hohn/codeql
1
0
Fork 0
mirror of https://github.com/github/codeql.git synced 2026-05-05 05:35:13 +02:00
Code Issues Packages Projects Releases Wiki Activity

JS: improve prototype pollution tests

Browse Source
This commit is contained in:
Esben Sparre Andreasen
2019-04-17 14:23:35 +02:00
parent af3f0b1d04
commit 1cea29d89f
5 changed files with 34 additions and 15 deletions
Download Patch File Download Diff File Expand all files Collapse all files

26
javascript/ql/test/query-tests/Security/CWE-400/PrototypePollution.expected
View File

@@ -1,15 +1,17 @@
nodes
| PrototypePollution.js:7:17:7:29 | req.query.foo |
| PrototypePollution.js:10:17:12:5 | {\\n ... K\\n } |
| PrototypePollution.js:11:16:11:30 | req.query.value |
| PrototypePollution.js:15:14:15:28 | req.query.value |
| PrototypePollution.js:17:17:19:5 | {\\n ... K\\n } |
| PrototypePollution.js:18:16:18:25 | opts.thing |
| src-non-vulnerable-lodash/tst.js:7:17:7:29 | req.query.foo |
| src-vulnerable-lodash/tst.js:7:17:7:29 | req.query.foo |
| src-vulnerable-lodash/tst.js:10:17:12:5 | {\\n ... K\\n } |
| src-vulnerable-lodash/tst.js:11:16:11:30 | req.query.value |
| src-vulnerable-lodash/tst.js:15:14:15:28 | req.query.value |
| src-vulnerable-lodash/tst.js:17:17:19:5 | {\\n ... K\\n } |
| src-vulnerable-lodash/tst.js:18:16:18:25 | opts.thing |
edges
| PrototypePollution.js:11:16:11:30 | req.query.value | PrototypePollution.js:10:17:12:5 | {\\n ... K\\n } |
| PrototypePollution.js:15:14:15:28 | req.query.value | PrototypePollution.js:18:16:18:25 | opts.thing |
| PrototypePollution.js:18:16:18:25 | opts.thing | PrototypePollution.js:17:17:19:5 | {\\n ... K\\n } |
| src-vulnerable-lodash/tst.js:11:16:11:30 | req.query.value | src-vulnerable-lodash/tst.js:10:17:12:5 | {\\n ... K\\n } |
| src-vulnerable-lodash/tst.js:15:14:15:28 | req.query.value | src-vulnerable-lodash/tst.js:18:16:18:25 | opts.thing |
| src-vulnerable-lodash/tst.js:18:16:18:25 | opts.thing | src-vulnerable-lodash/tst.js:17:17:19:5 | {\\n ... K\\n } |
#select
| PrototypePollution.js:7:17:7:29 | req.query.foo | PrototypePollution.js:7:17:7:29 | req.query.foo | PrototypePollution.js:7:17:7:29 | req.query.foo | Prototype pollution caused by merging a user-controlled value from $@. | PrototypePollution.js:7:17:7:29 | req.query.foo | here |
| PrototypePollution.js:10:17:12:5 | {\\n ... K\\n } | PrototypePollution.js:11:16:11:30 | req.query.value | PrototypePollution.js:10:17:12:5 | {\\n ... K\\n } | Prototype pollution caused by merging a user-controlled value from $@. | PrototypePollution.js:11:16:11:30 | req.query.value | here |
| PrototypePollution.js:17:17:19:5 | {\\n ... K\\n } | PrototypePollution.js:15:14:15:28 | req.query.value | PrototypePollution.js:17:17:19:5 | {\\n ... K\\n } | Prototype pollution caused by merging a user-controlled value from $@. | PrototypePollution.js:15:14:15:28 | req.query.value | here |
| src-non-vulnerable-lodash/tst.js:7:17:7:29 | req.query.foo | src-non-vulnerable-lodash/tst.js:7:17:7:29 | req.query.foo | src-non-vulnerable-lodash/tst.js:7:17:7:29 | req.query.foo | Prototype pollution caused by merging a user-controlled value from $@. | src-non-vulnerable-lodash/tst.js:7:17:7:29 | req.query.foo | here |
| src-vulnerable-lodash/tst.js:7:17:7:29 | req.query.foo | src-vulnerable-lodash/tst.js:7:17:7:29 | req.query.foo | src-vulnerable-lodash/tst.js:7:17:7:29 | req.query.foo | Prototype pollution caused by merging a user-controlled value from $@. | src-vulnerable-lodash/tst.js:7:17:7:29 | req.query.foo | here |
| src-vulnerable-lodash/tst.js:10:17:12:5 | {\\n ... K\\n } | src-vulnerable-lodash/tst.js:11:16:11:30 | req.query.value | src-vulnerable-lodash/tst.js:10:17:12:5 | {\\n ... K\\n } | Prototype pollution caused by merging a user-controlled value from $@. | src-vulnerable-lodash/tst.js:11:16:11:30 | req.query.value | here |
| src-vulnerable-lodash/tst.js:17:17:19:5 | {\\n ... K\\n } | src-vulnerable-lodash/tst.js:15:14:15:28 | req.query.value | src-vulnerable-lodash/tst.js:17:17:19:5 | {\\n ... K\\n } | Prototype pollution caused by merging a user-controlled value from $@. | src-vulnerable-lodash/tst.js:15:14:15:28 | req.query.value | here |

5
javascript/ql/test/query-tests/Security/CWE-400/src-non-vulnerable-lodash/package.json Normal file
View File

@@ -0,0 +1,5 @@
{
"dependencies": {
"lodash": "4.17.12"
}
}

8
javascript/ql/test/query-tests/Security/CWE-400/src-non-vulnerable-lodash/tst.js Normal file
View File

@@ -0,0 +1,8 @@
let express = require('express');
let _ = require('lodash');
let app = express();
app.get('/hello', function(req, res) {
_.merge({}, req.query.foo); // OK
});

5
javascript/ql/test/query-tests/Security/CWE-400/src-vulnerable-lodash/package.json Normal file
View File

@@ -0,0 +1,5 @@
{
"dependencies": {
"lodash": "4.17.4"
}
}

5
javascript/ql/test/query-tests/Security/CWE-400/PrototypePollution.js → javascript/ql/test/query-tests/Security/CWE-400/src-vulnerable-lodash/tst.js
View File

@@ -6,11 +6,11 @@ let app = express();
app.get('/hello', function(req, res) {
_.merge({}, req.query.foo); // NOT OK
_.merge({}, req.query); // NOT OK - but not flagged
_.merge({}, {
value: req.query.value // NOT OK
});
let opts = {
thing: req.query.value // wrapped and unwrapped value
};
@@ -18,4 +18,3 @@ app.get('/hello', function(req, res) {
value: opts.thing // NOT OK
});
});