hohn/codeql
1
0
Fork 0
mirror of https://github.com/github/codeql.git synced 2026-04-26 17:25:19 +02:00
Code Issues Packages Projects Releases Wiki Activity

Added test cases for fastify.addHook

Browse Source
This commit is contained in:
Napalys
2025-04-15 09:33:41 +02:00
parent f1a3293f4c
commit c175081698
3 changed files with 125 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

13
javascript/ql/test/query-tests/Security/CWE-094/CodeInjection/CodeInjection.expected
View File

@@ -27,6 +27,10 @@
| express.js:20:34:20:38 | taint | express.js:19:17:19:35 | req.param("wobble") | express.js:20:34:20:38 | taint | This code execution depends on a $@. | express.js:19:17:19:35 | req.param("wobble") | user-provided value |
| express.js:36:15:36:19 | taint | express.js:27:17:27:35 | req.param("wobble") | express.js:36:15:36:19 | taint | This code execution depends on a $@. | express.js:27:17:27:35 | req.param("wobble") | user-provided value |
| express.js:43:10:43:12 | msg | express.js:42:30:42:32 | msg | express.js:43:10:43:12 | msg | This code execution depends on a $@. | express.js:42:30:42:32 | msg | user-provided value |
| fastify.js:58:44:58:52 | userInput | fastify.js:57:21:57:33 | request.query | fastify.js:58:44:58:52 | userInput | This code execution depends on a $@. | fastify.js:57:21:57:33 | request.query | user-provided value |
| fastify.js:58:44:58:52 | userInput | fastify.js:57:21:57:39 | request.query.input | fastify.js:58:44:58:52 | userInput | This code execution depends on a $@. | fastify.js:57:21:57:39 | request.query.input | user-provided value |
| fastify.js:59:23:59:31 | userInput | fastify.js:57:21:57:33 | request.query | fastify.js:59:23:59:31 | userInput | This code execution depends on a $@. | fastify.js:57:21:57:33 | request.query | user-provided value |
| fastify.js:59:23:59:31 | userInput | fastify.js:57:21:57:39 | request.query.input | fastify.js:59:23:59:31 | userInput | This code execution depends on a $@. | fastify.js:57:21:57:39 | request.query.input | user-provided value |
| module.js:9:16:9:29 | req.query.code | module.js:9:16:9:29 | req.query.code | module.js:9:16:9:29 | req.query.code | This code execution depends on a $@. | module.js:9:16:9:29 | req.query.code | user-provided value |
| module.js:11:17:11:30 | req.query.code | module.js:11:17:11:30 | req.query.code | module.js:11:17:11:30 | req.query.code | This code execution depends on a $@. | module.js:11:17:11:30 | req.query.code | user-provided value |
| react-native.js:8:32:8:38 | tainted | react-native.js:7:17:7:33 | req.param("code") | react-native.js:8:32:8:38 | tainted | This code execution depends on a $@. | react-native.js:7:17:7:33 | req.param("code") | user-provided value |
@@ -75,6 +79,10 @@ edges
| express.js:27:9:27:35 | taint | express.js:36:15:36:19 | taint | provenance | |
| express.js:27:17:27:35 | req.param("wobble") | express.js:27:9:27:35 | taint | provenance | |
| express.js:42:30:42:32 | msg | express.js:43:10:43:12 | msg | provenance | |
| fastify.js:57:9:57:39 | userInput | fastify.js:58:44:58:52 | userInput | provenance | |
| fastify.js:57:9:57:39 | userInput | fastify.js:59:23:59:31 | userInput | provenance | |
| fastify.js:57:21:57:33 | request.query | fastify.js:57:9:57:39 | userInput | provenance | |
| fastify.js:57:21:57:39 | request.query.input | fastify.js:57:9:57:39 | userInput | provenance | |
| react-native.js:7:7:7:33 | tainted | react-native.js:8:32:8:38 | tainted | provenance | |
| react-native.js:7:7:7:33 | tainted | react-native.js:10:23:10:29 | tainted | provenance | |
| react-native.js:7:17:7:33 | req.param("code") | react-native.js:7:7:7:33 | tainted | provenance | |
@@ -144,6 +152,11 @@ nodes
| express.js:36:15:36:19 | taint | semmle.label | taint |
| express.js:42:30:42:32 | msg | semmle.label | msg |
| express.js:43:10:43:12 | msg | semmle.label | msg |
| fastify.js:57:9:57:39 | userInput | semmle.label | userInput |
| fastify.js:57:21:57:33 | request.query | semmle.label | request.query |
| fastify.js:57:21:57:39 | request.query.input | semmle.label | request.query.input |
| fastify.js:58:44:58:52 | userInput | semmle.label | userInput |
| fastify.js:59:23:59:31 | userInput | semmle.label | userInput |
| module.js:9:16:9:29 | req.query.code | semmle.label | req.query.code |
| module.js:11:17:11:30 | req.query.code | semmle.label | req.query.code |
| react-native.js:7:7:7:33 | tainted | semmle.label | tainted |

