hohn/codeql
1
0
Fork 0
mirror of https://github.com/github/codeql.git synced 2026-05-02 04:05:14 +02:00
Code Issues Packages Projects Releases Wiki Activity

Merge pull request #6286 from erik-krogh/mkdirp

Browse Source 
Approved by asgerf
This commit is contained in:
CodeQL CI
2021-07-16 02:11:07 -07:00
committed by GitHub
parent 6c2c51a767 14b26f2a68
commit c1d0e52492
4 changed files with 325 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

13
javascript/ql/src/semmle/javascript/frameworks/Files.qll
View File

@@ -470,3 +470,16 @@ class Chokidar extends FileNameProducer, FileSystemAccess, API::CallNode {
)
}
}
/**
* A call to the [`mkdirp`](https://www.npmjs.com/package/mkdirp) library.
*/
private class Mkdirp extends FileSystemAccess, API::CallNode {
Mkdirp() {
this = API::moduleImport("mkdirp").getACall()
or
this = API::moduleImport("mkdirp").getMember("sync").getACall()
}
override DataFlow::Node getAPathArgument() { result = getArgument(0) }
}

299
javascript/ql/test/query-tests/Security/CWE-022/TaintedPath/TaintedPath.expected
View File

@@ -2396,6 +2396,126 @@ nodes
| other-fs-libraries.js:63:51:63:54 | path |
| other-fs-libraries.js:63:51:63:54 | path |
| other-fs-libraries.js:63:51:63:54 | path |
| other-fs-libraries.js:68:7:68:48 | path |
| other-fs-libraries.js:68:7:68:48 | path |
| other-fs-libraries.js:68:7:68:48 | path |
| other-fs-libraries.js:68:7:68:48 | path |
| other-fs-libraries.js:68:7:68:48 | path |
| other-fs-libraries.js:68:7:68:48 | path |
| other-fs-libraries.js:68:7:68:48 | path |
| other-fs-libraries.js:68:7:68:48 | path |
| other-fs-libraries.js:68:7:68:48 | path |
| other-fs-libraries.js:68:7:68:48 | path |
| other-fs-libraries.js:68:7:68:48 | path |
| other-fs-libraries.js:68:7:68:48 | path |
| other-fs-libraries.js:68:7:68:48 | path |
| other-fs-libraries.js:68:7:68:48 | path |
| other-fs-libraries.js:68:7:68:48 | path |
| other-fs-libraries.js:68:7:68:48 | path |
| other-fs-libraries.js:68:14:68:37 | url.par ... , true) |
| other-fs-libraries.js:68:14:68:37 | url.par ... , true) |
| other-fs-libraries.js:68:14:68:37 | url.par ... , true) |
| other-fs-libraries.js:68:14:68:37 | url.par ... , true) |
| other-fs-libraries.js:68:14:68:37 | url.par ... , true) |
| other-fs-libraries.js:68:14:68:37 | url.par ... , true) |
| other-fs-libraries.js:68:14:68:37 | url.par ... , true) |
| other-fs-libraries.js:68:14:68:37 | url.par ... , true) |
| other-fs-libraries.js:68:14:68:37 | url.par ... , true) |
| other-fs-libraries.js:68:14:68:37 | url.par ... , true) |
| other-fs-libraries.js:68:14:68:37 | url.par ... , true) |
| other-fs-libraries.js:68:14:68:37 | url.par ... , true) |
| other-fs-libraries.js:68:14:68:37 | url.par ... , true) |
| other-fs-libraries.js:68:14:68:37 | url.par ... , true) |
| other-fs-libraries.js:68:14:68:37 | url.par ... , true) |
| other-fs-libraries.js:68:14:68:37 | url.par ... , true) |
| other-fs-libraries.js:68:14:68:43 | url.par ... ).query |
| other-fs-libraries.js:68:14:68:43 | url.par ... ).query |
| other-fs-libraries.js:68:14:68:43 | url.par ... ).query |
| other-fs-libraries.js:68:14:68:43 | url.par ... ).query |
| other-fs-libraries.js:68:14:68:43 | url.par ... ).query |
| other-fs-libraries.js:68:14:68:43 | url.par ... ).query |
| other-fs-libraries.js:68:14:68:43 | url.par ... ).query |
| other-fs-libraries.js:68:14:68:43 | url.par ... ).query |
| other-fs-libraries.js:68:14:68:43 | url.par ... ).query |
