hohn/codeql
1
0
Fork 0
mirror of https://github.com/github/codeql.git synced 2026-05-04 21:25:44 +02:00
Code Issues Packages Projects Releases Wiki Activity

filter away paths that start with libary inputs and end with a fixed-property write

Browse Source
This commit is contained in:
Erik Krogh Kristensen
2021-10-27 21:01:11 +02:00
parent 78371894f4
commit 96b6f670d9
3 changed files with 28 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files

13
javascript/ql/test/query-tests/Security/CWE-915/PrototypePollutingAssignment/PrototypePollutingAssignment.expected
View File

@@ -79,6 +79,13 @@ nodes
| lib.js:86:19:86:25 | path[0] |
| lib.js:87:10:87:14 | proto |
| lib.js:87:10:87:14 | proto |
| lib.js:90:43:90:46 | path |
| lib.js:90:43:90:46 | path |
| lib.js:91:7:91:28 | maybeProto |
| lib.js:91:20:91:28 | obj[path] |
| lib.js:91:24:91:27 | path |
| lib.js:92:3:92:12 | maybeProto |
| lib.js:92:3:92:12 | maybeProto |
| tst.js:5:9:5:38 | taint |
| tst.js:5:17:5:38 | String( ... y.data) |
| tst.js:5:24:5:37 | req.query.data |
@@ -192,6 +199,12 @@ edges
| lib.js:86:15:86:26 | obj[path[0]] | lib.js:86:7:86:26 | proto |
| lib.js:86:19:86:22 | path | lib.js:86:19:86:25 | path[0] |
| lib.js:86:19:86:25 | path[0] | lib.js:86:15:86:26 | obj[path[0]] |
| lib.js:90:43:90:46 | path | lib.js:91:24:91:27 | path |
| lib.js:90:43:90:46 | path | lib.js:91:24:91:27 | path |
| lib.js:91:7:91:28 | maybeProto | lib.js:92:3:92:12 | maybeProto |
| lib.js:91:7:91:28 | maybeProto | lib.js:92:3:92:12 | maybeProto |
| lib.js:91:20:91:28 | obj[path] | lib.js:91:7:91:28 | maybeProto |
| lib.js:91:24:91:27 | path | lib.js:91:20:91:28 | obj[path] |
| tst.js:5:9:5:38 | taint | tst.js:8:12:8:16 | taint |
| tst.js:5:9:5:38 | taint | tst.js:9:12:9:16 | taint |
| tst.js:5:9:5:38 | taint | tst.js:12:25:12:29 | taint |

7
javascript/ql/test/query-tests/Security/CWE-915/PrototypePollutingAssignment/lib.js
View File

@@ -84,5 +84,10 @@ module.exports.delete = function() {
delete obj[path[0]]; // OK
var prop = arguments[2];
var proto = obj[path[0]];
delete proto[prop]; // NOT
delete proto[prop]; // NOT OK
}
module.exports.fixedProp = function (obj, path, value) {
var maybeProto = obj[path];
maybeProto.foo = value; // OK - fixed properties from library inputs are OK.
}