hohn/codeql
1
0
Fork 0
mirror of https://github.com/github/codeql.git synced 2026-04-25 16:55:19 +02:00
Code Issues Packages Projects Releases Wiki Activity

JS: Fix some bugs in a test case

Browse Source 
'args' was a redeclared block-level variable, and 'myArgs' was not used when clearly intended to be used
This commit is contained in:
Asger F
2025-02-12 09:51:03 +01:00
parent 22c218d665
commit b095fe2a19
1 changed files with 4 additions and 4 deletions
Download Patch File Download Diff File Expand all files Collapse all files

8
javascript/ql/test/query-tests/Security/CWE-078/CommandInjection/child_process-test.js
View File

@@ -43,12 +43,12 @@ var server = http.createServer(function(req, res) {
args[1] = cmd;
cp.execFile("/bin/bash", args); // $ Alert
let args = [];
args = [];
args[0] = "-c";
args[1] = cmd;
run("sh", args);
let args = [];
args = [];
args[0] = `-` + "c";
args[1] = cmd;
cp.execFile(`/bin` + "/bash", args); // $ Alert
@@ -56,10 +56,10 @@ var server = http.createServer(function(req, res) {
cp.spawn('cmd.exe', ['/C', 'foo'].concat(["bar", cmd])); // $ Alert
cp.spawn('cmd.exe', ['/C', 'foo'].concat(cmd)); // $ Alert
let myArgs = [];
let myArgs = [];
myArgs.push(`-` + "c");
myArgs.push(cmd);
cp.execFile(`/bin` + "/bash", args); // $ MISSING: Alert - no support for `[].push()` for indirect arguments
cp.execFile(`/bin` + "/bash", myArgs); // $ MISSING: Alert - no support for `[].push()` for indirect arguments
});