hohn/codeql
1
0
Fork 0
mirror of https://github.com/github/codeql.git synced 2026-04-26 17:25:19 +02:00
Code Issues Packages Projects Releases Wiki Activity

JS: Update alerts in HardcodedCredentials test

Browse Source 
Note that file is inside a folder named __tests__. The same code is found in another file outside the test folder, where it is flagged.
This commit is contained in:
Asger F
2025-02-25 15:40:53 +01:00
parent 69b2d197e6
commit 7fa63fa6ee
1 changed files with 5 additions and 5 deletions
Download Patch File Download Diff File Expand all files Collapse all files

10
javascript/ql/test/query-tests/Security/CWE-798/__tests__/HardcodedCredentialsDemo.js
View File

@@ -2,10 +2,10 @@
const pg = require('pg');
const client = new pg.Client({
user: 'dbuser',
user: 'dbuser', // $ Alert
host: 'database.server.com',
database: 'mydb',
password: 'hgfedcba',
password: 'hgfedcba', // $ Alert
port: 3211,
});
client.connect();
@@ -15,17 +15,17 @@
const JwtStrategy = require('passport-jwt').Strategy;
const passport = require('passport')
var secretKey = "myHardCodedPrivateKey";
var secretKey = "myHardCodedPrivateKey"; // OK - JWT keys in tests are not flagged
const opts = {}
opts.secretOrKey = secretKey; // $ Alert
opts.secretOrKey = secretKey;
passport.use(new JwtStrategy(opts, function (jwt_payload, done) {
return done(null, false);
}));
passport.use(new JwtStrategy({
secretOrKeyProvider: function (request, rawJwtToken, done) {
return done(null, secretKey) // $ Alert
return done(null, secretKey)
}
}, function (jwt_payload, done) {
return done(null, false);