mirror of
https://github.com/github/codeql.git
synced 2026-05-02 12:15:17 +02:00
Merge branch 'main' into extractBigReg
This commit is contained in:
Erik Krogh Kristensen
@@ -2116,6 +2116,19 @@ nodes
|
||||
| normalizedPaths.js:381:25:381:28 | path |
|
||||
| normalizedPaths.js:381:25:381:28 | path |
|
||||
| normalizedPaths.js:381:25:381:28 | path |
|
||||
| normalizedPaths.js:385:7:385:46 | path |
|
||||
| normalizedPaths.js:385:7:385:46 | path |
|
||||
| normalizedPaths.js:385:14:385:46 | pathMod ... uery.x) |
|
||||
| normalizedPaths.js:385:14:385:46 | pathMod ... uery.x) |
|
||||
| normalizedPaths.js:385:35:385:45 | req.query.x |
|
||||
| normalizedPaths.js:385:35:385:45 | req.query.x |
|
||||
| normalizedPaths.js:385:35:385:45 | req.query.x |
|
||||
| normalizedPaths.js:388:19:388:22 | path |
|
||||
| normalizedPaths.js:388:19:388:22 | path |
|
||||
| normalizedPaths.js:388:19:388:22 | path |
|
||||
| normalizedPaths.js:399:21:399:24 | path |
|
||||
| normalizedPaths.js:399:21:399:24 | path |
|
||||
| normalizedPaths.js:399:21:399:24 | path |
|
||||
| other-fs-libraries.js:9:7:9:48 | path |
|
||||
| other-fs-libraries.js:9:7:9:48 | path |
|
||||
| other-fs-libraries.js:9:7:9:48 | path |
|
||||
@@ -6998,6 +7011,20 @@ edges
|
||||
| normalizedPaths.js:381:25:381:28 | path | normalizedPaths.js:381:19:381:29 | slash(path) |
|
||||
| normalizedPaths.js:381:25:381:28 | path | normalizedPaths.js:381:19:381:29 | slash(path) |
|
||||
| normalizedPaths.js:381:25:381:28 | path | normalizedPaths.js:381:19:381:29 | slash(path) |
|
||||
| normalizedPaths.js:385:7:385:46 | path | normalizedPaths.js:388:19:388:22 | path |
|
||||
| normalizedPaths.js:385:7:385:46 | path | normalizedPaths.js:388:19:388:22 | path |
|
||||
| normalizedPaths.js:385:7:385:46 | path | normalizedPaths.js:388:19:388:22 | path |
|
||||
| normalizedPaths.js:385:7:385:46 | path | normalizedPaths.js:388:19:388:22 | path |
|
||||
| normalizedPaths.js:385:7:385:46 | path | normalizedPaths.js:399:21:399:24 | path |
|
||||
| normalizedPaths.js:385:7:385:46 | path | normalizedPaths.js:399:21:399:24 | path |
|
||||
| normalizedPaths.js:385:7:385:46 | path | normalizedPaths.js:399:21:399:24 | path |
|
||||
| normalizedPaths.js:385:7:385:46 | path | normalizedPaths.js:399:21:399:24 | path |
|
||||
| normalizedPaths.js:385:14:385:46 | pathMod ... uery.x) | normalizedPaths.js:385:7:385:46 | path |
|
||||
| normalizedPaths.js:385:14:385:46 | pathMod ... uery.x) | normalizedPaths.js:385:7:385:46 | path |
|
||||
| normalizedPaths.js:385:35:385:45 | req.query.x | normalizedPaths.js:385:14:385:46 | pathMod ... uery.x) |
|
||||
| normalizedPaths.js:385:35:385:45 | req.query.x | normalizedPaths.js:385:14:385:46 | pathMod ... uery.x) |
|
||||
| normalizedPaths.js:385:35:385:45 | req.query.x | normalizedPaths.js:385:14:385:46 | pathMod ... uery.x) |
|
||||
| normalizedPaths.js:385:35:385:45 | req.query.x | normalizedPaths.js:385:14:385:46 | pathMod ... uery.x) |
|
||||
| other-fs-libraries.js:9:7:9:48 | path | other-fs-libraries.js:11:19:11:22 | path |
|
||||
| other-fs-libraries.js:9:7:9:48 | path | other-fs-libraries.js:11:19:11:22 | path |
|
||||
| other-fs-libraries.js:9:7:9:48 | path | other-fs-libraries.js:11:19:11:22 | path |
|
||||
@@ -9670,6 +9697,8 @@ edges
|
||||
| normalizedPaths.js:363:21:363:31 | requestPath | normalizedPaths.js:354:14:354:27 | req.query.path | normalizedPaths.js:363:21:363:31 | requestPath | This path depends on $@. | normalizedPaths.js:354:14:354:27 | req.query.path | a user-provided value |
|
||||
| normalizedPaths.js:379:19:379:22 | path | normalizedPaths.js:377:14:377:27 | req.query.path | normalizedPaths.js:379:19:379:22 | path | This path depends on $@. | normalizedPaths.js:377:14:377:27 | req.query.path | a user-provided value |
|
||||
| normalizedPaths.js:381:19:381:29 | slash(path) | normalizedPaths.js:377:14:377:27 | req.query.path | normalizedPaths.js:381:19:381:29 | slash(path) | This path depends on $@. | normalizedPaths.js:377:14:377:27 | req.query.path | a user-provided value |
|
||||
| normalizedPaths.js:388:19:388:22 | path | normalizedPaths.js:385:35:385:45 | req.query.x | normalizedPaths.js:388:19:388:22 | path | This path depends on $@. | normalizedPaths.js:385:35:385:45 | req.query.x | a user-provided value |
|
||||
| normalizedPaths.js:399:21:399:24 | path | normalizedPaths.js:385:35:385:45 | req.query.x | normalizedPaths.js:399:21:399:24 | path | This path depends on $@. | normalizedPaths.js:385:35:385:45 | req.query.x | a user-provided value |
|
||||
| other-fs-libraries.js:11:19:11:22 | path | other-fs-libraries.js:9:24:9:30 | req.url | other-fs-libraries.js:11:19:11:22 | path | This path depends on $@. | other-fs-libraries.js:9:24:9:30 | req.url | a user-provided value |
|
||||
| other-fs-libraries.js:12:27:12:30 | path | other-fs-libraries.js:9:24:9:30 | req.url | other-fs-libraries.js:12:27:12:30 | path | This path depends on $@. | other-fs-libraries.js:9:24:9:30 | req.url | a user-provided value |
