hohn/codeql
1
0
Fork 0
mirror of https://github.com/github/codeql.git synced 2026-04-21 15:05:56 +02:00
Code Issues Packages Projects Releases Wiki Activity

JS: Add tests for Response object sink

Browse Source
This commit is contained in:
Asger F
2025-04-02 13:47:18 +02:00
parent 887942e3e9
commit 9ebaac82cf
1 changed files with 39 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

39
javascript/ql/test/query-tests/Security/CWE-079/ReflectedXss/response-object.js Normal file
View File

@@ -0,0 +1,39 @@
const express = require('express');
// Note: We're using using express for the taint source in order to to test 'Response'
// in isolation from the more complicated http frameworks.
express().get('/foo', (req) => {
const data = req.body; // $ MISSING: Source
new Response(data); // $ MISSING: Alert
new Response(data, {}); // $ MISSING: Alert
new Response(data, { headers: null }); // $ MISSING: Alert
new Response(data, { headers: { 'content-type': 'text/plain'}});
new Response(data, { headers: { 'content-type': 'text/html'}}); // $ MISSING: Alert
new Response(data, { headers: { 'Content-Type': 'text/plain'}});
new Response(data, { headers: { 'Content-Type': 'text/html'}}); // $ MISSING: Alert
const headers1 = new Headers({ 'content-type': 'text/plain'});
new Response(data, { headers: headers1 });
const headers2 = new Headers({ 'content-type': 'text/html'});
new Response(data, { headers: headers2 }); // $ MISSING: Alert
const headers3 = new Headers();
new Response(data, { headers: headers3 }); // $ MISSING: Alert
const headers4 = new Headers();
headers4.set('content-type', 'text/plain');
new Response(data, { headers: headers4 });
const headers5 = new Headers();
headers5.set('content-type', 'text/html');
new Response(data, { headers: headers5 }); // $ MISSING: Alert
const headers6 = new Headers();
headers6.set('unrelated-header', 'text/plain');
new Response(data, { headers: headers6 }); // $ MISSING: Alert
});