hohn/codeql
1
0
Fork 0
mirror of https://github.com/github/codeql.git synced 2026-05-03 04:39:29 +02:00
Code Issues Packages Projects Releases Wiki Activity

fixed mistake in examples

Browse Source
This commit is contained in:
Naman Jain
2022-02-03 09:29:42 +00:00
parent aea7054938
commit adc8bf37fe
4 changed files with 37 additions and 17 deletions
Download Patch File Download Diff File Expand all files Collapse all files

10
javascript/ql/test/query-tests/Security/CWE-754/UnvalidatedDynamicMethodCall2.js
View File

@@ -3,13 +3,13 @@ var app = express();
var actions = new Map();
actions.put("play", function play(data) {
// ...
// ...
});
actions.put("pause", function pause(data) {
// ...
// ...
});
app.get('/perform/:action/:payload', function(req, res) {
let action = actions.get(req.params.action);
res.end(action.get(req.params.payload)); // NOT OK
});
let action = actions.get(req.params.action);
res.end(action(req.params.payload)); // NOT OK
});

14
javascript/ql/test/query-tests/Security/CWE-754/UnvalidatedDynamicMethodCall3.js
View File

@@ -3,15 +3,15 @@ var app = express();
var actions = new Map();
actions.put("play", function play(data) {
// ...
// ...
});
actions.put("pause", function pause(data) {
// ...
// ...
});
app.get('/perform/:action/:payload', function(req, res) {
if (actions.has(req.params.action)){
let action = actions.get(req.params.action);
res.end(action.get(req.params.payload)); // NOT OK, but not flagged [INCONSISTENCY]
}
});
if (actions.has(req.params.action)) {
let action = actions.get(req.params.action);
res.end(action(req.params.payload)); // NOT OK, but not flagged [INCONSISTENCY]
}
});

20
javascript/ql/test/query-tests/Security/CWE-754/UnvalidatedDynamicMethodCall4.js Normal file
View File

@@ -0,0 +1,20 @@
var express = require('express');
var app = express();
var actions = new Map();
actions.put("play", function play(data) {
// ...
});
actions.put("pause", function pause(data) {
// ...
});
app.get('/perform/:action/:payload', function(req, res) {
if (typeof actions.get(req.params.action) === 'function') {
let action = actions.get(req.params.action); // OK but flagged [INCONSISTENCY]
// GOOD: `action` is either the `play` or the `pause` function from above
res.end(action(req.params.payload));
} else {
res.end("Unsupported action.");
}
});

10
javascript/ql/test/query-tests/Security/CWE-754/UnvalidatedDynamicMethodCallGood3.js
View File

@@ -9,12 +9,12 @@ actions.put("pause", function pause(data) {
// ...
});
app.get('/perform/:action/:payload', function (req, res) {
if (typeof actions.get(req.params.action) === 'function') {
let action = actions.get(req.params.action);
// GOOD: `action` is either the `play` or the `pause` function from above
app.get('/perform/:action/:payload', function(req, res) {
let action = actions.get(req.params.action);
// GOOD: `action` is either the `play` or the `pause` function from above
if (typeof action === 'function') {
res.end(action(req.params.payload));
} else {
res.end("Unsupported action.");
}
});
});