mirror of
https://github.com/github/codeql.git
synced 2026-04-30 03:05:15 +02:00
Merge branch 'github:main' into main
This commit is contained in:
Mauro Baluda
@@ -233,6 +233,8 @@ module AccessPath {
|
||||
baseName = fromReference(write.getBase(), root)
|
||||
or
|
||||
baseName = fromRhs(write.getBase(), root)
|
||||
or
|
||||
baseName = fromRhs(GetLaterAccess::getLaterBaseAccess(write), root)
|
||||
)
|
||||
or
|
||||
exists(GlobalVariable var |
|
||||
@@ -266,6 +268,100 @@ module AccessPath {
|
||||
)
|
||||
}
|
||||
|
||||
/** A module for computing an access to a variable that happens after a property has been written onto it */
|
||||
private module GetLaterAccess {
|
||||
/**
|
||||
* Gets an access to a variable that is written to in `write`, where the access is after the write.
|
||||
*
|
||||
* This allows `fromRhs` to compute an access path for e.g. the below example:
|
||||
* ```JavaScript
|
||||
* function foo(x) {
|
||||
* var obj = {
|
||||
* bar: x // `x` has the access path "foo.bar" starting from the root `this`.
|
||||
* };
|
||||
* this.foo = obj;
|
||||
* }
|
||||
* ```
|
||||
*/
|
||||
pragma[noopt]
|
||||
DataFlow::Node getLaterBaseAccess(DataFlow::PropWrite write) {
|
||||
exists(
|
||||
ControlFlowNode writeNode, BindingPattern access, VarRef otherAccess, Variable variable,
|
||||
StmtContainer container
|
||||
|
|
||||
access = getBaseVar(write) and
|
||||
writeNode = write.getWriteNode() and
|
||||
access = getAnAccessInContainer(variable, container, true) and
|
||||
variable = getARelevantVariable() and // manual magic
|
||||
otherAccess = getAnAccessInContainer(variable, container, false) and
|
||||
access != otherAccess and
|
||||
result.asExpr() = otherAccess
|
||||
|
|
||||
exists(BasicBlock bb, int i, int j |
|
||||
bb.getNode(i) = writeNode and
|
||||
bb.getNode(j) = otherAccess and
|
||||
i < j
|
||||
)
|
||||
or
|
||||
otherAccess.getBasicBlock() = getASuccessorBBThatReadsVar(write) // more manual magic - outlined into a helper predicate.
|
||||
)
|
||||
}
|
||||
|
||||
/** Gets a variable ref that `write` writes a property to. */
|
||||
VarRef getBaseVar(DataFlow::PropWrite write) {
|
||||
result = write.getBase().asExpr()
|
||||
or
|
||||
exists(Assignment assign |
|
||||
write.getBase().asExpr() = assign.getRhs() and
|
||||
result = assign.getLhs()
|
||||
)
|
||||
or
|
||||
exists(VariableDeclarator decl |
|
||||
write.getBase().asExpr() = decl.getInit() and
|
||||
result = decl.getBindingPattern()
|
||||
)
|
||||
}
|
||||
|
||||
/** Gets an access to `var` inside `container` where `usedInWrite` indicates whether the access is the base of a property write. */
|
||||
private VarRef getAnAccessInContainer(Variable var, StmtContainer container, boolean usedInWrite) {
|
||||
result.getVariable() = var and
|
||||
result.getContainer() = container and
|
||||
var.isLocal() and
|
||||
if result = getBaseVar(_) then usedInWrite = true else usedInWrite = false
|
||||
}
|
||||
|
||||
/** Gets a variable that is relevant for the computations in the `GetLaterAccess` module. */
|
||||
private Variable getARelevantVariable() {
|
||||
// The variable might be used where `getLaterBaseAccess()` is called.
|
||||
exists(DataFlow::Node node |
|
||||
exists(fromRhs(node, _)) and
|
||||
node.asExpr().(VarAccess).getVariable() = result
|
||||
) and
|
||||
// There is a write that writes to the variable.
|
||||
getBaseVar(_).getVariable() = result and
|
||||
// It's local.
|
||||
result.isLocal() and // we skip global variables, because that turns messy quick.
|
||||
// There is both a "write" and "read" in the same container of the variable.
|
||||
exists(StmtContainer container |
|
||||
exists(getAnAccessInContainer(result, container, true)) and // a "write", an access to the variable that is the base of a property reference.
|
||||
exists(getAnAccessInContainer(result, container, false)) // a "read", an access to the variable that is not the base of a property reference.
|
||||
)
|
||||
}
|
||||
|
||||
/** Gets a basic-block that has a read of the variable that is written to by `write`, where the basicblock occurs after `start`. */
|
||||
private ReachableBasicBlock getASuccessorBBThatReadsVar(DataFlow::PropWrite write) {
|
||||
exists(VarAccess baseExpr, Variable var, ControlFlowNode writeNode |
|
||||
baseExpr = getBaseVar(write) and
|
||||
var = baseExpr.getVariable() and
|
||||
var = getARelevantVariable() and
|
||||
writeNode = write.getWriteNode() and
|
||||
writeNode.getBasicBlock().(ReachableBasicBlock).strictlyDominates(result) and
|
||||
// manual magic.
|
||||
result = getAnAccessInContainer(getARelevantVariable(), _, false).getBasicBlock()
|
||||
)
|
||||
}
|
||||
}
|
||||
|
||||
/**
|
||||
* Gets a node that refers to the given access path relative to the given `root` node,
|
||||
* or `root` itself if the access path is empty.
|
||||
|
||||
@@ -75,6 +75,16 @@ private DataFlow::Node getAValueExportedByPackage() {
|
||||
result = getAnExportFromModule(mod)
|
||||
)
|
||||
or
|
||||
// re-export of a value from another module
|
||||
// `module.exports.foo = require("./other").bar;`
|
||||
// other.js:
|
||||
// `module.exports.bar = function () { ... };`
|
||||
exists(DataFlow::PropRead read, Import imp |
|
||||
read = getAValueExportedByPackage() and
|
||||
read.getBase().getALocalSource() = imp.getImportedModuleNode() and
|
||||
result = imp.getImportedModule().getAnExportedValue(read.getPropertyName())
|
||||
)
|
||||
or
|
||||
// require("./other-module.js"); inside an AMD module.
|
||||
exists(Module mod, CallExpr call |
|
||||
call = getAValueExportedByPackage().asExpr() and
|
||||
|
||||
@@ -1692,10 +1692,10 @@ module DataFlow {
|
||||
*/
|
||||
predicate localFieldStep(DataFlow::Node pred, DataFlow::Node succ) {
|
||||
exists(ClassNode cls, string prop |
|
||||
pred = cls.getADirectSuperClass*().getAReceiverNode().getAPropertyWrite(prop).getRhs() or
|
||||
pred = AccessPath::getAnAssignmentTo(cls.getADirectSuperClass*().getAReceiverNode(), prop) or
|
||||
pred = cls.getInstanceMethod(prop)
|
||||
|
|
||||
succ = cls.getAReceiverNode().getAPropertyRead(prop)
|
||||
succ = AccessPath::getAReferenceTo(cls.getAReceiverNode(), prop)
|
||||
)
|
||||
}
|
||||
|
||||
|
||||
@@ -1,5 +1,5 @@
|
||||
/**
|
||||
* Module for parsing access paths from CSV models, both the identifying access path used
|
||||
* Module for parsing access paths from MaD models, both the identifying access path used
|
||||
* by dynamic languages, and the input/output specifications for summary steps.
|
||||
*
|
||||
* This file is used by the shared data flow library and by the JavaScript libraries
|
||||
|
||||
@@ -0,0 +1,5 @@
|
||||
---
|
||||
category: fix
|
||||
---
|
||||
* Fixed an issue with multi-line strings in YAML files being associated with an invalid location,
|
||||
causing alerts related to such strings to appear at the top of the YAML file.
