hohn/codeql
1
0
Fork 0
mirror of https://github.com/github/codeql.git synced 2026-05-03 12:45:27 +02:00
Code Issues Packages Projects Releases Wiki Activity

Merge branch 'master' of git.semmle.com:Semmle/ql into UrlSearch

Browse Source
This commit is contained in:
Erik Krogh Kristensen
2020-03-27 15:59:29 +01:00
parent 0ebbd80745 0b62a1d980
commit 4864e77430
146 changed files with 2480 additions and 545 deletions
Download Patch File Download Diff File Expand all files Collapse all files

13
javascript/ql/test/library-tests/Arrays/DataFlow.expected Normal file
View File

@@ -0,0 +1,13 @@
| arrays.js:2:16:2:23 | "source" | arrays.js:5:8:5:14 | obj.foo |
| arrays.js:2:16:2:23 | "source" | arrays.js:11:10:11:15 | arr[i] |
| arrays.js:2:16:2:23 | "source" | arrays.js:15:27:15:27 | e |
| arrays.js:2:16:2:23 | "source" | arrays.js:16:23:16:23 | e |
| arrays.js:2:16:2:23 | "source" | arrays.js:20:8:20:16 | arr.pop() |
| arrays.js:18:22:18:29 | "source" | arrays.js:18:50:18:50 | e |
| arrays.js:22:15:22:22 | "source" | arrays.js:23:8:23:17 | arr2.pop() |
| arrays.js:25:15:25:22 | "source" | arrays.js:26:8:26:17 | arr3.pop() |
| arrays.js:29:21:29:28 | "source" | arrays.js:30:8:30:17 | arr4.pop() |
| arrays.js:29:21:29:28 | "source" | arrays.js:33:8:33:17 | arr5.pop() |
| arrays.js:29:21:29:28 | "source" | arrays.js:35:8:35:26 | arr5.slice(2).pop() |
| arrays.js:29:21:29:28 | "source" | arrays.js:41:8:41:17 | arr6.pop() |
| arrays.js:44:4:44:11 | "source" | arrays.js:45:10:45:18 | ary.pop() |

15
javascript/ql/test/library-tests/Arrays/DataFlow.ql Normal file
View File

@@ -0,0 +1,15 @@
import javascript
class ArrayFlowConfig extends DataFlow::Configuration {
ArrayFlowConfig() { this = "ArrayFlowConfig" }
override predicate isSource(DataFlow::Node source) { source.asExpr().getStringValue() = "source" }
override predicate isSink(DataFlow::Node sink) {
sink = any(DataFlow::CallNode call | call.getCalleeName() = "sink").getAnArgument()
}
}
from ArrayFlowConfig config, DataFlow::Node src, DataFlow::Node snk
where config.hasFlow(src, snk)
select src, snk

50
javascript/ql/test/library-tests/Arrays/arrays.js Normal file
View File

@@ -0,0 +1,50 @@
(function () {
let source = "source";
var obj = { foo: source };
sink(obj.foo); // NOT OK
var arr = [];
arr.push(source);
for (var i = 0; i < arr.length; i++) {
sink(arr[i]); // NOT OK
}
arr.forEach((e) => sink(e)); // NOT OK
arr.map((e) => sink(e)); // NOT OK
[1, 2, 3].map(i => "source").forEach(e => sink(e)); // NOT OK.
sink(arr.pop()); // NOT OK
var arr2 = ["source"];
sink(arr2.pop()); // NOT OK
var arr3 = ["source"];
sink(arr3.pop()); // NOT OK
var arr4 = [];
arr4.splice(0, 0, "source");
sink(arr4.pop()); // NOT OK
var arr5 = [].concat(arr4);
sink(arr5.pop()); // NOT OK
sink(arr5.slice(2).pop()); // NOT OK
var arr6 = [];
for (var i = 0; i < arr5.length; i++) {
arr6[i] = arr5[i];
}
sink(arr6.pop()); // NOT OK
["source"].forEach((e, i, ary) => {
sink(ary.pop()); // NOT OK
sink(ary); // OK - its the array itself, not an element.
});
sink(arr[0]); // OK - tuple like usage.
});