|
||||
| other-fs-libraries.js:13:24:13:27 | path | other-fs-libraries.js:9:24:9:30 | req.url | other-fs-libraries.js:13:24:13:27 | path | This path depends on $@. | other-fs-libraries.js:9:24:9:30 | req.url | a user-provided value |
|
||||
|
||||
@@ -379,4 +379,26 @@ app.get('/slash-stuff', (req, res) => {
|
||||
fs.readFileSync(path); // NOT OK
|
||||
|
||||
fs.readFileSync(slash(path)); // NOT OK
|
||||
});
|
||||
});
|
||||
|
||||
app.get('/dotdot-regexp', (req, res) => {
|
||||
let path = pathModule.normalize(req.query.x);
|
||||
if (pathModule.isAbsolute(path))
|
||||
return;
|
||||
fs.readFileSync(path); // NOT OK
|
||||
if (!path.match(/\./)) {
|
||||
fs.readFileSync(path); // OK
|
||||
}
|
||||
if (!path.match(/\.\./)) {
|
||||
fs.readFileSync(path); // OK
|
||||
}
|
||||
if (!path.match(/\.\.\//)) {
|
||||
fs.readFileSync(path); // OK
|
||||
}
|
||||
if (!path.match(/\.\.\/foo/)) {
|
||||
fs.readFileSync(path); // NOT OK
|
||||
}
|
||||
if (!path.match(/(\.\.\/|\.\.\\)/)) {
|
||||
fs.readFileSync(path); // OK
|
||||
}
|
||||
});
|
||||
|
||||
@@ -121,6 +121,12 @@ nodes
|
||||
| unsafe-jquery-plugin.js:179:5:179:11 | options |
|
||||
| unsafe-jquery-plugin.js:179:5:179:18 | options.target |
|
||||
| unsafe-jquery-plugin.js:179:5:179:18 | options.target |
|
||||
| unsafe-jquery-plugin.js:185:28:185:34 | options |
|
||||
| unsafe-jquery-plugin.js:185:28:185:34 | options |
|
||||
| unsafe-jquery-plugin.js:186:21:186:27 | options |
|
||||
| unsafe-jquery-plugin.js:186:21:186:30 | options.of |
|
||||
| unsafe-jquery-plugin.js:192:19:192:28 | options.of |
|
||||
| unsafe-jquery-plugin.js:192:19:192:28 | options.of |
|
||||
edges
|
||||
| unsafe-jquery-plugin.js:2:38:2:44 | options | unsafe-jquery-plugin.js:3:5:3:11 | options |
|
||||
| unsafe-jquery-plugin.js:2:38:2:44 | options | unsafe-jquery-plugin.js:3:5:3:11 | options |
|
||||
@@ -245,6 +251,11 @@ edges
|
||||
| unsafe-jquery-plugin.js:178:27:178:33 | options | unsafe-jquery-plugin.js:179:5:179:11 | options |
|
||||
| unsafe-jquery-plugin.js:179:5:179:11 | options | unsafe-jquery-plugin.js:179:5:179:18 | options.target |
|
||||
| unsafe-jquery-plugin.js:179:5:179:11 | options | unsafe-jquery-plugin.js:179:5:179:18 | options.target |
|
||||
| unsafe-jquery-plugin.js:185:28:185:34 | options | unsafe-jquery-plugin.js:186:21:186:27 | options |
|
||||
| unsafe-jquery-plugin.js:185:28:185:34 | options | unsafe-jquery-plugin.js:186:21:186:27 | options |
|
||||
| unsafe-jquery-plugin.js:186:21:186:27 | options | unsafe-jquery-plugin.js:186:21:186:30 | options.of |
|
||||
| unsafe-jquery-plugin.js:186:21:186:30 | options.of | unsafe-jquery-plugin.js:192:19:192:28 | options.of |
|
||||
| unsafe-jquery-plugin.js:186:21:186:30 | options.of | unsafe-jquery-plugin.js:192:19:192:28 | options.of |
|
||||
#select
|
||||
| unsafe-jquery-plugin.js:3:5:3:11 | options | unsafe-jquery-plugin.js:2:38:2:44 | options | unsafe-jquery-plugin.js:3:5:3:11 | options | Potential XSS vulnerability in the $@. | unsafe-jquery-plugin.js:2:19:63:2 | functio ... \\t\\t}\\n\\n\\t} | '$.fn.my_plugin' plugin |
|
||||
| unsafe-jquery-plugin.js:5:5:5:18 | options.target | unsafe-jquery-plugin.js:2:38:2:44 | options | unsafe-jquery-plugin.js:5:5:5:18 | options.target | Potential XSS vulnerability in the $@. | unsafe-jquery-plugin.js:2:19:63:2 | functio ... \\t\\t}\\n\\n\\t} | '$.fn.my_plugin' plugin |
|
||||
@@ -268,3 +279,4 @@ edges
|
||||
| unsafe-jquery-plugin.js:157:44:157:59 | options.target.a | unsafe-jquery-plugin.js:153:38:153:44 | options | unsafe-jquery-plugin.js:157:44:157:59 | options.target.a | Potential XSS vulnerability in the $@. | unsafe-jquery-plugin.js:153:19:158:2 | functio ... NCY]\\n\\t} | '$.fn.my_plugin' plugin |
|
||||
| unsafe-jquery-plugin.js:170:6:170:11 | target | unsafe-jquery-plugin.js:160:38:160:44 | options | unsafe-jquery-plugin.js:170:6:170:11 | target | Potential XSS vulnerability in the $@. | unsafe-jquery-plugin.js:160:19:173:2 | functio ... \\t\\t}\\n\\n\\t} | '$.fn.my_plugin' plugin |
|
||||
| unsafe-jquery-plugin.js:179:5:179:18 | options.target | unsafe-jquery-plugin.js:178:27:178:33 | options | unsafe-jquery-plugin.js:179:5:179:18 | options.target | Potential XSS vulnerability in the $@. | unsafe-jquery-plugin.js:178:18:180:2 | functio ... T OK\\n\\t} | '$.fn.my_plugin' plugin |
|
||||
| unsafe-jquery-plugin.js:192:19:192:28 | options.of | unsafe-jquery-plugin.js:185:28:185:34 | options | unsafe-jquery-plugin.js:192:19:192:28 | options.of | Potential XSS vulnerability in the $@. | unsafe-jquery-plugin.js:185:18:194:2 | functio ... et);\\n\\t} | '$.fn.position' plugin |
|
||||
|
||||
@@ -182,4 +182,14 @@
|
||||
$(document).find(options.target); // OK
|
||||
}});
|
||||
|
||||
$.fn.position = function( options ) {
|
||||
if ( !options || !options.of ) {
|
||||
return doSomethingElse( this, arguments );
|
||||
}
|
||||
// extending options