|
||||
@@ -2,10 +2,10 @@
|
||||
| sub/.eslintrc.json:2:14:5:3 | {\\n ... lse\\n } | aNonWritableGlobal | false | sub/tst.js:1:1:1:15 | aWritableGlobal |
|
||||
| sub/.eslintrc.json:2:14:5:3 | {\\n ... lse\\n } | aWritableGlobal | true | sub/subsub/tst.js:1:1:1:15 | aWritableGlobal |
|
||||
| sub/.eslintrc.json:2:14:5:3 | {\\n ... lse\\n } | aWritableGlobal | true | sub/tst.js:1:1:1:15 | aWritableGlobal |
|
||||
| sub/.eslintrc.yml:3:5:6:0 | aWritab ... l: true | aNonWritableGlobal | false | sub/subsub/tst.js:1:1:1:15 | aWritableGlobal |
|
||||
| sub/.eslintrc.yml:3:5:6:0 | aWritab ... l: true | aNonWritableGlobal | false | sub/tst.js:1:1:1:15 | aWritableGlobal |
|
||||
| sub/.eslintrc.yml:3:5:6:0 | aWritab ... l: true | aWritableGlobal | true | sub/subsub/tst.js:1:1:1:15 | aWritableGlobal |
|
||||
| sub/.eslintrc.yml:3:5:6:0 | aWritab ... l: true | aWritableGlobal | true | sub/tst.js:1:1:1:15 | aWritableGlobal |
|
||||
| sub/.eslintrc.yml:3:5:4:30 | aWritab ... l: true | aNonWritableGlobal | false | sub/subsub/tst.js:1:1:1:15 | aWritableGlobal |
|
||||
| sub/.eslintrc.yml:3:5:4:30 | aWritab ... l: true | aNonWritableGlobal | false | sub/tst.js:1:1:1:15 | aWritableGlobal |
|
||||
| sub/.eslintrc.yml:3:5:4:30 | aWritab ... l: true | aWritableGlobal | true | sub/subsub/tst.js:1:1:1:15 | aWritableGlobal |
|
||||
| sub/.eslintrc.yml:3:5:4:30 | aWritab ... l: true | aWritableGlobal | true | sub/tst.js:1:1:1:15 | aWritableGlobal |
|
||||
| sub/package.json:5:20:8:9 | {\\n ... } | aNonWritableGlobal | false | sub/subsub/tst.js:1:1:1:15 | aWritableGlobal |
|
||||
| sub/package.json:5:20:8:9 | {\\n ... } | aNonWritableGlobal | false | sub/tst.js:1:1:1:15 | aWritableGlobal |
|
||||
| sub/package.json:5:20:8:9 | {\\n ... } | aWritableGlobal | true | sub/subsub/tst.js:1:1:1:15 | aWritableGlobal |
|
||||
|
||||
@@ -30,7 +30,7 @@ nodes
|
||||
| tst.yml:1:1:14:23 | [YamlSequence] - "name ... Knopf" | semmle.label | [YamlSequence] - "name ... Knopf" |
|
||||
| tst.yml:1:1:14:23 | [YamlSequence] - "name ... Knopf" | semmle.order | 3 |
|
||||
| tst.yml:1:3:1:8 | [YamlScalar] "name" | semmle.label | [YamlScalar] "name" |
|
||||
| tst.yml:1:3:7:0 | [YamlMapping] "name": "Jim Knopf" | semmle.label | [YamlMapping] "name": "Jim Knopf" |
|
||||
| tst.yml:1:3:6:4 | [YamlMapping] "name": "Jim Knopf" | semmle.label | [YamlMapping] "name": "Jim Knopf" |
|
||||
| tst.yml:1:11:1:21 | [YamlScalar] "Jim Knopf" | semmle.label | [YamlScalar] "Jim Knopf" |
|
||||
| tst.yml:2:3:2:9 | [YamlScalar] address | semmle.label | [YamlScalar] address |
|
||||
| tst.yml:2:12:6:3 | [YamlMapping] { | semmle.label | [YamlMapping] { |
|
||||
@@ -41,12 +41,12 @@ nodes
|
||||
| tst.yml:5:5:5:13 | [YamlScalar] "country" | semmle.label | [YamlScalar] "country" |
|
||||
| tst.yml:5:16:5:27 | [YamlScalar] "Lummerland" | semmle.label | [YamlScalar] "Lummerland" |
|
||||
| tst.yml:7:3:7:6 | [YamlScalar] name | semmle.label | [YamlScalar] name |
|
||||
| tst.yml:7:3:14:0 | [YamlMapping] name: Frau Mahlzahn | semmle.label | [YamlMapping] name: Frau Mahlzahn |
|
||||
| tst.yml:7:3:13:19 | [YamlMapping] name: Frau Mahlzahn | semmle.label | [YamlMapping] name: Frau Mahlzahn |
|
||||
| tst.yml:7:9:7:21 | [YamlScalar] Frau Mahlzahn | semmle.label | [YamlScalar] Frau Mahlzahn |
|
||||
| tst.yml:8:3:8:9 | [YamlScalar] address | semmle.label | [YamlScalar] address |
|
||||
| tst.yml:9:5:9:10 | [YamlScalar] street | semmle.label | [YamlScalar] street |
|
||||
| tst.yml:9:5:14:0 | [YamlMapping] street: \| | semmle.label | [YamlMapping] street: \| |
|
||||
| tst.yml:9:13:11:0 | [YamlScalar] \| | semmle.label | [YamlScalar] \| |
|
||||
| tst.yml:9:5:13:19 | [YamlMapping] street: \| | semmle.label | [YamlMapping] street: \| |
|
||||
| tst.yml:9:13:10:21 | [YamlScalar] \| | semmle.label | [YamlScalar] \| |
|
||||
| tst.yml:11:5:11:10 | [YamlScalar] number | semmle.label | [YamlScalar] number |
|
||||
| tst.yml:11:13:11:15 | [YamlScalar] 133 | semmle.label | [YamlScalar] 133 |
|
||||
| tst.yml:12:5:12:11 | [YamlScalar] country | semmle.label | [YamlScalar] country |
|
||||
@@ -67,8 +67,8 @@ edges
|
||||
| file://:0:0:0:0 | (Mapping 0) street: | tst.yml:3:14:3:13 | [YamlScalar] | semmle.order | 1 |
|
||||
| file://:0:0:0:0 | (Mapping 0) street: | tst.yml:9:5:9:10 | [YamlScalar] street | semmle.label | 0 |
|
||||
| file://:0:0:0:0 | (Mapping 0) street: | tst.yml:9:5:9:10 | [YamlScalar] street | semmle.order | 0 |
|
||||
| file://:0:0:0:0 | (Mapping 0) street: | tst.yml:9:13:11:0 | [YamlScalar] \| | semmle.label | 1 |
|
||||
| file://:0:0:0:0 | (Mapping 0) street: | tst.yml:9:13:11:0 | [YamlScalar] \| | semmle.order | 1 |
|
||||
| file://:0:0:0:0 | (Mapping 0) street: | tst.yml:9:13:10:21 | [YamlScalar] \| | semmle.label | 1 |
|
||||
| file://:0:0:0:0 | (Mapping 0) street: | tst.yml:9:13:10:21 | [YamlScalar] \| | semmle.order | 1 |
|
||||
| file://:0:0:0:0 | (Mapping 0) x: | merge.yaml:1:8:1:8 | [YamlScalar] x | semmle.label | 0 |
|
||||
| file://:0:0:0:0 | (Mapping 0) x: | merge.yaml:1:8:1:8 | [YamlScalar] x | semmle.order | 0 |
|
||||
| file://:0:0:0:0 | (Mapping 0) x: | merge.yaml:1:11:1:12 | [YamlScalar] 23 | semmle.label | 1 |
|
||||
@@ -87,8 +87,8 @@ edges
|
||||
| file://:0:0:0:0 | (Mapping 1) address: | tst.yml:2:12:6:3 | [YamlMapping] { | semmle.order | 1 |
|
||||
| file://:0:0:0:0 | (Mapping 1) address: | tst.yml:8:3:8:9 | [YamlScalar] address | semmle.label | 0 |
|
||||
| file://:0:0:0:0 | (Mapping 1) address: | tst.yml:8:3:8:9 | [YamlScalar] address | semmle.order | 0 |
|
||||
