Skip to content

Client side request forgery from jQuery.sap.getUriParameters() #312

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
mbaluda merged 11 commits into from
Mar 24, 2026
Merged

Client side request forgery from jQuery.sap.getUriParameters() #312

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
11 commits
Select commit Hold shift + click to select a range
7f534b0
XSRF test
mbaluda Feb 25, 2026
39d02f7
getContent is not a generic remote source
mbaluda Feb 25, 2026
b114377
Merge branch 'main' into mbaluda/xsrf-tests
mbaluda Mar 11, 2026
365d342
Change UI5URIParameters return type to browser-url-query
mbaluda Mar 11, 2026
20d85e9
Merge branch 'main' into mbaluda/xsrf-tests
mbaluda Mar 12, 2026
81856ae
Update CodeQL version
mbaluda Mar 23, 2026
63dc88c
Update pack dependency
mbaluda Mar 23, 2026
c5d1599
Merge branch 'main' into mbaluda/xsrf-tests
mbaluda Mar 23, 2026
d774792
Update source type
mbaluda Mar 23, 2026
5f607c5
CSRF test
mbaluda Mar 24, 2026
98c2710
Test names
mbaluda Mar 24, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 1 addition & 1 deletion javascript/frameworks/cap/ext/qlpack.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -3,4 +3,4 @@ library: true
name: advanced-security/javascript-sap-cap-models
version: 2.25.0
extensionTargets:
codeql/javascript-all: "^2.6.22"
codeql/javascript-all: "^2.6.24"
2 changes: 1 addition & 1 deletion javascript/frameworks/cap/lib/qlpack.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -5,4 +5,4 @@ version: 2.25.0
suites: codeql-suites
extractor: javascript
dependencies:
codeql/javascript-all: "^2.6.22"
codeql/javascript-all: "^2.6.24"
4 changes: 2 additions & 2 deletions javascript/frameworks/cap/src/qlpack.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -5,6 +5,6 @@ version: 2.25.0
suites: codeql-suites
extractor: javascript
dependencies:
codeql/javascript-all: "^2.6.22"
advanced-security/javascript-sap-cap-all: "2.24.3"
codeql/javascript-all: "^2.6.24"
advanced-security/javascript-sap-cap-all: "2.25.0"
default-suite-file: codeql-suites/javascript-code-scanning.qls
8 changes: 4 additions & 4 deletions javascript/frameworks/cap/test/qlpack.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -3,7 +3,7 @@ name: advanced-security/javascript-sap-cap-queries-tests
version: 2.25.0
extractor: javascript
dependencies:
codeql/javascript-all: "^2.6.22"
advanced-security/javascript-sap-cap-queries: "2.24.3"
advanced-security/javascript-sap-cap-models: "2.24.3"
advanced-security/javascript-sap-cap-all: "2.24.3"
codeql/javascript-all: "^2.6.24"
advanced-security/javascript-sap-cap-queries: "2.25.0"
advanced-security/javascript-sap-cap-models: "2.25.0"
advanced-security/javascript-sap-cap-all: "2.25.0"
4 changes: 2 additions & 2 deletions javascript/frameworks/ui5-webcomponents/test/qlpack.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -2,5 +2,5 @@ name: advanced-security/javascript-sap-ui5-webcomponents-for-react-test
version: 2.25.0
extractor: javascript
dependencies:
codeql/javascript-all: "^2.6.22"
advanced-security/javascript-sap-ui5-all: "2.24.3"
codeql/javascript-all: "^2.6.24"
advanced-security/javascript-sap-ui5-all: "2.25.0"
2 changes: 1 addition & 1 deletion javascript/frameworks/ui5/ext/qlpack.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -3,6 +3,6 @@ library: true
name: advanced-security/javascript-sap-ui5-models
version: 2.25.0
extensionTargets:
codeql/javascript-all: "^2.6.22"
codeql/javascript-all: "^2.6.24"
dataExtensions:
- "*.model.yml"
4 changes: 2 additions & 2 deletions javascript/frameworks/ui5/ext/ui5.model.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -118,8 +118,8 @@ extensions:
- ["UI5CodeEditor", "Member[value]", "remote"]
- ["UI5CodeEditor", "Member[getCurrentValue].ReturnValue", "remote"]
- ["global", "Member[jQuery].Member[sap].Member[syncHead,syncGet,syncGetText,syncPost,syncPostText].ReturnValue", "remote"]
- ["UI5URIParameters", "Member[get].ReturnValue", "remote"]
- ["UI5URIParameters", "Member[getAll].ReturnValue", "remote"]
- ["UI5URIParameters", "Member[get].ReturnValue", "browser-url-query"]
- ["UI5URIParameters", "Member[getAll].ReturnValue", "browser-url-query"]

