p = pos(node);
178180
if (flags.recursive)
179-
p = 'file://' + path.relative(baseFile.split('/').reverse().slice(1).reverse().join('/'), this.file) + ':' + p;
181+
p = 'file://' + path.relative(Scope.Scope.baseFile.split('/').reverse().slice(1).reverse().join('/'), this.file) + ':' + p;
182+
183+
184+
console.log(' ', '[' + type + ']', p, name, value ? value : '');
180185

181-
console.log(' ', cs[type]?cs[type]('[' + type + ']'):colors.blue('[' + type + ']'),
182-
colors.grey(p), name, value ? value : '');
186+
// console.log(' ', cs[type]?cs[type]('[' + type + ']'):colors.blue('[' + type + ']'),
187+
// colors.grey(p), name, value ? value : '');
183188
};
184189
}
185190

@@ -196,26 +201,21 @@ traverse = module.exports.traverse = function(ast, scope) {
196201
if (flags.verbose) {
197202
if (!flags.json)
198203
Scope.Scope.createNewScope();
199-
Scope.log('SOURCES', ast, scope.sources);
204+
scope.log('SOURCES', ast, scope.sources);
200205
}
201206

202-
if (flags.debug) {
207+
ast.body.forEach(function (node) {
208+
if (node.type == 'ExpressionStatement')
209+
node = node.expression;
203210
try {
204-
ast.body.forEach(function (node) {
205-
if (node.type == 'ExpressionStatement')
206-
node = node.expression;
207-
scope.resolveStatement(node);
208-
});
211+
scope.resolveStatement(node);
209212
} catch (e) {
210-
console.log(e);
213+
if (flags.debug) {
214+
console.error('Error reading line:'.red, scope.file + ':' + pos(node));
215+
console.error(e.stack);
216+
}
211217
}
212-
} else {
213-
ast.body.forEach(function (node) {
214-
if (node.type == 'ExpressionStatement')
215-
node = node.expression;
216-
scope.resolveStatement(node);
217-
});
218-
}
218+
});
219219

220220
if (flags.verbose && !flags.json)
221221
Scope.Scope.leaveScope();

‎danger.json

Lines changed: 5 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -6,9 +6,11 @@
66
"clearInterval",
77
"require\\([\\']child_process[\\']\\)\\.exec",
88
"require\\([\\']http[\\']\\)\\.get",
9-
"require\\([\\']fs[\\']\\)\\.\\w+"
9+
"require\\([\\']fs[\\']\\)\\.\\w+",
10+
"require\\([\\']mongodb[\\']\\)\\.\\w+",
11+
"require\\([\\']hapi[\\']\\)\\.\\w+",
12+
"require\\([\\']express[\\']\\)\\.\\w+"
1013
],
1114
"sources": [
12-
"process.argv",
13-
"eval"
15+
"process.argv"
1416
]}

‎scope.js

Lines changed: 45 additions & 30 deletions
Original file line numberDiff line numberDiff line change
@@ -21,21 +21,17 @@ var custom = module.exports.custom = require('./custom');
2121
var Sinks = require('./danger.json').sinks;
2222
var Sources = require('./danger.json').sources;
2323

24-
var cs = {
25-
'BE': colors.green,
26-
'CE': colors.green,
27-
'SCE': colors.red,
28-
'SCES': colors.red,
29-
'SINK': colors.red,
30-
'SASSIGN': colors.red,
31-
'SOURCE': colors.red,
32-
'SOURCES': colors.yellow,
33-
'RETURN': colors.red
24+
module.exports.flags = flags = {
25+
verbose: false,
26+
recursive: false,
27+
json: true,
28+
debug: false
3429
};
3530

3631
Scope = function(scope) {
3732
this.vars = scope.vars || {};
3833
if (!this.vars.module) this.vars.module = {exports: {}};
34+
if (!this.vars.exports) this.vars.exports = {};
3935
if (!this.vars.global) this.vars.global = {};
4036
// dynamic list of sources and sinks as variables get set to them
4137
this.sources = scope.sources || Sources;
@@ -113,6 +109,8 @@ function get(json, name) {
113109

114110
Scope.prototype.resolveStatement = function(node) {
115111
var scope = this;
112+
// if (!node)
113+
// return;
116114
switch (node.type) {
117115
case 'VariableDeclaration':
118116
node.declarations.forEach(function (i) {
@@ -189,7 +187,10 @@ Scope.prototype.resolveStatement = function(node) {
189187
eval('scope.vars.' + name + ' = ' + JSON.stringify(value));
190188
}
191189
} catch (e) {
192-
190+
// if (flags.debug) {
191+
// console.error('Error reading line:'.red, scope.file + ':' + pos(node));
192+
// console.error(e.stack);
193+
// }
193194
}
194195
});
195196