| file://:0:0:0:0 | (Mapping 1) address: | tst.yml:9:5:14:0 | [YamlMapping] street: \| | semmle.label | 1 |
|
||||
| file://:0:0:0:0 | (Mapping 1) address: | tst.yml:9:5:14:0 | [YamlMapping] street: \| | semmle.order | 1 |
|
||||
| file://:0:0:0:0 | (Mapping 1) address: | tst.yml:9:5:13:19 | [YamlMapping] street: \| | semmle.label | 1 |
|
||||
| file://:0:0:0:0 | (Mapping 1) address: | tst.yml:9:5:13:19 | [YamlMapping] street: \| | semmle.order | 1 |
|
||||
| file://:0:0:0:0 | (Mapping 1) number: | tst.yml:4:5:4:12 | [YamlScalar] "number" | semmle.label | 0 |
|
||||
| file://:0:0:0:0 | (Mapping 1) number: | tst.yml:4:5:4:12 | [YamlScalar] "number" | semmle.order | 0 |
|
||||
| file://:0:0:0:0 | (Mapping 1) number: | tst.yml:4:15:4:16 | [YamlScalar] -1 | semmle.label | 1 |
|
||||
@@ -121,31 +121,31 @@ edges
|
||||
| merge.yaml:2:3:3:8 | [YamlMapping] x: 56 | file://:0:0:0:0 | (Mapping 0) x: | semmle.order | 0 |
|
||||
| merge.yaml:2:3:3:8 | [YamlMapping] x: 56 | file://:0:0:0:0 | (Mapping 1) <<: | semmle.label | 1 |
|
||||
| merge.yaml:2:3:3:8 | [YamlMapping] x: 56 | file://:0:0:0:0 | (Mapping 1) <<: | semmle.order | 1 |
|
||||
| tst.yml:1:1:14:23 | [YamlSequence] - "name ... Knopf" | tst.yml:1:3:7:0 | [YamlMapping] "name": "Jim Knopf" | semmle.label | 0 |
|
||||
| tst.yml:1:1:14:23 | [YamlSequence] - "name ... Knopf" | tst.yml:1:3:7:0 | [YamlMapping] "name": "Jim Knopf" | semmle.order | 0 |
|
||||
| tst.yml:1:1:14:23 | [YamlSequence] - "name ... Knopf" | tst.yml:7:3:14:0 | [YamlMapping] name: Frau Mahlzahn | semmle.label | 1 |
|
||||
| tst.yml:1:1:14:23 | [YamlSequence] - "name ... Knopf" | tst.yml:7:3:14:0 | [YamlMapping] name: Frau Mahlzahn | semmle.order | 1 |
|
||||
| tst.yml:1:1:14:23 | [YamlSequence] - "name ... Knopf" | tst.yml:1:3:6:4 | [YamlMapping] "name": "Jim Knopf" | semmle.label | 0 |
|
||||
| tst.yml:1:1:14:23 | [YamlSequence] - "name ... Knopf" | tst.yml:1:3:6:4 | [YamlMapping] "name": "Jim Knopf" | semmle.order | 0 |
|
||||
| tst.yml:1:1:14:23 | [YamlSequence] - "name ... Knopf" | tst.yml:7:3:13:19 | [YamlMapping] name: Frau Mahlzahn | semmle.label | 1 |
|
||||
| tst.yml:1:1:14:23 | [YamlSequence] - "name ... Knopf" | tst.yml:7:3:13:19 | [YamlMapping] name: Frau Mahlzahn | semmle.order | 1 |
|
||||
| tst.yml:1:1:14:23 | [YamlSequence] - "name ... Knopf" | tst.yml:14:3:14:23 | [YamlScalar] !includ ... nal.yml | semmle.label | 2 |
|
||||
| tst.yml:1:1:14:23 | [YamlSequence] - "name ... Knopf" | tst.yml:14:3:14:23 | [YamlScalar] !includ ... nal.yml | semmle.order | 2 |
|
||||
| tst.yml:1:3:7:0 | [YamlMapping] "name": "Jim Knopf" | file://:0:0:0:0 | (Mapping 0) name: | semmle.label | 0 |
|
||||
| tst.yml:1:3:7:0 | [YamlMapping] "name": "Jim Knopf" | file://:0:0:0:0 | (Mapping 0) name: | semmle.order | 0 |
|
||||
| tst.yml:1:3:7:0 | [YamlMapping] "name": "Jim Knopf" | file://:0:0:0:0 | (Mapping 1) address: | semmle.label | 1 |
|
||||
| tst.yml:1:3:7:0 | [YamlMapping] "name": "Jim Knopf" | file://:0:0:0:0 | (Mapping 1) address: | semmle.order | 1 |
|
||||
| tst.yml:1:3:6:4 | [YamlMapping] "name": "Jim Knopf" | file://:0:0:0:0 | (Mapping 0) name: | semmle.label | 0 |
|
||||
| tst.yml:1:3:6:4 | [YamlMapping] "name": "Jim Knopf" | file://:0:0:0:0 | (Mapping 0) name: | semmle.order | 0 |
|
||||
| tst.yml:1:3:6:4 | [YamlMapping] "name": "Jim Knopf" | file://:0:0:0:0 | (Mapping 1) address: | semmle.label | 1 |
|
||||
| tst.yml:1:3:6:4 | [YamlMapping] "name": "Jim Knopf" | file://:0:0:0:0 | (Mapping 1) address: | semmle.order | 1 |
|
||||
| tst.yml:2:12:6:3 | [YamlMapping] { | file://:0:0:0:0 | (Mapping 0) street: | semmle.label | 0 |
|
||||
| tst.yml:2:12:6:3 | [YamlMapping] { | file://:0:0:0:0 | (Mapping 0) street: | semmle.order | 0 |
|
||||
| tst.yml:2:12:6:3 | [YamlMapping] { | file://:0:0:0:0 | (Mapping 1) number: | semmle.label | 1 |
|
||||
| tst.yml:2:12:6:3 | [YamlMapping] { | file://:0:0:0:0 | (Mapping 1) number: | semmle.order | 1 |
|
||||
| tst.yml:2:12:6:3 | [YamlMapping] { | file://:0:0:0:0 | (Mapping 2) country: | semmle.label | 2 |
|
||||
| tst.yml:2:12:6:3 | [YamlMapping] { | file://:0:0:0:0 | (Mapping 2) country: | semmle.order | 2 |
|
||||
| tst.yml:7:3:14:0 | [YamlMapping] name: Frau Mahlzahn | file://:0:0:0:0 | (Mapping 0) name: | semmle.label | 0 |
|
||||
| tst.yml:7:3:14:0 | [YamlMapping] name: Frau Mahlzahn | file://:0:0:0:0 | (Mapping 0) name: | semmle.order | 0 |
|
||||
| tst.yml:7:3:14:0 | [YamlMapping] name: Frau Mahlzahn | file://:0:0:0:0 | (Mapping 1) address: | semmle.label | 1 |
|
||||
| tst.yml:7:3:14:0 | [YamlMapping] name: Frau Mahlzahn | file://:0:0:0:0 | (Mapping 1) address: | semmle.order | 1 |
|
||||
| tst.yml:9:5:14:0 | [YamlMapping] street: \| | file://:0:0:0:0 | (Mapping 0) street: | semmle.label | 0 |
|
||||
| tst.yml:9:5:14:0 | [YamlMapping] street: \| | file://:0:0:0:0 | (Mapping 0) street: | semmle.order | 0 |
|
||||
| tst.yml:9:5:14:0 | [YamlMapping] street: \| | file://:0:0:0:0 | (Mapping 1) number: | semmle.label | 1 |
|
||||
| tst.yml:9:5:14:0 | [YamlMapping] street: \| | file://:0:0:0:0 | (Mapping 1) number: | semmle.order | 1 |
|
||||
| tst.yml:9:5:14:0 | [YamlMapping] street: \| | file://:0:0:0:0 | (Mapping 2) country: | semmle.label | 2 |
|
||||
| tst.yml:9:5:14:0 | [YamlMapping] street: \| | file://:0:0:0:0 | (Mapping 2) country: | semmle.order | 2 |
|
||||
| tst.yml:7:3:13:19 | [YamlMapping] name: Frau Mahlzahn | file://:0:0:0:0 | (Mapping 0) name: | semmle.label | 0 |
|
||||
| tst.yml:7:3:13:19 | [YamlMapping] name: Frau Mahlzahn | file://:0:0:0:0 | (Mapping 0) name: | semmle.order | 0 |
|
||||
