hohn/codeql
1
0
Fork 0
mirror of https://github.com/github/codeql.git synced 2026-05-01 19:55:15 +02:00
Code Issues Packages Projects Releases Wiki Activity

move jose SharedTaintStep to a local taint step, add more additional steps with test cases, update test cases and expected test results

Browse Source
This commit is contained in:
am0o0
2024-07-01 11:38:17 +02:00
parent 5a69bbf6b0
commit 65fdb8ccce
4 changed files with 121 additions and 87 deletions
Download Patch File Download Diff File Expand all files Collapse all files

148
javascript/ql/test/query-tests/Security/CWE-798/HardcodedCredentials.expected
View File

@@ -299,39 +299,45 @@ nodes
| HardcodedCredentials.js:317:27:317:62 | new Tex ... ateKey) |
| HardcodedCredentials.js:317:27:317:62 | new Tex ... ateKey) |
| HardcodedCredentials.js:317:52:317:61 | privateKey |
| HardcodedCredentials.js:320:11:323:29 | spki |
| HardcodedCredentials.js:320:18:323:29 | `-----B ... Y-----` |
| HardcodedCredentials.js:320:18:323:29 | `-----B ... Y-----` |
| HardcodedCredentials.js:324:11:324:58 | publicKey |
| HardcodedCredentials.js:324:23:324:58 | await j ... RS256') |
| HardcodedCredentials.js:324:45:324:48 | spki |
| HardcodedCredentials.js:325:27:325:35 | publicKey |
| HardcodedCredentials.js:325:27:325:35 | publicKey |
| HardcodedCredentials.js:331:9:331:43 | secretKey |
| HardcodedCredentials.js:331:21:331:43 | "myHard ... ateKey" |
| HardcodedCredentials.js:331:21:331:43 | "myHard ... ateKey" |
| HardcodedCredentials.js:336:21:336:29 | secretKey |
| HardcodedCredentials.js:336:21:336:29 | secretKey |
| HardcodedCredentials.js:347:21:347:52 | Buffer. ... ase64") |
| HardcodedCredentials.js:347:21:347:52 | Buffer. ... ase64") |
| HardcodedCredentials.js:347:33:347:41 | secretKey |
| HardcodedCredentials.js:362:9:362:43 | secretKey |
| HardcodedCredentials.js:362:21:362:43 | "myHard ... ateKey" |
| HardcodedCredentials.js:362:21:362:43 | "myHard ... ateKey" |
| HardcodedCredentials.js:365:24:365:32 | secretKey |
| HardcodedCredentials.js:365:24:365:32 | secretKey |
| HardcodedCredentials.js:372:31:372:39 | secretKey |
| HardcodedCredentials.js:372:31:372:39 | secretKey |
| HardcodedCredentials.js:383:9:383:43 | secretKey |
| HardcodedCredentials.js:383:21:383:43 | "myHard ... ateKey" |
| HardcodedCredentials.js:383:21:383:43 | "myHard ... ateKey" |
| HardcodedCredentials.js:386:17:386:25 | secretKey |
| HardcodedCredentials.js:386:17:386:25 | secretKey |
| HardcodedCredentials.js:401:9:401:43 | secretKey |
| HardcodedCredentials.js:401:21:401:43 | "myHard ... ateKey" |
| HardcodedCredentials.js:401:21:401:43 | "myHard ... ateKey" |
| HardcodedCredentials.js:403:27:403:35 | secretKey |
| HardcodedCredentials.js:403:27:403:35 | secretKey |
| HardcodedCredentials.js:319:11:321:29 | spki |
| HardcodedCredentials.js:319:18:321:29 | `-----B ... Y-----` |
| HardcodedCredentials.js:319:18:321:29 | `-----B ... Y-----` |
| HardcodedCredentials.js:322:9:322:56 | publicKey |
| HardcodedCredentials.js:322:21:322:56 | await j ... RS256') |
