Skip to content

Commit a4f8b19

Browse files
codeql-cicodeql-ci
authored
Merge pull request #3876 from erik-krogh/CWE078-Correctness
Approved by esbena
2 parents c8e5db1 + f5cc14f commit a4f8b19

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

57 files changed

+1693
-1661
lines changed

‎javascript/ql/src/semmle/javascript/frameworks/NoSQL.qll‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -302,6 +302,8 @@ private module Mongoose {
302302
MongoDB::CollectionMethodSignatures::interpretsArgumentAsQuery(name, n)
303303
or
304304
name = "findByIdAndUpdate" and n = 1
305+
or
306+
name = "where" and n = 0
305307
}
306308

307309
/**

‎javascript/ql/test/query-tests/Security/CWE-078/CommandInjection.expected‎

Lines changed: 60 additions & 56 deletions
Original file line numberDiff line numberDiff line change
@@ -29,30 +29,32 @@ nodes
2929
| child_process-test.js:39:26:39:28 | cmd |
3030
| child_process-test.js:43:15:43:17 | cmd |
3131
| child_process-test.js:43:15:43:17 | cmd |
32-
| child_process-test.js:50:15:50:17 | cmd |
33-
| child_process-test.js:50:15:50:17 | cmd |
34-
| child_process-test.js:53:25:53:58 | ['/C', ... , cmd]) |
35-
| child_process-test.js:53:25:53:58 | ['/C', ... , cmd]) |
36-
| child_process-test.js:53:46:53:57 | ["bar", cmd] |
37-
| child_process-test.js:53:46:53:57 | ["bar", cmd] |
38-
| child_process-test.js:53:54:53:56 | cmd |
39-
| child_process-test.js:53:54:53:56 | cmd |
40-
| child_process-test.js:54:25:54:49 | ['/C', ... at(cmd) |
41-
| child_process-test.js:54:25:54:49 | ['/C', ... at(cmd) |
42-
| child_process-test.js:54:46:54:48 | cmd |
43-
| child_process-test.js:70:9:70:49 | cmd |
44-
| child_process-test.js:70:15:70:38 | url.par ... , true) |
45-
| child_process-test.js:70:15:70:44 | url.par ... ).query |
46-
| child_process-test.js:70:15:70:49 | url.par ... ry.path |
47-
| child_process-test.js:70:25:70:31 | req.url |
48-
| child_process-test.js:70:25:70:31 | req.url |
49-
| child_process-test.js:72:29:72:31 | cmd |
50-
| child_process-test.js:72:29:72:31 | cmd |
51-
| child_process-test.js:80:19:80:36 | req.query.fileName |
52-
| child_process-test.js:80:19:80:36 | req.query.fileName |
53-
| child_process-test.js:80:19:80:36 | req.query.fileName |
54-
| child_process-test.js:82:37:82:54 | req.query.fileName |
55-
| child_process-test.js:82:37:82:54 | req.query.fileName |
32+
| child_process-test.js:48:15:48:17 | cmd |
33+
| child_process-test.js:48:15:48:17 | cmd |
34+
| child_process-test.js:53:15:53:17 | cmd |
35+
| child_process-test.js:53:15:53:17 | cmd |
36+
| child_process-test.js:56:25:56:58 | ['/C', ... , cmd]) |
37+
| child_process-test.js:56:25:56:58 | ['/C', ... , cmd]) |
38+
| child_process-test.js:56:46:56:57 | ["bar", cmd] |
39+
| child_process-test.js:56:46:56:57 | ["bar", cmd] |
40+
| child_process-test.js:56:54:56:56 | cmd |
41+
| child_process-test.js:56:54:56:56 | cmd |
42+
| child_process-test.js:57:25:57:49 | ['/C', ... at(cmd) |
43+
| child_process-test.js:57:25:57:49 | ['/C', ... at(cmd) |
44+
| child_process-test.js:57:46:57:48 | cmd |
45+
| child_process-test.js:73:9:73:49 | cmd |
46+
| child_process-test.js:73:15:73:38 | url.par ... , true) |
47+
| child_process-test.js:73:15:73:44 | url.par ... ).query |
48+
| child_process-test.js:73:15:73:49 | url.par ... ry.path |
49+
| child_process-test.js:73:25:73:31 | req.url |
50+