| other-fs-libraries.js:68:14:68:43 | url.par ... ).query |
| other-fs-libraries.js:68:14:68:43 | url.par ... ).query |
| other-fs-libraries.js:68:14:68:43 | url.par ... ).query |
| other-fs-libraries.js:68:14:68:43 | url.par ... ).query |
| other-fs-libraries.js:68:14:68:43 | url.par ... ).query |
| other-fs-libraries.js:68:14:68:43 | url.par ... ).query |
| other-fs-libraries.js:68:14:68:43 | url.par ... ).query |
| other-fs-libraries.js:68:14:68:48 | url.par ... ry.path |
| other-fs-libraries.js:68:14:68:48 | url.par ... ry.path |
| other-fs-libraries.js:68:14:68:48 | url.par ... ry.path |
| other-fs-libraries.js:68:14:68:48 | url.par ... ry.path |
| other-fs-libraries.js:68:14:68:48 | url.par ... ry.path |
| other-fs-libraries.js:68:14:68:48 | url.par ... ry.path |
| other-fs-libraries.js:68:14:68:48 | url.par ... ry.path |
| other-fs-libraries.js:68:14:68:48 | url.par ... ry.path |
| other-fs-libraries.js:68:14:68:48 | url.par ... ry.path |
| other-fs-libraries.js:68:14:68:48 | url.par ... ry.path |
| other-fs-libraries.js:68:14:68:48 | url.par ... ry.path |
| other-fs-libraries.js:68:14:68:48 | url.par ... ry.path |
| other-fs-libraries.js:68:14:68:48 | url.par ... ry.path |
| other-fs-libraries.js:68:14:68:48 | url.par ... ry.path |
| other-fs-libraries.js:68:14:68:48 | url.par ... ry.path |
| other-fs-libraries.js:68:14:68:48 | url.par ... ry.path |
| other-fs-libraries.js:68:24:68:30 | req.url |
| other-fs-libraries.js:68:24:68:30 | req.url |
| other-fs-libraries.js:68:24:68:30 | req.url |
| other-fs-libraries.js:68:24:68:30 | req.url |
| other-fs-libraries.js:68:24:68:30 | req.url |
| other-fs-libraries.js:70:19:70:22 | path |
| other-fs-libraries.js:70:19:70:22 | path |
| other-fs-libraries.js:70:19:70:22 | path |
| other-fs-libraries.js:70:19:70:22 | path |
| other-fs-libraries.js:70:19:70:22 | path |
| other-fs-libraries.js:70:19:70:22 | path |
| other-fs-libraries.js:70:19:70:22 | path |
| other-fs-libraries.js:70:19:70:22 | path |
| other-fs-libraries.js:70:19:70:22 | path |
| other-fs-libraries.js:70:19:70:22 | path |
| other-fs-libraries.js:70:19:70:22 | path |
| other-fs-libraries.js:70:19:70:22 | path |
| other-fs-libraries.js:70:19:70:22 | path |
| other-fs-libraries.js:70:19:70:22 | path |
| other-fs-libraries.js:70:19:70:22 | path |
| other-fs-libraries.js:70:19:70:22 | path |
| other-fs-libraries.js:70:19:70:22 | path |
| other-fs-libraries.js:71:10:71:13 | path |
| other-fs-libraries.js:71:10:71:13 | path |
| other-fs-libraries.js:71:10:71:13 | path |
| other-fs-libraries.js:71:10:71:13 | path |
| other-fs-libraries.js:71:10:71:13 | path |
| other-fs-libraries.js:71:10:71:13 | path |
| other-fs-libraries.js:71:10:71:13 | path |
| other-fs-libraries.js:71:10:71:13 | path |
| other-fs-libraries.js:71:10:71:13 | path |
| other-fs-libraries.js:71:10:71:13 | path |
| other-fs-libraries.js:71:10:71:13 | path |
| other-fs-libraries.js:71:10:71:13 | path |
| other-fs-libraries.js:71:10:71:13 | path |
| other-fs-libraries.js:71:10:71:13 | path |
| other-fs-libraries.js:71:10:71:13 | path |
| other-fs-libraries.js:71:10:71:13 | path |
| other-fs-libraries.js:71:10:71:13 | path |
| other-fs-libraries.js:72:15:72:18 | path |
| other-fs-libraries.js:72:15:72:18 | path |
| other-fs-libraries.js:72:15:72:18 | path |
| other-fs-libraries.js:72:15:72:18 | path |
| other-fs-libraries.js:72:15:72:18 | path |
| other-fs-libraries.js:72:15:72:18 | path |
| other-fs-libraries.js:72:15:72:18 | path |