|
||||
options = $.extend( {}, options );
|
||||
|
||||
var target = $( options.of ); // NOT OK
|
||||
console.log(target);
|
||||
};
|
||||
});
|
||||
|
||||
@@ -0,0 +1,11 @@
|
||||
| tst.js:3:14:3:71 | crypto. ... 1024 }) | Creation of an asymmetric RSA key uses 1024 bits, which is below 2048 and considered breakable. |
|
||||
| tst.js:7:14:7:59 | crypto. ... : 64 }) | Creation of an symmetric key uses 64 bits, which is below 128 and considered breakable. |
|
||||
| tst.js:13:14:13:56 | CryptoJ ... e: 2 }) | Creation of an symmetric PBKDF2 key uses 64 bits, which is below 128 and considered breakable. |
|
||||
| tst.js:14:14:14:60 | CryptoJ ... e: 2 }) | Creation of an symmetric PBKDF2 key uses 64 bits, which is below 128 and considered breakable. |
|
||||
| tst.js:15:14:15:60 | CryptoJ ... e: 2 }) | Creation of an symmetric EVPKDF key uses 64 bits, which is below 128 and considered breakable. |
|
||||
| tst.js:19:12:19:57 | forge.r ... rd, 64) | Creation of an symmetric RC2 key uses 64 bits, which is below 128 and considered breakable. |
|
||||
| tst.js:26:12:26:53 | forge.c ... , key2) | Creation of an symmetric AES key uses 64 bits, which is below 128 and considered breakable. |
|
||||
| tst.js:30:12:30:56 | forge.c ... , key3) | Creation of an symmetric 3DES key uses 64 bits, which is below 128 and considered breakable. |
|
||||
| tst.js:35:13:35:43 | crypto. ... an(512) | Creation of an asymmetric key uses 512 bits, which is below 2048 and considered breakable. |
|
||||
| tst.js:39:13:39:33 | new Nod ... : 512}) | Creation of an asymmetric RSA key uses 512 bits, which is below 2048 and considered breakable. |
|
||||
| tst.js:43:1:43:31 | key.gen ... 65537) | Creation of an asymmetric RSA key uses 512 bits, which is below 2048 and considered breakable. |
|
||||
@@ -0,0 +1 @@
|
||||
Security/CWE-326/InsufficientKeySize.ql
|
||||
44
javascript/ql/test/query-tests/Security/CWE-326/tst.js
Normal file
44
javascript/ql/test/query-tests/Security/CWE-326/tst.js
Normal file
@@ -0,0 +1,44 @@
|
||||
const crypto = require("crypto");
|
||||
|
||||
const bad1 = crypto.generateKeyPairSync("rsa", { modulusLength: 1024 }); // NOT OK
|
||||
|
||||
const good1 = crypto.generateKeyPairSync("rsa", { modulusLength: 4096 }); // OK
|
||||
|
||||
const bad2 = crypto.generateKeySync("hmac", { length: 64 }); // NOT OK
|
||||
|
||||
const good2 = crypto.generateKeySync("aes", { length: 256 }); // OK
|
||||
|
||||
var CryptoJS = require("crypto-js");
|
||||
|
||||
const bad3 = CryptoJS.algo.PBKDF2.create({ keySize: 2 }); // NOT OK
|
||||
const bad4 = CryptoJS.PBKDF2(password, salt, { keySize: 2 }); // NOT OK
|
||||
const bad5 = CryptoJS.EvpKDF(password, salt, { keySize: 2 }); // NOT OK
|
||||
const bad6 = CryptoJS.PBKDF2(password, salt, { keySize: 8 }); // OK
|
||||
|
||||
const forge = require("node-forge");
|
||||
var bad7 = forge.rc2.createEncryptionCipher(password, 64); // NOT OK
|
||||
var good3 = forge.rc2.createEncryptionCipher(password, 128); // OK
|
||||
|
||||
var key1 = forge.random.getBytesSync(16);
|
||||
var good4 = forge.cipher.createCipher('AES-CBC', key1); // OK
|
||||
|
||||
var key2 = forge.random.getBytesSync(8);
|
||||
var bad8 = forge.cipher.createCipher('AES-CBC', key2); // NOT OK
|
||||
|
||||
var myBuffer = forge.util.createBuffer(manyBytes);
|
||||
var key3 = myBuffer.getBytes(8);
|
||||
var bad9 = forge.cipher.createDecipher('3DES-CBC', key3); // NOT OK
|
||||
|
||||
var key4 = myBuffer.getBytes(16);
|
||||
var good5 = forge.cipher.createDecipher('AES-CBC', key4); // OK
|
||||
|
||||
var bad10 = crypto.createDiffieHellman(512);
|
||||
var good6 = crypto.createDiffieHellman(2048);
|
||||
|
||||
const NodeRSA = require('node-rsa');
|
||||
var bad11 = new NodeRSA({b: 512}); // NOT OK
|
||||
var good7 = new NodeRSA({b: 4096}); // OK
|
||||
|
||||
var key = new NodeRSA(); // OK
|
||||
key.generateKeyPair(512, 65537); // NOT OK
|
||||
key.generateKeyPair(4096, 65537); // OK
|
||||
@@ -0,0 +1,2 @@
|
||||
| tst.js:9:1:14:2 | app.get ... n');\\n}) | Route handler does not invalidate session following login |
|
||||
| tst.js:27:1:29:2 | app.get ... n');\\n}) | Route handler does not invalidate session following login |
|
||||
@@ -0,0 +1 @@
|
||||
Security/CWE-384/SessionFixation.ql
|
||||
40
javascript/ql/test/query-tests/Security/CWE-384/tst.js
Normal file
40
javascript/ql/test/query-tests/Security/CWE-384/tst.js
Normal file
@@ -0,0 +1,40 @@
|
||||
const express = require('express');
|
||||
const session = require('express-session');
|
||||
const passport = require('passport');
|
||||
const app = express();
|
||||
app.use(session({
|
||||
secret: 'keyboard cat'
|
||||
}));
|
||||
// handle login
|
||||
app.get('/login', function (req, res) { // NOT OK - no regenerate
|
||||
req.session.user = {
|
||||
userId: something
|
||||
};
|
||||
res.send('logged in');
|
||||
});
|
||||
|
||||
// with regenerate
|
||||
app.get('/login2', function (req, res) { // OK