| child_process-test.js:73:25:73:31 | req.url |
51+
| child_process-test.js:75:29:75:31 | cmd |
52+
| child_process-test.js:75:29:75:31 | cmd |
53+
| child_process-test.js:83:19:83:36 | req.query.fileName |
54+
| child_process-test.js:83:19:83:36 | req.query.fileName |
55+
| child_process-test.js:83:19:83:36 | req.query.fileName |
56+
| child_process-test.js:85:37:85:54 | req.query.fileName |
57+
| child_process-test.js:85:37:85:54 | req.query.fileName |
5658
| execSeries.js:3:20:3:22 | arr |
5759
| execSeries.js:6:14:6:16 | arr |
5860
| execSeries.js:6:14:6:21 | arr[i++] |
@@ -139,11 +141,13 @@ edges
139141
| child_process-test.js:6:9:6:49 | cmd | child_process-test.js:39:26:39:28 | cmd |
140142
| child_process-test.js:6:9:6:49 | cmd | child_process-test.js:43:15:43:17 | cmd |
141143
| child_process-test.js:6:9:6:49 | cmd | child_process-test.js:43:15:43:17 | cmd |
142-
| child_process-test.js:6:9:6:49 | cmd | child_process-test.js:50:15:50:17 | cmd |
143-
| child_process-test.js:6:9:6:49 | cmd | child_process-test.js:50:15:50:17 | cmd |
144-
| child_process-test.js:6:9:6:49 | cmd | child_process-test.js:53:54:53:56 | cmd |
145-
| child_process-test.js:6:9:6:49 | cmd | child_process-test.js:53:54:53:56 | cmd |
146-
| child_process-test.js:6:9:6:49 | cmd | child_process-test.js:54:46:54:48 | cmd |
144+
| child_process-test.js:6:9:6:49 | cmd | child_process-test.js:48:15:48:17 | cmd |
145+
| child_process-test.js:6:9:6:49 | cmd | child_process-test.js:48:15:48:17 | cmd |
146+
| child_process-test.js:6:9:6:49 | cmd | child_process-test.js:53:15:53:17 | cmd |
147+
| child_process-test.js:6:9:6:49 | cmd | child_process-test.js:53:15:53:17 | cmd |
148+
| child_process-test.js:6:9:6:49 | cmd | child_process-test.js:56:54:56:56 | cmd |
149+
| child_process-test.js:6:9:6:49 | cmd | child_process-test.js:56:54:56:56 | cmd |
150+
| child_process-test.js:6:9:6:49 | cmd | child_process-test.js:57:46:57:48 | cmd |
147151
| child_process-test.js:6:15:6:38 | url.par ... , true) | child_process-test.js:6:15:6:44 | url.par ... ).query |
148152
| child_process-test.js:6:15:6:44 | url.par ... ).query | child_process-test.js:6:15:6:49 | url.par ... ry.path |
149153
| child_process-test.js:6:15:6:44 | url.par ... ).query | child_process-test.js:6:15:6:49 | url.par ... ry.path |
@@ -154,22 +158,22 @@ edges
154158
| child_process-test.js:25:21:25:23 | cmd | child_process-test.js:25:13:25:31 | "foo" + cmd + "bar" |
155159
| child_process-test.js:39:26:39:28 | cmd | child_process-test.js:39:18:39:30 | [ flag, cmd ] |
156160
| child_process-test.js:39:26:39:28 | cmd | child_process-test.js:39:18:39:30 | [ flag, cmd ] |
157-
| child_process-test.js:53:46:53:57 | ["bar", cmd] | child_process-test.js:53:25:53:58 | ['/C', ... , cmd]) |
158-
| child_process-test.js:53:46:53:57 | ["bar", cmd] | child_process-test.js:53:25:53:58 | ['/C', ... , cmd]) |
159-
| child_process-test.js:53:54:53:56 | cmd | child_process-test.js:53:46:53:57 | ["bar", cmd] |
160-
| child_process-test.js:53:54:53:56 | cmd | child_process-test.js:53:46:53:57 | ["bar", cmd] |
161-
| child_process-test.js:54:46:54:48 | cmd | child_process-test.js:54:25:54:49 | ['/C', ... at(cmd) |
162-
| child_process-test.js:54:46:54:48 | cmd | child_process-test.js:54:25:54:49 | ['/C', ... at(cmd) |
163-
| child_process-test.js:70:9:70:49 | cmd | child_process-test.js:72:29:72:31 | cmd |
164-