| other-fs-libraries.js:72:15:72:18 | path |
| other-fs-libraries.js:72:15:72:18 | path |
| other-fs-libraries.js:72:15:72:18 | path |
| other-fs-libraries.js:72:15:72:18 | path |
| other-fs-libraries.js:72:15:72:18 | path |
| other-fs-libraries.js:72:15:72:18 | path |
| other-fs-libraries.js:72:15:72:18 | path |
| other-fs-libraries.js:72:15:72:18 | path |
| other-fs-libraries.js:72:15:72:18 | path |
| other-fs-libraries.js:72:15:72:18 | path |
| prettier.js:6:11:6:28 | p |
| prettier.js:6:11:6:28 | p |
| prettier.js:6:11:6:28 | p |
@@ -7044,6 +7164,182 @@ edges
| other-fs-libraries.js:49:24:49:30 | req.url | other-fs-libraries.js:49:14:49:37 | url.par ... , true) |
| other-fs-libraries.js:49:24:49:30 | req.url | other-fs-libraries.js:49:14:49:37 | url.par ... , true) |
| other-fs-libraries.js:49:24:49:30 | req.url | other-fs-libraries.js:49:14:49:37 | url.par ... , true) |
| other-fs-libraries.js:68:7:68:48 | path | other-fs-libraries.js:70:19:70:22 | path |
| other-fs-libraries.js:68:7:68:48 | path | other-fs-libraries.js:70:19:70:22 | path |
| other-fs-libraries.js:68:7:68:48 | path | other-fs-libraries.js:70:19:70:22 | path |
| other-fs-libraries.js:68:7:68:48 | path | other-fs-libraries.js:70:19:70:22 | path |
| other-fs-libraries.js:68:7:68:48 | path | other-fs-libraries.js:70:19:70:22 | path |
| other-fs-libraries.js:68:7:68:48 | path | other-fs-libraries.js:70:19:70:22 | path |
| other-fs-libraries.js:68:7:68:48 | path | other-fs-libraries.js:70:19:70:22 | path |
| other-fs-libraries.js:68:7:68:48 | path | other-fs-libraries.js:70:19:70:22 | path |
| other-fs-libraries.js:68:7:68:48 | path | other-fs-libraries.js:70:19:70:22 | path |
| other-fs-libraries.js:68:7:68:48 | path | other-fs-libraries.js:70:19:70:22 | path |
| other-fs-libraries.js:68:7:68:48 | path | other-fs-libraries.js:70:19:70:22 | path |
| other-fs-libraries.js:68:7:68:48 | path | other-fs-libraries.js:70:19:70:22 | path |
| other-fs-libraries.js:68:7:68:48 | path | other-fs-libraries.js:70:19:70:22 | path |
| other-fs-libraries.js:68:7:68:48 | path | other-fs-libraries.js:70:19:70:22 | path |
| other-fs-libraries.js:68:7:68:48 | path | other-fs-libraries.js:70:19:70:22 | path |
| other-fs-libraries.js:68:7:68:48 | path | other-fs-libraries.js:70:19:70:22 | path |
| other-fs-libraries.js:68:7:68:48 | path | other-fs-libraries.js:70:19:70:22 | path |
| other-fs-libraries.js:68:7:68:48 | path | other-fs-libraries.js:70:19:70:22 | path |
| other-fs-libraries.js:68:7:68:48 | path | other-fs-libraries.js:70:19:70:22 | path |
| other-fs-libraries.js:68:7:68:48 | path | other-fs-libraries.js:70:19:70:22 | path |
| other-fs-libraries.js:68:7:68:48 | path | other-fs-libraries.js:70:19:70:22 | path |
| other-fs-libraries.js:68:7:68:48 | path | other-fs-libraries.js:70:19:70:22 | path |
| other-fs-libraries.js:68:7:68:48 | path | other-fs-libraries.js:70:19:70:22 | path |
| other-fs-libraries.js:68:7:68:48 | path | other-fs-libraries.js:70:19:70:22 | path |
| other-fs-libraries.js:68:7:68:48 | path | other-fs-libraries.js:70:19:70:22 | path |
| other-fs-libraries.js:68:7:68:48 | path | other-fs-libraries.js:70:19:70:22 | path |
| other-fs-libraries.js:68:7:68:48 | path | other-fs-libraries.js:70:19:70:22 | path |
| other-fs-libraries.js:68:7:68:48 | path | other-fs-libraries.js:70:19:70:22 | path |
| other-fs-libraries.js:68:7:68:48 | path | other-fs-libraries.js:70:19:70:22 | path |
