Skip to content

Restrict the type of values that can be posted #1879

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom
Merged
merged 2 commits into from
Jun 18, 2025
Merged

Restrict the type of values that can be posted #1879

merged 2 commits into from
Jun 18, 2025

Conversation

prabhu
Copy link
Collaborator

@prabhu prabhu commented Jun 17, 2025 •
edited
Loading

The idea is to cut down on injection possibilities.

curl -X POST http://localhost:9090/sbom \
        -H 'Content-Type: application/json' \
        -d '{
      "url": "https://github.com/HooliCorp/vulnerable-aws-koa-app.git",
      "type": { "foo": "bar" },
      "multiProject": "true"
    }'
{"error":"TypeError: Invalid value type: object.","details":"Options can only be of string, number, and array type. No object values are allowed."}

@prabhu
Restrict the type of values that can be posted
be8cffb 
Signed-off-by: Prabhu Subramanian <prabhu@appthreat.com>
@prabhu prabhu added mode:server cdxgen used as server security labels Jun 17, 2025
@prabhu prabhu requested review from malice00 and setchy June 17, 2025 22:43
@prabhu
Make codeql happy about externally-controlled formatted string.
9553d4d 
Signed-off-by: Prabhu Subramanian <prabhu@appthreat.com>
@prabhu
Copy link
Collaborator Author

prabhu commented Jun 17, 2025

@bandhan-majumder can you test this and make sure we have not broken any legitimate functionality?

github-advanced-security[bot]
github-advanced-security bot found potential problems Jun 17, 2025
View reviewed changes
@bandhan-majumder
Copy link
Collaborator

bandhan-majumder commented Jun 18, 2025 •
edited
Loading

I tested with all the possible options, it's working fine.

@prabhu prabhu merged commit 5e5d54c into master Jun 18, 2025
72 checks passed
@prabhu prabhu deleted the feature/restrict-server-body-types branch June 18, 2025 12:06
@prabhu
Copy link
Collaborator Author

prabhu commented Jun 18, 2025 •
edited
Loading

How to find such vulnerabilities with cdxgen and atom:

  1. Download the latest cdxgen atom file.
  2. Download chennai container image.
docker run --rm -v /tmp:/tmp -v $HOME:$HOME -v $(pwd):/app:rw -it ghcr.io/appthreat/chen chennai
  1. To import the atom, type the query importAtom("/path/to/js-app.atom")
  2. Now we need a query to show all the calls to safeSpawnSync where the input came from a framework-input call.
atom.method("safeSpawnSync").call.argument.df(atom.tag("framework-input").call.argument).t

Example of a vulnerable flow:

Screenshot 2025-06-17 at 14 38 39

Example of a mitigated flow:

Screenshot 2025-06-17 at 14 40 30

prabhu
prabhu commented Jun 30, 2025
View reviewed changes
lib/server/server.test.js
test("parseValue tests", () => {
expect(parseValue("foo")).toEqual("foo");
expect(parseValue(1)).toEqual(1);
expect(parseValue("true")).toEqual(true);
Copy link
Collaborator Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Test for boolean values here.

@prabhu
Copy link
Collaborator Author

prabhu commented Jun 30, 2025

@bandhan-majumder we both missed a test for boolean which got fixed by a contributor here. Could you kindly send a PR to add boolean unit tests in server.test.js?

@bandhan-majumder bandhan-majumder mentioned this pull request Jul 1, 2025
Merged
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers

@malice00 malice00 Awaiting requested review from malice00

@setchy setchy Awaiting requested review from setchy

Assignees
No one assigned
Labels
mode:server cdxgen used as server Ready for QA security
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.
2 participants
@prabhu @bandhan-majumder