Skip to content

Commit 1cea29d

Browse files
author
Esben Sparre Andreasen
committed
JS: improve prototype pollution tests
1 parent af3f0b1 commit 1cea29d

File tree

5 files changed

+34
-15
lines changed

5 files changed

+34
-15
lines changed

‎javascript/ql/test/query-tests/Security/CWE-400/PrototypePollution.expected‎

Lines changed: 14 additions & 12 deletions
Original file line numberDiff line numberDiff line change
@@ -1,15 +1,17 @@
11
nodes
2-
| PrototypePollution.js:7:17:7:29 | req.query.foo |
3-
| PrototypePollution.js:10:17:12:5 | {\\n ... K\\n } |
4-
| PrototypePollution.js:11:16:11:30 | req.query.value |
5-
| PrototypePollution.js:15:14:15:28 | req.query.value |
6-
| PrototypePollution.js:17:17:19:5 | {\\n ... K\\n } |
7-
| PrototypePollution.js:18:16:18:25 | opts.thing |
2+
| src-non-vulnerable-lodash/tst.js:7:17:7:29 | req.query.foo |
3+
| src-vulnerable-lodash/tst.js:7:17:7:29 | req.query.foo |
4+
| src-vulnerable-lodash/tst.js:10:17:12:5 | {\\n ... K\\n } |
5+
| src-vulnerable-lodash/tst.js:11:16:11:30 | req.query.value |
6+
| src-vulnerable-lodash/tst.js:15:14:15:28 | req.query.value |
7+
| src-vulnerable-lodash/tst.js:17:17:19:5 | {\\n ... K\\n } |
8+
| src-vulnerable-lodash/tst.js:18:16:18:25 | opts.thing |
89
edges
9-
| PrototypePollution.js:11:16:11:30 | req.query.value | PrototypePollution.js:10:17:12:5 | {\\n ... K\\n } |
10-
| PrototypePollution.js:15:14:15:28 | req.query.value | PrototypePollution.js:18:16:18:25 | opts.thing |
11-
| PrototypePollution.js:18:16:18:25 | opts.thing | PrototypePollution.js:17:17:19:5 | {\\n ... K\\n } |
10+
| src-vulnerable-lodash/tst.js:11:16:11:30 | req.query.value | src-vulnerable-lodash/tst.js:10:17:12:5 | {\\n ... K\\n } |
11+
| src-vulnerable-lodash/tst.js:15:14:15:28 | req.query.value | src-vulnerable-lodash/tst.js:18:16:18:25 | opts.thing |
12+
| src-vulnerable-lodash/tst.js:18:16:18:25 | opts.thing | src-vulnerable-lodash/tst.js:17:17:19:5 | {\\n ... K\\n } |
1213
#select
13-
| PrototypePollution.js:7:17:7:29 | req.query.foo | PrototypePollution.js:7:17:7:29 | req.query.foo | PrototypePollution.js:7:17:7:29 | req.query.foo | Prototype pollution caused by merging a user-controlled value from $@. | PrototypePollution.js:7:17:7:29 | req.query.foo | here |
14-
| PrototypePollution.js:10:17:12:5 | {\\n ... K\\n } | PrototypePollution.js:11:16:11:30 | req.query.value | PrototypePollution.js:10:17:12:5 | {\\n ... K\\n } | Prototype pollution caused by merging a user-controlled value from $@. | PrototypePollution.js:11:16:11:30 | req.query.value | here |
15-
| PrototypePollution.js:17:17:19:5 | {\\n ... K\\n } | PrototypePollution.js:15:14:15:28 | req.query.value | PrototypePollution.js:17:17:19:5 | {\\n ... K\\n } | Prototype pollution caused by merging a user-controlled value from $@. | PrototypePollution.js:15:14:15:28 | req.query.value | here |
14+
| src-non-vulnerable-lodash/tst.js:7:17:7:29 | req.query.foo | src-non-vulnerable-lodash/tst.js:7:17:7:29 | req.query.foo | src-non-vulnerable-lodash/tst.js:7:17:7:29 | req.query.foo | Prototype pollution caused by merging a user-controlled value from $@. | src-non-vulnerable-lodash/tst.js:7:17:7:29 | req.query.foo | here |
15+
| src-vulnerable-lodash/tst.js:7:17:7:29 | req.query.foo | src-vulnerable-lodash/tst.js:7:17:7:29 | req.query.foo | src-vulnerable-lodash/tst.js:7:17:7:29 | req.query.foo | Prototype pollution caused by merging a user-controlled value from $@. | src-vulnerable-lodash/tst.js:7:17:7:29 | req.query.foo | here |
16+
| src-vulnerable-lodash/tst.js:10:17:12:5 | {\\n ... K\\n } | src-vulnerable-lodash/tst.js:11:16:11:30 | req.query.value | src-vulnerable-lodash/tst.js:10:17:12:5 | {\\n ... K\\n } | Prototype pollution caused by merging a user-controlled value from $@. | src-vulnerable-lodash/tst.js:11:16:11:30 | req.query.value | here |
17+
| src-vulnerable-lodash/tst.js:17:17:19:5 | {\\n ... K\\n } | src-vulnerable-lodash/tst.js:15:14:15:28 | req.query.value | src-vulnerable-lodash/tst.js:17:17:19:5 | {\\n ... K\\n } | Prototype pollution caused by merging a user-controlled value from $@. | src-vulnerable-lodash/tst.js:15:14:15:28 | req.query.value | here |

‎javascript/ql/test/query-tests/Security/CWE-400/src-non-vulnerable-lodash/package.json‎

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,5 @@
1+
{
2+
"dependencies": {
3+
"lodash": "4.17.12"
4+
}
5+
}

‎javascript/ql/test/query-tests/Security/CWE-400/src-non-vulnerable-lodash/tst.js‎

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,8 @@
1+
let express = require('express');
2+
let _ = require('lodash');
3+
4+
let app = express();
5+
6+
app.get('/hello', function(req, res) {
7+
_.merge({}, req.query.foo); // OK
8+
});

‎javascript/ql/test/query-tests/Security/CWE-400/src-vulnerable-lodash/package.json‎

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,5 @@
1+
{
2+
"dependencies": {
3+
"lodash": "4.17.4"
4+
}
5+
}

javascript/ql/test/query-tests/Security/CWE-400/PrototypePollution.js renamed to javascript/ql/test/query-tests/Security/CWE-400/src-vulnerable-lodash/tst.js

Lines changed: 2 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -6,16 +6,15 @@ let app = express();
66
app.get('/hello', function(req, res) {
77
_.merge({}, req.query.foo); // NOT OK
88
_.merge({}, req.query); // NOT OK - but not flagged
9-
9+
1010
_.merge({}, {
1111
value: req.query.value // NOT OK
1212
});
13-
13+
1414
let opts = {
1515
thing: req.query.value // wrapped and unwrapped value
1616
};
1717
_.merge({}, {
1818
value: opts.thing // NOT OK
1919
});
2020
});
21-

0 commit comments

Comments
 (0)