| other-fs-libraries.js:68:7:68:48 | path | other-fs-libraries.js:70:19:70:22 | path |
| other-fs-libraries.js:68:7:68:48 | path | other-fs-libraries.js:70:19:70:22 | path |
| other-fs-libraries.js:68:7:68:48 | path | other-fs-libraries.js:70:19:70:22 | path |
| other-fs-libraries.js:68:7:68:48 | path | other-fs-libraries.js:71:10:71:13 | path |
| other-fs-libraries.js:68:7:68:48 | path | other-fs-libraries.js:71:10:71:13 | path |
| other-fs-libraries.js:68:7:68:48 | path | other-fs-libraries.js:71:10:71:13 | path |
| other-fs-libraries.js:68:7:68:48 | path | other-fs-libraries.js:71:10:71:13 | path |
| other-fs-libraries.js:68:7:68:48 | path | other-fs-libraries.js:71:10:71:13 | path |
| other-fs-libraries.js:68:7:68:48 | path | other-fs-libraries.js:71:10:71:13 | path |
| other-fs-libraries.js:68:7:68:48 | path | other-fs-libraries.js:71:10:71:13 | path |
| other-fs-libraries.js:68:7:68:48 | path | other-fs-libraries.js:71:10:71:13 | path |
| other-fs-libraries.js:68:7:68:48 | path | other-fs-libraries.js:71:10:71:13 | path |
| other-fs-libraries.js:68:7:68:48 | path | other-fs-libraries.js:71:10:71:13 | path |
| other-fs-libraries.js:68:7:68:48 | path | other-fs-libraries.js:71:10:71:13 | path |
| other-fs-libraries.js:68:7:68:48 | path | other-fs-libraries.js:71:10:71:13 | path |
| other-fs-libraries.js:68:7:68:48 | path | other-fs-libraries.js:71:10:71:13 | path |
| other-fs-libraries.js:68:7:68:48 | path | other-fs-libraries.js:71:10:71:13 | path |
| other-fs-libraries.js:68:7:68:48 | path | other-fs-libraries.js:71:10:71:13 | path |
| other-fs-libraries.js:68:7:68:48 | path | other-fs-libraries.js:71:10:71:13 | path |
| other-fs-libraries.js:68:7:68:48 | path | other-fs-libraries.js:71:10:71:13 | path |
| other-fs-libraries.js:68:7:68:48 | path | other-fs-libraries.js:71:10:71:13 | path |
| other-fs-libraries.js:68:7:68:48 | path | other-fs-libraries.js:71:10:71:13 | path |
| other-fs-libraries.js:68:7:68:48 | path | other-fs-libraries.js:71:10:71:13 | path |
| other-fs-libraries.js:68:7:68:48 | path | other-fs-libraries.js:71:10:71:13 | path |
| other-fs-libraries.js:68:7:68:48 | path | other-fs-libraries.js:71:10:71:13 | path |
| other-fs-libraries.js:68:7:68:48 | path | other-fs-libraries.js:71:10:71:13 | path |
| other-fs-libraries.js:68:7:68:48 | path | other-fs-libraries.js:71:10:71:13 | path |
| other-fs-libraries.js:68:7:68:48 | path | other-fs-libraries.js:71:10:71:13 | path |
| other-fs-libraries.js:68:7:68:48 | path | other-fs-libraries.js:71:10:71:13 | path |
| other-fs-libraries.js:68:7:68:48 | path | other-fs-libraries.js:71:10:71:13 | path |
| other-fs-libraries.js:68:7:68:48 | path | other-fs-libraries.js:71:10:71:13 | path |
| other-fs-libraries.js:68:7:68:48 | path | other-fs-libraries.js:71:10:71:13 | path |
| other-fs-libraries.js:68:7:68:48 | path | other-fs-libraries.js:71:10:71:13 | path |
| other-fs-libraries.js:68:7:68:48 | path | other-fs-libraries.js:71:10:71:13 | path |
| other-fs-libraries.js:68:7:68:48 | path | other-fs-libraries.js:71:10:71:13 | path |
| other-fs-libraries.js:68:7:68:48 | path | other-fs-libraries.js:72:15:72:18 | path |
| other-fs-libraries.js:68:7:68:48 | path | other-fs-libraries.js:72:15:72:18 | path |
| other-fs-libraries.js:68:7:68:48 | path | other-fs-libraries.js:72:15:72:18 | path |
| other-fs-libraries.js:68:7:68:48 | path | other-fs-libraries.js:72:15:72:18 | path |
| other-fs-libraries.js:68:7:68:48 | path | other-fs-libraries.js:72:15:72:18 | path |