|
||||
req.session.regenerate(function (err) {
|
||||
req.session.user = {
|
||||
userId: something
|
||||
};
|
||||
res.send('logged in');
|
||||
});
|
||||
});
|
||||
|
||||
// using passport
|
||||
app.get('/passport', passport.authenticate('local'), function (req, res) { // NOT OK - no regenerate
|
||||
res.send('logged in');
|
||||
});
|
||||
|
||||
// with regenerate, still using passport
|
||||
app.get('/passport2', passport.authenticate('local'), function (req, res) { // OK
|
||||
var passport = req._passport.instance;
|
||||
req.session.regenerate(function(err, done, user) {
|
||||
req.session[passport._key] = {};
|
||||
req._passport.instance = passport;
|
||||
req._passport.session = req.session[passport._key];
|
||||
res.send('logged in');
|
||||
});
|
||||
});
|
||||
@@ -1,4 +1,93 @@
|
||||
nodes
|
||||
| lib.js:1:38:1:40 | obj |
|
||||
| lib.js:1:43:1:46 | path |
|
||||
| lib.js:1:43:1:46 | path |
|
||||
| lib.js:1:43:1:46 | path |
|
||||
| lib.js:2:7:2:27 | currentPath |
|
||||
| lib.js:2:7:2:27 | currentPath |
|
||||
| lib.js:2:21:2:24 | path |
|
||||
| lib.js:2:21:2:24 | path |
|
||||
| lib.js:2:21:2:27 | path[0] |
|
||||
| lib.js:2:21:2:27 | path[0] |
|
||||
| lib.js:6:7:6:9 | obj |
|
||||
| lib.js:6:7:6:9 | obj |
|
||||
| lib.js:11:17:11:32 | obj[currentPath] |
|
||||
| lib.js:11:17:11:32 | obj[currentPath] |
|
||||
| lib.js:11:21:11:31 | currentPath |
|
||||
| lib.js:11:21:11:31 | currentPath |
|
||||
| lib.js:11:35:11:38 | path |
|
||||
| lib.js:11:35:11:38 | path |
|
||||
| lib.js:11:35:11:47 | path.slice(1) |
|
||||
| lib.js:11:35:11:47 | path.slice(1) |
|
||||
| lib.js:14:38:14:41 | path |
|
||||
| lib.js:14:38:14:41 | path |
|
||||
| lib.js:15:3:15:14 | obj[path[0]] |
|
||||
| lib.js:15:3:15:14 | obj[path[0]] |
|
||||
| lib.js:15:7:15:10 | path |
|
||||
| lib.js:15:7:15:13 | path[0] |
|
||||
| lib.js:20:7:20:25 | path |
|
||||
| lib.js:20:14:20:25 | arguments[1] |
|
||||
| lib.js:20:14:20:25 | arguments[1] |
|
||||
| lib.js:22:3:22:14 | obj[path[0]] |
|
||||
| lib.js:22:3:22:14 | obj[path[0]] |
|
||||
| lib.js:22:7:22:10 | path |
|
||||
| lib.js:22:7:22:13 | path[0] |
|
||||
| lib.js:25:44:25:47 | path |
|
||||
| lib.js:25:44:25:47 | path |
|
||||
| lib.js:26:10:26:21 | obj[path[0]] |
|
||||
| lib.js:26:10:26:21 | obj[path[0]] |
|
||||
| lib.js:26:14:26:17 | path |
|
||||
| lib.js:26:14:26:20 | path[0] |
|
||||
| lib.js:32:7:32:20 | path |
|
||||
| lib.js:32:14:32:20 | args[1] |
|
||||
| lib.js:32:14:32:20 | args[1] |
|
||||
| lib.js:34:3:34:14 | obj[path[0]] |
|
||||
| lib.js:34:3:34:14 | obj[path[0]] |
|
||||
| lib.js:34:7:34:10 | path |
|
||||
| lib.js:34:7:34:13 | path[0] |
|
||||
| lib.js:40:7:40:20 | path |
|
||||
| lib.js:40:14:40:20 | args[1] |
|
||||
| lib.js:40:14:40:20 | args[1] |
|
||||
| lib.js:42:3:42:14 | obj[path[0]] |
|
||||
| lib.js:42:3:42:14 | obj[path[0]] |
|
||||
| lib.js:42:7:42:10 | path |
|
||||
| lib.js:42:7:42:13 | path[0] |
|
||||
| lib.js:45:13:45:13 | s |
|
||||
| lib.js:45:13:45:13 | s |
|
||||
| lib.js:46:10:46:10 | s |
|
||||
| lib.js:52:9:52:22 | path |
|
||||
| lib.js:52:16:52:22 | id("x") |
|
||||
| lib.js:55:11:55:22 | obj[path[0]] |
|
||||
| lib.js:55:11:55:22 | obj[path[0]] |
|
||||
| lib.js:55:15:55:18 | path |
|
||||
| lib.js:55:15:55:21 | path[0] |
|
||||
| lib.js:59:18:59:18 | s |
|
||||
| lib.js:59:18:59:18 | s |
|
||||
| lib.js:61:17:61:17 | s |
|
||||
| lib.js:68:11:68:26 | path |
|
||||
| lib.js:68:18:68:26 | this.path |
|
||||
| lib.js:70:13:70:24 | obj[path[0]] |
|
||||
| lib.js:70:13:70:24 | obj[path[0]] |
|
||||
| lib.js:70:17:70:20 | path |
|
||||
| lib.js:70:17:70:23 | path[0] |
|
||||
| lib.js:83:7:83:25 | path |
|
||||
| lib.js:83:14:83:25 | arguments[1] |
|
||||
| lib.js:83:14:83:25 | arguments[1] |
|
||||
| lib.js:86:7:86:26 | proto |
|
||||
| lib.js:86:15:86:26 | obj[path[0]] |
|
||||
| lib.js:86:19:86:22 | path |
|
||||
| lib.js:86:19:86:25 | path[0] |
|
||||
| lib.js:87:10:87:14 | proto |
|
||||
| lib.js:87:10:87:14 | proto |
|
||||
| lib.js:90:43:90:46 | path |
|
||||
| lib.js:90:43:90:46 | path |
|
||||
| lib.js:91:7:91:28 | maybeProto |
|
||||
| lib.js:91:20:91:28 | obj[path] |
|
||||
| lib.js:91:24:91:27 | path |
|
||||
| lib.js:92:3:92:12 | maybeProto |
|
||||
| lib.js:92:3:92:12 | maybeProto |
|
||||
| lib.js:95:3:95:12 | maybeProto |
|
||||
| lib.js:95:3:95:12 | maybeProto |
|
||||
| tst.js:5:9:5:38 | taint |
|
||||
| tst.js:5:17:5:38 | String( ... y.data) |
|
||||
| tst.js:5:24:5:37 | req.query.data |
|
||||
@@ -23,7 +112,113 @@ nodes
|
||||
| tst.js:45:9:45:11 | obj |
|
||||
| tst.js:48:9:48:11 | obj |
|
||||
| tst.js:48:9:48:11 | obj |
|
||||
| tst.js:77:9:77:38 | taint |
|
||||
| tst.js:77:17:77:38 | String( ... y.data) |
|
||||
| tst.js:77:24:77:37 | req.query.data |
|
||||
| tst.js:77:24:77:37 | req.query.data |
|
||||
| tst.js:80:5:80:17 | object[taint] |
|
||||
| tst.js:80:5:80:17 | object[taint] |
|
||||
| tst.js:80:12:80:16 | taint |
|
||||
