hohn/codeql
1
0
Fork 0
mirror of https://github.com/github/codeql.git synced 2026-04-25 16:55:19 +02:00
Code Issues Packages Projects Releases Wiki Activity

Added test cases for fs-extra missing features.

Browse Source
This commit is contained in:
Napalys
2025-03-27 10:06:08 +01:00
parent dc242da4be
commit 96a550582b
1 changed files with 33 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

33
javascript/ql/test/query-tests/Security/CWE-022/TaintedPath/more-fs-extra.js Normal file
View File

@@ -0,0 +1,33 @@
const express = require('express');
const fs = require('fs-extra');
const app = express();
app.use(express.json());
app.post('/rmsync', (req, res) => {
const { filename } = req.body; // $ MISSING: Source
fs.rmSync(filename); // MISSING: $ Alert
fs.rm(filename); // MISSING: $ Alert
fs.rmdir(filename); // MISSING: $ Alert
fs.rmdirSync(filename); // MISSING: $ Alert
fs.cp(filename, "destination"); // MISSING: $ Alert
fs.cp("source", filename); // MISSING: $ Alert
fs.copyFileSync(filename, "destination"); // MISSING: $ Alert
fs.copyFileSync("source", filename); // MISSING: $ Alert
fs.cpSync(filename, "destination"); // MISSING: $ Alert
fs.cpSync("source", filename); // MISSING: $ Alert
fs.emptydirSync(filename); // MISSING: $ Alert
fs.emptydir(filename); // MISSING: $ Alert
fs.opendir(filename); // $ MISSING: Alert
fs.opendirSync(filename); // $ MISSING: Alert
fs.openAsBlob(filename); // $ MISSING: Alert
fs.statfs(filename); // $ MISSING: Alert
fs.statfsSync(filename); // $ MISSING: Alert
fs.open(filename, 'r'); // $ MISSING: Alert
fs.openSync(filename, 'r'); // $ MISSING: Alert
fs.outputJSONSync(filename, req.body.data, { spaces: 2 }); // $ MISSING: Alert
fs.lutimes(filename, new Date(req.body.atime), new Date(req.body.mtime)); // MISSING: $ Alert
fs.lutimesSync(filename, new Date(req.body.atime), new Date(req.body.mtime)); // MISSING: $ Alert
fs.outputJsonSync(filename, { timestamp: new Date().toISOString(), action: req.body.action, user: req.body.user}, { spaces: 2 }); // $ MISSING: Alert
});