Add query-tests

javascript/ql/test/query-tests/Security/CWE-614/InsecureCookies.expected

@@ -0,0 +1,9 @@
+| Cookie is added to response without the 'secure' flag being set to true (using cookie-session). | test_cookie-session.js:18:9:28:2 | session ...    }\\n}) |
+| Cookie is added to response without the 'secure' flag being set to true (using express-session). | test_express-session.js:5:9:8:2 | session ... T OK\\n}) |
+| Cookie is added to response without the 'secure' flag being set to true (using express-session). | test_express-session.js:10:9:13:2 | session ... T OK\\n}) |
+| Cookie is added to response without the 'secure' flag being set to true (using express-session). | test_express-session.js:15:9:18:2 | session ... T OK\\n}) |
+| Cookie is added to response without the 'secure' flag being set to true (using express-session). | test_express-session.js:25:9:25:21 | session(sess) |
+| Cookie is added to response without the 'secure' flag being set to true (using js-cookie). | test_jscookie.js:2:1:2:48 | js_cook ... alse }) |
+| Cookie is added to response without the 'secure' flag being set to true (using response.cookie). | test_responseCookie.js:5:5:10:10 | res.coo ...      }) |
+| Cookie is added to response without the 'secure' flag being set to true (using response.cookie). | test_responseCookie.js:20:5:20:40 | res.coo ... ptions) |
+| Cookie is added to response without the 'secure' flag being set to true (using set-cookie header). | test_httpserver.js:7:37:7:73 | ["type= ... cript"] |

javascript/ql/test/query-tests/Security/CWE-614/InsecureCookies.qlref

@@ -0,0 +1 @@
+experimental/Security/CWE-614/InsecureCookie.ql

javascript/ql/test/query-tests/Security/CWE-614/test_cookie-session.js

@@ -0,0 +1,28 @@
+const express = require('express')
+const app = express()
+const session = require('cookie-session')
+const expiryDate = new Date(Date.now() + 60 * 60 * 1000)
+
+app.use(session({
+    name: 'session',
+    keys: ['key1', 'key2'],
+    cookie: {
+        secure: true, // OK
+        httpOnly: true,
+        domain: 'example.com',
+        path: 'foo/bar',
+        expires: expiryDate
+    }
+}))
+
+app.use(session({
+    name: 'session',
+    keys: ['key1', 'key2'],
+    cookie: {
+        secure: false, // NOT OK
+        httpOnly: true,
+        domain: 'example.com',
+        path: 'foo/bar',
+        expires: expiryDate
+    }
+}))

javascript/ql/test/query-tests/Security/CWE-614/test_express-session.js

@@ -0,0 +1,33 @@
+const express = require('express')
+const app = express()
+const session = require('express-session')
+
+app.use(session({
+    secret: 'secret',
+    cookie: { secure: false } // NOT OK
+}))
+
+app.use(session({
+    secret: 'secret'
+    // NOT OK
+}))
+
+app.use(session({
+    secret: 'secret',
+    cookie: {} // NOT OK
+}))
+
+const sess = {
+    secret: 'secret',
+    cookie: { secure: false } // NOT OK
+}
+
+app.use(session(sess))
+
+
+app.set('trust proxy', 1)
+app.use(session({
+    secret: 'secret',
+    cookie: { secure: true } // OK
+}))
+

javascript/ql/test/query-tests/Security/CWE-614/test_httpserver.js

@@ -0,0 +1,22 @@
+const http = require('http');
+
+function test1() {
+    const server = http.createServer((req, res) => {
+        res.setHeader('Content-Type', 'text/html');
+        // NOT OK
+        res.setHeader("Set-Cookie", ["type=ninja", "language=javascript"]);
+        res.writeHead(200, { 'Content-Type': 'text/plain' });
+        res.end('ok');
+    });
+}
+
+
+function test2() {
+    const server = http.createServer((req, res) => {
+        res.setHeader('Content-Type', 'text/html');
+        // OK
+        res.setHeader("Set-Cookie", ["type=ninja; Secure", "language=javascript; secure"]);
+        res.writeHead(200, { 'Content-Type': 'text/plain' });
+        res.end('ok');
+    });
+}

javascript/ql/test/query-tests/Security/CWE-614/test_jscookie.js

@@ -0,0 +1,3 @@
+const js_cookie = require('js-cookie')
+js_cookie.set('key', 'value', { secure: false }); // NOT OK
+js_cookie.set('key', 'value', { secure: true }); // OK

javascript/ql/test/query-tests/Security/CWE-614/test_responseCookie.js

@@ -0,0 +1,33 @@
+const express = require('express')
+const app = express()
+
+app.get('/a', function (req, res, next) {
+    res.cookie('name', 'value',
+        {
+            maxAge: 9000000000,
+            httpOnly: true,
+            secure: false // NOT OK
+        });
+    res.end('ok')
+})
+
+app.get('/b', function (req, res, next) {
+    let options = {
+        maxAge: 9000000000,
+        httpOnly: true,
+        secure: false // NOT OK
+    }
+    res.cookie('name', 'value', options);
+    res.end('ok')
+})
+
+app.get('/c', function (req, res, next) {
+    res.cookie('name', 'value',
+        {
+            maxAge: 9000000000,
+            httpOnly: true,
+            secure: true // OK
+        });
+    res.end('ok')
+})
+