JS: Dynamic import as code injection sink #14293

amammad · 2023-09-22T09:38:31Z

Dynamic import in nodejs support URLs starts with data: which is dangerous.
There is another nodejs API that accepts the data: URL which is:

const {Worker} = require('node:worker_threads');
new Worker(new URL('data:text/javascript,console.log("hello!");'))

but it needs to be a URL Type as input, not any string value that starts with data:, I'm not sure what is the best way to implement it.

amammad · 2023-09-28T10:41:48Z

Hi, I wanted to add two sinks, one of the sinks should have a new URL instance in one of the middle nodes, so I've used flow steps but it seems that I can't reach some sinks like this.

amammad added 2 commits September 22, 2023 19:19

V1

06114d9

change commandExecution sink to CodeInjection sink

344869f

github-actions bot added the JS label Sep 22, 2023

This was referenced Sep 22, 2023

[JS]: New command execution sinks(Execa, shelljs and dynamic import) github/securitylab#788

Open

JS: New Command Execution Sinks #14198

Closed

amammad and others added 2 commits September 25, 2023 21:09

fix FP

f6737b3

add separate query for sinks that accepts data: URL

921198e

github-actions bot added the documentation label Sep 28, 2023

amammad added 2 commits September 28, 2023 20:34

fix a mistake

75f0fc4

revert nodeJSLib

f41bc1f

JS: Dynamic import as code injection sink #14293

JS: Dynamic import as code injection sink #14293

amammad commented Sep 22, 2023

amammad commented Sep 28, 2023

JS: Dynamic import as code injection sink #14293

Are you sure you want to change the base?

JS: Dynamic import as code injection sink #14293

Conversation

amammad commented Sep 22, 2023

amammad commented Sep 28, 2023