| HardcodedCredentials.js:322:43:322:46 | spki |
| HardcodedCredentials.js:323:27:323:35 | publicKey |
| HardcodedCredentials.js:323:27:323:35 | publicKey |
| HardcodedCredentials.js:328:12:328:55 | 'whYOFK ... -6f...' |
| HardcodedCredentials.js:328:12:328:55 | 'whYOFK ... -6f...' |
| HardcodedCredentials.js:331:5:331:46 | publicKey |
| HardcodedCredentials.js:331:17:331:46 | await j ... k, alg) |
| HardcodedCredentials.js:335:31:335:39 | publicKey |
| HardcodedCredentials.js:335:31:335:39 | publicKey |
| HardcodedCredentials.js:344:9:344:43 | secretKey |
| HardcodedCredentials.js:344:21:344:43 | "myHard ... ateKey" |
| HardcodedCredentials.js:344:21:344:43 | "myHard ... ateKey" |
| HardcodedCredentials.js:349:21:349:29 | secretKey |
| HardcodedCredentials.js:349:21:349:29 | secretKey |
| HardcodedCredentials.js:360:21:360:52 | Buffer. ... ase64") |
| HardcodedCredentials.js:360:21:360:52 | Buffer. ... ase64") |
| HardcodedCredentials.js:360:33:360:41 | secretKey |
| HardcodedCredentials.js:375:9:375:43 | secretKey |
| HardcodedCredentials.js:375:21:375:43 | "myHard ... ateKey" |
| HardcodedCredentials.js:375:21:375:43 | "myHard ... ateKey" |
| HardcodedCredentials.js:378:24:378:32 | secretKey |
| HardcodedCredentials.js:378:24:378:32 | secretKey |
| HardcodedCredentials.js:385:31:385:39 | secretKey |
| HardcodedCredentials.js:385:31:385:39 | secretKey |
| HardcodedCredentials.js:396:9:396:43 | secretKey |
| HardcodedCredentials.js:396:21:396:43 | "myHard ... ateKey" |
| HardcodedCredentials.js:396:21:396:43 | "myHard ... ateKey" |
| HardcodedCredentials.js:399:17:399:25 | secretKey |
| HardcodedCredentials.js:399:17:399:25 | secretKey |
| HardcodedCredentials.js:414:9:414:43 | secretKey |
| HardcodedCredentials.js:414:21:414:43 | "myHard ... ateKey" |
| HardcodedCredentials.js:414:21:414:43 | "myHard ... ateKey" |
| HardcodedCredentials.js:416:27:416:35 | secretKey |
| HardcodedCredentials.js:416:27:416:35 | secretKey |
| __tests__/HardcodedCredentialsDemo.js:5:15:5:22 | 'dbuser' |
| __tests__/HardcodedCredentialsDemo.js:5:15:5:22 | 'dbuser' |
| __tests__/HardcodedCredentialsDemo.js:5:15:5:22 | 'dbuser' |
@@ -484,34 +490,39 @@ edges
| HardcodedCredentials.js:316:22:316:44 | "myHard ... ateKey" | HardcodedCredentials.js:316:9:316:44 | privateKey |
| HardcodedCredentials.js:317:52:317:61 | privateKey | HardcodedCredentials.js:317:27:317:62 | new Tex ... ateKey) |
| HardcodedCredentials.js:317:52:317:61 | privateKey | HardcodedCredentials.js:317:27:317:62 | new Tex ... ateKey) |
| HardcodedCredentials.js:320:11:323:29 | spki | HardcodedCredentials.js:324:45:324:48 | spki |
| HardcodedCredentials.js:320:18:323:29 | `-----B ... Y-----` | HardcodedCredentials.js:320:11:323:29 | spki |
| HardcodedCredentials.js:320:18:323:29 | `-----B ... Y-----` | HardcodedCredentials.js:320:11:323:29 | spki |
| HardcodedCredentials.js:324:11:324:58 | publicKey | HardcodedCredentials.js:325:27:325:35 | publicKey |
| HardcodedCredentials.js:324:11:324:58 | publicKey | HardcodedCredentials.js:325:27:325:35 | publicKey |
