Skip to content

Commit 6211fe7

Browse files
asgerfasgerf
committed
JS: Add test
1 parent 1459d91 commit 6211fe7

File tree

2 files changed

+67
-0
lines changed

2 files changed

+67
-0
lines changed

‎javascript/ql/test/query-tests/Security/CWE-094/CodeInjection/CodeInjection.expected‎

Lines changed: 45 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -118,6 +118,25 @@ nodes
118118
| react-native.js:8:32:8:38 | tainted |
119119
| react-native.js:10:23:10:29 | tainted |
120120
| react-native.js:10:23:10:29 | tainted |
121+
| template-sinks.js:12:9:12:31 | tainted |
122+
| template-sinks.js:12:19:12:31 | req.query.foo |
123+
| template-sinks.js:12:19:12:31 | req.query.foo |
124+
| template-sinks.js:14:17:14:23 | tainted |
125+
| template-sinks.js:14:17:14:23 | tainted |
126+
| template-sinks.js:15:16:15:22 | tainted |
127+
| template-sinks.js:15:16:15:22 | tainted |
128+
| template-sinks.js:16:18:16:24 | tainted |
129+
| template-sinks.js:16:18:16:24 | tainted |
130+
| template-sinks.js:17:17:17:23 | tainted |
131+
| template-sinks.js:17:17:17:23 | tainted |
132+
| template-sinks.js:18:18:18:24 | tainted |
133+
| template-sinks.js:18:18:18:24 | tainted |
134+
| template-sinks.js:19:16:19:22 | tainted |
135+
| template-sinks.js:19:16:19:22 | tainted |
136+
| template-sinks.js:20:27:20:33 | tainted |
137+
| template-sinks.js:20:27:20:33 | tainted |
138+
| template-sinks.js:21:21:21:27 | tainted |
139+
| template-sinks.js:21:21:21:27 | tainted |
121140
| tst.js:2:6:2:22 | document.location |
122141
| tst.js:2:6:2:22 | document.location |
123142
| tst.js:2:6:2:27 | documen ... on.href |
@@ -256,6 +275,24 @@ edges
256275
| react-native.js:7:7:7:33 | tainted | react-native.js:10:23:10:29 | tainted |
257276
| react-native.js:7:17:7:33 | req.param("code") | react-native.js:7:7:7:33 | tainted |
258277
| react-native.js:7:17:7:33 | req.param("code") | react-native.js:7:7:7:33 | tainted |
278+
| template-sinks.js:12:9:12:31 | tainted | template-sinks.js:14:17:14:23 | tainted |
279+
| template-sinks.js:12:9:12:31 | tainted | template-sinks.js:14:17:14:23 | tainted |
280+
| template-sinks.js:12:9:12:31 | tainted | template-sinks.js:15:16:15:22 | tainted |
281+
| template-sinks.js:12:9:12:31 | tainted | template-sinks.js:15:16:15:22 | tainted |
282+
| template-sinks.js:12:9:12:31 | tainted | template-sinks.js:16:18:16:24 | tainted |
283+
| template-sinks.js:12:9:12:31 | tainted | template-sinks.js:16:18:16:24 | tainted |
284+
| template-sinks.js:12:9:12:31 | tainted | template-sinks.js:17:17:17:23 | tainted |
285+
| template-sinks.js:12:9:12:31 | tainted | template-sinks.js:17:17:17:23 | tainted |
286+
| template-sinks.js:12:9:12:31 | tainted | template-sinks.js:18:18:18:24 | tainted |
287+
| template-sinks.js:12:9:12:31 | tainted | template-sinks.js:18:18:18:24 | tainted |
288+
| template-sinks.js:12:9:12:31 | tainted | template-sinks.js:19:16:19:22 | tainted |
289+
| template-sinks.js:12:9:12:31 | tainted | template-sinks.js:19:16:19:22 | tainted |
290+
| template-sinks.js:12:9:12:31 | tainted | template-sinks.js:20:27:20:33 | tainted |
291+
| template-sinks.js:12:9:12:31 | tainted | template-sinks.js:20:27:20:33 | tainted |
292+
| template-sinks.js:12:9:12:31 | tainted | template-sinks.js:21:21:21:27 | tainted |
293+
| template-sinks.js:12:9:12:31 | tainted | template-sinks.js:21:21:21:27 | tainted |
294+
| template-sinks.js:12:19:12:31 | req.query.foo | template-sinks.js:12:9:12:31 | tainted |
295+
| template-sinks.js:12:19:12:31 | req.query.foo | template-sinks.js:12:9:12:31 | tainted |
259296
| tst.js:2:6:2:22 | document.location | tst.js:2:6:2:27 | documen ... on.href |
260297
| tst.js:2:6:2:22 | document.location | tst.js:2:6:2:27 | documen ... on.href |
261298
| tst.js:2:6:2:27 | documen ... on.href | tst.js:2:6:2:83 | documen ... t=")+8) |
@@ -315,6 +352,14 @@ edges
315352
| module.js:9:16:9:29 | req.query.code | module.js:9:16:9:29 | req.query.code | module.js:9:16:9:29 | req.query.code | $@ flows to here and is interpreted as code. | module.js:9:16:9:29 | req.query.code | User-provided value |
316353
| react-native.js:8:32:8:38 | tainted | react-native.js:7:17:7:33 | req.param("code") | react-native.js:8:32:8:38 | tainted | $@ flows to here and is interpreted as code. | react-native.js:7:17:7:33 | req.param("code") | User-provided value |
