hohn/codeql
1
0
Fork 0
mirror of https://github.com/github/codeql.git synced 2026-05-03 12:45:27 +02:00
Code Issues Packages Projects Releases Wiki Activity

JavaScript: Add two new command-injection tests.

Browse Source
This commit is contained in:
Max Schaefer
2020-09-23 09:45:30 +01:00
parent 54c35748f0
commit 825fc2228b
4 changed files with 41 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

2
javascript/ql/test/query-tests/Security/CWE-078/Consistency.expected
View File

@@ -0,0 +1,2 @@
| query-tests/Security/CWE-078/exec-sh2.js:10 | expected an alert, but found none | BAD | ComandInjection |
| query-tests/Security/CWE-078/exec-sh.js:15 | expected an alert, but found none | BAD | ComandInjection |

2
javascript/ql/test/query-tests/Security/CWE-078/UselessUseOfCat.expected
View File

@@ -94,6 +94,8 @@ options
| child_process-test.js:56:5:56:59 | cp.spaw ... cmd])) | child_process-test.js:56:25:56:58 | ['/C', ... , cmd]) |
| child_process-test.js:57:5:57:50 | cp.spaw ... t(cmd)) | child_process-test.js:57:25:57:49 | ['/C', ... at(cmd) |
| child_process-test.js:67:3:67:21 | cp.spawn(cmd, args) | child_process-test.js:67:17:67:20 | args |
| exec-sh2.js:10:12:10:57 | cp.spaw ... ptions) | exec-sh2.js:10:50:10:56 | options |
| exec-sh.js:15:12:15:61 | cp.spaw ... ptions) | exec-sh.js:15:54:15:60 | options |
| lib/lib.js:152:2:152:23 | cp.spaw ... gs, cb) | lib/lib.js:152:21:152:22 | cb |
| lib/lib.js:159:2:159:23 | cp.spaw ... gs, cb) | lib/lib.js:159:21:159:22 | cb |
| lib/lib.js:163:2:167:2 | cp.spaw ... t' }\\n\\t) | lib/lib.js:166:3:166:22 | { stdio: 'inherit' } |

21
javascript/ql/test/query-tests/Security/CWE-078/exec-sh.js Normal file
View File

@@ -0,0 +1,21 @@
const cp = require('child_process'),
http = require('http'),
url = require('url');
function getShell() {
if (process.platform === 'win32') {
return { cmd: 'cmd', arg: '/C' }
} else {
return { cmd: 'sh', arg: '-c' }
}
}
function execSh(command, options) {
var shell = getShell()
return cp.spawn(shell.cmd, [shell.arg, command], options) // BAD
}
http.createServer(function (req, res) {
let cmd = url.parse(req.url, true).query.path;
execSh(cmd);
});

16
javascript/ql/test/query-tests/Security/CWE-078/exec-sh2.js Normal file
View File

@@ -0,0 +1,16 @@
const cp = require('child_process'),
http = require('http'),
url = require('url');
function getShell() {
return "sh";
}
function execSh(command, options) {
return cp.spawn(getShell(), ["-c", command], options) // BAD
};
http.createServer(function (req, res) {
let cmd = url.parse(req.url, true).query.path;
execSh(cmd);
});