| HardcodedCredentials.js:324:23:324:58 | await j ... RS256') | HardcodedCredentials.js:324:11:324:58 | publicKey |
| HardcodedCredentials.js:324:45:324:48 | spki | HardcodedCredentials.js:324:23:324:58 | await j ... RS256') |
| HardcodedCredentials.js:331:9:331:43 | secretKey | HardcodedCredentials.js:336:21:336:29 | secretKey |
| HardcodedCredentials.js:331:9:331:43 | secretKey | HardcodedCredentials.js:336:21:336:29 | secretKey |
| HardcodedCredentials.js:331:9:331:43 | secretKey | HardcodedCredentials.js:347:33:347:41 | secretKey |
| HardcodedCredentials.js:331:21:331:43 | "myHard ... ateKey" | HardcodedCredentials.js:331:9:331:43 | secretKey |
| HardcodedCredentials.js:331:21:331:43 | "myHard ... ateKey" | HardcodedCredentials.js:331:9:331:43 | secretKey |
| HardcodedCredentials.js:347:33:347:41 | secretKey | HardcodedCredentials.js:347:21:347:52 | Buffer. ... ase64") |
| HardcodedCredentials.js:347:33:347:41 | secretKey | HardcodedCredentials.js:347:21:347:52 | Buffer. ... ase64") |
| HardcodedCredentials.js:362:9:362:43 | secretKey | HardcodedCredentials.js:365:24:365:32 | secretKey |
| HardcodedCredentials.js:362:9:362:43 | secretKey | HardcodedCredentials.js:365:24:365:32 | secretKey |
| HardcodedCredentials.js:362:9:362:43 | secretKey | HardcodedCredentials.js:372:31:372:39 | secretKey |
| HardcodedCredentials.js:362:9:362:43 | secretKey | HardcodedCredentials.js:372:31:372:39 | secretKey |
| HardcodedCredentials.js:362:21:362:43 | "myHard ... ateKey" | HardcodedCredentials.js:362:9:362:43 | secretKey |
| HardcodedCredentials.js:362:21:362:43 | "myHard ... ateKey" | HardcodedCredentials.js:362:9:362:43 | secretKey |
| HardcodedCredentials.js:383:9:383:43 | secretKey | HardcodedCredentials.js:386:17:386:25 | secretKey |
| HardcodedCredentials.js:383:9:383:43 | secretKey | HardcodedCredentials.js:386:17:386:25 | secretKey |
| HardcodedCredentials.js:383:21:383:43 | "myHard ... ateKey" | HardcodedCredentials.js:383:9:383:43 | secretKey |
| HardcodedCredentials.js:383:21:383:43 | "myHard ... ateKey" | HardcodedCredentials.js:383:9:383:43 | secretKey |
| HardcodedCredentials.js:401:9:401:43 | secretKey | HardcodedCredentials.js:403:27:403:35 | secretKey |
| HardcodedCredentials.js:401:9:401:43 | secretKey | HardcodedCredentials.js:403:27:403:35 | secretKey |
| HardcodedCredentials.js:401:21:401:43 | "myHard ... ateKey" | HardcodedCredentials.js:401:9:401:43 | secretKey |
| HardcodedCredentials.js:401:21:401:43 | "myHard ... ateKey" | HardcodedCredentials.js:401:9:401:43 | secretKey |
| HardcodedCredentials.js:319:11:321:29 | spki | HardcodedCredentials.js:322:43:322:46 | spki |
| HardcodedCredentials.js:319:18:321:29 | `-----B ... Y-----` | HardcodedCredentials.js:319:11:321:29 | spki |
| HardcodedCredentials.js:319:18:321:29 | `-----B ... Y-----` | HardcodedCredentials.js:319:11:321:29 | spki |
| HardcodedCredentials.js:322:9:322:56 | publicKey | HardcodedCredentials.js:323:27:323:35 | publicKey |
| HardcodedCredentials.js:322:9:322:56 | publicKey | HardcodedCredentials.js:323:27:323:35 | publicKey |
