hohn/codeql
1
0
Fork 0
mirror of https://github.com/github/codeql.git synced 2026-05-05 13:45:19 +02:00
Code Issues Packages Projects Releases Wiki Activity

Merge pull request #7633 from erik-krogh/CWE-300

Browse Source 
JS: add js/http-dependency query
This commit is contained in:
Erik Krogh Kristensen
2022-01-28 12:10:14 +01:00
committed by GitHub
parent 47a57e0c0a b5198bdaca
commit 7aa59ca233
9 changed files with 117 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

4
javascript/ql/test/query-tests/Security/CWE-300/InsecureDependencyResolution.expected Normal file
View File

@@ -0,0 +1,4 @@
| package.json:6:17:6:40 | "http:/ ... rg/foo" | Dependency downloaded using unencrypted communication channel. |
| package.json:7:17:7:39 | "ftp:// ... rg/foo" | Dependency downloaded using unencrypted communication channel. |
| package.json:12:17:12:40 | "http:/ ... rg/foo" | Dependency downloaded using unencrypted communication channel. |
| package.json:13:17:13:39 | "ftp:// ... rg/foo" | Dependency downloaded using unencrypted communication channel. |

1
javascript/ql/test/query-tests/Security/CWE-300/InsecureDependencyResolution.qlref Normal file
View File

@@ -0,0 +1 @@
Security/CWE-300/InsecureDependencyResolution.ql

1
javascript/ql/test/query-tests/Security/CWE-300/foo.js Normal file
View File

@@ -0,0 +1 @@
console.log("foo");

15
javascript/ql/test/query-tests/Security/CWE-300/package.json Normal file
View File

@@ -0,0 +1,15 @@
{
"name": "insecure-dep-downloader",
"dependencies": {
"foo": "*",
"good1": "https://example.org/foo",
"bad1": "http://example.org/foo",
"bad2": "ftp://example.org/foo"
},
"devDependencies": {
"bar": "*",
"good2": "https://example.org/foo",
"bad3": "http://example.org/foo",
"bad4": "ftp://example.org/foo"
}
}