| tst.js:82:5:82:22 | object["" + taint] |
|
||||
| tst.js:82:5:82:22 | object["" + taint] |
|
||||
| tst.js:82:12:82:21 | "" + taint |
|
||||
| tst.js:82:17:82:21 | taint |
|
||||
| tst.js:87:9:87:21 | object[taint] |
|
||||
| tst.js:87:9:87:21 | object[taint] |
|
||||
| tst.js:87:16:87:20 | taint |
|
||||
| tst.js:94:5:94:37 | obj[req ... ', '')] |
|
||||
| tst.js:94:5:94:37 | obj[req ... ', '')] |
|
||||
| tst.js:94:9:94:19 | req.query.x |
|
||||
| tst.js:94:9:94:19 | req.query.x |
|
||||
| tst.js:94:9:94:36 | req.que ... _', '') |
|
||||
| tst.js:97:5:97:46 | obj[req ... g, '')] |
|
||||
| tst.js:97:5:97:46 | obj[req ... g, '')] |
|
||||
| tst.js:97:9:97:19 | req.query.x |
|
||||
| tst.js:97:9:97:19 | req.query.x |
|
||||
| tst.js:97:9:97:45 | req.que ... /g, '') |
|
||||
edges
|
||||
| lib.js:1:38:1:40 | obj | lib.js:6:7:6:9 | obj |
|
||||
| lib.js:1:38:1:40 | obj | lib.js:6:7:6:9 | obj |
|
||||
| lib.js:1:43:1:46 | path | lib.js:2:21:2:24 | path |
|
||||
| lib.js:1:43:1:46 | path | lib.js:2:21:2:24 | path |
|
||||
| lib.js:1:43:1:46 | path | lib.js:2:21:2:24 | path |
|
||||
| lib.js:1:43:1:46 | path | lib.js:11:35:11:38 | path |
|
||||
| lib.js:1:43:1:46 | path | lib.js:11:35:11:38 | path |
|
||||
| lib.js:1:43:1:46 | path | lib.js:11:35:11:38 | path |
|
||||
| lib.js:2:7:2:27 | currentPath | lib.js:11:21:11:31 | currentPath |
|
||||
| lib.js:2:7:2:27 | currentPath | lib.js:11:21:11:31 | currentPath |
|
||||
| lib.js:2:21:2:24 | path | lib.js:2:21:2:27 | path[0] |
|
||||
| lib.js:2:21:2:24 | path | lib.js:2:21:2:27 | path[0] |
|
||||
| lib.js:2:21:2:27 | path[0] | lib.js:2:7:2:27 | currentPath |
|
||||
| lib.js:2:21:2:27 | path[0] | lib.js:2:7:2:27 | currentPath |
|
||||
| lib.js:11:17:11:32 | obj[currentPath] | lib.js:1:38:1:40 | obj |
|
||||
| lib.js:11:17:11:32 | obj[currentPath] | lib.js:1:38:1:40 | obj |
|
||||
| lib.js:11:21:11:31 | currentPath | lib.js:11:17:11:32 | obj[currentPath] |
|
||||
| lib.js:11:21:11:31 | currentPath | lib.js:11:17:11:32 | obj[currentPath] |
|
||||
| lib.js:11:35:11:38 | path | lib.js:11:35:11:47 | path.slice(1) |
|
||||
| lib.js:11:35:11:38 | path | lib.js:11:35:11:47 | path.slice(1) |
|
||||
| lib.js:11:35:11:47 | path.slice(1) | lib.js:1:43:1:46 | path |
|
||||
| lib.js:11:35:11:47 | path.slice(1) | lib.js:1:43:1:46 | path |
|
||||
| lib.js:14:38:14:41 | path | lib.js:15:7:15:10 | path |
|
||||
| lib.js:14:38:14:41 | path | lib.js:15:7:15:10 | path |
|
||||
| lib.js:15:7:15:10 | path | lib.js:15:7:15:13 | path[0] |
|
||||
| lib.js:15:7:15:13 | path[0] | lib.js:15:3:15:14 | obj[path[0]] |
|
||||
| lib.js:15:7:15:13 | path[0] | lib.js:15:3:15:14 | obj[path[0]] |
|
||||
| lib.js:20:7:20:25 | path | lib.js:22:7:22:10 | path |
|
||||
| lib.js:20:14:20:25 | arguments[1] | lib.js:20:7:20:25 | path |
|
||||
| lib.js:20:14:20:25 | arguments[1] | lib.js:20:7:20:25 | path |
|
||||
| lib.js:22:7:22:10 | path | lib.js:22:7:22:13 | path[0] |
|
||||
| lib.js:22:7:22:13 | path[0] | lib.js:22:3:22:14 | obj[path[0]] |
|
||||
| lib.js:22:7:22:13 | path[0] | lib.js:22:3:22:14 | obj[path[0]] |
|
||||
| lib.js:25:44:25:47 | path | lib.js:26:14:26:17 | path |
|
||||
| lib.js:25:44:25:47 | path | lib.js:26:14:26:17 | path |
|
||||
| lib.js:26:14:26:17 | path | lib.js:26:14:26:20 | path[0] |
|
||||
| lib.js:26:14:26:20 | path[0] | lib.js:26:10:26:21 | obj[path[0]] |
|
||||
| lib.js:26:14:26:20 | path[0] | lib.js:26:10:26:21 | obj[path[0]] |
|
||||
| lib.js:32:7:32:20 | path | lib.js:34:7:34:10 | path |
|
||||
| lib.js:32:14:32:20 | args[1] | lib.js:32:7:32:20 | path |
|
||||
| lib.js:32:14:32:20 | args[1] | lib.js:32:7:32:20 | path |
|
||||
| lib.js:34:7:34:10 | path | lib.js:34:7:34:13 | path[0] |
|
||||
| lib.js:34:7:34:13 | path[0] | lib.js:34:3:34:14 | obj[path[0]] |
|
||||
| lib.js:34:7:34:13 | path[0] | lib.js:34:3:34:14 | obj[path[0]] |
|
||||
| lib.js:40:7:40:20 | path | lib.js:42:7:42:10 | path |
|
||||
| lib.js:40:14:40:20 | args[1] | lib.js:40:7:40:20 | path |
|
||||
| lib.js:40:14:40:20 | args[1] | lib.js:40:7:40:20 | path |
|
||||
| lib.js:42:7:42:10 | path | lib.js:42:7:42:13 | path[0] |
|
||||
| lib.js:42:7:42:13 | path[0] | lib.js:42:3:42:14 | obj[path[0]] |
|
||||
| lib.js:42:7:42:13 | path[0] | lib.js:42:3:42:14 | obj[path[0]] |
|
||||
| lib.js:45:13:45:13 | s | lib.js:46:10:46:10 | s |
|
||||
| lib.js:45:13:45:13 | s | lib.js:46:10:46:10 | s |
|
||||
| lib.js:46:10:46:10 | s | lib.js:52:16:52:22 | id("x") |
|
||||
| lib.js:52:9:52:22 | path | lib.js:55:15:55:18 | path |
|
||||
| lib.js:52:16:52:22 | id("x") | lib.js:52:9:52:22 | path |
|
||||
| lib.js:55:15:55:18 | path | lib.js:55:15:55:21 | path[0] |
|
||||
| lib.js:55:15:55:21 | path[0] | lib.js:55:11:55:22 | obj[path[0]] |
|
||||
| lib.js:55:15:55:21 | path[0] | lib.js:55:11:55:22 | obj[path[0]] |
|
||||
| lib.js:59:18:59:18 | s | lib.js:61:17:61:17 | s |
|
||||
| lib.js:59:18:59:18 | s | lib.js:61:17:61:17 | s |
|
||||
| lib.js:61:17:61:17 | s | lib.js:68:18:68:26 | this.path |
