hohn/codeql
1
0
Fork 0
mirror of https://github.com/github/codeql.git synced 2026-05-05 05:35:13 +02:00
Code Issues Packages Projects Releases Wiki Activity

JS: Accept trivial test changes

Browse Source 
This adds Alert annotations for alerts that seem intentional by the test
but has not been annotated with 'NOT OK', or the comment was in the wrong
place.

In a few cases I included 'Source' expectations to make it easier to see
what happened. Other 'Source' expectations will be added in bulk a later
commit.
This commit is contained in:
Asger F
2025-02-11 15:06:48 +01:00
parent 0453ded338
commit 10a7294327
177 changed files with 469 additions and 503 deletions
Download Patch File Download Diff File Expand all files Collapse all files

10
javascript/ql/test/query-tests/Security/CWE-078/UnsafeShellCommandConstruction/lib/lib.js
View File

@@ -158,7 +158,7 @@ module.exports.indirect2 = function (name) {
let args = ["-c", cmd];
cp.spawn(sh, args, cb);
let cmd2 = "rm -rf " + name;
let cmd2 = "rm -rf " + name; // $ Alert
var args2 = [cmd2];
cp.spawn(
'cmd.exe',
@@ -178,7 +178,7 @@ module.exports.sanitizer = function (name) {
var sanitized = "'" + name.replace(/'/g, "'\\''") + "'"
cp.exec("rm -rf " + sanitized);
var broken = "'" + name.replace(/'/g, "'\''") + "'"
var broken = "'" + name.replace(/'/g, "'\''") + "'" // $ Alert
cp.exec("rm -rf " + broken); // $ Alert
}
@@ -551,8 +551,8 @@ module.exports.shellThing = function (name) {
function indirectShell(cmd, args, spawnOpts) {
cp.spawn(cmd, args, spawnOpts); // $ Alert
}
indirectShell("rm", ["-rf", name], {shell: true});
indirectShell("rm", ["-rf", name], {shell: true}); // $ Alert
}
module.exports.badSanitizer = function (name) {
@@ -630,7 +630,7 @@ module.exports.veryIndeirect = function (name) {
}
module.exports.sanitizer = function (name) {
var sanitized = "'" + name.replace(new RegExp("\'"), "'\\''") + "'"
var sanitized = "'" + name.replace(new RegExp("\'"), "'\\''") + "'" // $ Alert
cp.exec("rm -rf " + sanitized); // $ Alert
var sanitized = "'" + name.replace(new RegExp("\'", 'g'), "'\\''") + "'"