hohn/codeql
1
0
Fork 0
mirror of https://github.com/github/codeql.git synced 2026-04-26 09:15:12 +02:00
Code Issues Packages Projects Releases Wiki Activity

JS: Accept some alerts at the SystemCommandExecution location

Browse Source
This commit is contained in:
Asger F
2025-02-12 10:20:27 +01:00
parent 10a7294327
commit 07a876b4e9
1 changed files with 2 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files

4
javascript/ql/test/query-tests/Security/CWE-078/UnsafeShellCommandConstruction/lib/lib.js
View File

@@ -424,8 +424,8 @@ module.exports.shellOption = function (name) {
spawn("rm", ["first", name], SPAWN_OPT); // $ Alert
var arr = [];
arr.push(name); // $ Alert
spawn("rm", arr, SPAWN_OPT);
spawn("rm", build("node", (name ? name + ':' : '') + '-'), SPAWN_OPT); // This is bad, but the alert location is down in `build`.
spawn("rm", arr, SPAWN_OPT); // $ Alert
spawn("rm", build("node", (name ? name + ':' : '') + '-'), SPAWN_OPT); // $ Alert
}
function build(first, last) {