@@ -198,9 +199,6 @@ Scope.prototype.resolveStatement = function(node) {
198199
break;
199200
case 'FunctionDeclaration':
200201
var func = scope.resolveFunctionExpression(node);
201-
scope.vars[func.name] = func;
202-
203-
traverse(func.body, func.scope);
204202

205203
this.log('FUNC', node, func.name);
206204
break;
@@ -212,7 +210,11 @@ Scope.prototype.resolveStatement = function(node) {
212210
break;
213211
case 'ForInStatement': // These
214212
case 'ForStatement': // are
213+
if (node.init || node.left)
214+
this.resolveStatement(node.init || node.left);
215215
case 'WhileStatement': // all
216+
if (node.test)
217+
this.resolveExpression(node.test);
216218
case 'CatchClause': // the same
217219
this.traverse(node.body);
218220
break;
@@ -259,7 +261,6 @@ Scope.prototype.resolveExpression = function(right, isSourceCB) {
259261
case 'UpdateExpression':
260262
case 'UnaryExpression':
261263
var arg = this.resolveExpression(right.argument, isSourceCB);
262-
// console.log(right.operator, arg);
263264
return {};
264265
case 'ArrayExpression':
265266
var array = scope.resolveArrayExpression(right);
@@ -304,7 +305,6 @@ Scope.prototype.resolveExpression = function(right, isSourceCB) {
304305
return false;
305306
}))) {
306307

307-
308308
// If the function is a sink and there is a source, return as sink;
309309
// If not a sink but still has source, return as a Source CES (possible taint)
310310
t = (scope.isSink(ce.name) || scope.isSink(ceName))?'SINK':'SCES';
@@ -359,7 +359,7 @@ Scope.prototype.resolveExpression = function(right, isSourceCB) {
359359
eval('scope.vars.' + name + ' = ' + JSON.stringify(value));
360360
}
361361
} catch (e) {
362-
362+
363363
}
364364
});
365365

@@ -414,15 +414,15 @@ Scope.prototype.resolveCallExpression = function(node) {
414414
}
415415
ce.raw = ce.name + '(' + (ce.arguments ? ce.arguments.join(','):'') + ')';
416416

417-
custom.some(function(i) {
418-
var r = false;
419-
if (ce.name) {
420-
r = i(scope, node, ce); // result
421-
if (r)
422-
ce = r;
423-
}
424-
return !!r;
425-
});
417+
if (ce.name) {
418+
custom.some(function(i) {
419+
var r = false;
420+
r = i(scope, node, ce); // result
421+
if (r)
422+
ce = r;
423+
return !!r;
424+
});
425+
}
426426
return ce;
427427
};
428428

@@ -465,6 +465,8 @@ Scope.prototype.resolveFunctionExpression = function(node) {
465465
for (var i in fe.params) {
466466
fe.scope.addVar(fe.params[i], undefined);
467467
}
468+
469+
scope.vars[fe.name] = fe;
468470
fe.scope.traverse(fe.body, function(node) {
469471
// Push scope.log. We don't want line 466 to log anything. Then pop it.
470472
var l = scope.log; scope.log = function () {};
@@ -496,10 +498,18 @@ Scope.prototype.traverse = function(ast, returnCB) {
496498
(ast.body || [ast]).forEach(function (node) {
497499
if (node.type == 'ExpressionStatement')
498500
node = node.expression;
499-
scope.resolveStatement(node);
500-
if (returnCB && node.type == 'ReturnStatement') {
501-
returnCB(node);
501+
try {
502+
scope.resolveStatement(node);
503+
if (returnCB && node.type == 'ReturnStatement') {
504+
returnCB(node);
505+
}
506+
} catch (e) {
507+
if (flags.debug) {
508+
console.error('Error reading line:'.red, scope.file + ':' + pos(node));
509+
console.error(e.stack);
510+
}
502511
}
512+
503513
});
504514
} else {
505515
// ast is a single statement so resolve it instead
@@ -521,7 +531,7 @@ Scope.prototype.resolvePath = function(file, cb) {
521531
try {
522532
pkg = resolve.sync(file, {basedir: String(this.file).split('/').slice(0,-1).join('/')});
523533
} catch (e) {
524-
console.error(String(e));
534+
// console.log(e);
525535
return false;
526536
}
527537

@@ -586,4 +596,9 @@ traverseJSON = function(o,func) {
586596

587597
return false;
588598
}) : false;
599+
};
600+
601+
// Convience function to return the line of a node assuming a node has one.
602+
pos = module.exports.pos = function(node) {
603+
return node.loc ? String(node.loc.start.line) : "-1";
589604
};

0 commit comments

Comments
 (0)