| tst.yml:7:3:13:19 | [YamlMapping] name: Frau Mahlzahn | file://:0:0:0:0 | (Mapping 1) address: | semmle.label | 1 |
|
||||
| tst.yml:7:3:13:19 | [YamlMapping] name: Frau Mahlzahn | file://:0:0:0:0 | (Mapping 1) address: | semmle.order | 1 |
|
||||
| tst.yml:9:5:13:19 | [YamlMapping] street: \| | file://:0:0:0:0 | (Mapping 0) street: | semmle.label | 0 |
|
||||
| tst.yml:9:5:13:19 | [YamlMapping] street: \| | file://:0:0:0:0 | (Mapping 0) street: | semmle.order | 0 |
|
||||
| tst.yml:9:5:13:19 | [YamlMapping] street: \| | file://:0:0:0:0 | (Mapping 1) number: | semmle.label | 1 |
|
||||
| tst.yml:9:5:13:19 | [YamlMapping] street: \| | file://:0:0:0:0 | (Mapping 1) number: | semmle.order | 1 |
|
||||
| tst.yml:9:5:13:19 | [YamlMapping] street: \| | file://:0:0:0:0 | (Mapping 2) country: | semmle.label | 2 |
|
||||
| tst.yml:9:5:13:19 | [YamlMapping] street: \| | file://:0:0:0:0 | (Mapping 2) country: | semmle.order | 2 |
|
||||
graphProperties
|
||||
| semmle.graphKind | tree |
|
||||
|
||||
@@ -12,16 +12,16 @@ yamlMapping_maps
|
||||
| merge.yaml:2:3:3:8 | x: 56 | merge.yaml:1:15:1:15 | y | merge.yaml:1:18:1:19 | 42 |
|
||||
| merge.yaml:2:3:3:8 | x: 56 | merge.yaml:2:3:2:3 | x | merge.yaml:2:6:2:7 | 56 |
|
||||
| merge.yaml:2:3:3:8 | x: 56 | merge.yaml:3:3:3:4 | << | merge.yaml:1:3:1:21 | &A { x: 23, y: 42 } |
|
||||
| tst.yml:1:3:7:0 | "name": "Jim Knopf" | tst.yml:1:3:1:8 | "name" | tst.yml:1:11:1:21 | "Jim Knopf" |
|
||||
| tst.yml:1:3:7:0 | "name": "Jim Knopf" | tst.yml:2:3:2:9 | address | tst.yml:2:12:6:3 | { |
|
||||
| tst.yml:1:3:6:4 | "name": "Jim Knopf" | tst.yml:1:3:1:8 | "name" | tst.yml:1:11:1:21 | "Jim Knopf" |
|
||||
| tst.yml:1:3:6:4 | "name": "Jim Knopf" | tst.yml:2:3:2:9 | address | tst.yml:2:12:6:3 | { |
|
||||
| tst.yml:2:12:6:3 | { | tst.yml:3:5:3:12 | "street" | tst.yml:3:14:3:13 | |
|
||||
| tst.yml:2:12:6:3 | { | tst.yml:4:5:4:12 | "number" | tst.yml:4:15:4:16 | -1 |
|
||||
| tst.yml:2:12:6:3 | { | tst.yml:5:5:5:13 | "country" | tst.yml:5:16:5:27 | "Lummerland" |
|
||||
| tst.yml:7:3:14:0 | name: Frau Mahlzahn | tst.yml:7:3:7:6 | name | tst.yml:7:9:7:21 | Frau Mahlzahn |
|
||||
| tst.yml:7:3:14:0 | name: Frau Mahlzahn | tst.yml:8:3:8:9 | address | tst.yml:9:5:14:0 | street: \| |
|
||||
| tst.yml:9:5:14:0 | street: \| | tst.yml:9:5:9:10 | street | tst.yml:9:13:11:0 | \| |
|
||||
| tst.yml:9:5:14:0 | street: \| | tst.yml:11:5:11:10 | number | tst.yml:11:13:11:15 | 133 |
|
||||
| tst.yml:9:5:14:0 | street: \| | tst.yml:12:5:12:11 | country | tst.yml:12:14:13:18 | < |
|
||||
| tst.yml:7:3:13:19 | name: Frau Mahlzahn | tst.yml:7:3:7:6 | name | tst.yml:7:9:7:21 | Frau Mahlzahn |
|
||||
| tst.yml:7:3:13:19 | name: Frau Mahlzahn | tst.yml:8:3:8:9 | address | tst.yml:9:5:13:19 | street: \| |
|
||||
| tst.yml:9:5:13:19 | street: \| | tst.yml:9:5:9:10 | street | tst.yml:9:13:10:21 | \| |
|
||||
| tst.yml:9:5:13:19 | street: \| | tst.yml:11:5:11:10 | number | tst.yml:11:13:11:15 | 133 |
|
||||
| tst.yml:9:5:13:19 | street: \| | tst.yml:12:5:12:11 | country | tst.yml:12:14:13:18 | < |
|
||||
yamlNode
|
||||
| external.yml:1:1:1:2 | 42 | tag:yaml.org,2002:int |
|
||||
| merge.yaml:1:1:3:8 | - &A { ... y: 42 } | tag:yaml.org,2002:seq |
|
||||
@@ -37,7 +37,7 @@ yamlNode
|
||||
| merge.yaml:3:7:3:8 | *A | |
|
||||
| tst.yml:1:1:14:23 | - "name ... Knopf" | tag:yaml.org,2002:seq |
|
||||
| tst.yml:1:3:1:8 | "name" | tag:yaml.org,2002:str |
|
||||
| tst.yml:1:3:7:0 | "name": "Jim Knopf" | tag:yaml.org,2002:map |
|
||||
| tst.yml:1:3:6:4 | "name": "Jim Knopf" | tag:yaml.org,2002:map |
|
||||
| tst.yml:1:11:1:21 | "Jim Knopf" | tag:yaml.org,2002:str |
|
||||
| tst.yml:2:3:2:9 | address | tag:yaml.org,2002:str |
|
||||
| tst.yml:2:12:6:3 | { | tag:yaml.org,2002:map |
|
||||
@@ -48,12 +48,12 @@ yamlNode
|
||||
| tst.yml:5:5:5:13 | "country" | tag:yaml.org,2002:str |
|
||||
| tst.yml:5:16:5:27 | "Lummerland" | tag:yaml.org,2002:str |
|
||||
| tst.yml:7:3:7:6 | name | tag:yaml.org,2002:str |
|
||||
| tst.yml:7:3:14:0 | name: Frau Mahlzahn | tag:yaml.org,2002:map |
|
||||
| tst.yml:7:3:13:19 | name: Frau Mahlzahn | tag:yaml.org,2002:map |
|
||||
| tst.yml:7:9:7:21 | Frau Mahlzahn | tag:yaml.org,2002:str |
|
||||
| tst.yml:8:3:8:9 | address | tag:yaml.org,2002:str |
|
||||
| tst.yml:9:5:9:10 | street | tag:yaml.org,2002:str |
|
||||
| tst.yml:9:5:14:0 | street: \| | tag:yaml.org,2002:map |
|
||||
| tst.yml:9:13:11:0 | \| | tag:yaml.org,2002:str |
|
||||
| tst.yml:9:5:13:19 | street: \| | tag:yaml.org,2002:map |
|
||||
| tst.yml:9:13:10:21 | \| | tag:yaml.org,2002:str |
|
||||
| tst.yml:11:5:11:10 | number | tag:yaml.org,2002:str |
|
||||
| tst.yml:11:13:11:15 | 133 | tag:yaml.org,2002:int |
|
||||
| tst.yml:12:5:12:11 | country | tag:yaml.org,2002:str |
|
||||
@@ -81,7 +81,7 @@ yamlScalar
|
||||
| tst.yml:7:9:7:21 | Frau Mahlzahn | | Frau Mahlzahn |
|
||||
| tst.yml:8:3:8:9 | address | | address |
|
||||
| tst.yml:9:5:9:10 | street | | street |
|
||||
| tst.yml:9:13:11:0 | \| | \| | Alte Strasse\n |
|
||||
| tst.yml:9:13:10:21 | \| | \| | Alte Strasse\n |
|
||||
| tst.yml:11:5:11:10 | number | | number |
|
||||
| tst.yml:11:13:11:15 | 133 | | 133 |
|
||||
| tst.yml:12:5:12:11 | country | | country |
|
||||
|
||||
@@ -170,6 +170,10 @@ nodes
|
||||
| lib/lib.js:277:23:277:26 | opts |
|
||||
| lib/lib.js:277:23:277:30 | opts.bla |
|
||||
| lib/lib.js:277:23:277:30 | opts.bla |
|
||||
| lib/lib.js:279:19:279:22 | opts |
|
||||
| lib/lib.js:279:19:279:26 | opts.bla |
|
||||
| lib/lib.js:281:23:281:35 | this.opts.bla |
|
||||
| lib/lib.js:281:23:281:35 | this.opts.bla |
|
||||
