JavaScript CodeQL library updates: new Angular sink(s)

javascript/ql/lib/change-notes/2025-01-03-angular-source-sink.md

@@ -0,0 +1,4 @@
+---
+category: majorAnalysis
+---
+* Added new XSS sink where `InnerHTML` is assigned to with the Angular Renderer2 API

javascript/ql/lib/semmle/javascript/frameworks/AngularJS/AngularJSCore.qll

@@ -1032,3 +1032,35 @@ private class BindCall extends DataFlow::PartialInvokeNode::Range, DataFlow::Cal
     result = this.getArgument(0)
   }
 }
+
+/**
+ * A DOM attribute write, using the AngularJS Renderer2 API: a call to `Renderer2.setProperty`.
+ */
+private class AngularRenderer2AttributeDefinition extends DOM::AttributeDefinition {
+  DataFlow::Node propertyNode;
+  DataFlow::Node valueNode;
+  DataFlow::Node elementNode;
+
+  AngularRenderer2AttributeDefinition() {
+    exists(API::CallNode setProperty |
+      setProperty =
+        API::moduleImport("@angular/core")
+            .getMember("Renderer2")
+            .getInstance()
+            .getMember("setProperty")
+            .getACall() and
+      elementNode = setProperty.getArgument(0) and
+      propertyNode = setProperty.getArgument(1) and
+      valueNode = setProperty.getArgument(2) and
+      this = setProperty.asExpr()
+    )
+  }
+
+  override string getName() { result = propertyNode.getStringValue() }
+
+  // override DOM::ElementDefinition getElement() { /* TODO */ }
+  DataFlow::Node getElementNode() { result = elementNode }
+
+  override DataFlow::Node getValueNode() { result = valueNode }
+  //override predicate mayHaveTemplateValue() { /* TODO */ }
+}

javascript/ql/lib/semmle/javascript/security/dataflow/DomBasedXssCustomizations.qll

@@ -251,6 +251,26 @@ module DomBasedXss {
     }
   }
 
+  // /**
+  //  * A write to the `innerHTML` property of a DOM element, viewed as an XSS sink.
+  //  *
+  //  * Uses the Angular Renderer2 API, instead of the default `Element.innerHTML` property.
+  //  */
+  // class AngularRender2SetPropertyInnerHtmlSink extends Sink {
+  //   AngularRender2SetPropertyInnerHtmlSink() {
+  //     exists(API::CallNode setProperty |
+  //       setProperty =
+  //         API::moduleImport("@angular/core")
+  //             .getMember("Renderer2")
+  //             .getInstance()
+  //             .getMember("setProperty")
+  //             .getACall() and
+  //       this = setProperty.getParameter(2).asSink() and
+  //       setProperty.getArgument(1).getStringValue() = "innerHTML"
+  //     )
+  //   }
+  // }
+
   /**
    * A value being piped into the `safe` pipe in a template file,
    * disabling subsequent HTML escaping.