|
||||
| lib.js:68:11:68:26 | path | lib.js:70:17:70:20 | path |
|
||||
| lib.js:68:18:68:26 | this.path | lib.js:68:11:68:26 | path |
|
||||
| lib.js:70:17:70:20 | path | lib.js:70:17:70:23 | path[0] |
|
||||
| lib.js:70:17:70:23 | path[0] | lib.js:70:13:70:24 | obj[path[0]] |
|
||||
| lib.js:70:17:70:23 | path[0] | lib.js:70:13:70:24 | obj[path[0]] |
|
||||
| lib.js:83:7:83:25 | path | lib.js:86:19:86:22 | path |
|
||||
| lib.js:83:14:83:25 | arguments[1] | lib.js:83:7:83:25 | path |
|
||||
| lib.js:83:14:83:25 | arguments[1] | lib.js:83:7:83:25 | path |
|
||||
| lib.js:86:7:86:26 | proto | lib.js:87:10:87:14 | proto |
|
||||
| lib.js:86:7:86:26 | proto | lib.js:87:10:87:14 | proto |
|
||||
| lib.js:86:15:86:26 | obj[path[0]] | lib.js:86:7:86:26 | proto |
|
||||
| lib.js:86:19:86:22 | path | lib.js:86:19:86:25 | path[0] |
|
||||
| lib.js:86:19:86:25 | path[0] | lib.js:86:15:86:26 | obj[path[0]] |
|
||||
| lib.js:90:43:90:46 | path | lib.js:91:24:91:27 | path |
|
||||
| lib.js:90:43:90:46 | path | lib.js:91:24:91:27 | path |
|
||||
| lib.js:91:7:91:28 | maybeProto | lib.js:92:3:92:12 | maybeProto |
|
||||
| lib.js:91:7:91:28 | maybeProto | lib.js:92:3:92:12 | maybeProto |
|
||||
| lib.js:91:7:91:28 | maybeProto | lib.js:95:3:95:12 | maybeProto |
|
||||
| lib.js:91:7:91:28 | maybeProto | lib.js:95:3:95:12 | maybeProto |
|
||||
| lib.js:91:20:91:28 | obj[path] | lib.js:91:7:91:28 | maybeProto |
|
||||
| lib.js:91:24:91:27 | path | lib.js:91:20:91:28 | obj[path] |
|
||||
| tst.js:5:9:5:38 | taint | tst.js:8:12:8:16 | taint |
|
||||
| tst.js:5:9:5:38 | taint | tst.js:9:12:9:16 | taint |
|
||||
| tst.js:5:9:5:38 | taint | tst.js:12:25:12:29 | taint |
|
||||
@@ -47,11 +242,45 @@ edges
|
||||
| tst.js:33:23:33:25 | obj | tst.js:45:9:45:11 | obj |
|
||||
| tst.js:33:23:33:25 | obj | tst.js:48:9:48:11 | obj |
|
||||
| tst.js:33:23:33:25 | obj | tst.js:48:9:48:11 | obj |
|
||||
| tst.js:77:9:77:38 | taint | tst.js:80:12:80:16 | taint |
|
||||
| tst.js:77:9:77:38 | taint | tst.js:82:17:82:21 | taint |
|
||||
| tst.js:77:9:77:38 | taint | tst.js:87:16:87:20 | taint |
|
||||
| tst.js:77:17:77:38 | String( ... y.data) | tst.js:77:9:77:38 | taint |
|
||||
| tst.js:77:24:77:37 | req.query.data | tst.js:77:17:77:38 | String( ... y.data) |
|
||||
| tst.js:77:24:77:37 | req.query.data | tst.js:77:17:77:38 | String( ... y.data) |
|
||||
| tst.js:80:12:80:16 | taint | tst.js:80:5:80:17 | object[taint] |
|
||||
| tst.js:80:12:80:16 | taint | tst.js:80:5:80:17 | object[taint] |
|
||||
| tst.js:82:12:82:21 | "" + taint | tst.js:82:5:82:22 | object["" + taint] |
|
||||
| tst.js:82:12:82:21 | "" + taint | tst.js:82:5:82:22 | object["" + taint] |
|
||||
| tst.js:82:17:82:21 | taint | tst.js:82:12:82:21 | "" + taint |
|
||||
| tst.js:87:16:87:20 | taint | tst.js:87:9:87:21 | object[taint] |
|
||||
| tst.js:87:16:87:20 | taint | tst.js:87:9:87:21 | object[taint] |
|
||||
| tst.js:94:9:94:19 | req.query.x | tst.js:94:9:94:36 | req.que ... _', '') |
|
||||
| tst.js:94:9:94:19 | req.query.x | tst.js:94:9:94:36 | req.que ... _', '') |
|
||||
| tst.js:94:9:94:36 | req.que ... _', '') | tst.js:94:5:94:37 | obj[req ... ', '')] |
|
||||
| tst.js:94:9:94:36 | req.que ... _', '') | tst.js:94:5:94:37 | obj[req ... ', '')] |
|
||||
| tst.js:97:9:97:19 | req.query.x | tst.js:97:9:97:45 | req.que ... /g, '') |
|
||||
| tst.js:97:9:97:19 | req.query.x | tst.js:97:9:97:45 | req.que ... /g, '') |
|
||||
| tst.js:97:9:97:45 | req.que ... /g, '') | tst.js:97:5:97:46 | obj[req ... g, '')] |
|
||||
| tst.js:97:9:97:45 | req.que ... /g, '') | tst.js:97:5:97:46 | obj[req ... g, '')] |
|
||||
#select
|
||||
| tst.js:8:5:8:17 | object[taint] | tst.js:5:24:5:37 | req.query.data | tst.js:8:5:8:17 | object[taint] | This assignment may alter Object.prototype if a malicious '__proto__' string is injected from $@. | tst.js:5:24:5:37 | req.query.data | here |
|
||||
| tst.js:9:5:9:17 | object[taint] | tst.js:5:24:5:37 | req.query.data | tst.js:9:5:9:17 | object[taint] | This assignment may alter Object.prototype if a malicious '__proto__' string is injected from $@. | tst.js:5:24:5:37 | req.query.data | here |
|
||||
| tst.js:14:5:14:32 | unsafeG ... taint) | tst.js:5:24:5:37 | req.query.data | tst.js:14:5:14:32 | unsafeG ... taint) | This assignment may alter Object.prototype if a malicious '__proto__' string is injected from $@. | tst.js:5:24:5:37 | req.query.data | here |
|
||||
| tst.js:34:5:34:7 | obj | tst.js:5:24:5:37 | req.query.data | tst.js:34:5:34:7 | obj | This assignment may alter Object.prototype if a malicious '__proto__' string is injected from $@. | tst.js:5:24:5:37 | req.query.data | here |
|
||||
| tst.js:39:9:39:11 | obj | tst.js:5:24:5:37 | req.query.data | tst.js:39:9:39:11 | obj | This assignment may alter Object.prototype if a malicious '__proto__' string is injected from $@. | tst.js:5:24:5:37 | req.query.data | here |
|
||||