| other-fs-libraries.js:68:7:68:48 | path | other-fs-libraries.js:72:15:72:18 | path |
| other-fs-libraries.js:68:7:68:48 | path | other-fs-libraries.js:72:15:72:18 | path |
| other-fs-libraries.js:68:7:68:48 | path | other-fs-libraries.js:72:15:72:18 | path |
| other-fs-libraries.js:68:7:68:48 | path | other-fs-libraries.js:72:15:72:18 | path |
| other-fs-libraries.js:68:7:68:48 | path | other-fs-libraries.js:72:15:72:18 | path |
| other-fs-libraries.js:68:7:68:48 | path | other-fs-libraries.js:72:15:72:18 | path |
| other-fs-libraries.js:68:7:68:48 | path | other-fs-libraries.js:72:15:72:18 | path |
| other-fs-libraries.js:68:7:68:48 | path | other-fs-libraries.js:72:15:72:18 | path |
| other-fs-libraries.js:68:7:68:48 | path | other-fs-libraries.js:72:15:72:18 | path |
| other-fs-libraries.js:68:7:68:48 | path | other-fs-libraries.js:72:15:72:18 | path |
| other-fs-libraries.js:68:7:68:48 | path | other-fs-libraries.js:72:15:72:18 | path |
| other-fs-libraries.js:68:7:68:48 | path | other-fs-libraries.js:72:15:72:18 | path |
| other-fs-libraries.js:68:7:68:48 | path | other-fs-libraries.js:72:15:72:18 | path |
| other-fs-libraries.js:68:7:68:48 | path | other-fs-libraries.js:72:15:72:18 | path |
| other-fs-libraries.js:68:7:68:48 | path | other-fs-libraries.js:72:15:72:18 | path |
| other-fs-libraries.js:68:7:68:48 | path | other-fs-libraries.js:72:15:72:18 | path |
| other-fs-libraries.js:68:7:68:48 | path | other-fs-libraries.js:72:15:72:18 | path |
| other-fs-libraries.js:68:7:68:48 | path | other-fs-libraries.js:72:15:72:18 | path |
| other-fs-libraries.js:68:7:68:48 | path | other-fs-libraries.js:72:15:72:18 | path |
| other-fs-libraries.js:68:7:68:48 | path | other-fs-libraries.js:72:15:72:18 | path |
| other-fs-libraries.js:68:7:68:48 | path | other-fs-libraries.js:72:15:72:18 | path |
| other-fs-libraries.js:68:7:68:48 | path | other-fs-libraries.js:72:15:72:18 | path |
| other-fs-libraries.js:68:7:68:48 | path | other-fs-libraries.js:72:15:72:18 | path |
| other-fs-libraries.js:68:7:68:48 | path | other-fs-libraries.js:72:15:72:18 | path |
| other-fs-libraries.js:68:7:68:48 | path | other-fs-libraries.js:72:15:72:18 | path |
| other-fs-libraries.js:68:7:68:48 | path | other-fs-libraries.js:72:15:72:18 | path |
| other-fs-libraries.js:68:7:68:48 | path | other-fs-libraries.js:72:15:72:18 | path |
| other-fs-libraries.js:68:14:68:37 | url.par ... , true) | other-fs-libraries.js:68:14:68:43 | url.par ... ).query |
| other-fs-libraries.js:68:14:68:37 | url.par ... , true) | other-fs-libraries.js:68:14:68:43 | url.par ... ).query |
| other-fs-libraries.js:68:14:68:37 | url.par ... , true) | other-fs-libraries.js:68:14:68:43 | url.par ... ).query |
| other-fs-libraries.js:68:14:68:37 | url.par ... , true) | other-fs-libraries.js:68:14:68:43 | url.par ... ).query |
| other-fs-libraries.js:68:14:68:37 | url.par ... , true) | other-fs-libraries.js:68:14:68:43 | url.par ... ).query |
| other-fs-libraries.js:68:14:68:37 | url.par ... , true) | other-fs-libraries.js:68:14:68:43 | url.par ... ).query |
| other-fs-libraries.js:68:14:68:37 | url.par ... , true) | other-fs-libraries.js:68:14:68:43 | url.par ... ).query |
| other-fs-libraries.js:68:14:68:37 | url.par ... , true) | other-fs-libraries.js:68:14:68:43 | url.par ... ).query |
| other-fs-libraries.js:68:14:68:37 | url.par ... , true) | other-fs-libraries.js:68:14:68:43 | url.par ... ).query |
