Skip to content

Commit 1072977

Browse files
erik-krogherik-krogh
committed
add test
1 parent de70593 commit 1072977

File tree

3 files changed

+57
-0
lines changed

3 files changed

+57
-0
lines changed

‎javascript/ql/test/query-tests/Security/CWE-094/CodeInjection/CodeInjection.expected

Lines changed: 19 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -110,6 +110,15 @@ nodes
110110
| react.js:10:56:10:77 | documen ... on.hash |
111111
| react.js:10:56:10:77 | documen ... on.hash |
112112
| react.js:10:56:10:77 | documen ... on.hash |
113+
| rxjs.js:9:9:9:35 | taint |
114+
| rxjs.js:9:17:9:35 | req.param("wobble") |
115+
| rxjs.js:9:17:9:35 | req.param("wobble") |
116+
| rxjs.js:12:16:12:20 | taint |
117+
| rxjs.js:14:12:14:12 | v |
118+
| rxjs.js:15:12:15:12 | v |
119+
| rxjs.js:15:12:15:12 | v |
120+
| rxjs.js:19:10:19:22 | subject.value |
121+
| rxjs.js:19:10:19:22 | subject.value |
113122
| template-sinks.js:17:9:17:31 | tainted |
114123
| template-sinks.js:17:19:17:31 | req.query.foo |
115124
| template-sinks.js:17:19:17:31 | req.query.foo |
@@ -232,6 +241,14 @@ edges
232241
| react-native.js:7:17:7:33 | req.param("code") | react-native.js:7:7:7:33 | tainted |
233242
| react-native.js:7:17:7:33 | req.param("code") | react-native.js:7:7:7:33 | tainted |
234243
| react.js:10:56:10:77 | documen ... on.hash | react.js:10:56:10:77 | documen ... on.hash |
244+
| rxjs.js:9:9:9:35 | taint | rxjs.js:12:16:12:20 | taint |
245+
| rxjs.js:9:17:9:35 | req.param("wobble") | rxjs.js:9:9:9:35 | taint |
246+
| rxjs.js:9:17:9:35 | req.param("wobble") | rxjs.js:9:9:9:35 | taint |
247+
| rxjs.js:12:16:12:20 | taint | rxjs.js:14:12:14:12 | v |
248+
| rxjs.js:12:16:12:20 | taint | rxjs.js:19:10:19:22 | subject.value |
249+
| rxjs.js:12:16:12:20 | taint | rxjs.js:19:10:19:22 | subject.value |
250+
| rxjs.js:14:12:14:12 | v | rxjs.js:15:12:15:12 | v |
251+
| rxjs.js:14:12:14:12 | v | rxjs.js:15:12:15:12 | v |
235252
| template-sinks.js:17:9:17:31 | tainted | template-sinks.js:19:17:19:23 | tainted |
236253
| template-sinks.js:17:9:17:31 | tainted | template-sinks.js:19:17:19:23 | tainted |
237254
| template-sinks.js:17:9:17:31 | tainted | template-sinks.js:20:16:20:22 | tainted |
@@ -313,6 +330,8 @@ edges
313330
| react-native.js:8:32:8:38 | tainted | react-native.js:7:17:7:33 | req.param("code") | react-native.js:8:32:8:38 | tainted | $@ flows to here and is interpreted as code. | react-native.js:7:17:7:33 | req.param("code") | User-provided value |
314331
| react-native.js:10:23:10:29 | tainted | react-native.js:7:17:7:33 | req.param("code") | react-native.js:10:23:10:29 | tainted | $@ flows to here and is interpreted as code. | react-native.js:7:17:7:33 | req.param("code") | User-provided value |
315332
| react.js:10:56:10:77 | documen ... on.hash | react.js:10:56:10:77 | documen ... on.hash | react.js:10:56:10:77 | documen ... on.hash | $@ flows to here and is interpreted as code. | react.js:10:56:10:77 | documen ... on.hash | User-provided value |
333+
| rxjs.js:15:12:15:12 | v | rxjs.js:9:17:9:35 | req.param("wobble") | rxjs.js:15:12:15:12 | v | $@ flows to here and is interpreted as code. | rxjs.js:9:17:9:35 | req.param("wobble") | User-provided value |
334+
| rxjs.js:19:10:19:22 | subject.value | rxjs.js:9:17:9:35 | req.param("wobble") | rxjs.js:19:10:19:22 | subject.value | $@ flows to here and is interpreted as code. | rxjs.js:9:17:9:35 | req.param("wobble") | User-provided value |
316335
| template-sinks.js:19:17:19:23 | tainted | template-sinks.js:17:19:17:31 | req.query.foo | template-sinks.js:19:17:19:23 | tainted | $@ flows to here and is interpreted as a template, which may contain code. | template-sinks.js:17:19:17:31 | req.query.foo | User-provided value |
317336
| template-sinks.js:20:16:20:22 | tainted | template-sinks.js:17:19:17:31 | req.query.foo | template-sinks.js:20:16:20:22 | tainted | $@ flows to here and is interpreted as a template, which may contain code. | template-sinks.js:17:19:17:31 | req.query.foo | User-provided value |
318337
| template-sinks.js:21:18:21:24 | tainted | template-sinks.js:17:19:17:31 | req.query.foo | template-sinks.js:21:18:21:24 | tainted | $@ flows to here and is interpreted as a template, which may contain code. | template-sinks.js:17:19:17:31 | req.query.foo | User-provided value |

