diff --git a/javascript/ql/src/Security/CWE-295/DisablingCertificateValidation.ql b/javascript/ql/src/Security/CWE-295/DisablingCertificateValidation.ql index 6855ec2519d..f18ff4a3535 100644 --- a/javascript/ql/src/Security/CWE-295/DisablingCertificateValidation.ql +++ b/javascript/ql/src/Security/CWE-295/DisablingCertificateValidation.ql @@ -16,7 +16,7 @@ import javascript */ DataFlow::ObjectLiteralNode tlsOptions() { exists(DataFlow::InvokeNode invk | result.flowsTo(invk.getAnArgument()) | - invk instanceof NodeJSLib::NodeJSClientRequest + invk instanceof ClientRequest or invk = DataFlow::moduleMember("https", "Agent").getAnInstantiation() or diff --git a/javascript/ql/test/query-tests/Security/CWE-295/DisablingCertificateValidation.expected b/javascript/ql/test/query-tests/Security/CWE-295/DisablingCertificateValidation.expected index d028c5b3b30..9b21e2f5d8b 100644 --- a/javascript/ql/test/query-tests/Security/CWE-295/DisablingCertificateValidation.expected +++ b/javascript/ql/test/query-tests/Security/CWE-295/DisablingCertificateValidation.expected @@ -1,3 +1,4 @@ +| tst2.js:8:5:8:29 | rejectU ... : false | Disabling certificate validation is strongly discouraged. | | tst.js:15:3:15:27 | rejectU ... : false | Disabling certificate validation is strongly discouraged. | | tst.js:18:1:18:40 | process ... HORIZED | Disabling certificate validation is strongly discouraged. | | tst.js:21:3:21:27 | rejectU ... : false | Disabling certificate validation is strongly discouraged. | diff --git a/javascript/ql/test/query-tests/Security/CWE-295/tst2.js b/javascript/ql/test/query-tests/Security/CWE-295/tst2.js new file mode 100644 index 00000000000..50f5ae27714 --- /dev/null +++ b/javascript/ql/test/query-tests/Security/CWE-295/tst2.js @@ -0,0 +1,24 @@ +const request = require('request'); + +let requestOptions = { + headers: { + "content-type": "application/json", + "accept": "application/json" + }, + rejectUnauthorized: false, + requestCert: true, + agent: false +} + +module.exports.post = (url, requestBody, apiContext) => { + Object.assign(requestOptions, { + body: JSON.stringify(requestBody), + headers : Object.assign(requestOptions.headers, apiContext) + }) + + return request.post(url, requestOptions).then((res) => { + return Promise.resolve(res.body); + }).catch((err) => { + return Promise.resolve(err); + }) +} \ No newline at end of file