2
javascript/ql/test/library-tests/InterProceduralFlow/DataFlow.expected
View File

@@ -2,6 +2,7 @@
| a.js:1:15:1:23 | "tainted" | b.js:6:13:6:13 | x |
| a.js:2:15:2:28 | "also tainted" | b.js:5:13:5:29 | notTaintedTrustMe |
| callback.js:16:14:16:21 | "source" | callback.js:13:14:13:14 | x |
| callback.js:17:15:17:23 | "source2" | callback.js:13:14:13:14 | x |
| callback.js:27:15:27:23 | "source3" | callback.js:13:14:13:14 | x |
| destructuring.js:2:16:2:24 | "tainted" | destructuring.js:9:15:9:22 | tainted2 |
| destructuring.js:19:15:19:23 | "tainted" | destructuring.js:14:15:14:15 | p |
@@ -44,6 +45,7 @@
| tst2.js:6:24:6:37 | "also tainted" | tst2.js:11:15:11:24 | g(source2) |
| tst6.mjs:12:14:12:21 | "source" | tst6.mjs:14:12:14:16 | a.m() |
| tst6.mjs:16:15:16:23 | "source2" | tst6.mjs:18:13:18:24 | a.m.call(a2) |
| tst.js:2:17:2:22 | "src1" | tst.js:28:20:28:22 | elt |
| tst.js:2:17:2:22 | "src1" | tst.js:39:17:39:17 | x |
| tst.js:2:17:2:22 | "src1" | tst.js:41:19:41:19 | x |
| tst.js:2:17:2:22 | "src1" | tst.js:45:17:45:17 | x |

2
javascript/ql/test/library-tests/InterProceduralFlow/GermanFlow.expected
View File

@@ -2,6 +2,7 @@
| a.js:1:15:1:23 | "tainted" | b.js:6:13:6:13 | x |
| a.js:2:15:2:28 | "also tainted" | b.js:5:13:5:29 | notTaintedTrustMe |
| callback.js:16:14:16:21 | "source" | callback.js:13:14:13:14 | x |
| callback.js:17:15:17:23 | "source2" | callback.js:13:14:13:14 | x |
| callback.js:27:15:27:23 | "source3" | callback.js:13:14:13:14 | x |
| custom.js:1:14:1:26 | "verschmutzt" | custom.js:2:15:2:20 | quelle |
| destructuring.js:2:16:2:24 | "tainted" | destructuring.js:9:15:9:22 | tainted2 |
@@ -45,6 +46,7 @@
| tst2.js:6:24:6:37 | "also tainted" | tst2.js:11:15:11:24 | g(source2) |
| tst6.mjs:12:14:12:21 | "source" | tst6.mjs:14:12:14:16 | a.m() |
| tst6.mjs:16:15:16:23 | "source2" | tst6.mjs:18:13:18:24 | a.m.call(a2) |
| tst.js:2:17:2:22 | "src1" | tst.js:28:20:28:22 | elt |
| tst.js:2:17:2:22 | "src1" | tst.js:39:17:39:17 | x |
| tst.js:2:17:2:22 | "src1" | tst.js:41:19:41:19 | x |
| tst.js:2:17:2:22 | "src1" | tst.js:45:17:45:17 | x |

5
javascript/ql/test/library-tests/InterProceduralFlow/TrackedNodes.expected
View File