| child_process-test.js:70:9:70:49 | cmd | child_process-test.js:72:29:72:31 | cmd |
165-
| child_process-test.js:70:15:70:38 | url.par ... , true) | child_process-test.js:70:15:70:44 | url.par ... ).query |
166-
| child_process-test.js:70:15:70:44 | url.par ... ).query | child_process-test.js:70:15:70:49 | url.par ... ry.path |
167-
| child_process-test.js:70:15:70:49 | url.par ... ry.path | child_process-test.js:70:9:70:49 | cmd |
168-
| child_process-test.js:70:25:70:31 | req.url | child_process-test.js:70:15:70:38 | url.par ... , true) |
169-
| child_process-test.js:70:25:70:31 | req.url | child_process-test.js:70:15:70:38 | url.par ... , true) |
170-
| child_process-test.js:80:19:80:36 | req.query.fileName | child_process-test.js:80:19:80:36 | req.query.fileName |
171-
| child_process-test.js:82:37:82:54 | req.query.fileName | lib/subLib/index.js:7:32:7:35 | name |
172-
| child_process-test.js:82:37:82:54 | req.query.fileName | lib/subLib/index.js:7:32:7:35 | name |
161+
| child_process-test.js:56:46:56:57 | ["bar", cmd] | child_process-test.js:56:25:56:58 | ['/C', ... , cmd]) |
162+
| child_process-test.js:56:46:56:57 | ["bar", cmd] | child_process-test.js:56:25:56:58 | ['/C', ... , cmd]) |
163+
| child_process-test.js:56:54:56:56 | cmd | child_process-test.js:56:46:56:57 | ["bar", cmd] |
164+
| child_process-test.js:56:54:56:56 | cmd | child_process-test.js:56:46:56:57 | ["bar", cmd] |
165+
| child_process-test.js:57:46:57:48 | cmd | child_process-test.js:57:25:57:49 | ['/C', ... at(cmd) |
166+
| child_process-test.js:57:46:57:48 | cmd | child_process-test.js:57:25:57:49 | ['/C', ... at(cmd) |
167+
| child_process-test.js:73:9:73:49 | cmd | child_process-test.js:75:29:75:31 | cmd |
168+
| child_process-test.js:73:9:73:49 | cmd | child_process-test.js:75:29:75:31 | cmd |
169+
| child_process-test.js:73:15:73:38 | url.par ... , true) | child_process-test.js:73:15:73:44 | url.par ... ).query |
170+
| child_process-test.js:73:15:73:44 | url.par ... ).query | child_process-test.js:73:15:73:49 | url.par ... ry.path |
171+
| child_process-test.js:73:15:73:49 | url.par ... ry.path | child_process-test.js:73:9:73:49 | cmd |
172+
| child_process-test.js:73:25:73:31 | req.url | child_process-test.js:73:15:73:38 | url.par ... , true) |
173+
| child_process-test.js:73:25:73:31 | req.url | child_process-test.js:73:15:73:38 | url.par ... , true) |
174+
| child_process-test.js:83:19:83:36 | req.query.fileName | child_process-test.js:83:19:83:36 | req.query.fileName |
175+
| child_process-test.js:85:37:85:54 | req.query.fileName | lib/subLib/index.js:7:32:7:35 | name |
176+
| child_process-test.js:85:37:85:54 | req.query.fileName | lib/subLib/index.js:7:32:7:35 | name |
173177
| execSeries.js:3:20:3:22 | arr | execSeries.js:6:14:6:16 | arr |
174178
| execSeries.js:6:14:6:16 | arr | execSeries.js:6:14:6:21 | arr[i++] |
175179
| execSeries.js:6:14:6:21 | arr[i++] | execSeries.js:14:24:14:30 | command |
@@ -246,18 +250,18 @@ edges
246250
| child_process-test.js:39:5:39:31 | cp.spaw ... cmd ]) | child_process-test.js:6:25:6:31 | req.url | child_process-test.js:39:18:39:30 | [ flag, cmd ] | This command depends on $@. | child_process-test.js:6:25:6:31 | req.url | a user-provided value |
247251
| child_process-test.js:39:5:39:31 | cp.spaw ... cmd ]) | child_process-test.js:6:25:6:31 | req.url | child_process-test.js:39:26:39:28 | cmd | This command depends on $@. | child_process-test.js:6:25:6:31 | req.url | a user-provided value |