‎javascript/ql/test/query-tests/Security/CWE-094/CodeInjection/HeuristicSourceCodeInjection.expected

Lines changed: 17 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -114,6 +114,15 @@ nodes
114114
| react.js:10:56:10:77 | documen ... on.hash |
115115
| react.js:10:56:10:77 | documen ... on.hash |
116116
| react.js:10:56:10:77 | documen ... on.hash |
117+
| rxjs.js:9:9:9:35 | taint |
118+
| rxjs.js:9:17:9:35 | req.param("wobble") |
119+
| rxjs.js:9:17:9:35 | req.param("wobble") |
120+
| rxjs.js:12:16:12:20 | taint |
121+
| rxjs.js:14:12:14:12 | v |
122+
| rxjs.js:15:12:15:12 | v |
123+
| rxjs.js:15:12:15:12 | v |
124+
| rxjs.js:19:10:19:22 | subject.value |
125+
| rxjs.js:19:10:19:22 | subject.value |
117126
| template-sinks.js:17:9:17:31 | tainted |
118127
| template-sinks.js:17:19:17:31 | req.query.foo |
119128
| template-sinks.js:17:19:17:31 | req.query.foo |
@@ -240,6 +249,14 @@ edges
240249
| react-native.js:7:17:7:33 | req.param("code") | react-native.js:7:7:7:33 | tainted |
241250
| react-native.js:7:17:7:33 | req.param("code") | react-native.js:7:7:7:33 | tainted |
242251
| react.js:10:56:10:77 | documen ... on.hash | react.js:10:56:10:77 | documen ... on.hash |
252+
| rxjs.js:9:9:9:35 | taint | rxjs.js:12:16:12:20 | taint |
253+
| rxjs.js:9:17:9:35 | req.param("wobble") | rxjs.js:9:9:9:35 | taint |
254+
| rxjs.js:9:17:9:35 | req.param("wobble") | rxjs.js:9:9:9:35 | taint |
255+
| rxjs.js:12:16:12:20 | taint | rxjs.js:14:12:14:12 | v |
256+
| rxjs.js:12:16:12:20 | taint | rxjs.js:19:10:19:22 | subject.value |
257+
| rxjs.js:12:16:12:20 | taint | rxjs.js:19:10:19:22 | subject.value |
258+
| rxjs.js:14:12:14:12 | v | rxjs.js:15:12:15:12 | v |
259+
| rxjs.js:14:12:14:12 | v | rxjs.js:15:12:15:12 | v |
243260
| template-sinks.js:17:9:17:31 | tainted | template-sinks.js:19:17:19:23 | tainted |
244261
| template-sinks.js:17:9:17:31 | tainted | template-sinks.js:19:17:19:23 | tainted |
245262
| template-sinks.js:17:9:17:31 | tainted | template-sinks.js:20:16:20:22 | tainted |

‎javascript/ql/test/query-tests/Security/CWE-094/CodeInjection/rxjs.js

Lines changed: 21 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,21 @@
1+
var express = require('express');
2+
3+
var app = express();
4+
5+
import { BehaviorSubject } from 'rxjs';
6+
7+
8+
app.get('/some/path', function(req, res) {
9+
const taint = req.param("wobble");
10+
11+
const subject = new BehaviorSubject();
12+
subject.next(taint);
13+
subject.subscribe({
14+
next: (v) => {
15+
eval(v); // NOT OK
16+
}
17+
});
18+
setTimeout(() => {
19+
eval(subject.value); // NOT OK
20+
}, 100);
21+
});

0 commit comments

Comments
 (0)
pFad - Phonifier reborn

Pfad - The Proxy pFad of © 2024 Garber Painting. All rights reserved.

Note: This service is not intended for secure transactions such as banking, social media, email, or purchasing. Use at your own risk. We assume no liability whatsoever for broken pages.


Alternative Proxies:

Alternative Proxy

pFad Proxy

pFad v3 Proxy

pFad v4 Proxy