| lib/lib.js:307:39:307:42 | name |
|
||||
| lib/lib.js:307:39:307:42 | name |
|
||||
| lib/lib.js:308:23:308:26 | name |
|
||||
@@ -504,8 +508,13 @@ edges
|
||||
| lib/lib.js:268:22:268:24 | obj | lib/lib.js:268:22:268:32 | obj.version |
|
||||
| lib/lib.js:276:8:276:11 | opts | lib/lib.js:277:23:277:26 | opts |
|
||||
| lib/lib.js:276:8:276:11 | opts | lib/lib.js:277:23:277:26 | opts |
|
||||
| lib/lib.js:276:8:276:11 | opts | lib/lib.js:279:19:279:22 | opts |
|
||||
| lib/lib.js:276:8:276:11 | opts | lib/lib.js:279:19:279:22 | opts |
|
||||
| lib/lib.js:277:23:277:26 | opts | lib/lib.js:277:23:277:30 | opts.bla |
|
||||
| lib/lib.js:277:23:277:26 | opts | lib/lib.js:277:23:277:30 | opts.bla |
|
||||
| lib/lib.js:279:19:279:22 | opts | lib/lib.js:279:19:279:26 | opts.bla |
|
||||
| lib/lib.js:279:19:279:26 | opts.bla | lib/lib.js:281:23:281:35 | this.opts.bla |
|
||||
| lib/lib.js:279:19:279:26 | opts.bla | lib/lib.js:281:23:281:35 | this.opts.bla |
|
||||
| lib/lib.js:307:39:307:42 | name | lib/lib.js:308:23:308:26 | name |
|
||||
| lib/lib.js:307:39:307:42 | name | lib/lib.js:308:23:308:26 | name |
|
||||
| lib/lib.js:307:39:307:42 | name | lib/lib.js:308:23:308:26 | name |
|
||||
@@ -714,6 +723,7 @@ edges
|
||||
| lib/lib.js:261:11:261:33 | "rm -rf ... + name | lib/lib.js:257:35:257:38 | name | lib/lib.js:261:30:261:33 | name | This string concatenation which depends on $@ is later used in a $@. | lib/lib.js:257:35:257:38 | name | library input | lib/lib.js:261:3:261:34 | cp.exec ... + name) | shell command |
|
||||
| lib/lib.js:268:10:268:32 | "rm -rf ... version | lib/lib.js:267:46:267:48 | obj | lib/lib.js:268:22:268:32 | obj.version | This string concatenation which depends on $@ is later used in a $@. | lib/lib.js:267:46:267:48 | obj | library input | lib/lib.js:268:2:268:33 | cp.exec ... ersion) | shell command |
|
||||
| lib/lib.js:277:11:277:30 | "rm -rf " + opts.bla | lib/lib.js:276:8:276:11 | opts | lib/lib.js:277:23:277:30 | opts.bla | This string concatenation which depends on $@ is later used in a $@. | lib/lib.js:276:8:276:11 | opts | library input | lib/lib.js:277:3:277:31 | cp.exec ... ts.bla) | shell command |
|
||||
| lib/lib.js:281:11:281:35 | "rm -rf ... pts.bla | lib/lib.js:276:8:276:11 | opts | lib/lib.js:281:23:281:35 | this.opts.bla | This string concatenation which depends on $@ is later used in a $@. | lib/lib.js:276:8:276:11 | opts | library input | lib/lib.js:281:3:281:36 | cp.exec ... ts.bla) | shell command |
|
||||
| lib/lib.js:308:11:308:26 | "rm -rf " + name | lib/lib.js:307:39:307:42 | name | lib/lib.js:308:23:308:26 | name | This string concatenation which depends on $@ is later used in a $@. | lib/lib.js:307:39:307:42 | name | library input | lib/lib.js:308:3:308:27 | cp.exec ... + name) | shell command |
|
||||
| lib/lib.js:315:10:315:25 | "rm -rf " + name | lib/lib.js:314:40:314:43 | name | lib/lib.js:315:22:315:25 | name | This string concatenation which depends on $@ is later used in a $@. | lib/lib.js:314:40:314:43 | name | library input | lib/lib.js:315:2:315:26 | cp.exec ... + name) | shell command |
|
||||
| lib/lib.js:320:11:320:26 | "rm -rf " + name | lib/lib.js:314:40:314:43 | name | lib/lib.js:320:23:320:26 | name | This string concatenation which depends on $@ is later used in a $@. | lib/lib.js:314:40:314:43 | name | library input | lib/lib.js:320:3:320:27 | cp.exec ... + name) | shell command |
|
||||
|
||||
@@ -278,7 +278,7 @@ module.exports.Foo = class Foo {
|
||||
this.opts = {};
|
||||
this.opts.bla = opts.bla
|
||||
|
||||
cp.exec("rm -rf " + this.opts.bla); // NOT OK - but FN [INCONSISTENCY]
|
||||
cp.exec("rm -rf " + this.opts.bla); // NOT OK
|
||||
}
|
||||
}
|
||||
|
||||
|
||||
@@ -15,6 +15,41 @@ nodes
|
||||
| lib/index.js:19:26:19:29 | data |
|
||||
| lib/index.js:22:7:22:10 | data |
|
||||
| lib/index.js:22:7:22:10 | data |
|
||||
| lib/index.js:41:32:41:35 | opts |
|
||||
| lib/index.js:41:32:41:35 | opts |
|
||||
| lib/index.js:42:3:42:19 | opts |
|
||||
| lib/index.js:42:10:42:13 | opts |
|
||||
| lib/index.js:42:10:42:19 | opts \|\| {} |
|
||||
| lib/index.js:44:21:44:24 | opts |
|
||||
| lib/index.js:44:21:44:32 | opts.varName |
|
||||
| lib/index.js:51:21:51:32 | opts.varName |
|
||||
| lib/index.js:51:21:51:32 | opts.varName |
|
||||
| lib/index.js:51:21:51:32 | opts.varName |
|
||||
| lib/index.js:86:15:86:19 | taint |
|
||||
| lib/index.js:86:15:86:19 | taint |
|
||||
| lib/index.js:87:18:87:22 | taint |
|
||||
| lib/index.js:89:36:89:40 | taint |
|
||||
| lib/index.js:93:32:93:36 | taint |
|
||||
| lib/index.js:98:30:98:34 | taint |
|
||||
| lib/index.js:103:21:103:47 | this.op ... dOption |
|
||||
| lib/index.js:103:21:103:47 | this.op ... dOption |
|
||||
| lib/index.js:104:21:104:47 | this.op ... dOption |
|
||||
| lib/index.js:104:21:104:47 | this.op ... dOption |
|
||||
| lib/index.js:105:21:105:47 | this.op ... dOption |
|
||||
| lib/index.js:105:21:105:47 | this.op ... dOption |
|
||||
| lib/index.js:106:21:106:30 | this.taint |
|
||||
| lib/index.js:106:21:106:30 | this.taint |
|
||||
| lib/index.js:112:17:112:21 | taint |
|
||||
| lib/index.js:112:17:112:21 | taint |
|
||||
| lib/index.js:113:20:113:24 | taint |
|
||||
| lib/index.js:121:34:121:38 | taint |
|
||||
| lib/index.js:129:32:129:36 | taint |
|
||||
| lib/index.js:136:23:136:49 | this.op ... dOption |
|
||||
| lib/index.js:136:23:136:49 | this.op ... dOption |
|
||||
| lib/index.js:137:23:137:49 | this.op ... dOption |
|
||||
| lib/index.js:137:23:137:49 | this.op ... dOption |
|
||||