@@ -1,3 +1,6 @@
| missing | callback.js:17:15:17:23 | "source2" | callback.js:8:16:8:20 | xs[i] |
| missing | callback.js:17:15:17:23 | "source2" | callback.js:12:16:12:16 | x |
| missing | callback.js:17:15:17:23 | "source2" | callback.js:13:14:13:14 | x |
| missing | promises.js:1:2:1:2 | source | promises.js:6:26:6:28 | val |
| missing | promises.js:1:2:1:2 | source | promises.js:7:16:7:18 | val |
| missing | promises.js:1:2:1:2 | source | promises.js:37:11:37:11 | v |
@@ -30,3 +33,5 @@
| missing | promises.js:16:7:16:21 | exceptional return of rej(rej_source) | promises.js:24:20:24:20 | v |
| missing | promises.js:32:24:32:37 | "also tainted" | promises.js:37:11:37:11 | v |
| missing | promises.js:32:24:32:37 | "also tainted" | promises.js:38:32:38:32 | v |
| missing | tst.js:2:17:2:22 | "src1" | tst.js:27:22:27:24 | elt |
| missing | tst.js:2:17:2:22 | "src1" | tst.js:28:20:28:22 | elt |

23
javascript/ql/test/library-tests/frameworks/Concepts/FileAccess.expected
View File

@@ -16,11 +16,34 @@ getPathArgument
| file-access.js:47:1:47:36 | vfs.des ... true }) | file-access.js:47:10:47:13 | './' |
| file-access.js:51:1:51:36 | ncp("fr ... rr) {}) | file-access.js:51:5:51:10 | "from" |
| file-access.js:51:1:51:36 | ncp("fr ... rr) {}) | file-access.js:51:13:51:16 | "to" |
| file-access.js:56:23:56:46 | loadJso ... .json') | file-access.js:56:36:56:45 | 'foo.json' |
| file-access.js:57:14:57:42 | loadJso ... .json') | file-access.js:57:32:57:41 | 'foo.json' |
| file-access.js:62:5:62:42 | writeJs ... true}) | file-access.js:62:19:62:28 | 'bar.json' |
| file-access.js:63:2:63:60 | writeJs ... : " "}) | file-access.js:63:21:63:30 | 'bar.json' |
| file-access.js:67:1:67:35 | readdir ... *.js'}) | file-access.js:67:10:67:12 | '.' |
| file-access.js:70:1:72:2 | recursi ... es);\\n}) | file-access.js:70:11:70:29 | "directory/to/read" |
| file-access.js:73:1:73:30 | recursi ... /read") | file-access.js:73:11:73:29 | "directory/to/read" |
| file-access.js:75:1:75:29 | jsonfil ... .json') | file-access.js:75:19:75:28 | 'baz.json' |
| file-access.js:79:2:81:3 | walk('. ... h);\\n\\t}) | file-access.js:79:7:79:11 | '../' |
| file-access.js:82:16:82:26 | walk('../') | file-access.js:82:21:82:25 | '../' |
| file-access.js:84:2:86:3 | walk.sy ... h);\\n\\t}) | file-access.js:84:12:84:16 | '../' |
| file-access.js:87:14:87:29 | walk.sync('../') | file-access.js:87:24:87:28 | '../' |
| file-access.js:88:21:88:37 | walk.async('../') | file-access.js:88:32:88:36 | '../' |
| file-access.js:92:1:92:15 | walker('/etc/') | file-access.js:92:8:92:14 | '/etc/' |
| tst-file-names.js:43:15:43:50 | globule ... o.js"]) | tst-file-names.js:43:40:43:49 | ["foo.js"] |
| tst-file-names.js:44:12:44:49 | globule ... o.js"]) | tst-file-names.js:44:39:44:48 | ["foo.js"] |
| tst-file-names.js:46:12:46:51 | globule ... .js"]}) | tst-file-names.js:46:34:46:49 | ["a.js", "b.js"] |
| tst-file-names.js:47:12:47:52 | globule ... b.js"]) | tst-file-names.js:47:28:47:51 | ["foo/a ... /b.js"] |
getReadNode
| file-access.js:25:1:25:59 | jsonfil ... bj) {}) | file-access.js:25:52:25:54 | obj |
| file-access.js:26:1:26:39 | jsonfil ... .json') | file-access.js:26:1:26:39 | jsonfil ... .json') |
| file-access.js:56:23:56:46 | loadJso ... .json') | file-access.js:56:17:56:46 | await l ... .json') |
| file-access.js:57:14:57:42 | loadJso ... .json') | file-access.js:57:14:57:42 | loadJso ... .json') |
| file-access.js:75:1:75:29 | jsonfil ... .json') | file-access.js:75:36:75:38 | obj |
getWriteNode
| file-access.js:15:1:15:60 | writeFi ... rr) {}) | file-access.js:15:31:15:36 | 'Data' |
| file-access.js:18:1:18:59 | writeFi ... tions]) | file-access.js:18:37:18:47 | "More data" |
| file-access.js:28:1:28:60 | jsonfil ... rr) {}) | file-access.js:28:38:28:40 | obj |
| file-access.js:29:1:29:45 | jsonfil ... ', obj) | file-access.js:29:42:29:44 | obj |
| file-access.js:62:5:62:42 | writeJs ... true}) | file-access.js:62:31:62:41 | {bar: true} |
| file-access.js:63:2:63:60 | writeJs ... : " "}) | file-access.js:63:33:63:44 | {bar: false} |

