hohn/codeql
1
0
Fork 0
mirror of https://github.com/github/codeql.git synced 2026-04-30 19:26:02 +02:00
Code Issues Packages Projects Releases Wiki Activity

JS: improve PoI tests

Browse Source
This commit is contained in:
Esben Sparre Andreasen
2020-03-21 09:43:54 +01:00
parent c407cc072e
commit 607d46e2f9
15 changed files with 76 additions and 11 deletions
Download Patch File Download Diff File Expand all files Collapse all files

4
javascript/ql/test/experimental/PoI/CommandInjectionPoIConfiguration.expected Normal file
View File

@@ -0,0 +1,4 @@
| tst.js:16:15:16:25 | req.query.x | SourcePoI | tst.js:16:15:16:25 | req.query.x | irrelevant | tst.js:16:15:16:25 | req.query.x | irrelevant |
| tst.js:17:11:17:21 | req.query.x | SinkPoI | tst.js:17:11:17:21 | req.query.x | irrelevant | tst.js:17:11:17:21 | req.query.x | irrelevant |
| tst.js:17:11:17:21 | req.query.x | SourcePoI | tst.js:17:11:17:21 | req.query.x | irrelevant | tst.js:17:11:17:21 | req.query.x | irrelevant |
| tst.js:18:12:18:22 | req.query.x | SourcePoI | tst.js:18:12:18:22 | req.query.x | irrelevant | tst.js:18:12:18:22 | req.query.x | irrelevant |

15
javascript/ql/test/experimental/PoI/CommandInjectionPoIConfiguration.ql Normal file
View File

@@ -0,0 +1,15 @@
/**
* @kind problem
*/
import javascript
import experimental.PoI.PoI::PoI
import semmle.javascript.security.dataflow.CommandInjection
import semmle.javascript.security.dataflow.IndirectCommandInjection
import semmle.javascript.security.dataflow.ShellCommandInjectionFromEnvironment
class Config extends StandardPoIConfigurations::DataFlowConfigurationPoIConfiguration {
Config() { this = "Config" }
}
query predicate problems = alertQuery/6;

6
javascript/ql/test/experimental/PoI/CustomPoIs.expected
View File

@@ -1,6 +0,0 @@
| tst.js:6:1:6:44 | app.get ... es) {}) | RouteSetupAndRouterAndRouteHandlerPoI: $@ $@ | tst.js:2:11:2:19 | express() | router | tst.js:6:23:6:43 | functio ... res) {} | routehandler |
| tst.js:6:23:6:43 | functio ... res) {} | RouteHandlerAndSetupPoI: $@ | tst.js:6:1:6:44 | app.get ... es) {}) | setup | tst.js:6:23:6:43 | functio ... res) {} | irrelevant |
| tst.js:6:23:6:43 | functio ... res) {} | RouteHandlerPoI | tst.js:6:23:6:43 | functio ... res) {} | irrelevant | tst.js:6:23:6:43 | functio ... res) {} | irrelevant |
| tst.js:8:10:8:30 | functio ... res) {} | RouteHandlerAndSetupPoI: $@ | tst.js:9:1:9:31 | app.get ... h", rh) | setup | tst.js:8:10:8:30 | functio ... res) {} | irrelevant |
| tst.js:8:10:8:30 | functio ... res) {} | RouteHandlerPoI | tst.js:8:10:8:30 | functio ... res) {} | irrelevant | tst.js:8:10:8:30 | functio ... res) {} | irrelevant |
| tst.js:9:1:9:31 | app.get ... h", rh) | RouteSetupAndRouterAndRouteHandlerPoI: $@ $@ | tst.js:2:11:2:19 | express() | router | tst.js:8:10:8:30 | functio ... res) {} | routehandler |

3
javascript/ql/test/experimental/PoI/ServerPoIConfiguration.expected Normal file
View File