| tst.js:45:9:45:11 | obj | tst.js:5:24:5:37 | req.query.data | tst.js:45:9:45:11 | obj | This assignment may alter Object.prototype if a malicious '__proto__' string is injected from $@. | tst.js:5:24:5:37 | req.query.data | here |
|
||||
| tst.js:48:9:48:11 | obj | tst.js:5:24:5:37 | req.query.data | tst.js:48:9:48:11 | obj | This assignment may alter Object.prototype if a malicious '__proto__' string is injected from $@. | tst.js:5:24:5:37 | req.query.data | here |
|
||||
| lib.js:6:7:6:9 | obj | lib.js:1:43:1:46 | path | lib.js:6:7:6:9 | obj | This assignment may alter Object.prototype if a malicious '__proto__' string is injected from $@. | lib.js:1:43:1:46 | path | library input |
|
||||
| lib.js:15:3:15:14 | obj[path[0]] | lib.js:14:38:14:41 | path | lib.js:15:3:15:14 | obj[path[0]] | This assignment may alter Object.prototype if a malicious '__proto__' string is injected from $@. | lib.js:14:38:14:41 | path | library input |
|
||||
| lib.js:22:3:22:14 | obj[path[0]] | lib.js:20:14:20:25 | arguments[1] | lib.js:22:3:22:14 | obj[path[0]] | This assignment may alter Object.prototype if a malicious '__proto__' string is injected from $@. | lib.js:20:14:20:25 | arguments[1] | library input |
|
||||
| lib.js:26:10:26:21 | obj[path[0]] | lib.js:25:44:25:47 | path | lib.js:26:10:26:21 | obj[path[0]] | This assignment may alter Object.prototype if a malicious '__proto__' string is injected from $@. | lib.js:25:44:25:47 | path | library input |
|
||||
| lib.js:34:3:34:14 | obj[path[0]] | lib.js:32:14:32:20 | args[1] | lib.js:34:3:34:14 | obj[path[0]] | This assignment may alter Object.prototype if a malicious '__proto__' string is injected from $@. | lib.js:32:14:32:20 | args[1] | library input |
|
||||
| lib.js:42:3:42:14 | obj[path[0]] | lib.js:40:14:40:20 | args[1] | lib.js:42:3:42:14 | obj[path[0]] | This assignment may alter Object.prototype if a malicious '__proto__' string is injected from $@. | lib.js:40:14:40:20 | args[1] | library input |
|
||||
| lib.js:70:13:70:24 | obj[path[0]] | lib.js:59:18:59:18 | s | lib.js:70:13:70:24 | obj[path[0]] | This assignment may alter Object.prototype if a malicious '__proto__' string is injected from $@. | lib.js:59:18:59:18 | s | library input |
|
||||
| lib.js:87:10:87:14 | proto | lib.js:83:14:83:25 | arguments[1] | lib.js:87:10:87:14 | proto | This assignment may alter Object.prototype if a malicious '__proto__' string is injected from $@. | lib.js:83:14:83:25 | arguments[1] | library input |
|
||||
| tst.js:8:5:8:17 | object[taint] | tst.js:5:24:5:37 | req.query.data | tst.js:8:5:8:17 | object[taint] | This assignment may alter Object.prototype if a malicious '__proto__' string is injected from $@. | tst.js:5:24:5:37 | req.query.data | user controlled input |
|
||||
| tst.js:9:5:9:17 | object[taint] | tst.js:5:24:5:37 | req.query.data | tst.js:9:5:9:17 | object[taint] | This assignment may alter Object.prototype if a malicious '__proto__' string is injected from $@. | tst.js:5:24:5:37 | req.query.data | user controlled input |
|
||||
| tst.js:14:5:14:32 | unsafeG ... taint) | tst.js:5:24:5:37 | req.query.data | tst.js:14:5:14:32 | unsafeG ... taint) | This assignment may alter Object.prototype if a malicious '__proto__' string is injected from $@. | tst.js:5:24:5:37 | req.query.data | user controlled input |
|
||||
| tst.js:34:5:34:7 | obj | tst.js:5:24:5:37 | req.query.data | tst.js:34:5:34:7 | obj | This assignment may alter Object.prototype if a malicious '__proto__' string is injected from $@. | tst.js:5:24:5:37 | req.query.data | user controlled input |
|
||||
| tst.js:39:9:39:11 | obj | tst.js:5:24:5:37 | req.query.data | tst.js:39:9:39:11 | obj | This assignment may alter Object.prototype if a malicious '__proto__' string is injected from $@. | tst.js:5:24:5:37 | req.query.data | user controlled input |
|
||||
| tst.js:45:9:45:11 | obj | tst.js:5:24:5:37 | req.query.data | tst.js:45:9:45:11 | obj | This assignment may alter Object.prototype if a malicious '__proto__' string is injected from $@. | tst.js:5:24:5:37 | req.query.data | user controlled input |
|
||||
| tst.js:48:9:48:11 | obj | tst.js:5:24:5:37 | req.query.data | tst.js:48:9:48:11 | obj | This assignment may alter Object.prototype if a malicious '__proto__' string is injected from $@. | tst.js:5:24:5:37 | req.query.data | user controlled input |
|
||||
| tst.js:80:5:80:17 | object[taint] | tst.js:77:24:77:37 | req.query.data | tst.js:80:5:80:17 | object[taint] | This assignment may alter Object.prototype if a malicious '__proto__' string is injected from $@. | tst.js:77:24:77:37 | req.query.data | user controlled input |
|
||||
| tst.js:82:5:82:22 | object["" + taint] | tst.js:77:24:77:37 | req.query.data | tst.js:82:5:82:22 | object["" + taint] | This assignment may alter Object.prototype if a malicious '__proto__' string is injected from $@. | tst.js:77:24:77:37 | req.query.data | user controlled input |
|
||||