- addsTo:
pack: codeql/javascript-all
Expand Down
2 changes: 1 addition & 1 deletion javascript/frameworks/ui5/lib/qlpack.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -5,4 +5,4 @@ version: 2.25.0
suites: codeql-suites
extractor: javascript
dependencies:
codeql/javascript-all: "^2.6.22"
codeql/javascript-all: "^2.6.24"
4 changes: 2 additions & 2 deletions javascript/frameworks/ui5/src/qlpack.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -5,6 +5,6 @@ version: 2.25.0
suites: codeql-suites
extractor: javascript
dependencies:
codeql/javascript-all: "^2.6.22"
advanced-security/javascript-sap-ui5-all: "2.24.3"
codeql/javascript-all: "^2.6.24"
advanced-security/javascript-sap-ui5-all: "2.25.0"
default-suite-file: codeql-suites/javascript-code-scanning.qls
14 changes: 7 additions & 7 deletions javascript/frameworks/ui5/test/models/source/sourceTest.expected
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -54,7 +54,7 @@
| source.js:92:17:92:25 | obj.value | Remote flow source of type: Source node (remote) [from data-extension] |
| source.js:94:17:94:30 | obj.getValue() | Remote flow source of type: Remote flow |
| source.js:94:17:94:30 | obj.getValue() | Remote flow source of type: Source node (remote) [from data-extension] |
| source.js:96:17:96:51 | jQuery. ... ).get() | Remote flow source of type: Remote flow |
| source.js:96:17:96:51 | jQuery. ... ).get() | Remote flow source of type: Source node (browser-url-query) [from data-extension] |
| source.js:96:17:96:51 | jQuery. ... ).get() | Remote flow source of type: Source node (remote) [from data-extension] |
| source.js:98:17:98:37 | jQuery. ... cHead() | Remote flow source of type: Remote flow |
| source.js:98:17:98:37 | jQuery. ... cHead() | Remote flow source of type: Source node (remote) [from data-extension] |
Expand All @@ -66,15 +66,15 @@
| source.js:104:17:104:37 | jQuery. ... cPost() | Remote flow source of type: Source node (remote) [from data-extension] |
| source.js:106:17:106:41 | jQuery. ... tText() | Remote flow source of type: Remote flow |
| source.js:106:17:106:41 | jQuery. ... tText() | Remote flow source of type: Source node (remote) [from data-extension] |
| source.js:108:17:108:52 | UriPara ... ).get() | Remote flow source of type: Remote flow |
| source.js:108:17:108:52 | UriPara ... ).get() | Remote flow source of type: Source node (browser-url-query) [from data-extension] |
| source.js:108:17:108:52 | UriPara ... ).get() | Remote flow source of type: Source node (remote) [from data-extension] |
| source.js:109:17:109:55 | UriPara ... etAll() | Remote flow source of type: Remote flow |
| source.js:109:17:109:55 | UriPara ... etAll() | Remote flow source of type: Source node (browser-url-query) [from data-extension] |
| source.js:109:17:109:55 | UriPara ... etAll() | Remote flow source of type: Source node (remote) [from data-extension] |
| source.js:112:17:112:25 | obj.get() | Remote flow source of type: Remote flow |
| source.js:112:17:112:25 | obj.get() | Remote flow source of type: Source node (browser-url-query) [from data-extension] |
| source.js:112:17:112:25 | obj.get() | Remote flow source of type: Source node (remote) [from data-extension] |
| source.js:113:17:113:28 | obj.getAll() | Remote flow source of type: Remote flow |
| source.js:113:17:113:28 | obj.getAll() | Remote flow source of type: Source node (browser-url-query) [from data-extension] |
| source.js:113:17:113:28 | obj.getAll() | Remote flow source of type: Source node (remote) [from data-extension] |
| source.js:115:17:115:28 | obj.getAll() | Remote flow source of type: Remote flow |
| source.js:115:17:115:28 | obj.getAll() | Remote flow source of type: Source node (browser-url-query) [from data-extension] |
| source.js:115:17:115:28 | obj.getAll() | Remote flow source of type: Source node (remote) [from data-extension] |
| source.js:117:17:117:25 | obj.get() | Remote flow source of type: Remote flow |
| source.js:117:17:117:25 | obj.get() | Remote flow source of type: Source node (browser-url-query) [from data-extension] |
| source.js:117:17:117:25 | obj.get() | Remote flow source of type: Source node (remote) [from data-extension] |
8 changes: 4 additions & 4 deletions javascript/frameworks/ui5/test/qlpack.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -2,11 +2,11 @@ name: advanced-security/javascript-sap-ui5-queries-tests
version: 2.25.0
extractor: javascript
dependencies:
codeql/javascript-all: "^2.6.22"
codeql/javascript-all: "^2.6.24"