| HardcodedCredentials.js:322:21:322:56 | await j ... RS256') | HardcodedCredentials.js:322:9:322:56 | publicKey |
| HardcodedCredentials.js:322:43:322:46 | spki | HardcodedCredentials.js:322:21:322:56 | await j ... RS256') |
| HardcodedCredentials.js:328:12:328:55 | 'whYOFK ... -6f...' | HardcodedCredentials.js:331:17:331:46 | await j ... k, alg) |
| HardcodedCredentials.js:328:12:328:55 | 'whYOFK ... -6f...' | HardcodedCredentials.js:331:17:331:46 | await j ... k, alg) |
| HardcodedCredentials.js:331:5:331:46 | publicKey | HardcodedCredentials.js:335:31:335:39 | publicKey |
| HardcodedCredentials.js:331:5:331:46 | publicKey | HardcodedCredentials.js:335:31:335:39 | publicKey |
| HardcodedCredentials.js:331:17:331:46 | await j ... k, alg) | HardcodedCredentials.js:331:5:331:46 | publicKey |
| HardcodedCredentials.js:344:9:344:43 | secretKey | HardcodedCredentials.js:349:21:349:29 | secretKey |
| HardcodedCredentials.js:344:9:344:43 | secretKey | HardcodedCredentials.js:349:21:349:29 | secretKey |
| HardcodedCredentials.js:344:9:344:43 | secretKey | HardcodedCredentials.js:360:33:360:41 | secretKey |
| HardcodedCredentials.js:344:21:344:43 | "myHard ... ateKey" | HardcodedCredentials.js:344:9:344:43 | secretKey |
| HardcodedCredentials.js:344:21:344:43 | "myHard ... ateKey" | HardcodedCredentials.js:344:9:344:43 | secretKey |
| HardcodedCredentials.js:360:33:360:41 | secretKey | HardcodedCredentials.js:360:21:360:52 | Buffer. ... ase64") |
| HardcodedCredentials.js:360:33:360:41 | secretKey | HardcodedCredentials.js:360:21:360:52 | Buffer. ... ase64") |
| HardcodedCredentials.js:375:9:375:43 | secretKey | HardcodedCredentials.js:378:24:378:32 | secretKey |
| HardcodedCredentials.js:375:9:375:43 | secretKey | HardcodedCredentials.js:378:24:378:32 | secretKey |
| HardcodedCredentials.js:375:9:375:43 | secretKey | HardcodedCredentials.js:385:31:385:39 | secretKey |
| HardcodedCredentials.js:375:9:375:43 | secretKey | HardcodedCredentials.js:385:31:385:39 | secretKey |
| HardcodedCredentials.js:375:21:375:43 | "myHard ... ateKey" | HardcodedCredentials.js:375:9:375:43 | secretKey |
| HardcodedCredentials.js:375:21:375:43 | "myHard ... ateKey" | HardcodedCredentials.js:375:9:375:43 | secretKey |
| HardcodedCredentials.js:396:9:396:43 | secretKey | HardcodedCredentials.js:399:17:399:25 | secretKey |
| HardcodedCredentials.js:396:9:396:43 | secretKey | HardcodedCredentials.js:399:17:399:25 | secretKey |
| HardcodedCredentials.js:396:21:396:43 | "myHard ... ateKey" | HardcodedCredentials.js:396:9:396:43 | secretKey |
| HardcodedCredentials.js:396:21:396:43 | "myHard ... ateKey" | HardcodedCredentials.js:396:9:396:43 | secretKey |
| HardcodedCredentials.js:414:9:414:43 | secretKey | HardcodedCredentials.js:416:27:416:35 | secretKey |
| HardcodedCredentials.js:414:9:414:43 | secretKey | HardcodedCredentials.js:416:27:416:35 | secretKey |
| HardcodedCredentials.js:414:21:414:43 | "myHard ... ateKey" | HardcodedCredentials.js:414:9:414:43 | secretKey |