248252
| child_process-test.js:44:5:44:34 | cp.exec ... , args) | child_process-test.js:6:25:6:31 | req.url | child_process-test.js:43:15:43:17 | cmd | This command depends on $@. | child_process-test.js:6:25:6:31 | req.url | a user-provided value |
249-
| child_process-test.js:51:5:51:39 | cp.exec ... , args) | child_process-test.js:6:25:6:31 | req.url | child_process-test.js:50:15:50:17 | cmd | This command depends on $@. | child_process-test.js:6:25:6:31 | req.url | a user-provided value |
250-
| child_process-test.js:53:5:53:59 | cp.spaw ... cmd])) | child_process-test.js:6:25:6:31 | req.url | child_process-test.js:53:25:53:58 | ['/C', ... , cmd]) | This command depends on $@. | child_process-test.js:6:25:6:31 | req.url | a user-provided value |
251-
| child_process-test.js:53:5:53:59 | cp.spaw ... cmd])) | child_process-test.js:6:25:6:31 | req.url | child_process-test.js:53:46:53:57 | ["bar", cmd] | This command depends on $@. | child_process-test.js:6:25:6:31 | req.url | a user-provided value |
252-
| child_process-test.js:53:5:53:59 | cp.spaw ... cmd])) | child_process-test.js:6:25:6:31 | req.url | child_process-test.js:53:54:53:56 | cmd | This command depends on $@. | child_process-test.js:6:25:6:31 | req.url | a user-provided value |
253-
| child_process-test.js:54:5:54:50 | cp.spaw ... t(cmd)) | child_process-test.js:6:25:6:31 | req.url | child_process-test.js:6:15:6:49 | url.par ... ry.path | This command depends on $@. | child_process-test.js:6:25:6:31 | req.url | a user-provided value |
254-
| child_process-test.js:54:5:54:50 | cp.spaw ... t(cmd)) | child_process-test.js:6:25:6:31 | req.url | child_process-test.js:54:25:54:49 | ['/C', ... at(cmd) | This command depends on $@. | child_process-test.js:6:25:6:31 | req.url | a user-provided value |
255-
| child_process-test.js:59:5:59:39 | cp.exec ... , args) | child_process-test.js:6:25:6:31 | req.url | child_process-test.js:50:15:50:17 | cmd | This command depends on $@. | child_process-test.js:6:25:6:31 | req.url | a user-provided value |
256-
| child_process-test.js:64:3:64:21 | cp.spawn(cmd, args) | child_process-test.js:6:25:6:31 | req.url | child_process-test.js:43:15:43:17 | cmd | This command depends on $@. | child_process-test.js:6:25:6:31 | req.url | a user-provided value |
257-
| child_process-test.js:72:29:72:31 | cmd | child_process-test.js:70:25:70:31 | req.url | child_process-test.js:72:29:72:31 | cmd | This command depends on $@. | child_process-test.js:70:25:70:31 | req.url | a user-provided value |
258-
| child_process-test.js:80:19:80:36 | req.query.fileName | child_process-test.js:80:19:80:36 | req.query.fileName | child_process-test.js:80:19:80:36 | req.query.fileName | This command depends on $@. | child_process-test.js:80:19:80:36 | req.query.fileName | a user-provided value |
253+
| child_process-test.js:54:5:54:39 | cp.exec ... , args) | child_process-test.js:6:25:6:31 | req.url | child_process-test.js:53:15:53:17 | cmd | This command depends on $@. | child_process-test.js:6:25:6:31 | req.url | a user-provided value |
254+
| child_process-test.js:56:5:56:59 | cp.spaw ... cmd])) | child_process-test.js:6:25:6:31 | req.url | child_process-test.js:56:25:56:58 | ['/C', ... , cmd]) | This command depends on $@. | child_process-test.js:6:25:6:31 | req.url | a user-provided value |
