hohn/codeql
1
0
Fork 0
mirror of https://github.com/github/codeql.git synced 2025-12-16 16:53:25 +01:00
Code Issues Packages Projects Releases Wiki Activity

Added test case for CreatePreparedStatementCommand

Browse Source
This commit is contained in:
Napalys Klicius
2025-09-04 12:28:55 +02:00
parent b89e70b5a0
commit 872b6d8bee
1 changed files with 15 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files

17
javascript/ql/test/query-tests/Security/CWE-089/untyped/athena.js
View File

@@ -1,4 +1,4 @@
const { AthenaClient, StartQueryExecutionCommand, CreateNamedQueryCommand, UpdateNamedQueryCommand } = require("@aws-sdk/client-athena");
const { AthenaClient, StartQueryExecutionCommand, CreateNamedQueryCommand, UpdateNamedQueryCommand, CreatePreparedStatementCommand } = require("@aws-sdk/client-athena");
const AWS = require('aws-sdk');
const express = require('express');
const bodyParser = require('body-parser');
@@ -10,7 +10,7 @@ app.post('/v3/athena/all', async (req, res) => {
const client = new AthenaClient({ region: "us-east-1" });
const params1 = {
const params1 = {
QueryString: "SQL" + userQuery,
QueryExecutionContext: { Database: "default" },
ResultConfiguration: { OutputLocation: "s3://my-results/" }
@@ -70,3 +70,16 @@ app.post('/v2/athena/all', async (req, res) => {
res.end();
});
app.post('/dynamodb-v3', async (req, res) => {
const userQueryStatement = req.body.query; // $ MISSING: Source
const client = new AthenaClient({ region: "us-east-1" });
const input = {
StatementName: "STRING_VALUE",
WorkGroup: "STRING_VALUE",
QueryStatement: userQueryStatement,
Description: "STRING_VALUE",
};
const command = new CreatePreparedStatementCommand(input);
await client.send(command); // $ MISSING: Alert
});