| HardcodedCredentials.js:414:21:414:43 | "myHard ... ateKey" | HardcodedCredentials.js:414:9:414:43 | secretKey |
| __tests__/HardcodedCredentialsDemo.js:5:15:5:22 | 'dbuser' | __tests__/HardcodedCredentialsDemo.js:5:15:5:22 | 'dbuser' |
| __tests__/HardcodedCredentialsDemo.js:8:19:8:28 | 'hgfedcba' | __tests__/HardcodedCredentialsDemo.js:8:19:8:28 | 'hgfedcba' |
#select
@@ -583,10 +594,11 @@ edges
| HardcodedCredentials.js:302:44:302:69 | 'iubfew ... ybgera' | HardcodedCredentials.js:302:44:302:69 | 'iubfew ... ybgera' | HardcodedCredentials.js:302:44:302:69 | 'iubfew ... ybgera' | The hard-coded value "iubfewiaaweiybgaeuybgera" is used as $@. | HardcodedCredentials.js:302:44:302:69 | 'iubfew ... ybgera' | key |
| HardcodedCredentials.js:308:22:308:44 | "myHard ... ateKey" | HardcodedCredentials.js:308:22:308:44 | "myHard ... ateKey" | HardcodedCredentials.js:309:34:309:43 | privateKey | The hard-coded value "myHardCodedPrivateKey" is used as $@. | HardcodedCredentials.js:309:34:309:43 | privateKey | key |
| HardcodedCredentials.js:316:22:316:44 | "myHard ... ateKey" | HardcodedCredentials.js:316:22:316:44 | "myHard ... ateKey" | HardcodedCredentials.js:317:27:317:62 | new Tex ... ateKey) | The hard-coded value "myHardCodedPrivateKey" is used as $@. | HardcodedCredentials.js:317:27:317:62 | new Tex ... ateKey) | key |
| HardcodedCredentials.js:320:18:323:29 | `-----B ... Y-----` | HardcodedCredentials.js:320:18:323:29 | `-----B ... Y-----` | HardcodedCredentials.js:325:27:325:35 | publicKey | The hard-coded value "-----BEGIN PUBLIC KEY-----\n MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAwhYOFK2Ocbbpb/zVypi9\n ...\n -----END PUBLIC KEY-----" is used as $@. | HardcodedCredentials.js:325:27:325:35 | publicKey | key |
| HardcodedCredentials.js:331:21:331:43 | "myHard ... ateKey" | HardcodedCredentials.js:331:21:331:43 | "myHard ... ateKey" | HardcodedCredentials.js:336:21:336:29 | secretKey | The hard-coded value "myHardCodedPrivateKey" is used as $@. | HardcodedCredentials.js:336:21:336:29 | secretKey | key |
| HardcodedCredentials.js:331:21:331:43 | "myHard ... ateKey" | HardcodedCredentials.js:331:21:331:43 | "myHard ... ateKey" | HardcodedCredentials.js:347:21:347:52 | Buffer. ... ase64") | The hard-coded value "myHardCodedPrivateKey" is used as $@. | HardcodedCredentials.js:347:21:347:52 | Buffer. ... ase64") | key |
| HardcodedCredentials.js:362:21:362:43 | "myHard ... ateKey" | HardcodedCredentials.js:362:21:362:43 | "myHard ... ateKey" | HardcodedCredentials.js:365:24:365:32 | secretKey | The hard-coded value "myHardCodedPrivateKey" is used as $@. | HardcodedCredentials.js:365:24:365:32 | secretKey | key |
| HardcodedCredentials.js:362:21:362:43 | "myHard ... ateKey" | HardcodedCredentials.js:362:21:362:43 | "myHard ... ateKey" | HardcodedCredentials.js:372:31:372:39 | secretKey | The hard-coded value "myHardCodedPrivateKey" is used as $@. | HardcodedCredentials.js:372:31:372:39 | secretKey | key |