255+
| child_process-test.js:56:5:56:59 | cp.spaw ... cmd])) | child_process-test.js:6:25:6:31 | req.url | child_process-test.js:56:46:56:57 | ["bar", cmd] | This command depends on $@. | child_process-test.js:6:25:6:31 | req.url | a user-provided value |
256+
| child_process-test.js:56:5:56:59 | cp.spaw ... cmd])) | child_process-test.js:6:25:6:31 | req.url | child_process-test.js:56:54:56:56 | cmd | This command depends on $@. | child_process-test.js:6:25:6:31 | req.url | a user-provided value |
257+
| child_process-test.js:57:5:57:50 | cp.spaw ... t(cmd)) | child_process-test.js:6:25:6:31 | req.url | child_process-test.js:6:15:6:49 | url.par ... ry.path | This command depends on $@. | child_process-test.js:6:25:6:31 | req.url | a user-provided value |
258+
| child_process-test.js:57:5:57:50 | cp.spaw ... t(cmd)) | child_process-test.js:6:25:6:31 | req.url | child_process-test.js:57:25:57:49 | ['/C', ... at(cmd) | This command depends on $@. | child_process-test.js:6:25:6:31 | req.url | a user-provided value |
259+
| child_process-test.js:62:5:62:39 | cp.exec ... , args) | child_process-test.js:6:25:6:31 | req.url | child_process-test.js:53:15:53:17 | cmd | This command depends on $@. | child_process-test.js:6:25:6:31 | req.url | a user-provided value |
260+
| child_process-test.js:67:3:67:21 | cp.spawn(cmd, args) | child_process-test.js:6:25:6:31 | req.url | child_process-test.js:48:15:48:17 | cmd | This command depends on $@. | child_process-test.js:6:25:6:31 | req.url | a user-provided value |
261+
| child_process-test.js:75:29:75:31 | cmd | child_process-test.js:73:25:73:31 | req.url | child_process-test.js:75:29:75:31 | cmd | This command depends on $@. | child_process-test.js:73:25:73:31 | req.url | a user-provided value |
262+
| child_process-test.js:83:19:83:36 | req.query.fileName | child_process-test.js:83:19:83:36 | req.query.fileName | child_process-test.js:83:19:83:36 | req.query.fileName | This command depends on $@. | child_process-test.js:83:19:83:36 | req.query.fileName | a user-provided value |
259263
| execSeries.js:14:41:14:47 | command | execSeries.js:18:34:18:40 | req.url | execSeries.js:14:41:14:47 | command | This command depends on $@. | execSeries.js:18:34:18:40 | req.url | a user-provided value |
260-
| lib/subLib/index.js:8:10:8:25 | "rm -rf " + name | child_process-test.js:82:37:82:54 | req.query.fileName | lib/subLib/index.js:8:10:8:25 | "rm -rf " + name | This command depends on $@. | child_process-test.js:82:37:82:54 | req.query.fileName | a user-provided value |
264+
| lib/subLib/index.js:8:10:8:25 | "rm -rf " + name | child_process-test.js:85:37:85:54 | req.query.fileName | lib/subLib/index.js:8:10:8:25 | "rm -rf " + name | This command depends on $@. | child_process-test.js:85:37:85:54 | req.query.fileName | a user-provided value |
261265
| other.js:7:33:7:35 | cmd | other.js:5:25:5:31 | req.url | other.js:7:33:7:35 | cmd | This command depends on $@. | other.js:5:25:5:31 | req.url | a user-provided value |
262266
| other.js:8:28:8:30 | cmd | other.js:5:25:5:31 | req.url | other.js:8:28:8:30 | cmd | This command depends on $@. | other.js:5:25:5:31 | req.url | a user-provided value |
263267
| other.js:9:32:9:34 | cmd | other.js:5:25:5:31 | req.url | other.js:9:32:9:34 | cmd | This command depends on $@. | other.js:5:25:5:31 | req.url | a user-provided value |