| lib/index.js:138:23:138:32 | this.taint |
|
||||
| lib/index.js:138:23:138:32 | this.taint |
|
||||
edges
|
||||
| lib/index.js:1:35:1:38 | data | lib/index.js:2:21:2:24 | data |
|
||||
| lib/index.js:1:35:1:38 | data | lib/index.js:2:21:2:24 | data |
|
||||
@@ -32,8 +67,53 @@ edges
|
||||
| lib/index.js:19:26:19:29 | data | lib/index.js:22:7:22:10 | data |
|
||||
| lib/index.js:19:26:19:29 | data | lib/index.js:22:7:22:10 | data |
|
||||
| lib/index.js:19:26:19:29 | data | lib/index.js:22:7:22:10 | data |
|
||||
| lib/index.js:41:32:41:35 | opts | lib/index.js:42:10:42:13 | opts |
|
||||
| lib/index.js:41:32:41:35 | opts | lib/index.js:42:10:42:13 | opts |
|
||||
| lib/index.js:42:3:42:19 | opts | lib/index.js:44:21:44:24 | opts |
|
||||
| lib/index.js:42:10:42:13 | opts | lib/index.js:42:10:42:19 | opts \|\| {} |
|
||||
| lib/index.js:42:10:42:19 | opts \|\| {} | lib/index.js:42:3:42:19 | opts |
|
||||
| lib/index.js:44:21:44:24 | opts | lib/index.js:44:21:44:32 | opts.varName |
|
||||
| lib/index.js:44:21:44:32 | opts.varName | lib/index.js:51:21:51:32 | opts.varName |
|
||||
| lib/index.js:44:21:44:32 | opts.varName | lib/index.js:51:21:51:32 | opts.varName |
|
||||
| lib/index.js:44:21:44:32 | opts.varName | lib/index.js:51:21:51:32 | opts.varName |
|
||||
| lib/index.js:86:15:86:19 | taint | lib/index.js:87:18:87:22 | taint |
|
||||
| lib/index.js:86:15:86:19 | taint | lib/index.js:87:18:87:22 | taint |
|
||||
| lib/index.js:86:15:86:19 | taint | lib/index.js:89:36:89:40 | taint |
|
||||
| lib/index.js:86:15:86:19 | taint | lib/index.js:89:36:89:40 | taint |
|
||||
| lib/index.js:86:15:86:19 | taint | lib/index.js:93:32:93:36 | taint |
|
||||
| lib/index.js:86:15:86:19 | taint | lib/index.js:93:32:93:36 | taint |
|
||||
| lib/index.js:86:15:86:19 | taint | lib/index.js:98:30:98:34 | taint |
|
||||
| lib/index.js:86:15:86:19 | taint | lib/index.js:98:30:98:34 | taint |
|
||||
| lib/index.js:87:18:87:22 | taint | lib/index.js:106:21:106:30 | this.taint |
|
||||
| lib/index.js:87:18:87:22 | taint | lib/index.js:106:21:106:30 | this.taint |
|
||||
| lib/index.js:89:36:89:40 | taint | lib/index.js:103:21:103:47 | this.op ... dOption |
|
||||
| lib/index.js:89:36:89:40 | taint | lib/index.js:103:21:103:47 | this.op ... dOption |
|
||||
| lib/index.js:93:32:93:36 | taint | lib/index.js:104:21:104:47 | this.op ... dOption |
|
||||
| lib/index.js:93:32:93:36 | taint | lib/index.js:104:21:104:47 | this.op ... dOption |
|
||||
| lib/index.js:98:30:98:34 | taint | lib/index.js:105:21:105:47 | this.op ... dOption |
|
||||
| lib/index.js:98:30:98:34 | taint | lib/index.js:105:21:105:47 | this.op ... dOption |
|
||||
| lib/index.js:112:17:112:21 | taint | lib/index.js:113:20:113:24 | taint |
|
||||
| lib/index.js:112:17:112:21 | taint | lib/index.js:113:20:113:24 | taint |
|
||||
| lib/index.js:112:17:112:21 | taint | lib/index.js:121:34:121:38 | taint |
|
||||
| lib/index.js:112:17:112:21 | taint | lib/index.js:121:34:121:38 | taint |
|
||||
| lib/index.js:112:17:112:21 | taint | lib/index.js:129:32:129:36 | taint |
|
||||
| lib/index.js:112:17:112:21 | taint | lib/index.js:129:32:129:36 | taint |
|
||||
| lib/index.js:113:20:113:24 | taint | lib/index.js:138:23:138:32 | this.taint |
|
||||
| lib/index.js:113:20:113:24 | taint | lib/index.js:138:23:138:32 | this.taint |
|
||||
| lib/index.js:121:34:121:38 | taint | lib/index.js:136:23:136:49 | this.op ... dOption |
|
||||
| lib/index.js:121:34:121:38 | taint | lib/index.js:136:23:136:49 | this.op ... dOption |
|
||||
| lib/index.js:129:32:129:36 | taint | lib/index.js:137:23:137:49 | this.op ... dOption |
|
||||
| lib/index.js:129:32:129:36 | taint | lib/index.js:137:23:137:49 | this.op ... dOption |
|
||||
#select
|
||||
| lib/index.js:2:21:2:24 | data | lib/index.js:1:35:1:38 | data | lib/index.js:2:21:2:24 | data | This string concatenation which depends on $@ is later $@. | lib/index.js:1:35:1:38 | data | library input | lib/index.js:2:15:2:30 | "(" + data + ")" | interpreted as code |
|
||||
| lib/index.js:6:26:6:29 | name | lib/index.js:5:35:5:38 | name | lib/index.js:6:26:6:29 | name | This string concatenation which depends on $@ is later $@. | lib/index.js:5:35:5:38 | name | library input | lib/index.js:6:17:6:29 | "obj." + name | interpreted as code |
|
||||
| lib/index.js:14:21:14:24 | data | lib/index.js:13:38:13:41 | data | lib/index.js:14:21:14:24 | data | This string concatenation which depends on $@ is later $@. | lib/index.js:13:38:13:41 | data | library input | lib/index.js:14:15:14:30 | "(" + data + ")" | interpreted as code |
|
||||
| lib/index.js:22:7:22:10 | data | lib/index.js:19:26:19:29 | data | lib/index.js:22:7:22:10 | data | This string concatenation which depends on $@ is later $@. | lib/index.js:19:26:19:29 | data | library input | lib/index.js:25:24:25:26 | str | interpreted as code |
|
||||
| lib/index.js:51:21:51:32 | opts.varName | lib/index.js:41:32:41:35 | opts | lib/index.js:51:21:51:32 | opts.varName | This string concatenation which depends on $@ is later $@. | lib/index.js:41:32:41:35 | opts | library input | lib/index.js:51:10:51:52 | " var ... ing();" | interpreted as code |
|
||||
| lib/index.js:103:21:103:47 | this.op ... dOption | lib/index.js:86:15:86:19 | taint | lib/index.js:103:21:103:47 | this.op ... dOption | This string concatenation which depends on $@ is later $@. | lib/index.js:86:15:86:19 | taint | library input | lib/index.js:103:10:103:67 | " var ... ing();" | interpreted as code |
|
||||