9
javascript/ql/test/query-tests/Security/CWE-094/CodeInjection/HeuristicSourceCodeInjection.expected
View File

@@ -11,6 +11,10 @@ edges
| express.js:27:9:27:35 | taint | express.js:36:15:36:19 | taint | provenance | |
| express.js:27:17:27:35 | req.param("wobble") | express.js:27:9:27:35 | taint | provenance | |
| express.js:42:30:42:32 | msg | express.js:43:10:43:12 | msg | provenance | |
| fastify.js:57:9:57:39 | userInput | fastify.js:58:44:58:52 | userInput | provenance | |
| fastify.js:57:9:57:39 | userInput | fastify.js:59:23:59:31 | userInput | provenance | |
| fastify.js:57:21:57:33 | request.query | fastify.js:57:9:57:39 | userInput | provenance | |
| fastify.js:57:21:57:39 | request.query.input | fastify.js:57:9:57:39 | userInput | provenance | |
| react-native.js:7:7:7:33 | tainted | react-native.js:8:32:8:38 | tainted | provenance | |
| react-native.js:7:7:7:33 | tainted | react-native.js:10:23:10:29 | tainted | provenance | |
| react-native.js:7:17:7:33 | req.param("code") | react-native.js:7:7:7:33 | tainted | provenance | |
@@ -82,6 +86,11 @@ nodes
| express.js:36:15:36:19 | taint | semmle.label | taint |
| express.js:42:30:42:32 | msg | semmle.label | msg |
| express.js:43:10:43:12 | msg | semmle.label | msg |
| fastify.js:57:9:57:39 | userInput | semmle.label | userInput |
| fastify.js:57:21:57:33 | request.query | semmle.label | request.query |
| fastify.js:57:21:57:39 | request.query.input | semmle.label | request.query.input |
| fastify.js:58:44:58:52 | userInput | semmle.label | userInput |
| fastify.js:59:23:59:31 | userInput | semmle.label | userInput |
| module.js:9:16:9:29 | req.query.code | semmle.label | req.query.code |
| module.js:11:17:11:30 | req.query.code | semmle.label | req.query.code |
| react-native.js:7:7:7:33 | tainted | semmle.label | tainted |

103
javascript/ql/test/query-tests/Security/CWE-094/CodeInjection/fastify.js Normal file
View File