‎javascript/ql/test/query-tests/Security/CWE-078/Consistency.expected‎

Whitespace-only changes.

‎javascript/ql/test/query-tests/Security/CWE-078/Consistency.ql‎

Lines changed: 22 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,22 @@
1+
import javascript
2+
import testUtilities.ConsistencyChecking
3+
import semmle.javascript.security.dataflow.CommandInjection
4+
import semmle.javascript.security.dataflow.IndirectCommandInjection
5+
import semmle.javascript.security.dataflow.ShellCommandInjectionFromEnvironment
6+
import semmle.javascript.security.dataflow.UnsafeShellCommandConstruction
7+
8+
class CommandInjectionConsistency extends ConsistencyConfiguration {
9+
CommandInjectionConsistency() { this = "ComandInjection" }
10+
11+
override File getAFile() { not result.getBaseName() = "uselesscat.js" }
12+
}
13+
14+
import semmle.javascript.security.UselessUseOfCat
15+
16+
class UselessCatConsistency extends ConsistencyConfiguration {
17+
UselessCatConsistency() { this = "Cat" }
18+
19+
override DataFlow::Node getAnAlert() { result instanceof UselessCat }
20+
21+
override File getAFile() { result.getBaseName() = "uselesscat.js" }
22+
}

‎javascript/ql/test/query-tests/Security/CWE-078/UselessUseOfCat.expected‎

Lines changed: 3 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -91,9 +91,9 @@ syncCommand
9191
| uselesscat.js:158:16:158:46 | cspawn. ... /bar']) |
9292
| uselesscat.js:159:16:159:68 | cspawn. ... tf8' }) |
9393
options
94-
| child_process-test.js:53:5:53:59 | cp.spaw ... cmd])) | child_process-test.js:53:25:53:58 | ['/C', ... , cmd]) |
95-
| child_process-test.js:54:5:54:50 | cp.spaw ... t(cmd)) | child_process-test.js:54:25:54:49 | ['/C', ... at(cmd) |
96-
| child_process-test.js:64:3:64:21 | cp.spawn(cmd, args) | child_process-test.js:64:17:64:20 | args |
94+
| child_process-test.js:56:5:56:59 | cp.spaw ... cmd])) | child_process-test.js:56:25:56:58 | ['/C', ... , cmd]) |
95+
| child_process-test.js:57:5:57:50 | cp.spaw ... t(cmd)) | child_process-test.js:57:25:57:49 | ['/C', ... at(cmd) |
96+
| child_process-test.js:67:3:67:21 | cp.spawn(cmd, args) | child_process-test.js:67:17:67:20 | args |
9797
| lib/lib.js:152:2:152:23 | cp.spaw ... gs, cb) | lib/lib.js:152:21:152:22 | cb |
9898
| lib/lib.js:159:2:159:23 | cp.spaw ... gs, cb) | lib/lib.js:159:21:159:22 | cb |
9999
| lib/lib.js:163:2:167:2 | cp.spaw ... t' }\\n\\t) | lib/lib.js:166:3:166:22 | { stdio: 'inherit' } |
@@ -115,6 +115,3 @@ options
115115
| uselesscat.js:156:1:156:35 | cspawn( ... tf8' }) | uselesscat.js:156:15:156:34 | { encoding: 'utf8' } |
116116
| uselesscat.js:159:16:159:68 | cspawn. ... tf8' }) | uselesscat.js:159:48:159:67 | { encoding: 'utf8' } |
117117
| uselesscat.js:164:1:164:76 | execmod ... (out)}) | uselesscat.js:164:24:164:41 | {encoding: 'utf8'} |
118-
#select
119-
| False negative | uselesscat.js:54:42:54:69 | // NOT ... lagged] |
120-
| False positive | uselesscat.js:44:37:44:85 | // OK [ ... le read |