| HardcodedCredentials.js:383:21:383:43 | "myHard ... ateKey" | HardcodedCredentials.js:383:21:383:43 | "myHard ... ateKey" | HardcodedCredentials.js:386:17:386:25 | secretKey | The hard-coded value "myHardCodedPrivateKey" is used as $@. | HardcodedCredentials.js:386:17:386:25 | secretKey | key |
| HardcodedCredentials.js:401:21:401:43 | "myHard ... ateKey" | HardcodedCredentials.js:401:21:401:43 | "myHard ... ateKey" | HardcodedCredentials.js:403:27:403:35 | secretKey | The hard-coded value "myHardCodedPrivateKey" is used as $@. | HardcodedCredentials.js:403:27:403:35 | secretKey | key |
| HardcodedCredentials.js:319:18:321:29 | `-----B ... Y-----` | HardcodedCredentials.js:319:18:321:29 | `-----B ... Y-----` | HardcodedCredentials.js:323:27:323:35 | publicKey | The hard-coded value "-----BEGIN PUBLIC KEY-----\n MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAwhYOFK2Ocbbpb/zVypi9...\n -----END PUBLIC KEY-----" is used as $@. | HardcodedCredentials.js:323:27:323:35 | publicKey | key |
| HardcodedCredentials.js:328:12:328:55 | 'whYOFK ... -6f...' | HardcodedCredentials.js:328:12:328:55 | 'whYOFK ... -6f...' | HardcodedCredentials.js:335:31:335:39 | publicKey | The hard-coded value "whYOFK2Ocbbpb_zVypi9SeKiNUqKQH0zTKN1-6f..." is used as $@. | HardcodedCredentials.js:335:31:335:39 | publicKey | key |
| HardcodedCredentials.js:344:21:344:43 | "myHard ... ateKey" | HardcodedCredentials.js:344:21:344:43 | "myHard ... ateKey" | HardcodedCredentials.js:349:21:349:29 | secretKey | The hard-coded value "myHardCodedPrivateKey" is used as $@. | HardcodedCredentials.js:349:21:349:29 | secretKey | key |
| HardcodedCredentials.js:344:21:344:43 | "myHard ... ateKey" | HardcodedCredentials.js:344:21:344:43 | "myHard ... ateKey" | HardcodedCredentials.js:360:21:360:52 | Buffer. ... ase64") | The hard-coded value "myHardCodedPrivateKey" is used as $@. | HardcodedCredentials.js:360:21:360:52 | Buffer. ... ase64") | key |
| HardcodedCredentials.js:375:21:375:43 | "myHard ... ateKey" | HardcodedCredentials.js:375:21:375:43 | "myHard ... ateKey" | HardcodedCredentials.js:378:24:378:32 | secretKey | The hard-coded value "myHardCodedPrivateKey" is used as $@. | HardcodedCredentials.js:378:24:378:32 | secretKey | key |
| HardcodedCredentials.js:375:21:375:43 | "myHard ... ateKey" | HardcodedCredentials.js:375:21:375:43 | "myHard ... ateKey" | HardcodedCredentials.js:385:31:385:39 | secretKey | The hard-coded value "myHardCodedPrivateKey" is used as $@. | HardcodedCredentials.js:385:31:385:39 | secretKey | key |
| HardcodedCredentials.js:396:21:396:43 | "myHard ... ateKey" | HardcodedCredentials.js:396:21:396:43 | "myHard ... ateKey" | HardcodedCredentials.js:399:17:399:25 | secretKey | The hard-coded value "myHardCodedPrivateKey" is used as $@. | HardcodedCredentials.js:399:17:399:25 | secretKey | key |
| HardcodedCredentials.js:414:21:414:43 | "myHard ... ateKey" | HardcodedCredentials.js:414:21:414:43 | "myHard ... ateKey" | HardcodedCredentials.js:416:27:416:35 | secretKey | The hard-coded value "myHardCodedPrivateKey" is used as $@. | HardcodedCredentials.js:416:27:416:35 | secretKey | key |