12
javascript/ql/test/library-tests/frameworks/Concepts/FileNameSource.expected
View File

@@ -1,4 +1,11 @@
| file-access.js:22:39:22:43 | files |
| file-access.js:70:47:70:51 | files |
| file-access.js:73:37:73:42 | files2 |
| file-access.js:79:23:79:26 | path |
| file-access.js:83:30:83:37 | filename |
| file-access.js:84:2:86:3 | walk.sy ... h);\\n\\t}) |
| file-access.js:87:14:87:29 | walk.sync('../') |
| file-access.js:88:15:88:37 | await w ... ('../') |
| tst-file-names.js:7:1:7:10 | walkSync() |
| tst-file-names.js:9:35:9:44 | stats.name |
| tst-file-names.js:11:1:11:12 | glob.sync(_) |
@@ -15,3 +22,8 @@
| tst-file-names.js:34:15:34:29 | await globby(_) |
| tst-file-names.js:36:16:36:38 | await f ... sync(_) |
| tst-file-names.js:38:16:38:57 | await f ... => {}) |
| tst-file-names.js:42:17:42:39 | globule ... /*.js') |
| tst-file-names.js:43:15:43:50 | globule ... o.js"]) |
| tst-file-names.js:45:12:45:42 | globule ... /*.js") |
| tst-file-names.js:46:12:46:51 | globule ... .js"]}) |
| tst-file-names.js:47:12:47:52 | globule ... b.js"]) |

43
javascript/ql/test/library-tests/frameworks/Concepts/file-access.js
View File

@@ -48,4 +48,45 @@ vfs.dest('./', { sourcemaps: true });
var ncp = require('ncp').ncp;
ncp("from", "to", function (err) {});
ncp("from", "to", function (err) {});
const loadJsonFile = require('load-json-file');
(async () => {
console.log(await loadJsonFile('foo.json'));
console.log(loadJsonFile.sync('foo.json'));
})();
const writeJsonFile = require('write-json-file');
(async () => {
writeJsonFile('bar.json', {bar: true});
writeJsonFile.sync('bar.json', {bar: false}, {indent: " "})
})();
var readdirp = require("readdirp");
readdirp('.', {fileFilter: '*.js'}).on('data', (entry) => { /* stream and promise api not modelled yet */ })
var recursive = require("recursive-readdir");
recursive("directory/to/read", function (err, files) {
console.log(files);
});
recursive("directory/to/read").then(files2 => console.log(files2));
jsonfile.readFile('baz.json').then(obj => console.log(obj))
(async function () {
var walk = require('walkdir');
walk('../', function(path, stat) {
console.log('found: ', path);
});
var emitter = walk('../');
emitter.on('file', function(filename, stat) { });
walk.sync('../', function(path, stat) {
console.log('found sync:', path);
});
var paths = walk.sync('../');
let result = await walk.async('../')
})();
var walker = require("walker");
walker('/etc/').filterDir(() => {}).on('entry', () => {}); // only file access modelled.