| other-fs-libraries.js:68:14:68:37 | url.par ... , true) | other-fs-libraries.js:68:14:68:43 | url.par ... ).query |
| other-fs-libraries.js:68:14:68:37 | url.par ... , true) | other-fs-libraries.js:68:14:68:43 | url.par ... ).query |
| other-fs-libraries.js:68:14:68:37 | url.par ... , true) | other-fs-libraries.js:68:14:68:43 | url.par ... ).query |
| other-fs-libraries.js:68:14:68:37 | url.par ... , true) | other-fs-libraries.js:68:14:68:43 | url.par ... ).query |
| other-fs-libraries.js:68:14:68:37 | url.par ... , true) | other-fs-libraries.js:68:14:68:43 | url.par ... ).query |
| other-fs-libraries.js:68:14:68:37 | url.par ... , true) | other-fs-libraries.js:68:14:68:43 | url.par ... ).query |
| other-fs-libraries.js:68:14:68:37 | url.par ... , true) | other-fs-libraries.js:68:14:68:43 | url.par ... ).query |
| other-fs-libraries.js:68:14:68:43 | url.par ... ).query | other-fs-libraries.js:68:14:68:48 | url.par ... ry.path |
| other-fs-libraries.js:68:14:68:43 | url.par ... ).query | other-fs-libraries.js:68:14:68:48 | url.par ... ry.path |
| other-fs-libraries.js:68:14:68:43 | url.par ... ).query | other-fs-libraries.js:68:14:68:48 | url.par ... ry.path |
| other-fs-libraries.js:68:14:68:43 | url.par ... ).query | other-fs-libraries.js:68:14:68:48 | url.par ... ry.path |
| other-fs-libraries.js:68:14:68:43 | url.par ... ).query | other-fs-libraries.js:68:14:68:48 | url.par ... ry.path |
| other-fs-libraries.js:68:14:68:43 | url.par ... ).query | other-fs-libraries.js:68:14:68:48 | url.par ... ry.path |
| other-fs-libraries.js:68:14:68:43 | url.par ... ).query | other-fs-libraries.js:68:14:68:48 | url.par ... ry.path |
| other-fs-libraries.js:68:14:68:43 | url.par ... ).query | other-fs-libraries.js:68:14:68:48 | url.par ... ry.path |
| other-fs-libraries.js:68:14:68:43 | url.par ... ).query | other-fs-libraries.js:68:14:68:48 | url.par ... ry.path |
| other-fs-libraries.js:68:14:68:43 | url.par ... ).query | other-fs-libraries.js:68:14:68:48 | url.par ... ry.path |
| other-fs-libraries.js:68:14:68:43 | url.par ... ).query | other-fs-libraries.js:68:14:68:48 | url.par ... ry.path |
| other-fs-libraries.js:68:14:68:43 | url.par ... ).query | other-fs-libraries.js:68:14:68:48 | url.par ... ry.path |
| other-fs-libraries.js:68:14:68:43 | url.par ... ).query | other-fs-libraries.js:68:14:68:48 | url.par ... ry.path |
| other-fs-libraries.js:68:14:68:43 | url.par ... ).query | other-fs-libraries.js:68:14:68:48 | url.par ... ry.path |
| other-fs-libraries.js:68:14:68:43 | url.par ... ).query | other-fs-libraries.js:68:14:68:48 | url.par ... ry.path |
| other-fs-libraries.js:68:14:68:43 | url.par ... ).query | other-fs-libraries.js:68:14:68:48 | url.par ... ry.path |
| other-fs-libraries.js:68:14:68:48 | url.par ... ry.path | other-fs-libraries.js:68:7:68:48 | path |
| other-fs-libraries.js:68:14:68:48 | url.par ... ry.path | other-fs-libraries.js:68:7:68:48 | path |
| other-fs-libraries.js:68:14:68:48 | url.par ... ry.path | other-fs-libraries.js:68:7:68:48 | path |
| other-fs-libraries.js:68:14:68:48 | url.par ... ry.path | other-fs-libraries.js:68:7:68:48 | path |
| other-fs-libraries.js:68:14:68:48 | url.par ... ry.path | other-fs-libraries.js:68:7:68:48 | path |
| other-fs-libraries.js:68:14:68:48 | url.par ... ry.path | other-fs-libraries.js:68:7:68:48 | path |
| other-fs-libraries.js:68:14:68:48 | url.par ... ry.path | other-fs-libraries.js:68:7:68:48 | path |