@@ -0,0 +1,3 @@
| tst.js:6:1:6:16 | (req, res) => 42 | UnpromotedRouteHandlerPoI | tst.js:6:1:6:16 | (req, res) => 42 | irrelevant | tst.js:6:1:6:16 | (req, res) => 42 | irrelevant |
| tst.js:6:1:6:16 | (req, res) => 42 | UnpromotedRouteHandlerWithFlowPoI: $@ | tst.js:6:1:6:16 | (req, res) => 42 | ends here | tst.js:6:1:6:16 | (req, res) => 42 | irrelevant |
| tst.js:13:1:13:36 | otherAp ... h", rh) | UnpromotedRouteSetupPoI | tst.js:13:1:13:36 | otherAp ... h", rh) | irrelevant | tst.js:13:1:13:36 | otherAp ... h", rh) | irrelevant |

0
javascript/ql/test/experimental/PoI/StandardPoIConfigs.ql → javascript/ql/test/experimental/PoI/ServerPoIConfiguration.ql
View File

3
javascript/ql/test/experimental/PoI/StandardPoIConfigs.expected
View File

@@ -1,3 +0,0 @@
| tst.js:4:1:4:16 | (req, res) => 42 | UnpromotedRouteHandlerPoI | tst.js:4:1:4:16 | (req, res) => 42 | irrelevant | tst.js:4:1:4:16 | (req, res) => 42 | irrelevant |
| tst.js:4:1:4:16 | (req, res) => 42 | UnpromotedRouteHandlerWithFlowPoI: $@ | tst.js:4:1:4:16 | (req, res) => 42 | ends here | tst.js:4:1:4:16 | (req, res) => 42 | irrelevant |
| tst.js:11:1:11:36 | otherAp ... h", rh) | UnpromotedRouteSetupPoI | tst.js:11:1:11:36 | otherAp ... h", rh) | irrelevant | tst.js:11:1:11:36 | otherAp ... h", rh) | irrelevant |

1
javascript/ql/test/experimental/PoI/StandardPoIs.expected
View File

@@ -1 +0,0 @@
| tst.js:4:1:4:16 | (req, res) => 42 | UnpromotedRouteHandlerPoI | tst.js:4:1:4:16 | (req, res) => 42 | irrelevant | tst.js:4:1:4:16 | (req, res) => 42 | irrelevant |

6
javascript/ql/test/experimental/PoI/TaintedPathPoIConfiguration.expected Normal file
View File

@@ -0,0 +1,6 @@
| tst.js:1:23:1:31 | "express" | SinkPoI | tst.js:1:23:1:31 | "express" | irrelevant | tst.js:1:23:1:31 | "express" | irrelevant |
| tst.js:2:16:2:19 | "fs" | SinkPoI | tst.js:2:16:2:19 | "fs" | irrelevant | tst.js:2:16:2:19 | "fs" | irrelevant |
| tst.js:3:16:3:30 | "child_process" | SinkPoI | tst.js:3:16:3:30 | "child_process" | irrelevant | tst.js:3:16:3:30 | "child_process" | irrelevant |
| tst.js:16:15:16:25 | req.query.x | SourcePoI | tst.js:16:15:16:25 | req.query.x | irrelevant | tst.js:16:15:16:25 | req.query.x | irrelevant |
| tst.js:17:11:17:21 | req.query.x | SourcePoI | tst.js:17:11:17:21 | req.query.x | irrelevant | tst.js:17:11:17:21 | req.query.x | irrelevant |
| tst.js:18:12:18:22 | req.query.x | SourcePoI | tst.js:18:12:18:22 | req.query.x | irrelevant | tst.js:18:12:18:22 | req.query.x | irrelevant |

13
javascript/ql/test/experimental/PoI/TaintedPathPoIConfiguration.ql Normal file
View File

@@ -0,0 +1,13 @@
/**
* @kind problem
*/
import javascript
import experimental.PoI.PoI::PoI
import semmle.javascript.security.dataflow.TaintedPath
class Config extends StandardPoIConfigurations::DataFlowConfigurationPoIConfiguration {
Config() { this = "Config" }
}
query predicate problems = alertQuery/6;

9
javascript/ql/test/experimental/PoI/TestCustomPoIs.expected Normal file
View File