@@ -0,0 +1,103 @@
const fastify = require('fastify')({ logger: true });
fastify.addHook('onRequest', async (request, reply) => {
const userInput = request.query.onRequest; // $ MISSING: Source[js/code-injection]
if (userInput) request.evalResult = eval(userInput); // $ MISSING: Alert[js/code-injection]
});
fastify.addHook('onSend', async (request, reply, payload) => {
const userInput = request.query.onSend; // $ MISSING: Source[js/code-injection]
if (userInput) request.evalResult = eval(userInput); // $ MISSING: Alert[js/code-injection]
return JSON.stringify({ ...JSON.parse(payload), onSend: request.evalResult });
});
fastify.addHook('preParsing', async (request, reply, payload) => {
const userInput = request.query.preParsing; // $ MISSING: Source[js/code-injection]
if (userInput) request.evalResult = eval(userInput); // $ MISSING: Alert[js/code-injection]
return payload;
});
fastify.addHook('preValidation', async (request, reply) => {
const userInput = request.query.preValidation; // $ MISSING: Source[js/code-injection]
if (userInput) request.evalResult = eval(userInput); // $ MISSING: Alert[js/code-injection]
});
fastify.addHook('preHandler', async (request, reply) => {
const userInput = request.query.preHandler; // $ MISSING: Source[js/code-injection]
if (userInput) request.evalResult = eval(userInput); // $ MISSING: Alert[js/code-injection]
});
fastify.addHook('preSerialization', async (request, reply, payload) => {
const userInput = request.query.preSerialization; // $ MISSING: Source[js/code-injection]
if (userInput) request.evalResult = eval(userInput); // $ MISSING: Alert[js/code-injection]
return payload;
});
fastify.addHook('onResponse', async (request, reply) => {
const userInput = request.query.onResponse; // $ MISSING: Source[js/code-injection]
if (userInput) request.evalResult = eval(userInput); // $ MISSING: Alert[js/code-injection]
});
fastify.addHook('onError', async (request, reply, error) => {
const userInput = request.query.onError; // $ MISSING: Source[js/code-injection]
if (userInput) request.evalResult = eval(userInput); // $ MISSING: Alert[js/code-injection]
});
fastify.addHook('onTimeout', async (request, reply) => {
const userInput = request.query.onTimeout; // $ MISSING: Source[js/code-injection]
if (userInput) request.evalResult = eval(userInput); // $ MISSING: Alert[js/code-injection]
});
fastify.addHook('onRequestAbort', (request, done) => {
const userInput = request.query.onRequestAbort; // $ MISSING: Source[js/code-injection]
if (userInput) request.evalResult = eval(userInput); // $ MISSING: Alert[js/code-injection]
});
fastify.get('/dangerous', async (request, reply) => {
const userInput = request.query.input; // $ Source[js/code-injection]
if (userInput) request.evalResult = eval(userInput); // $ Alert[js/code-injection]
const result = eval(userInput); // $ Alert[js/code-injection]
return { result };
});
// Store user input in request object
fastify.addHook('preHandler', async (request, reply) => {
request.storedCode = request.query.storedCode;
});
fastify.get('/flow-through-request', async (request, reply) => {
// Use the stored code from previous hook
if (request.storedCode) {
const evaluatedResult = eval(request.storedCode); // $ MISSING: Alert[js/code-injection]
return { result: evaluatedResult };
}
return { result: null };
});
// Store user input in reply object
fastify.addHook('onRequest', async (request, reply) => {
reply.userCode = request.query.replyCode;
});
fastify.get('/flow-through-reply', async (request, reply) => {
// Use the code stored in reply object
if (reply.userCode) {
const replyResult = eval(reply.userCode); // $ MISSING: Alert[js/code-injection]
return { result: replyResult };
}
return { result: null };
});
// Store user input in reply object
fastify.addHook('onRequest', async (request, reply) => {
reply.locals = reply.locals || {};
reply.locals.nestedCode = request.query.replyCode;
});
fastify.get('/flow-through-reply', async (request, reply) => {
// Use the code stored in reply object
if (reply.locals && reply.locals.nestedCode) {
const replyResult = eval(reply.locals.nestedCode); // $ MISSING: Alert[js/code-injection]
return { result: replyResult };
}
return { result: null };
});