| other-fs-libraries.js:68:14:68:48 | url.par ... ry.path | other-fs-libraries.js:68:7:68:48 | path |
| other-fs-libraries.js:68:14:68:48 | url.par ... ry.path | other-fs-libraries.js:68:7:68:48 | path |
| other-fs-libraries.js:68:14:68:48 | url.par ... ry.path | other-fs-libraries.js:68:7:68:48 | path |
| other-fs-libraries.js:68:14:68:48 | url.par ... ry.path | other-fs-libraries.js:68:7:68:48 | path |
| other-fs-libraries.js:68:14:68:48 | url.par ... ry.path | other-fs-libraries.js:68:7:68:48 | path |
| other-fs-libraries.js:68:14:68:48 | url.par ... ry.path | other-fs-libraries.js:68:7:68:48 | path |
| other-fs-libraries.js:68:14:68:48 | url.par ... ry.path | other-fs-libraries.js:68:7:68:48 | path |
| other-fs-libraries.js:68:14:68:48 | url.par ... ry.path | other-fs-libraries.js:68:7:68:48 | path |
| other-fs-libraries.js:68:14:68:48 | url.par ... ry.path | other-fs-libraries.js:68:7:68:48 | path |
| other-fs-libraries.js:68:24:68:30 | req.url | other-fs-libraries.js:68:14:68:37 | url.par ... , true) |
| other-fs-libraries.js:68:24:68:30 | req.url | other-fs-libraries.js:68:14:68:37 | url.par ... , true) |
| other-fs-libraries.js:68:24:68:30 | req.url | other-fs-libraries.js:68:14:68:37 | url.par ... , true) |
| other-fs-libraries.js:68:24:68:30 | req.url | other-fs-libraries.js:68:14:68:37 | url.par ... , true) |
| other-fs-libraries.js:68:24:68:30 | req.url | other-fs-libraries.js:68:14:68:37 | url.par ... , true) |
| other-fs-libraries.js:68:24:68:30 | req.url | other-fs-libraries.js:68:14:68:37 | url.par ... , true) |
| other-fs-libraries.js:68:24:68:30 | req.url | other-fs-libraries.js:68:14:68:37 | url.par ... , true) |
| other-fs-libraries.js:68:24:68:30 | req.url | other-fs-libraries.js:68:14:68:37 | url.par ... , true) |
| other-fs-libraries.js:68:24:68:30 | req.url | other-fs-libraries.js:68:14:68:37 | url.par ... , true) |
| other-fs-libraries.js:68:24:68:30 | req.url | other-fs-libraries.js:68:14:68:37 | url.par ... , true) |
| other-fs-libraries.js:68:24:68:30 | req.url | other-fs-libraries.js:68:14:68:37 | url.par ... , true) |
| other-fs-libraries.js:68:24:68:30 | req.url | other-fs-libraries.js:68:14:68:37 | url.par ... , true) |
| other-fs-libraries.js:68:24:68:30 | req.url | other-fs-libraries.js:68:14:68:37 | url.par ... , true) |
| other-fs-libraries.js:68:24:68:30 | req.url | other-fs-libraries.js:68:14:68:37 | url.par ... , true) |
| other-fs-libraries.js:68:24:68:30 | req.url | other-fs-libraries.js:68:14:68:37 | url.par ... , true) |
| other-fs-libraries.js:68:24:68:30 | req.url | other-fs-libraries.js:68:14:68:37 | url.par ... , true) |
| other-fs-libraries.js:68:24:68:30 | req.url | other-fs-libraries.js:68:14:68:37 | url.par ... , true) |
| other-fs-libraries.js:68:24:68:30 | req.url | other-fs-libraries.js:68:14:68:37 | url.par ... , true) |
| other-fs-libraries.js:68:24:68:30 | req.url | other-fs-libraries.js:68:14:68:37 | url.par ... , true) |
| other-fs-libraries.js:68:24:68:30 | req.url | other-fs-libraries.js:68:14:68:37 | url.par ... , true) |
| other-fs-libraries.js:68:24:68:30 | req.url | other-fs-libraries.js:68:14:68:37 | url.par ... , true) |
| other-fs-libraries.js:68:24:68:30 | req.url | other-fs-libraries.js:68:14:68:37 | url.par ... , true) |
| other-fs-libraries.js:68:24:68:30 | req.url | other-fs-libraries.js:68:14:68:37 | url.par ... , true) |
| other-fs-libraries.js:68:24:68:30 | req.url | other-fs-libraries.js:68:14:68:37 | url.par ... , true) |