| lib/index.js:104:21:104:47 | this.op ... dOption | lib/index.js:86:15:86:19 | taint | lib/index.js:104:21:104:47 | this.op ... dOption | This string concatenation which depends on $@ is later $@. | lib/index.js:86:15:86:19 | taint | library input | lib/index.js:104:10:104:67 | " var ... ing();" | interpreted as code |
|
||||
| lib/index.js:105:21:105:47 | this.op ... dOption | lib/index.js:86:15:86:19 | taint | lib/index.js:105:21:105:47 | this.op ... dOption | This string concatenation which depends on $@ is later $@. | lib/index.js:86:15:86:19 | taint | library input | lib/index.js:105:10:105:67 | " var ... ing();" | interpreted as code |
|
||||
| lib/index.js:106:21:106:30 | this.taint | lib/index.js:86:15:86:19 | taint | lib/index.js:106:21:106:30 | this.taint | This string concatenation which depends on $@ is later $@. | lib/index.js:86:15:86:19 | taint | library input | lib/index.js:106:10:106:50 | " var ... ing();" | interpreted as code |
|
||||
| lib/index.js:136:23:136:49 | this.op ... dOption | lib/index.js:112:17:112:21 | taint | lib/index.js:136:23:136:49 | this.op ... dOption | This string concatenation which depends on $@ is later $@. | lib/index.js:112:17:112:21 | taint | library input | lib/index.js:136:12:136:69 | " var ... ing();" | interpreted as code |
|
||||
| lib/index.js:137:23:137:49 | this.op ... dOption | lib/index.js:112:17:112:21 | taint | lib/index.js:137:23:137:49 | this.op ... dOption | This string concatenation which depends on $@ is later $@. | lib/index.js:112:17:112:21 | taint | library input | lib/index.js:137:12:137:69 | " var ... ing();" | interpreted as code |
|
||||
| lib/index.js:138:23:138:32 | this.taint | lib/index.js:112:17:112:21 | taint | lib/index.js:138:23:138:32 | this.taint | This string concatenation which depends on $@ is later $@. | lib/index.js:112:17:112:21 | taint | library input | lib/index.js:138:12:138:52 | " var ... ing();" | interpreted as code |
|
||||
|
||||
@@ -33,3 +33,109 @@ export function greySink(data) {
|
||||
}
|
||||
});
|
||||
}
|
||||
|
||||
function codeIsAlive() {
|
||||
new Template().compile();
|
||||
}
|
||||
|
||||
export function Template(text, opts) {
|
||||
opts = opts || {};
|
||||
var options = {};
|
||||
options.varName = opts.varName;
|
||||
this.opts = options;
|
||||
}
|
||||
|
||||
Template.prototype = {
|
||||
compile: function () {
|
||||
var opts = this.opts;
|
||||
eval(" var " + opts.varName + " = something();"); // NOT OK
|
||||
},
|
||||
// The below are justs tests that ensure the global-access-path computations terminate.
|
||||
pathsTerminate1: function (node, prev) {
|
||||
node.tree = {
|
||||
ancestor: node,
|
||||
number: rand ? prev.tree.number + 1 : 0,
|
||||
};
|
||||
},
|
||||
pathsTerminate2: function (A) {
|
||||
try {
|
||||
var B = A.p1;
|
||||
var C = B.p2;
|
||||
C.p5 = C;
|
||||
} catch (ex) {}
|
||||
},
|
||||
pathsTerminate3: function (A) {
|
||||
var x = foo();
|
||||
while (Math.random()) {
|
||||
x.r = x;
|
||||
}
|
||||
},
|
||||
pathsTerminate4: function () {
|
||||
var dest = foo();
|
||||
var range = foo();
|
||||
while (Math.random() < 0.5) {
|
||||
range.tabstop = dest;
|
||||
if (Math.random() < 0.5) {
|
||||
dest.firstNonLinked = range;
|
||||
}
|
||||
}
|
||||
},
|
||||
};
|
||||
|
||||
export class AccessPathClass {
|
||||
constructor(taint) {
|
||||
this.taint = taint;
|
||||
|
||||
var options1 = {taintedOption: taint};
|
||||
this.options1 = options1;
|
||||
|
||||
var options2;
|
||||
options2 = {taintedOption: taint};
|
||||
this.options2 = options2;
|
||||
|
||||
var options3;
|
||||
options3 = {};
|
||||
options3.taintedOption = taint;
|
||||
this.options3 = options3;
|
||||
}
|
||||
|
||||
doesTaint() {
|
||||
eval(" var " + this.options1.taintedOption + " = something();"); // NOT OK
|
||||
eval(" var " + this.options2.taintedOption + " = something();"); // NOT OK
|
||||
eval(" var " + this.options3.taintedOption + " = something();"); // NOT OK
|
||||
eval(" var " + this.taint + " = something();"); // NOT OK
|
||||
}
|
||||
}
|
||||
|
||||
|
||||
export class AccessPathClassBB {
|
||||
constructor(taint) {
|
||||
this.taint = taint;
|
||||
|
||||
var options1 = {taintedOption: taint};
|
||||
if (Math.random() < 0.5) { console.log("foo"); }
|
||||
this.options1 = options1;
|
||||
|
||||
var options2;
|
||||
if (Math.random() < 0.5) { console.log("foo"); }
|
||||
options2 = {taintedOption: taint};
|
||||
if (Math.random() < 0.5) { console.log("foo"); }
|
||||
this.options2 = options2;
|
||||
|
||||
var options3;
|
||||
if (Math.random() < 0.5) { console.log("foo"); }
|
||||
options3 = {};
|
||||
if (Math.random() < 0.5) { console.log("foo"); }
|
||||
options3.taintedOption = taint;
|
||||
if (Math.random() < 0.5) { console.log("foo"); }
|
||||
this.options3 = options3;
|
||||
}
|
||||
|
||||
doesTaint() {
|
||||
eval(" var " + this.options1.taintedOption + " = something();"); // NOT OK
|
||||
eval(" var " + this.options2.taintedOption + " = something();"); // NOT OK
|
||||
eval(" var " + this.options3.taintedOption + " = something();"); // NOT OK
|
||||
eval(" var " + this.taint + " = something();"); // NOT OK
|
||||
}
|
||||
}
|
||||
|
||||
@@ -2,6 +2,12 @@ on: issue_comment
|
||||
|
||||
jobs:
|
||||
echo-chamber:
|
||||
runs-on: ubuntu-latest
|
||||
steps:
|
||||
- run: |
|
||||
echo '${{ github.event.comment.body }}'
|
||||
|
||||
echo-chamber2:
|
||||
runs-on: ubuntu-latest
|
||||
steps:
|
||||
- run: |
|
||||
|
||||
@@ -0,0 +1,10 @@
|
||||
on: issue_comment
|
||||
|
||||
# same as comment_issue but this file ends with a line break
|
||||
|
||||
jobs:
|
||||
echo-chamber:
|
||||
runs-on: ubuntu-latest
|
||||
steps:
|
||||
- run: |
|
||||
echo '${{ github.event.comment.body }}'
|
||||
@@ -1 +1,3 @@
|
||||
| .github/workflows/comment_issue.yml:7:12:8:47 | \| | Potential injection from the github.event.comment.body context, which may be controlled by an external user. |
|
||||
| .github/workflows/comment_issue.yml:7:12:8:48 | \| | Potential injection from the github.event.comment.body context, which may be controlled by an external user. |
|
||||
| .github/workflows/comment_issue.yml:13:12:14:47 | \| | Potential injection from the github.event.comment.body context, which may be controlled by an external user. |
|
||||
| .github/workflows/comment_issue_newline.yml:9:14:10:50 | \| | Potential injection from the github.event.comment.body context, which may be controlled by an external user. |
|
||||
|
||||
@@ -117,6 +117,12 @@ nodes
|
||||
| lib.js:128:9:128:20 | obj[path[0]] |
|
||||
| lib.js:128:13:128:16 | path |
|
||||
| lib.js:128:13:128:19 | path[0] |
|
||||
| sublib/other.js:5:28:5:31 | path |
|
||||
| sublib/other.js:5:28:5:31 | path |
|
||||
| sublib/other.js:6:7:6:18 | obj[path[0]] |
|
||||
| sublib/other.js:6:7:6:18 | obj[path[0]] |
|
||||
| sublib/other.js:6:11:6:14 | path |
|
||||
| sublib/other.js:6:11:6:17 | path[0] |
|
||||
| sublib/sub.js:1:37:1:40 | path |
|
||||
| sublib/sub.js:1:37:1:40 | path |
|
||||
| sublib/sub.js:2:3:2:14 | obj[path[0]] |
|
||||
@@ -248,7 +254,9 @@ edges
|
||||
| lib.js:55:15:55:21 | path[0] | lib.js:55:11:55:22 | obj[path[0]] |
|
||||
| lib.js:59:18:59:18 | s | lib.js:61:17:61:17 | s |
|
||||
| lib.js:59:18:59:18 | s | lib.js:61:17:61:17 | s |
|
||||
| lib.js:61:17:61:17 | s | lib.js:68:11:68:26 | path |
|
||||
| lib.js:61:17:61:17 | s | lib.js:68:18:68:26 | this.path |
|
||||
| lib.js:61:17:61:17 | s | lib.js:70:17:70:20 | path |
|
||||
| lib.js:68:11:68:26 | path | lib.js:70:17:70:20 | path |
|
||||
| lib.js:68:18:68:26 | this.path | lib.js:68:11:68:26 | path |
|
||||
| lib.js:70:17:70:20 | path | lib.js:70:17:70:23 | path[0] |
|
||||
@@ -287,6 +295,11 @@ edges
|
||||
| lib.js:128:13:128:16 | path | lib.js:128:13:128:19 | path[0] |
|
||||
| lib.js:128:13:128:19 | path[0] | lib.js:128:9:128:20 | obj[path[0]] |
|
||||
| lib.js:128:13:128:19 | path[0] | lib.js:128:9:128:20 | obj[path[0]] |
|
||||
| sublib/other.js:5:28:5:31 | path | sublib/other.js:6:11:6:14 | path |
|
||||
| sublib/other.js:5:28:5:31 | path | sublib/other.js:6:11:6:14 | path |
|
||||
| sublib/other.js:6:11:6:14 | path | sublib/other.js:6:11:6:17 | path[0] |
|
||||
| sublib/other.js:6:11:6:17 | path[0] | sublib/other.js:6:7:6:18 | obj[path[0]] |
|
||||
| sublib/other.js:6:11:6:17 | path[0] | sublib/other.js:6:7:6:18 | obj[path[0]] |
|
||||
| sublib/sub.js:1:37:1:40 | path | sublib/sub.js:2:7:2:10 | path |
|
||||
| sublib/sub.js:1:37:1:40 | path | sublib/sub.js:2:7:2:10 | path |
|
||||
| sublib/sub.js:2:7:2:10 | path | sublib/sub.js:2:7:2:13 | path[0] |
|
||||
@@ -354,6 +367,7 @@ edges
|
||||
| lib.js:108:3:108:10 | obj[one] | lib.js:104:13:104:21 | arguments | lib.js:108:3:108:10 | obj[one] | This assignment may alter Object.prototype if a malicious '__proto__' string is injected from $@. | lib.js:104:13:104:21 | arguments | library input |
|
||||
| lib.js:119:13:119:24 | obj[path[0]] | lib.js:118:29:118:32 | path | lib.js:119:13:119:24 | obj[path[0]] | This assignment may alter Object.prototype if a malicious '__proto__' string is injected from $@. | lib.js:118:29:118:32 | path | library input |
|
||||
| lib.js:128:9:128:20 | obj[path[0]] | lib.js:127:14:127:17 | path | lib.js:128:9:128:20 | obj[path[0]] | This assignment may alter Object.prototype if a malicious '__proto__' string is injected from $@. | lib.js:127:14:127:17 | path | library input |
|
||||
| sublib/other.js:6:7:6:18 | obj[path[0]] | sublib/other.js:5:28:5:31 | path | sublib/other.js:6:7:6:18 | obj[path[0]] | This assignment may alter Object.prototype if a malicious '__proto__' string is injected from $@. | sublib/other.js:5:28:5:31 | path | library input |
|
||||
| sublib/sub.js:2:3:2:14 | obj[path[0]] | sublib/sub.js:1:37:1:40 | path | sublib/sub.js:2:3:2:14 | obj[path[0]] | This assignment may alter Object.prototype if a malicious '__proto__' string is injected from $@. | sublib/sub.js:1:37:1:40 | path | library input |
|
||||
| tst.js:8:5:8:17 | object[taint] | tst.js:5:24:5:37 | req.query.data | tst.js:8:5:8:17 | object[taint] | This assignment may alter Object.prototype if a malicious '__proto__' string is injected from $@. | tst.js:5:24:5:37 | req.query.data | user controlled input |
|
||||
| tst.js:9:5:9:17 | object[taint] | tst.js:5:24:5:37 | req.query.data | tst.js:9:5:9:17 | object[taint] | This assignment may alter Object.prototype if a malicious '__proto__' string is injected from $@. | tst.js:5:24:5:37 | req.query.data | user controlled input |
|
||||
|
||||
@@ -0,0 +1,15 @@
|
||||
(function () {
|
||||
function Foobar() {}
|
||||
|
||||
Foobar.prototype = {
|
||||
method: function (obj, path, value) {
|
||||
obj[path[0]][path[1]] = value; // NOT OK
|
||||
},
|
||||
};
|
||||
|
||||
module.exports.foobar = Foobar;
|
||||
|
||||
module.other.notExported = function (obj, path, value) {
|
||||
obj[path[0]][path[1]] = value; // OK - not exported
|
||||
}
|
||||
})();
|
||||
@@ -1,3 +1,6 @@
|
||||
module.exports.set = function (obj, path, value) {
|
||||
obj[path[0]][path[1]] = value; // NOT OK
|
||||
}
|
||||
}
|
||||
|
||||
var other = require('./other')
|
||||
exports.foobar = other.foobar;
|
||||
Reference in New Issue
Block a user