‎javascript/ql/test/query-tests/Security/CWE-078/UselessUseOfCat.ql‎

Lines changed: 0 additions & 16 deletions
Original file line numberDiff line numberDiff line change
@@ -1,22 +1,6 @@
11
import javascript
22
import semmle.javascript.security.UselessUseOfCat
33

4-
from LineComment comment, string msg
5-
where
6-
comment.getFile().getAbsolutePath().regexpMatch(".*/uselesscat.js") and
7-
(
8-
comment.getText().regexpMatch(".*NOT OK.*") and
9-
not any(UselessCat cat).asExpr().getLocation().getStartLine() =
10-
comment.getLocation().getStartLine() and
11-
msg = "False negative"
12-
or
13-
comment.getText().regexpMatch(".* OK.*") and
14-
not comment.getText().regexpMatch(".*NOT OK.*") and
15-
any(UselessCat cat).asExpr().getLocation().getStartLine() = comment.getLocation().getStartLine() and
16-
msg = "False positive"
17-
)
18-
select msg, comment
19-
204
query string readFile(UselessCat cat) { result = PrettyPrintCatCall::createReadFileCall(cat) }
215

226
query SystemCommandExecution syncCommand() { result.isSync() }

‎javascript/ql/test/query-tests/Security/CWE-078/child_process-test.js‎

Lines changed: 9 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -40,28 +40,31 @@ var server = http.createServer(function(req, res) {
4040

4141
let args = [];
4242
args[0] = "-c";
43-
args[1] = cmd;
44-
cp.execFile("/bin/bash", args); // NOT OK
43+
args[1] = cmd; // NOT OK
44+
cp.execFile("/bin/bash", args);
4545

46+
let args = [];
47+
args[0] = "-c";
48+
args[1] = cmd; // NOT OK
4649
run("sh", args);
4750

4851
let args = [];
4952
args[0] = `-` + "c";
50-
args[1] = cmd;
51-
cp.execFile(`/bin` + "/bash", args); // NOT OK
53+
args[1] = cmd; // NOT OK
54+
cp.execFile(`/bin` + "/bash", args);
5255

5356
cp.spawn('cmd.exe', ['/C', 'foo'].concat(["bar", cmd])); // NOT OK
5457
cp.spawn('cmd.exe', ['/C', 'foo'].concat(cmd)); // NOT OK
5558

5659
let myArgs = [];
5760
myArgs.push(`-` + "c");
5861
myArgs.push(cmd);
59-
cp.execFile(`/bin` + "/bash", args); // NOT OK
62+
cp.execFile(`/bin` + "/bash", args); // NOT OK - but no support for `[].push()` for indirect arguments [INCONSISTENCY]
6063

6164
});
6265

6366
function run(cmd, args) {
64-
cp.spawn(cmd, args); // NOT OK
67+
cp.spawn(cmd, args); // OK - the alert happens where `args` is build.
6568
}
6669

6770
var util = require("util")

‎javascript/ql/test/query-tests/Security/CWE-078/command-line-parameter-command-injection.js‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -16,7 +16,7 @@ var cp = require("child_process");
1616
cp.execSync("cmd.sh " + fewerArgs[0]); // NOT OK
1717

1818
var arg0 = fewerArgs[0];
19-
cp.execSync(arg0); // OK
19+
cp.execSync(arg0); // NOT OK
2020
cp.execSync("cmd.sh " + arg0); // NOT OK
2121
});
2222

0 commit comments

Comments
 (0)