hohn/codeql
1
0
Fork 0
mirror of https://github.com/github/codeql.git synced 2026-04-28 18:25:24 +02:00
Code Issues Packages Projects Releases Wiki Activity

Merge pull request #9356 from erik-krogh/getRouting

Browse Source 
JS: rewrite js/sensitive-get-query to use routing trees
This commit is contained in:
Erik Krogh Kristensen
2022-05-31 11:08:54 +02:00
committed by GitHub
parent bb93179c45 95fae8155e
commit 6cfd790cda
3 changed files with 27 additions and 5 deletions
Download Patch File Download Diff File Expand all files Collapse all files

2
javascript/ql/test/query-tests/Security/CWE-598/SensitiveGetQuery.expected
View File

@@ -1,3 +1,5 @@
| tst.js:8:22:8:39 | req.query.password | $@ for GET requests uses query parameter as sensitive data. | tst.js:6:19:14:1 | (req, r ... serId\\n} | Route handler |
| tst.js:26:22:26:42 | req.par ... sword') | $@ for GET requests uses query parameter as sensitive data. | tst.js:24:20:35:1 | (req, r ... });\\n} | Route handler |
| tst.js:31:24:31:40 | req.param('word') | $@ for GET requests uses query parameter as sensitive data. | tst.js:24:20:35:1 | (req, r ... });\\n} | Route handler |
| tst.js:39:29:39:41 | query.current | $@ for GET requests uses query parameter as sensitive data. | tst.js:37:19:43:1 | ({query ... });\\n} | Route handler |
| tst.js:50:33:50:52 | req.param('current') | $@ for GET requests uses query parameter as sensitive data. | tst.js:48:12:54:5 | (req, r ... ;\\n } | Route handler |

22
javascript/ql/test/query-tests/Security/CWE-598/tst.js
View File

@@ -32,4 +32,24 @@ app.get("/login2", (req, res) => {
checkUser(username, myPassword, (result) => {
res.send(result);
});
});
});
app.get("/login", ({query}, res) => {
const username = query.username; // OK - usernames are fine
const currentPassword = query.current; // NOT OK - password read
checkUser(username, currentPassword, (result) => {
res.send(result);
});
});
app.get('/rest/user/change-password', mkHandler());
function mkHandler() {
return (req, res) => {
const username = req.param('username'); // OK - usernames are fine
const currentPassword = req.param('current'); // NOT OK - password read
checkUser(username, currentPassword, (result) => {
res.send(result);
});
}
}