| tst.js:87:9:87:21 | object[taint] | tst.js:77:24:77:37 | req.query.data | tst.js:87:9:87:21 | object[taint] | This assignment may alter Object.prototype if a malicious '__proto__' string is injected from $@. | tst.js:77:24:77:37 | req.query.data | user controlled input |
|
||||
| tst.js:94:5:94:37 | obj[req ... ', '')] | tst.js:94:9:94:19 | req.query.x | tst.js:94:5:94:37 | obj[req ... ', '')] | This assignment may alter Object.prototype if a malicious '__proto__' string is injected from $@. | tst.js:94:9:94:19 | req.query.x | user controlled input |
|
||||
| tst.js:97:5:97:46 | obj[req ... g, '')] | tst.js:97:9:97:19 | req.query.x | tst.js:97:5:97:46 | obj[req ... g, '')] | This assignment may alter Object.prototype if a malicious '__proto__' string is injected from $@. | tst.js:97:9:97:19 | req.query.x | user controlled input |
|
||||
|
||||
@@ -0,0 +1,96 @@
|
||||
module.exports.set = function recSet(obj, path, value) {
|
||||
var currentPath = path[0];
|
||||
var currentValue = obj[currentPath];
|
||||
if (path.length === 1) {
|
||||
if (currentValue === void 0) {
|
||||
obj[currentPath] = value; // NOT OK
|
||||
}
|
||||
return currentValue;
|
||||
}
|
||||
|
||||
return recSet(obj[currentPath], path.slice(1), value);
|
||||
}
|
||||
|
||||
module.exports.set2 = function (obj, path, value) {
|
||||
obj[path[0]][path[1]] = value; // NOT OK
|
||||
}
|
||||
|
||||
module.exports.setWithArgs = function() {
|
||||
var obj = arguments[0];
|
||||
var path = arguments[1];
|
||||
var value = arguments[2];
|
||||
obj[path[0]][path[1]] = value; // NOT OK
|
||||
}
|
||||
|
||||
module.exports.usedInTest = function (obj, path, value) {
|
||||
return obj[path[0]][path[1]] = value; // NOT OK
|
||||
}
|
||||
|
||||
module.exports.setWithArgs2 = function() {
|
||||
const args = Array.prototype.slice.call(arguments);
|
||||
var obj = args[0];
|
||||
var path = args[1];
|
||||
var value = args[2];
|
||||
obj[path[0]][path[1]] = value; // NOT OK
|
||||
}
|
||||
|
||||
module.exports.setWithArgs3 = function() {
|
||||
const args = Array.from(arguments);
|
||||
var obj = args[0];
|
||||
var path = args[1];
|
||||
var value = args[2];
|
||||
obj[path[0]][path[1]] = value; // NOT OK
|
||||
}
|
||||
|
||||
function id(s) {
|
||||
return s;
|
||||
}
|
||||
|
||||
module.exports.id = id;
|
||||
|
||||
module.exports.notVulnerable = function () {
|
||||
const path = id("x");
|
||||
const value = id("y");
|
||||
const obj = id("z");
|
||||
return (obj[path[0]][path[1]] = value); // OK
|
||||
}
|
||||
|
||||
class Foo {
|
||||
constructor(o, s, v) {
|
||||
this.obj = o;
|
||||
this.path = s;
|
||||
this.value = v;
|
||||
}
|
||||
|
||||
doXss() {
|
||||
// not called here, but still bad.
|
||||
const obj = this.obj;
|
||||
const path = this.path;
|
||||
const value = this.value;
|
||||
return (obj[path[0]][path[1]] = value); // NOT OK
|
||||
}
|
||||
|
||||
safe() {
|
||||
const obj = this.obj;
|
||||
obj[path[0]] = this.value; // OK
|
||||
}
|
||||
}
|
||||
|
||||
module.exports.Foo = Foo;
|
||||
|
||||
module.exports.delete = function() {
|
||||
var obj = arguments[0];
|
||||
var path = arguments[1];
|
||||
delete obj[path[0]]; // OK
|
||||
var prop = arguments[2];
|
||||
var proto = obj[path[0]];
|
||||
delete proto[prop]; // NOT OK
|
||||
}
|
||||
|
||||
module.exports.fixedProp = function (obj, path, value) {
|
||||
var maybeProto = obj[path];
|
||||
maybeProto.foo = value; // OK - fixed properties from library inputs are OK.
|
||||
|
||||
var i = 0;
|
||||
maybeProto[i + 2] = value; // OK - number properties are OK.
|
||||
}
|
||||
@@ -0,0 +1,9 @@
|
||||
const lib = require("./lib");
|
||||
|
||||
describe("lib", () => {
|
||||
it("should work", () => {
|
||||
const obj = Object.create(null);
|
||||
|
||||
lib.usedInTest(obj, "foo", "my-value");
|
||||
});
|
||||
});
|
||||
@@ -0,0 +1,5 @@
|
||||
{
|
||||
"name": "my-lib",
|
||||
"version": "0.0.7",
|
||||
"main": "./lib.js"
|
||||
}
|
||||
@@ -71,3 +71,29 @@ class Box {
|
||||
this.foo = 'bar'; // OK - 'this' won't refer to Object.prototype
|
||||
}
|
||||
}
|
||||
|
||||
|
||||
app.get('/', (req, res) => {
|
||||
let taint = String(req.query.data);
|
||||
|
||||
let object = {};
|
||||
object[taint][taint] = taint; // NOT OK
|
||||
|
||||
object["" + taint]["" + taint] = taint; // NOT OK
|
||||
|
||||
if (!taint.includes("__proto__")) {
|
||||
object[taint][taint] = taint; // OK
|
||||
} else {
|
||||
object[taint][taint] = taint; // NOT OK
|
||||
}
|
||||
});
|
||||
|
||||
app.get('/foo', (req, res) => {
|
||||
let obj = {};
|
||||
obj[req.query.x.replace('_', '-')].x = 'foo'; // OK
|
||||
obj[req.query.x.replace('_', '')].x = 'foo'; // NOT OK
|
||||
obj[req.query.x.replace(/_/g, '')].x = 'foo'; // OK
|
||||
obj[req.query.x.replace(/_/g, '-')].x = 'foo'; // OK
|
||||
obj[req.query.x.replace(/__proto__/g, '')].x = 'foo'; // NOT OK - "__pr__proto__oto__"
|
||||
obj[req.query.x.replace('o', '0')].x = 'foo'; // OK
|
||||
});
|
||||
|
||||
Reference in New Issue
Block a user