Skip to content

JS: Modeling of aws-sdk clients* #20135

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
wants to merge 13 commits into
base: main
Choose a base branch
from
Open

JS: Modeling of aws-sdk clients* #20135

Show file tree
Hide file tree
Changes from 1 commit
Commits
Show all changes
13 commits
Select commit Hold shift + click to select a range
fda74cb
Added test cases for v2 and v3 sql injection of dynamodb
Napalys Jul 28, 2025
94fb606
Added modeling of dynamodb v3 for sql injections
Napalys Jul 28, 2025
b2d1821
Added modeling for V2 of dynamoDB
Napalys Jul 28, 2025
5e09416
Added change note
Napalys Jul 28, 2025
44008a8
Added test cases for client-s v2 and v3 sql injection
Napalys Jul 29, 2025
1af289c
Added modeling of client-s3 v2 and v3
Napalys Jul 29, 2025
c725191
Added test cases for athena v2 and v3 for sql injections
Napalys Jul 29, 2025
238568d
Added modeling of athena v2 and v3 for sql injections
Napalys Jul 29, 2025
0588274
Added test cases for client-rds-data for sql injections
Napalys Jul 29, 2025
a8a6fdf
Added modeling of rds v2 and v3 for sql injections
Napalys Jul 29, 2025
0806bd6
Updated change note
Napalys Jul 29, 2025
2ca5d81
Added tests and modeling of database-access-result
Napalys Jul 29, 2025
d93033b
Unified aws-db modeling into singular file
Napalys Jul 29, 2025
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
Prev Previous commit
Next Next commit
Added modeling for V2 of dynamoDB
  • Loading branch information
@Napalys
Napalys committed Jul 28, 2025
commit b2d182117c07798d94b9f87a1d397a93e58339e7
3 changes: 3 additions & 0 deletions javascript/ql/lib/ext/dynamodb.model.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -4,6 +4,8 @@ extensions:
extensible: sinkModel
data:
- ["DynamoDBClientV3", "ReturnValue.Member[send].Argument[0]", "sql-injection"]
- ["DynamoDBClientV2", "ReturnValue.Member[executeStatement].Argument[0].Member[Statement]", "sql-injection"]
- ["DynamoDBClientV2", "ReturnValue.Member[batchExecuteStatement].Argument[0].Member[Statements].ArrayElement.Member[Statement]", "sql-injection"]

