Simple JS CodeInjection vulnerability no longer caught in latest release.

[yonajix]

I noticed that this very simple code injection example is longer caught in the latest release.

function main() {
    let userInput = new URLSearchParams(window.location.search).get('input');

    eval(userInput);

}
main()

This CodeInjection query fails to catch this:

/**
 * @name Code injection
 * @description Interpreting unsanitized user input as code allows a malicious user arbitrary
 *              code execution.
 * @kind path-problem
 * @problem.severity error
 * @security-severity 9.3
 * @precision high
 * @id js/code-injection
 * @tags security
 *       external/cwe/cwe-094
 *       external/cwe/cwe-095
 *       external/cwe/cwe-079
 *       external/cwe/cwe-116
 */

import javascript
import semmle.javascript.security.dataflow.CodeInjectionQuery
import CodeInjectionFlow::PathGraph

from CodeInjectionFlow::PathNode source, CodeInjectionFlow::PathNode sink
where CodeInjectionFlow::flowPath(source, sink)
select sink.getNode(), source, sink, sink.getNode().(Sink).getMessagePrefix() + " depends on a $@.",
  source.getNode(), "user-provided value"

However this is caught using the old deprecated Configuration method:

/**
 * @name Code injection
 * @description Interpreting unsanitized user input as code allows a malicious user arbitrary
 *              code execution.
 * @kind path-problem
 * @problem.severity error
 * @security-severity 9.3
 * @precision high
 * @id js/code-injection
 * @tags security
 *       external/cwe/cwe-094
 *       external/cwe/cwe-095
 *       external/cwe/cwe-079
 *       external/cwe/cwe-116
 */

 import javascript
 import semmle.javascript.security.dataflow.CodeInjectionQuery
 import DataFlow::PathGraph
 
 from Configuration cfg, DataFlow::PathNode source, DataFlow::PathNode sink
 where cfg.hasFlowPath(source, sink)
 select sink.getNode(), source, sink, sink.getNode().(Sink).getMessagePrefix() + " depends on a $@.",
   source.getNode(), "user-provided value"
 

I believe this is due to the source not propagating through URLSearchParams. Removing URLSearchParams and simply setting userInput = window.location.search allows this vulnerability to be caught.

[jketema]

Hi @yonajix

Thanks for your report. I've asked the CodeQL Javascript team to take a look.

[asgerf]

Thanks for the report @yonajix. I can confirm that this is bug introduced in the recent release and we're working on a fix.