8
javascript/ql/test/library-tests/frameworks/Concepts/tst-file-names.js
View File

@@ -37,3 +37,11 @@ async function foo() {
var files2 = await fastGlob.async(_).catch((wat) => {});
}
var globule = require('globule');
var filepaths = globule.find('**/*.js');
var matches = globule.match('**/*.js', ["foo.js"])
var bool = globule.isMatch('**/*.js', ["foo.js"])
var map1 = globule.findMapping("foo/*.js")
var map2 = globule.mapping({src: ["a.js", "b.js"]})
var map3 = globule.mapping(["foo/a.js", "foo/b.js"])

1
javascript/ql/test/library-tests/frameworks/SQL/SqlString.expected
View File

@@ -12,6 +12,7 @@
| postgres1.js:37:21:37:24 | text |
| postgres2.js:30:16:30:41 | 'SELECT ... number' |
| postgres3.js:15:16:15:40 | 'SELECT ... s name' |
| postgres5.js:8:21:8:25 | query |
| sequelize2.js:10:17:10:118 | 'SELECT ... Y name' |
| sequelize.js:8:17:8:118 | 'SELECT ... Y name' |
| spanner2.js:5:26:5:35 | "SQL code" |

9
javascript/ql/test/library-tests/frameworks/SQL/postgres5.js Normal file
View File

@@ -0,0 +1,9 @@
const pg = require('pg');
function PgWrapper() {
this.pool = new pg.Pool({});
}
PgWrapper.prototype.query = function (query, params, cb) {
this.pool.query(query, params || [], cb);
};

29
javascript/ql/test/library-tests/frameworks/WebSocket/browser.js
View File

@@ -2,14 +2,31 @@
const socket = new WebSocket('ws://localhost:8080');
socket.addEventListener('open', function (event) {
socket.send('Hi from browser!');
socket.send('Hi from browser!');
});
socket.addEventListener('message', function (event) {
console.log('Message from server ', event.data);
console.log('Message from server ', event.data);
});
socket.onmessage = function (event) {
console.log("Message from server 2", event.data)
};
})();
(function () {
var sock = new SockJS('http://0.0.0.0:9999/echo');
sock.onopen = function () {
sock.send('test');
};
socket.onmessage = function(event) {
console.log("Message from server 2", event.data)
};
})();
sock.onmessage = function (e) {
console.log('message', e.data);
sock.close();
};
sock.addEventListener('message', function (event) {
console.log('Using addEventListener ', event.data);
});
})

4
javascript/ql/test/library-tests/frameworks/WebSocket/client.js
View File

@@ -4,10 +4,10 @@
const ws = new WebSocket('ws://example.org');
ws.on('open', function open() {
ws.send('Hi from client!');
ws.send('Hi from client!');
});
ws.on('message', function incoming(data) {
console.log(data);
console.log(data);
});
})();

8
javascript/ql/test/library-tests/frameworks/WebSocket/server.js
View File

@@ -4,10 +4,10 @@
const wss = new WebSocket.Server({ port: 8080 });
wss.on('connection', function connection(ws) {
ws.on('message', function incoming(message) {
console.log('received: %s', message);
});
ws.on('message', function incoming(message) {
console.log('received: %s', message);
});
ws.send('Hi from server!');
ws.send('Hi from server!');
});
})();

16
javascript/ql/test/library-tests/frameworks/WebSocket/sockjs.js Normal file
View File

