hohn/codeql
1
0
Fork 0
mirror of https://github.com/github/codeql.git synced 2026-04-25 08:45:14 +02:00
Code Issues Packages Projects Releases Wiki Activity

Tests for InsecureHelmet

Browse Source
This commit is contained in:
aegilops
2024-05-20 12:05:42 +01:00
parent 3a885eaf9f
commit 8300aeb0a0
4 changed files with 34 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

2
javascript/ql/test/query-tests/Security/CWE-693/InsecureHelment.expected Normal file
View File

@@ -0,0 +1,2 @@
| InsecureHelmetBad.js:7:5:7:32 | content ... : false | Helmet route handler, called with $@ set to 'false' | InsecureHelmetBad.js:7:5:7:32 | content ... : false | contentSecurityPolicy |
| InsecureHelmetBad.js:8:5:8:21 | frameguard: false | Helmet route handler, called with $@ set to 'false' | InsecureHelmetBad.js:8:5:8:21 | frameguard: false | frameguard |

1
javascript/ql/test/query-tests/Security/CWE-693/InsecureHelment.qlref Normal file
View File

@@ -0,0 +1 @@
Security/CWE-693/InsecureHelmet.ql

17
javascript/ql/test/query-tests/Security/CWE-693/InsecureHelmetBad.js Normal file
View File

@@ -0,0 +1,17 @@
const express = require("express");
const helmet = require("helmet");
const app = express();
app.use(helmet({
contentSecurityPolicy: false, // BAD: switch off default CSP
frameguard: false // BAD: switch off default frameguard
}));
app.get("/", (req, res) => {
res.send("Hello, world!");
});
app.listen(3000, () => {
console.log("App is listening on port 3000");
});

14
javascript/ql/test/query-tests/Security/CWE-693/InsecureHelmetGood.js Normal file
View File

@@ -0,0 +1,14 @@
const express = require("express");
const helmet = require("helmet");
const app = express();
app.use(helmet()); // GOOD: use the defaults
app.get("/", (req, res) => {
res.send("Hello, world!");
});
app.listen(3000, () => {
console.log("App is listening on port 3000");
});