317354
| react-native.js:10:23:10:29 | tainted | react-native.js:7:17:7:33 | req.param("code") | react-native.js:10:23:10:29 | tainted | $@ flows to here and is interpreted as code. | react-native.js:7:17:7:33 | req.param("code") | User-provided value |
355+
| template-sinks.js:14:17:14:23 | tainted | template-sinks.js:12:19:12:31 | req.query.foo | template-sinks.js:14:17:14:23 | tainted | $@ flows to here and is interpreted as a template, which may contain code. | template-sinks.js:12:19:12:31 | req.query.foo | User-provided value |
356+
| template-sinks.js:15:16:15:22 | tainted | template-sinks.js:12:19:12:31 | req.query.foo | template-sinks.js:15:16:15:22 | tainted | $@ flows to here and is interpreted as a template, which may contain code. | template-sinks.js:12:19:12:31 | req.query.foo | User-provided value |
357+
| template-sinks.js:16:18:16:24 | tainted | template-sinks.js:12:19:12:31 | req.query.foo | template-sinks.js:16:18:16:24 | tainted | $@ flows to here and is interpreted as a template, which may contain code. | template-sinks.js:12:19:12:31 | req.query.foo | User-provided value |
358+
| template-sinks.js:17:17:17:23 | tainted | template-sinks.js:12:19:12:31 | req.query.foo | template-sinks.js:17:17:17:23 | tainted | $@ flows to here and is interpreted as a template, which may contain code. | template-sinks.js:12:19:12:31 | req.query.foo | User-provided value |
359+
| template-sinks.js:18:18:18:24 | tainted | template-sinks.js:12:19:12:31 | req.query.foo | template-sinks.js:18:18:18:24 | tainted | $@ flows to here and is interpreted as a template, which may contain code. | template-sinks.js:12:19:12:31 | req.query.foo | User-provided value |
360+
| template-sinks.js:19:16:19:22 | tainted | template-sinks.js:12:19:12:31 | req.query.foo | template-sinks.js:19:16:19:22 | tainted | $@ flows to here and is interpreted as a template, which may contain code. | template-sinks.js:12:19:12:31 | req.query.foo | User-provided value |
361+
| template-sinks.js:20:27:20:33 | tainted | template-sinks.js:12:19:12:31 | req.query.foo | template-sinks.js:20:27:20:33 | tainted | $@ flows to here and is interpreted as a template, which may contain code. | template-sinks.js:12:19:12:31 | req.query.foo | User-provided value |
362+
| template-sinks.js:21:21:21:27 | tainted | template-sinks.js:12:19:12:31 | req.query.foo | template-sinks.js:21:21:21:27 | tainted | $@ flows to here and is interpreted as a template, which may contain code. | template-sinks.js:12:19:12:31 | req.query.foo | User-provided value |
318363
| tst.js:2:6:2:83 | documen ... t=")+8) | tst.js:2:6:2:22 | document.location | tst.js:2:6:2:83 | documen ... t=")+8) | $@ flows to here and is interpreted as code. | tst.js:2:6:2:22 | document.location | User-provided value |
319364
| tst.js:5:12:5:33 | documen ... on.hash | tst.js:5:12:5:28 | document.location | tst.js:5:12:5:33 | documen ... on.hash | $@ flows to here and is interpreted as code. | tst.js:5:12:5:28 | document.location | User-provided value |
320365
| tst.js:14:10:14:74 | documen ... , "$1") | tst.js:14:10:14:26 | document.location | tst.js:14:10:14:74 | documen ... , "$1") | $@ flows to here and is interpreted as code. | tst.js:14:10:14:26 | document.location | User-provided value |

‎javascript/ql/test/query-tests/Security/CWE-094/CodeInjection/template-sinks.js‎

Lines changed: 22 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,22 @@
1+
import express from 'express';
2+
import * as pug from 'pug';
3+
import * as jade from 'jade';
4+
import * as dot from 'dot';
5+
import * as ejs from 'ejs';
6+
import * as nunjucks from 'nunjucks';
7+
import * as lodash from 'lodash';
8+
9+
var app = express();
10+
11+
app.get('/some/path', function(req, res) {
12+
let tainted = req.query.foo;
13+
14+
pug.compile(tainted); // NOT OK
15+
pug.render(tainted); // NOT OK
16+
jade.compile(tainted); // NOT OK
17+
jade.render(tainted); // NOT OK
18+
dot.template(tainted); // NOT OK
19+
ejs.render(tainted); // NOT OK
20+
nunjucks.renderString(tainted); // NOT OK
21+
lodash.template(tainted); // NOT OK
22+
});

0 commit comments

Comments
 (0)