# We use this dependency to run the standard Log Injection query to ensure that
# no overlap occurs with the SAP UI5 queries. We therefore allow any version
# greater than or equal to 1.2.0, as major breaking changes are not a concern.
codeql/javascript-queries: ">1.2.0"
advanced-security/javascript-sap-ui5-queries: "2.24.3"
advanced-security/javascript-sap-ui5-models: "2.24.3"
advanced-security/javascript-sap-ui5-all: "2.24.3"
advanced-security/javascript-sap-ui5-queries: "2.25.0"
advanced-security/javascript-sap-ui5-models: "2.25.0"
advanced-security/javascript-sap-ui5-all: "2.25.0"
8 changes: 8 additions & 0 deletions javascript/frameworks/ui5/test/queries/RequestForgery/ClientSideRequestForgery.expected
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,8 @@
edges
| test.js:1:11:1:50 | jQuery. ... ("url") | test.js:2:34:2:36 | url | provenance | |
nodes
| test.js:1:11:1:50 | jQuery. ... ("url") | semmle.label | jQuery. ... ("url") |
| test.js:2:34:2:36 | url | semmle.label | url |
subpaths
#select
| test.js:2:1:2:20 | new XMLHttpRequest() | test.js:1:11:1:50 | jQuery. ... ("url") | test.js:2:34:2:36 | url | The $@ of this request depends on a $@. | test.js:2:34:2:36 | url | URL | test.js:1:11:1:50 | jQuery. ... ("url") | user-provided value |
1 change: 1 addition & 0 deletions javascript/frameworks/ui5/test/queries/RequestForgery/ClientSideRequestForgery.qlref
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1 @@
Security/CWE-918/ClientSideRequestForgery.ql
4 changes: 4 additions & 0 deletions javascript/frameworks/ui5/test/queries/RequestForgery/RequestForgery.expected
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,4 @@
edges
nodes
subpaths
#select
1 change: 1 addition & 0 deletions javascript/frameworks/ui5/test/queries/RequestForgery/RequestForgery.qlref
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1 @@
Security/CWE-918/RequestForgery.ql
2 changes: 2 additions & 0 deletions javascript/frameworks/ui5/test/queries/RequestForgery/test.js
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,2 @@
var url = jQuery.sap.getUriParameters().get("url");
new XMLHttpRequest().open("GET", url, false);
2 changes: 1 addition & 1 deletion javascript/frameworks/xsjs/ext/qlpack.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -3,6 +3,6 @@ library: true
name: advanced-security/javascript-sap-xsjs-models
version: 2.25.0
extensionTargets:
codeql/javascript-all: "^2.6.22"
codeql/javascript-all: "^2.6.24"
dataExtensions:
- "*.model.yml"
2 changes: 1 addition & 1 deletion javascript/frameworks/xsjs/lib/qlpack.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -5,4 +5,4 @@ version: 2.25.0
suites: codeql-suites
extractor: javascript
dependencies:
codeql/javascript-all: "^2.6.22"
codeql/javascript-all: "^2.6.24"
4 changes: 2 additions & 2 deletions javascript/frameworks/xsjs/src/qlpack.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -5,6 +5,6 @@ version: 2.25.0
suites: codeql-suites
extractor: javascript
dependencies:
codeql/javascript-all: "^2.6.22"
advanced-security/javascript-sap-xsjs-all: "2.24.3"
codeql/javascript-all: "^2.6.24"
advanced-security/javascript-sap-xsjs-all: "2.25.0"
default-suite-file: codeql-suites/javascript-code-scanning.qls
8 changes: 4 additions & 4 deletions javascript/frameworks/xsjs/test/qlpack.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -3,7 +3,7 @@ name: advanced-security/javascript-sap-xsjs-tests
version: 2.25.0
extractor: javascript
dependencies:
codeql/javascript-all: "^2.6.22"
advanced-security/javascript-sap-xsjs-queries: "2.24.3"
advanced-security/javascript-sap-xsjs-all: "2.24.3"
advanced-security/javascript-sap-xsjs-models: "2.24.3"
codeql/javascript-all: "^2.6.24"
advanced-security/javascript-sap-xsjs-queries: "2.25.0"
advanced-security/javascript-sap-xsjs-all: "2.25.0"
advanced-security/javascript-sap-xsjs-models: "2.25.0"
2 changes: 1 addition & 1 deletion javascript/heuristic-models/ext/qlpack.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -4,6 +4,6 @@ warnOnImplicitThis: false
name: advanced-security/javascript-heuristic-models
version: 2.25.0
extensionTargets:
codeql/javascript-all: "^2.6.22"
codeql/javascript-all: "^2.6.24"
dataExtensions:
- "*.model.yml"
4 changes: 2 additions & 2 deletions javascript/heuristic-models/tests/qlpack.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -4,5 +4,5 @@ name: advanced-security/javascript-heuristic-models-tests
version: 2.25.0
extractor: javascript
dependencies:
"codeql/javascript-all": "^2.6.22"
"advanced-security/javascript-heuristic-models": "2.24.3"
"codeql/javascript-all": "^2.6.24"
"advanced-security/javascript-heuristic-models": "2.25.0"
Loading