@@ -0,0 +1,9 @@
| tst.js:8:1:8:44 | app.get ... es) {}) | RouteSetupAndRouterAndRouteHandlerPoI: $@ $@ | tst.js:4:11:4:19 | express() | router | tst.js:8:23:8:43 | functio ... res) {} | routehandler |
| tst.js:8:23:8:43 | functio ... res) {} | RouteHandlerAndSetupPoI: $@ | tst.js:8:1:8:44 | app.get ... es) {}) | setup | tst.js:8:23:8:43 | functio ... res) {} | irrelevant |
| tst.js:8:23:8:43 | functio ... res) {} | RouteHandlerPoI | tst.js:8:23:8:43 | functio ... res) {} | irrelevant | tst.js:8:23:8:43 | functio ... res) {} | irrelevant |
| tst.js:10:10:10:30 | functio ... res) {} | RouteHandlerAndSetupPoI: $@ | tst.js:11:1:11:31 | app.get ... h", rh) | setup | tst.js:10:10:10:30 | functio ... res) {} | irrelevant |
| tst.js:10:10:10:30 | functio ... res) {} | RouteHandlerPoI | tst.js:10:10:10:30 | functio ... res) {} | irrelevant | tst.js:10:10:10:30 | functio ... res) {} | irrelevant |
| tst.js:11:1:11:31 | app.get ... h", rh) | RouteSetupAndRouterAndRouteHandlerPoI: $@ $@ | tst.js:4:11:4:19 | express() | router | tst.js:10:10:10:30 | functio ... res) {} | routehandler |
| tst.js:15:1:19:2 | app.get ... .x);\\n}) | RouteSetupAndRouterAndRouteHandlerPoI: $@ $@ | tst.js:4:11:4:19 | express() | router | tst.js:15:23:19:1 | functio ... y.x);\\n} | routehandler |
| tst.js:15:23:19:1 | functio ... y.x);\\n} | RouteHandlerAndSetupPoI: $@ | tst.js:15:1:19:2 | app.get ... .x);\\n}) | setup | tst.js:15:23:19:1 | functio ... y.x);\\n} | irrelevant |
| tst.js:15:23:19:1 | functio ... y.x);\\n} | RouteHandlerPoI | tst.js:15:23:19:1 | functio ... y.x);\\n} | irrelevant | tst.js:15:23:19:1 | functio ... y.x);\\n} | irrelevant |

0
javascript/ql/test/experimental/PoI/CustomPoIs.ql → javascript/ql/test/experimental/PoI/TestCustomPoIs.ql
View File

1
javascript/ql/test/experimental/PoI/TestStandardPoIs.expected Normal file
View File

@@ -0,0 +1 @@
| tst.js:6:1:6:16 | (req, res) => 42 | UnpromotedRouteHandlerPoI | tst.js:6:1:6:16 | (req, res) => 42 | irrelevant | tst.js:6:1:6:16 | (req, res) => 42 | irrelevant |

0
javascript/ql/test/experimental/PoI/StandardPoIs.ql → javascript/ql/test/experimental/PoI/TestStandardPoIs.ql
View File

16
javascript/ql/test/experimental/PoI/XssPoIConfiguration.ql Normal file
View File

@@ -0,0 +1,16 @@
/**
* @kind problem
*/
import javascript
import experimental.PoI.PoI::PoI
import semmle.javascript.security.dataflow.ReflectedXss
import semmle.javascript.security.dataflow.StoredXss
import semmle.javascript.security.dataflow.DomBasedXss
import semmle.javascript.security.dataflow.ExceptionXss
class Config extends StandardPoIConfigurations::DataFlowConfigurationPoIConfiguration {
Config() { this = "Config" }
}
query predicate problems = alertQuery/6;

10
javascript/ql/test/experimental/PoI/tst.js
View File

@@ -1,4 +1,6 @@
var express = require("express");
var express = require("express"),
fs = require("fs"),
cp = require("child_process");
var app = express();
(req, res) => 42;
@@ -9,3 +11,9 @@ let rh = function(req, res) {};
app.get("/some/other/path", rh);
otherApp.get("/some/other/path", rh);
app.get("/some/path", function(req, res) {
fs.readFile(req.query.x);
cp.exec(req.query.x);
res.send(req.query.x);
});