| other-fs-libraries.js:68:24:68:30 | req.url | other-fs-libraries.js:68:14:68:37 | url.par ... , true) |
| other-fs-libraries.js:68:24:68:30 | req.url | other-fs-libraries.js:68:14:68:37 | url.par ... , true) |
| other-fs-libraries.js:68:24:68:30 | req.url | other-fs-libraries.js:68:14:68:37 | url.par ... , true) |
| other-fs-libraries.js:68:24:68:30 | req.url | other-fs-libraries.js:68:14:68:37 | url.par ... , true) |
| other-fs-libraries.js:68:24:68:30 | req.url | other-fs-libraries.js:68:14:68:37 | url.par ... , true) |
| other-fs-libraries.js:68:24:68:30 | req.url | other-fs-libraries.js:68:14:68:37 | url.par ... , true) |
| other-fs-libraries.js:68:24:68:30 | req.url | other-fs-libraries.js:68:14:68:37 | url.par ... , true) |
| other-fs-libraries.js:68:24:68:30 | req.url | other-fs-libraries.js:68:14:68:37 | url.par ... , true) |
| prettier.js:6:11:6:28 | p | prettier.js:7:28:7:28 | p |
| prettier.js:6:11:6:28 | p | prettier.js:7:28:7:28 | p |
| prettier.js:6:11:6:28 | p | prettier.js:7:28:7:28 | p |
@@ -8705,6 +9001,9 @@ edges
| other-fs-libraries.js:59:39:59:42 | path | other-fs-libraries.js:49:24:49:30 | req.url | other-fs-libraries.js:59:39:59:42 | path | This path depends on $@. | other-fs-libraries.js:49:24:49:30 | req.url | a user-provided value |
| other-fs-libraries.js:62:43:62:46 | path | other-fs-libraries.js:49:24:49:30 | req.url | other-fs-libraries.js:62:43:62:46 | path | This path depends on $@. | other-fs-libraries.js:49:24:49:30 | req.url | a user-provided value |
| other-fs-libraries.js:63:51:63:54 | path | other-fs-libraries.js:49:24:49:30 | req.url | other-fs-libraries.js:63:51:63:54 | path | This path depends on $@. | other-fs-libraries.js:49:24:49:30 | req.url | a user-provided value |
| other-fs-libraries.js:70:19:70:22 | path | other-fs-libraries.js:68:24:68:30 | req.url | other-fs-libraries.js:70:19:70:22 | path | This path depends on $@. | other-fs-libraries.js:68:24:68:30 | req.url | a user-provided value |
| other-fs-libraries.js:71:10:71:13 | path | other-fs-libraries.js:68:24:68:30 | req.url | other-fs-libraries.js:71:10:71:13 | path | This path depends on $@. | other-fs-libraries.js:68:24:68:30 | req.url | a user-provided value |
| other-fs-libraries.js:72:15:72:18 | path | other-fs-libraries.js:68:24:68:30 | req.url | other-fs-libraries.js:72:15:72:18 | path | This path depends on $@. | other-fs-libraries.js:68:24:68:30 | req.url | a user-provided value |
| prettier.js:7:28:7:28 | p | prettier.js:6:13:6:13 | p | prettier.js:7:28:7:28 | p | This path depends on $@. | prettier.js:6:13:6:13 | p | a user-provided value |
| prettier.js:11:44:11:44 | p | prettier.js:6:13:6:13 | p | prettier.js:11:44:11:44 | p | This path depends on $@. | prettier.js:6:13:6:13 | p | a user-provided value |
| pupeteer.js:9:28:9:34 | tainted | pupeteer.js:5:28:5:53 | parseTo ... t).name | pupeteer.js:9:28:9:34 | tainted | This path depends on $@. | pupeteer.js:5:28:5:53 | parseTo ... t).name | a user-provided value |

9
javascript/ql/test/query-tests/Security/CWE-022/TaintedPath/other-fs-libraries.js
View File

@@ -62,3 +62,12 @@ http.createServer(function(req, res) {
var pkg = readPkg.readPackageSync({cwd: path}); // NOT OK
var pkgPromise = readPkg.readPackageAsync({cwd: path}); // NOT OK
});
const mkdirp = require("mkdirp");
http.createServer(function(req, res) {
var path = url.parse(req.url, true).query.path;
fs.readFileSync(path); // NOT OK
mkdirp(path); // NOT OK
mkdirp.sync(path); // NOT OK
});