- addsTo:
pack: codeql/javascript-all
Expand All @@ -17,3 +19,4 @@ extensions:
extensible: typeModel
data:
- ["DynamoDBClientV3", "@aws-sdk/client-dynamodb", "Member[DynamoDBClient,DynamoDB]"]
- ["DynamoDBClientV2", "aws-sdk", "Member[DynamoDB]"]
18 changes: 18 additions & 0 deletions javascript/ql/test/query-tests/Security/CWE-089/untyped/SqlInjection.expected
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -2,6 +2,9 @@
| dynamodb.js:15:23:15:29 | command | dynamodb.js:9:26:9:33 | req.body | dynamodb.js:15:23:15:29 | command | This query string depends on a $@. | dynamodb.js:9:26:9:33 | req.body | user-provided value |
| dynamodb.js:21:23:21:35 | updateCommand | dynamodb.js:9:26:9:33 | req.body | dynamodb.js:21:23:21:35 | updateCommand | This query string depends on a $@. | dynamodb.js:9:26:9:33 | req.body | user-provided value |
| dynamodb.js:47:24:47:30 | command | dynamodb.js:9:26:9:33 | req.body | dynamodb.js:47:24:47:30 | command | This query string depends on a $@. | dynamodb.js:9:26:9:33 | req.body | user-provided value |
| dynamodb.js:58:20:58:77 | `SELECT ... nput}'` | dynamodb.js:56:26:56:33 | req.body | dynamodb.js:58:20:58:77 | `SELECT ... nput}'` | This query string depends on a $@. | dynamodb.js:56:26:56:33 | req.body | user-provided value |
| dynamodb.js:64:28:64:85 | `SELECT ... nput}'` | dynamodb.js:56:26:56:33 | req.body | dynamodb.js:64:28:64:85 | `SELECT ... nput}'` | This query string depends on a $@. | dynamodb.js:56:26:56:33 | req.body | user-provided value |
| dynamodb.js:67:28:67:85 | `SELECT ... nput}'` | dynamodb.js:56:26:56:33 | req.body | dynamodb.js:67:28:67:85 | `SELECT ... nput}'` | This query string depends on a $@. | dynamodb.js:56:26:56:33 | req.body | user-provided value |
| graphql.js:9:34:19:5 | `\\n ... }\\n ` | graphql.js:8:16:8:28 | req.params.id | graphql.js:9:34:19:5 | `\\n ... }\\n ` | This query string depends on a $@. | graphql.js:8:16:8:28 | req.params.id | user-provided value |
| graphql.js:26:30:26:40 | `foo ${id}` | graphql.js:25:16:25:28 | req.params.id | graphql.js:26:30:26:40 | `foo ${id}` | This query string depends on a $@. | graphql.js:25:16:25:28 | req.params.id | user-provided value |
| graphql.js:29:32:29:42 | `foo ${id}` | graphql.js:25:16:25:28 | req.params.id | graphql.js:29:32:29:42 | `foo ${id}` | This query string depends on a $@. | graphql.js:25:16:25:28 | req.params.id | user-provided value |
Expand Down Expand Up @@ -156,6 +159,13 @@ edges
| dynamodb.js:18:27:20:6 | new Exe ... \\n }) | dynamodb.js:18:11:20:6 | updateCommand | provenance | |
| dynamodb.js:18:55:20:5 | {\\n ... t\\n } [Statement] | dynamodb.js:18:27:20:6 | new Exe ... \\n }) | provenance | |
| dynamodb.js:19:20:19:34 | updateStatement | dynamodb.js:18:55:20:5 | {\\n ... t\\n } [Statement] | provenance | |
| dynamodb.js:56:9:56:38 | maliciousInput | dynamodb.js:58:61:58:74 | maliciousInput | provenance | |
| dynamodb.js:56:9:56:38 | maliciousInput | dynamodb.js:64:69:64:82 | maliciousInput | provenance | |
| dynamodb.js:56:9:56:38 | maliciousInput | dynamodb.js:67:69:67:82 | maliciousInput | provenance | |
| dynamodb.js:56:26:56:33 | req.body | dynamodb.js:56:9:56:38 | maliciousInput | provenance | |
| dynamodb.js:58:61:58:74 | maliciousInput | dynamodb.js:58:20:58:77 | `SELECT ... nput}'` | provenance | |
| dynamodb.js:64:69:64:82 | maliciousInput | dynamodb.js:64:28:64:85 | `SELECT ... nput}'` | provenance | |
| dynamodb.js:67:69:67:82 | maliciousInput | dynamodb.js:67:28:67:85 | `SELECT ... nput}'` | provenance | |
| graphql.js:8:11:8:28 | id | graphql.js:11:46:11:47 | id | provenance | |
| graphql.js:8:16:8:28 | req.params.id | graphql.js:8:11:8:28 | id | provenance | |
| graphql.js:11:46:11:47 | id | graphql.js:9:34:19:5 | `\\n ... }\\n ` | provenance | |
Expand Down Expand Up @@ -554,6 +564,14 @@ nodes
| dynamodb.js:19:20:19:34 | updateStatement | semmle.label | updateStatement |
| dynamodb.js:21:23:21:35 | updateCommand | semmle.label | updateCommand |
| dynamodb.js:47:24:47:30 | command | semmle.label | command |
| dynamodb.js:56:9:56:38 | maliciousInput | semmle.label | maliciousInput |
| dynamodb.js:56:26:56:33 | req.body | semmle.label | req.body |
| dynamodb.js:58:20:58:77 | `SELECT ... nput}'` | semmle.label | `SELECT ... nput}'` |
| dynamodb.js:58:61:58:74 | maliciousInput | semmle.label | maliciousInput |
| dynamodb.js:64:28:64:85 | `SELECT ... nput}'` | semmle.label | `SELECT ... nput}'` |
| dynamodb.js:64:69:64:82 | maliciousInput | semmle.label | maliciousInput |
| dynamodb.js:67:28:67:85 | `SELECT ... nput}'` | semmle.label | `SELECT ... nput}'` |
| dynamodb.js:67:69:67:82 | maliciousInput | semmle.label | maliciousInput |
| graphql.js:8:11:8:28 | id | semmle.label | id |
| graphql.js:8:16:8:28 | req.params.id | semmle.label | req.params.id |
| graphql.js:9:34:19:5 | `\\n ... }\\n ` | semmle.label | `\\n ... }\\n ` |
Expand Down
12 changes: 6 additions & 6 deletions javascript/ql/test/query-tests/Security/CWE-089/untyped/dynamodb.js
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -53,21 +53,21 @@ app.post('/partiql/v2/execute', async (req, res) => {
const dynamodb = new AWS.DynamoDB({
region: 'us-east-1'
});
let maliciousInput = req.body.data; // $ MISSING: Source
let maliciousInput = req.body.data; // $ Source
const params = {
Statement: `SELECT * FROM Users WHERE username = '${maliciousInput}'`
Statement: `SELECT * FROM Users WHERE username = '${maliciousInput}'` // $ Alert
};

dynamodb.executeStatement(params, function(err, data) {}); // $ MISSING: Alert
dynamodb.executeStatement(params, function(err, data) {});
const params2 = {
Statements: [{
Statement: `SELECT * FROM Users WHERE username = '${maliciousInput}'`
Statement: `SELECT * FROM Users WHERE username = '${maliciousInput}'` // $ Alert
},
{
Statement: `SELECT * FROM Users WHERE username = '${maliciousInput}'`
Statement: `SELECT * FROM Users WHERE username = '${maliciousInput}'` // $ Alert
}
]
};

dynamodb.batchExecuteStatement(params2, function(err, data) {}); // $ MISSING: Alert
dynamodb.batchExecuteStatement(params2, function(err, data) {});
});
pFad - Phonifier reborn

Pfad - The Proxy pFad of © 2024 Garber Painting. All rights reserved.

Note: This service is not intended for secure transactions such as banking, social media, email, or purchasing. Use at your own risk. We assume no liability whatsoever for broken pages.


Alternative Proxies:

Alternative Proxy

pFad Proxy

pFad v3 Proxy

pFad v4 Proxy