@@ -0,0 +1,16 @@
const express = require('express');
const http = require('http');
const sockjs = require('sockjs');
const app = express();
const server = http.createServer(app);
const sockjs_echo = sockjs.createServer({});
sockjs_echo.on('connection', function (conn) {
conn.on('data', function (message) {
var data = JSON.parse(message);
conn.write(JSON.stringify(eval(data.test)));
});
});
sockjs_echo.installHandlers(server, { prefix: '/echo' });
server.listen(9090, '127.0.0.1');

33
javascript/ql/test/library-tests/frameworks/WebSocket/test.expected
View File

@@ -1,22 +1,35 @@
clientSocket
| browser.js:2:17:2:52 | new Web ... :8080') |
| browser.js:19:13:19:50 | new Soc ... /echo') |
| client.js:4:13:4:45 | new Web ... e.org') |
clientSend
| browser.js:5:6:5:36 | socket. ... wser!') |
| client.js:7:5:7:30 | ws.send ... ient!') |
| browser.js:5:3:5:33 | socket. ... wser!') |
| browser.js:21:3:21:19 | sock.send('test') |
| client.js:7:3:7:28 | ws.send ... ient!') |
clientReceive
| browser.js:8:37:10:2 | functio ... ta);\\n\\t} |
| browser.js:12:21:14:5 | functio ... )\\n } |
| browser.js:12:21:14:2 | functio ... ata)\\n\\t} |
| browser.js:24:19:27:2 | functio ... e();\\n\\t} |
| browser.js:29:35:31:2 | functio ... ta);\\n\\t} |
| client.js:10:19:12:2 | functio ... ta);\\n\\t} |
serverSocket
| server.js:6:43:6:44 | ws |
| sockjs.js:8:40:8:43 | conn |
serverSend
| server.js:11:5:11:30 | ws.send ... rver!') |
| server.js:11:3:11:28 | ws.send ... rver!') |
| sockjs.js:11:9:11:51 | conn.wr ... test))) |
serverReceive
| server.js:7:5:9:6 | ws.on(' ... \\n \\t\\t}) |
| server.js:7:3:9:4 | ws.on(' ... );\\n\\t\\t}) |
| sockjs.js:9:5:12:6 | conn.on ... \\n }) |
taintStep
| browser.js:5:18:5:35 | 'Hi from browser!' | server.js:7:40:7:46 | message |
| client.js:7:13:7:29 | 'Hi from client!' | server.js:7:40:7:46 | message |
| server.js:11:13:11:29 | 'Hi from server!' | browser.js:9:42:9:51 | event.data |
| server.js:11:13:11:29 | 'Hi from server!' | browser.js:13:44:13:53 | event.data |
| server.js:11:13:11:29 | 'Hi from server!' | client.js:10:37:10:40 | data |
| browser.js:5:15:5:32 | 'Hi from browser!' | server.js:7:38:7:44 | message |
| browser.js:21:13:21:18 | 'test' | sockjs.js:9:31:9:37 | message |
| client.js:7:11:7:27 | 'Hi from client!' | server.js:7:38:7:44 | message |
| server.js:11:11:11:27 | 'Hi from server!' | browser.js:9:39:9:48 | event.data |
| server.js:11:11:11:27 | 'Hi from server!' | browser.js:13:40:13:49 | event.data |
| server.js:11:11:11:27 | 'Hi from server!' | client.js:10:37:10:40 | data |
| sockjs.js:11:20:11:50 | JSON.st ... .test)) | browser.js:25:26:25:31 | e.data |
| sockjs.js:11:20:11:50 | JSON.st ... .test)) | browser.js:30:42:30:51 | event.data |
remoteFlow
| server.js:7:38:7:44 | message |
| sockjs.js:9:31:9:37 | message |

2
javascript/ql/test/library-tests/frameworks/WebSocket/test.ql
View File

@@ -15,3 +15,5 @@ query ServerWebSocket::ReceiveNode serverReceive() { any() }
query predicate taintStep(DataFlow::Node pred, DataFlow::Node succ) {
any(DataFlow::AdditionalFlowStep s).step(pred, succ)
}
query RemoteFlowSource remoteFlow() { any() }