hohn/codeql
1
0
Fork 0
mirror of https://github.com/github/codeql.git synced 2026-04-30 19:26:02 +02:00
Code Issues Packages Projects Releases Wiki Activity

JS: Add regression test

Browse Source
This commit is contained in:
Asger F
2019-11-26 15:34:38 +00:00
committed by Asger Feldthaus
parent 9bd3c4a11c
commit 2c05ee8ab8
2 changed files with 53 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

33
javascript/ql/test/query-tests/Security/CWE-400/PrototypePollutionUtility.expected
View File

@@ -832,6 +832,22 @@ nodes
| PrototypePollutionUtility/tests.js:338:28:338:35 | src[key] |
| PrototypePollutionUtility/tests.js:338:28:338:35 | src[key] |
| PrototypePollutionUtility/tests.js:338:28:338:35 | src[key] |
| PrototypePollutionUtility/tests.js:348:40:348:45 | source |
| PrototypePollutionUtility/tests.js:350:37:350:39 | key |
| PrototypePollutionUtility/tests.js:350:37:350:39 | key |
| PrototypePollutionUtility/tests.js:355:66:355:71 | source |
| PrototypePollutionUtility/tests.js:355:66:355:76 | source[key] |
| PrototypePollutionUtility/tests.js:355:66:355:76 | source[key] |
| PrototypePollutionUtility/tests.js:355:66:355:76 | source[key] |
| PrototypePollutionUtility/tests.js:357:24:357:26 | key |
| PrototypePollutionUtility/tests.js:357:24:357:26 | key |
| PrototypePollutionUtility/tests.js:357:31:357:36 | source |
| PrototypePollutionUtility/tests.js:357:31:357:41 | source[key] |
| PrototypePollutionUtility/tests.js:357:31:357:41 | source[key] |
| PrototypePollutionUtility/tests.js:357:31:357:41 | source[key] |
| PrototypePollutionUtility/tests.js:357:31:357:41 | source[key] |
| PrototypePollutionUtility/tests.js:357:31:357:41 | source[key] |
| PrototypePollutionUtility/tests.js:357:38:357:40 | key |
| examples/PrototypePollutionUtility.js:1:16:1:18 | dst |
| examples/PrototypePollutionUtility.js:1:16:1:18 | dst |
| examples/PrototypePollutionUtility.js:1:21:1:23 | src |
@@ -1984,6 +2000,23 @@ edges
| PrototypePollutionUtility/tests.js:338:28:338:30 | src | PrototypePollutionUtility/tests.js:338:28:338:35 | src[key] |
| PrototypePollutionUtility/tests.js:338:28:338:30 | src | PrototypePollutionUtility/tests.js:338:28:338:35 | src[key] |
| PrototypePollutionUtility/tests.js:338:28:338:35 | src[key] | PrototypePollutionUtility/tests.js:338:28:338:35 | src[key] |
| PrototypePollutionUtility/tests.js:348:40:348:45 | source | PrototypePollutionUtility/tests.js:355:66:355:71 | source |
| PrototypePollutionUtility/tests.js:348:40:348:45 | source | PrototypePollutionUtility/tests.js:357:31:357:36 | source |
| PrototypePollutionUtility/tests.js:350:37:350:39 | key | PrototypePollutionUtility/tests.js:357:24:357:26 | key |
| PrototypePollutionUtility/tests.js:350:37:350:39 | key | PrototypePollutionUtility/tests.js:357:24:357:26 | key |
| PrototypePollutionUtility/tests.js:350:37:350:39 | key | PrototypePollutionUtility/tests.js:357:24:357:26 | key |
| PrototypePollutionUtility/tests.js:350:37:350:39 | key | PrototypePollutionUtility/tests.js:357:24:357:26 | key |
| PrototypePollutionUtility/tests.js:350:37:350:39 | key | PrototypePollutionUtility/tests.js:357:38:357:40 | key |
| PrototypePollutionUtility/tests.js:350:37:350:39 | key | PrototypePollutionUtility/tests.js:357:38:357:40 | key |
| PrototypePollutionUtility/tests.js:355:66:355:71 | source | PrototypePollutionUtility/tests.js:355:66:355:76 | source[key] |
| PrototypePollutionUtility/tests.js:355:66:355:76 | source[key] | PrototypePollutionUtility/tests.js:348:40:348:45 | source |
| PrototypePollutionUtility/tests.js:355:66:355:76 | source[key] | PrototypePollutionUtility/tests.js:348:40:348:45 | source |
| PrototypePollutionUtility/tests.js:355:66:355:76 | source[key] | PrototypePollutionUtility/tests.js:348:40:348:45 | source |
| PrototypePollutionUtility/tests.js:357:31:357:36 | source | PrototypePollutionUtility/tests.js:357:31:357:41 | source[key] |
| PrototypePollutionUtility/tests.js:357:31:357:36 | source | PrototypePollutionUtility/tests.js:357:31:357:41 | source[key] |
| PrototypePollutionUtility/tests.js:357:31:357:41 | source[key] | PrototypePollutionUtility/tests.js:357:31:357:41 | source[key] |
| PrototypePollutionUtility/tests.js:357:38:357:40 | key | PrototypePollutionUtility/tests.js:357:31:357:41 | source[key] |
| PrototypePollutionUtility/tests.js:357:38:357:40 | key | PrototypePollutionUtility/tests.js:357:31:357:41 | source[key] |
| examples/PrototypePollutionUtility.js:1:16:1:18 | dst | examples/PrototypePollutionUtility.js:5:19:5:21 | dst |
| examples/PrototypePollutionUtility.js:1:16:1:18 | dst | examples/PrototypePollutionUtility.js:5:19:5:21 | dst |
| examples/PrototypePollutionUtility.js:1:16:1:18 | dst | examples/PrototypePollutionUtility.js:7:13:7:15 | dst |

20
javascript/ql/test/query-tests/Security/CWE-400/PrototypePollutionUtility/tests.js
View File

@@ -340,3 +340,23 @@ function mergeSelective(dst, src) {
}
}
}
function isNonArrayObject(item) {
return item && typeof item === 'object' && !Array.isArray(item);
}
function mergePlainObjectsOnly(target, source) {
if (isNonArrayObject(target) && isNonArrayObject(source)) {
Object.keys(source).forEach(key => {
if (key === '__proto__') {
return;
}
if (isNonArrayObject(source[key]) && key in target) {
target[key] = mergePlainObjectsOnly(target[key], source[key], options);
} else {
target[key] = source[key]; // OK
}
});
}
return target;
}