hohn/codeql
1
0
Fork 0
mirror of https://github.com/github/codeql.git synced 2026-04-28 10:15:14 +02:00
Code Issues Packages Projects Releases Wiki Activity

JavaScript: Update qhelp example for CleartextStorage.

Browse Source
This commit is contained in:
Max Schaefer
2019-02-08 08:43:02 +00:00
parent 0be81dacdc
commit aebc5bc6c3
7 changed files with 29 additions and 30 deletions
Download Patch File Download Diff File Expand all files Collapse all files

3
javascript/ql/src/Security/CWE-312/CleartextStorage.qhelp
View File

@@ -35,8 +35,7 @@ causing logged sensitive information to be stored as well.
<example>
<p>
The following example code stores user credentials (in this case, their account
name) in a cookie in plain text:
The following example code stores user credentials (in this case, their password) in a cookie in plain text:
</p>
<sample src="examples/CleartextStorage.js"/>
<p>

6
javascript/ql/src/Security/CWE-312/examples/CleartextStorage.js
View File

@@ -1,8 +1,8 @@
var express = require('express');
var app = express();
app.get('/', function (req, res) {
let accountName = req.param("AccountName");
app.get('/remember-password', function (req, res) {
let pw = req.param("current_password");
// BAD: Setting a cookie value with cleartext sensitive data.
res.cookie("AccountName", accountName);
res.cookie("password", pw);
});

6
javascript/ql/src/Security/CWE-312/examples/CleartextStorageGood.js
View File

@@ -8,8 +8,8 @@ function encrypt(text){
}
var app = express();
app.get('/', function (req, res) {
let accountName = req.param("AccountName");
app.get('/remember-password', function (req, res) {
let pw = req.param("current_password");
// GOOD: Encoding the value before setting it.
res.cookie("AccountName", encrypt(accountName));
res.cookie("password", encrypt(pw));
});