move comments to match alert location for CWE-834

erik-krogh · erik-krogh · commit 45b6906a0d3c · 2020-07-08T10:16:04.000+02:00
diff --git a/javascript/ql/test/query-tests/Security/CWE-834/LoopBoundInjectionBad.js b/javascript/ql/test/query-tests/Security/CWE-834/LoopBoundInjectionBad.js
@@ -35,9 +35,9 @@ function whileLoop(val) {
 function useLengthIndirectly(val) {
     var ret = [];
 
-    var len = val.length;
+    var len = val.length; // NOT OK!
 
-    for (var i = 0; i < len; i++) { // NOT OK!
+    for (var i = 0; i < len; i++) {
         ret.push(val[i]);
     }
 }
diff --git a/javascript/ql/test/query-tests/Security/CWE-834/LoopBoundInjectionExitBad.js b/javascript/ql/test/query-tests/Security/CWE-834/LoopBoundInjectionExitBad.js
@@ -56,8 +56,8 @@ function returns(val) {
     }
 }
 
-function lodashThrow(val) { // NOT OK!
-	_.map(val, function (e) {
+function lodashThrow(val) {
+	_.map(val, function (e) { // NOT OK!
 		if (!e) {
 			try {
 				throw new Error(); // Does not prevent DoS.

Original file line number	Diff line number	Diff line change
`@@ -35,9 +35,9 @@ function whileLoop(val) {`
`35`	`35`	`function useLengthIndirectly(val) {`
`36`	`36`	`var ret = [];`
`37`	`37`
`38`		`- var len = val.length;`
	`38`	`+ var len = val.length; // NOT OK!`
`39`	`39`
`40`		`- for (var i = 0; i < len; i++) { // NOT OK!`
	`40`	`+ for (var i = 0; i < len; i++) {`
`41`	`41`	`ret.push(val[i]);`
`42`	`42`	`}`
`43`	`43`	`}`
Original file line number	Diff line number	Diff line change
`@@ -56,8 +56,8 @@ function returns(val) {`
`56`	`56`	`}`
`57`	`57`	`}`
`58`	`58`
`59`		`-function lodashThrow(val) { // NOT OK!`
`60`		`- _.map(val, function (e) {`
	`59`	`+function lodashThrow(val) {`
	`60`	`+ _.map(val, function (e) { // NOT OK!`
`61`	`61`	`if (!e) {`
`62`	`62`	`try {`
`63`	`63`	`throw new Error(); // Does not prevent DoS.`