diff --git a/javascript/config/suites/javascript/security b/javascript/config/suites/javascript/security index 6411b84fe6b..8615000b9e9 100644 --- a/javascript/config/suites/javascript/security +++ b/javascript/config/suites/javascript/security @@ -42,7 +42,7 @@ + semmlecode-javascript-queries/Security/CWE-798/HardcodedCredentials.ql: /Security/CWE/CWE-798 + semmlecode-javascript-queries/Security/CWE-807/ConditionalBypass.ql: /Security/CWE/CWE-807 + semmlecode-javascript-queries/Security/CWE-807/DifferentKindsComparisonBypass.ql: /Security/CWE/CWE-807 -+ semmlecode-javascript-queries/Security/CWE-834/TaintedLength.ql: /Security/CWE/CWE-834 ++ semmlecode-javascript-queries/Security/CWE-834/LoopBoundInjection.ql: /Security/CWE/CWE-834 + semmlecode-javascript-queries/Security/CWE-843/TypeConfusionThroughParameterTampering.ql: /Security/CWE/CWE-834 + semmlecode-javascript-queries/Security/CWE-916/InsufficientPasswordHash.ql: /Security/CWE/CWE-916 + semmlecode-javascript-queries/Security/CWE-918/RequestForgery.ql: /Security/CWE/CWE-918 diff --git a/javascript/ql/src/Security/CWE-834/LoopBoundInjection.qhelp b/javascript/ql/src/Security/CWE-834/LoopBoundInjection.qhelp index be0b2e661d2..89f86944445 100644 --- a/javascript/ql/src/Security/CWE-834/LoopBoundInjection.qhelp +++ b/javascript/ql/src/Security/CWE-834/LoopBoundInjection.qhelp @@ -9,7 +9,7 @@ cause indefinite looping since a malicious attacker can set the .length property to a very large number. For example, when a program that expects an array is passed a JSON object such as - {length: 1e100}, the loop will be run for 1e100 + {length: 1e100}, the loop will be run for 10100 iterations. This may cause the program to hang or run out of memory, which can be used to mount a denial-of-service (DoS) attack.

@@ -30,7 +30,7 @@ obj to an array.

- +

This is not secure since an attacker can control the value of @@ -39,7 +39,7 @@ the user controlled object is an array.

- + diff --git a/javascript/ql/src/Security/CWE-834/LoopBoundInjection.ql b/javascript/ql/src/Security/CWE-834/LoopBoundInjection.ql index ee829007d42..e06dea4d080 100644 --- a/javascript/ql/src/Security/CWE-834/LoopBoundInjection.ql +++ b/javascript/ql/src/Security/CWE-834/LoopBoundInjection.ql @@ -1,5 +1,5 @@ /** - * @name Tainted .length in loop condition + * @name Loop bound injection * @description Iterating over an object with a user-controlled .length * property can cause indefinite looping. * @kind path-problem @@ -11,7 +11,7 @@ */ import javascript -import semmle.javascript.security.dataflow.TaintedLength::TaintedLength +import semmle.javascript.security.dataflow.LoopBoundInjection::LoopBoundInjection from Configuration dataflow, DataFlow::PathNode source, DataFlow::PathNode sink where dataflow.hasFlowPath(source, sink) diff --git a/javascript/ql/src/semmle/javascript/security/dataflow/TaintedLength.qll b/javascript/ql/src/semmle/javascript/security/dataflow/LoopBoundInjection.qll similarity index 82% rename from javascript/ql/src/semmle/javascript/security/dataflow/TaintedLength.qll rename to javascript/ql/src/semmle/javascript/security/dataflow/LoopBoundInjection.qll index 46f94cf34ef..61855e30289 100644 --- a/javascript/ql/src/semmle/javascript/security/dataflow/TaintedLength.qll +++ b/javascript/ql/src/semmle/javascript/security/dataflow/LoopBoundInjection.qll @@ -3,21 +3,21 @@ * using a user controlled object with an unbounded .length property. * * Note, for performance reasons: only import this file if - * `TaintedLength::Configuration` is needed, otherwise - * `TaintedLengthCustomizations` should be imported instead. + * `LoopBoundInjection::Configuration` is needed, otherwise + * `LoopBoundInjectionCustomizations` should be imported instead. */ import javascript import semmle.javascript.security.TaintedObject -module TaintedLength { - import TaintedLengthCustomizations::TaintedLength +module LoopBoundInjection { + import LoopBoundInjectionCustomizations::LoopBoundInjection /** * A taint-tracking configuration for reasoning about looping on tainted objects with unbounded length. */ class Configuration extends TaintTracking::Configuration { - Configuration() { this = "TaintedLength" } + Configuration() { this = "LoopBoundInjection" } override predicate isSource(DataFlow::Node source, DataFlow::FlowLabel label) { source instanceof Source and label = TaintedObject::label() diff --git a/javascript/ql/src/semmle/javascript/security/dataflow/TaintedLengthCustomizations.qll b/javascript/ql/src/semmle/javascript/security/dataflow/LoopBoundInjectionCustomizations.qll similarity index 99% rename from javascript/ql/src/semmle/javascript/security/dataflow/TaintedLengthCustomizations.qll rename to javascript/ql/src/semmle/javascript/security/dataflow/LoopBoundInjectionCustomizations.qll index 67863f7fdf7..4a4ea783f9a 100644 --- a/javascript/ql/src/semmle/javascript/security/dataflow/TaintedLengthCustomizations.qll +++ b/javascript/ql/src/semmle/javascript/security/dataflow/LoopBoundInjectionCustomizations.qll @@ -6,7 +6,7 @@ import javascript -module TaintedLength { +module LoopBoundInjection { import semmle.javascript.security.dataflow.RemoteFlowSources import semmle.javascript.security.TaintedObject import DataFlow::PathGraph diff --git a/javascript/ql/test/query-tests/Security/CWE-834/LoopBoundInjection.expected b/javascript/ql/test/query-tests/Security/CWE-834/LoopBoundInjection.expected new file mode 100644 index 00000000000..dec60a2bbb8 --- /dev/null +++ b/javascript/ql/test/query-tests/Security/CWE-834/LoopBoundInjection.expected @@ -0,0 +1,57 @@ +nodes +| LoopBoundInjectionBad.js:8:13:8:20 | req.body | +| LoopBoundInjectionBad.js:10:15:10:22 | req.body | +| LoopBoundInjectionBad.js:12:25:12:32 | req.body | +| LoopBoundInjectionBad.js:14:19:14:26 | req.body | +| LoopBoundInjectionBad.js:17:18:17:20 | val | +| LoopBoundInjectionBad.js:20:25:20:27 | val | +| LoopBoundInjectionBad.js:25:20:25:22 | val | +| LoopBoundInjectionBad.js:29:16:29:18 | val | +| LoopBoundInjectionBad.js:35:30:35:32 | val | +| LoopBoundInjectionBad.js:38:15:38:17 | val | +| LoopBoundInjectionBad.js:46:24:46:26 | val | +| LoopBoundInjectionBad.js:51:25:51:27 | val | +| LoopBoundInjectionExitBad.js:8:9:8:16 | req.body | +| LoopBoundInjectionExitBad.js:10:9:10:16 | req.body | +| LoopBoundInjectionExitBad.js:12:10:12:17 | req.body | +| LoopBoundInjectionExitBad.js:14:14:14:21 | req.body | +| LoopBoundInjectionExitBad.js:17:17:17:19 | val | +| LoopBoundInjectionExitBad.js:20:22:20:24 | val | +| LoopBoundInjectionExitBad.js:31:17:31:19 | val | +| LoopBoundInjectionExitBad.js:34:22:34:24 | val | +| LoopBoundInjectionExitBad.js:46:18:46:20 | val | +| LoopBoundInjectionExitBad.js:49:22:49:24 | val | +| LoopBoundInjectionExitBad.js:59:22:59:24 | val | +| LoopBoundInjectionExitBad.js:60:8:60:10 | val | +| LoopBoundInjectionLodash.js:9:13:9:20 | req.body | +| LoopBoundInjectionLodash.js:12:18:12:20 | val | +| LoopBoundInjectionLodash.js:13:13:13:15 | val | +edges +| LoopBoundInjectionBad.js:8:13:8:20 | req.body | LoopBoundInjectionBad.js:17:18:17:20 | val | +| LoopBoundInjectionBad.js:10:15:10:22 | req.body | LoopBoundInjectionBad.js:25:20:25:22 | val | +| LoopBoundInjectionBad.js:12:25:12:32 | req.body | LoopBoundInjectionBad.js:35:30:35:32 | val | +| LoopBoundInjectionBad.js:14:19:14:26 | req.body | LoopBoundInjectionBad.js:46:24:46:26 | val | +| LoopBoundInjectionBad.js:17:18:17:20 | val | LoopBoundInjectionBad.js:20:25:20:27 | val | +| LoopBoundInjectionBad.js:25:20:25:22 | val | LoopBoundInjectionBad.js:29:16:29:18 | val | +| LoopBoundInjectionBad.js:35:30:35:32 | val | LoopBoundInjectionBad.js:38:15:38:17 | val | +| LoopBoundInjectionBad.js:46:24:46:26 | val | LoopBoundInjectionBad.js:51:25:51:27 | val | +| LoopBoundInjectionExitBad.js:8:9:8:16 | req.body | LoopBoundInjectionExitBad.js:17:17:17:19 | val | +| LoopBoundInjectionExitBad.js:10:9:10:16 | req.body | LoopBoundInjectionExitBad.js:31:17:31:19 | val | +| LoopBoundInjectionExitBad.js:12:10:12:17 | req.body | LoopBoundInjectionExitBad.js:46:18:46:20 | val | +| LoopBoundInjectionExitBad.js:14:14:14:21 | req.body | LoopBoundInjectionExitBad.js:59:22:59:24 | val | +| LoopBoundInjectionExitBad.js:17:17:17:19 | val | LoopBoundInjectionExitBad.js:20:22:20:24 | val | +| LoopBoundInjectionExitBad.js:31:17:31:19 | val | LoopBoundInjectionExitBad.js:34:22:34:24 | val | +| LoopBoundInjectionExitBad.js:46:18:46:20 | val | LoopBoundInjectionExitBad.js:49:22:49:24 | val | +| LoopBoundInjectionExitBad.js:59:22:59:24 | val | LoopBoundInjectionExitBad.js:60:8:60:10 | val | +| LoopBoundInjectionLodash.js:9:13:9:20 | req.body | LoopBoundInjectionLodash.js:12:18:12:20 | val | +| LoopBoundInjectionLodash.js:12:18:12:20 | val | LoopBoundInjectionLodash.js:13:13:13:15 | val | +#select +| LoopBoundInjectionBad.js:20:25:20:27 | val | LoopBoundInjectionBad.js:8:13:8:20 | req.body | LoopBoundInjectionBad.js:20:25:20:27 | val | Iterating over user-controlled object with a potentially unbounded .length property from $@. | LoopBoundInjectionBad.js:8:13:8:20 | req.body | here | +| LoopBoundInjectionBad.js:29:16:29:18 | val | LoopBoundInjectionBad.js:10:15:10:22 | req.body | LoopBoundInjectionBad.js:29:16:29:18 | val | Iterating over user-controlled object with a potentially unbounded .length property from $@. | LoopBoundInjectionBad.js:10:15:10:22 | req.body | here | +| LoopBoundInjectionBad.js:38:15:38:17 | val | LoopBoundInjectionBad.js:12:25:12:32 | req.body | LoopBoundInjectionBad.js:38:15:38:17 | val | Iterating over user-controlled object with a potentially unbounded .length property from $@. | LoopBoundInjectionBad.js:12:25:12:32 | req.body | here | +| LoopBoundInjectionBad.js:51:25:51:27 | val | LoopBoundInjectionBad.js:14:19:14:26 | req.body | LoopBoundInjectionBad.js:51:25:51:27 | val | Iterating over user-controlled object with a potentially unbounded .length property from $@. | LoopBoundInjectionBad.js:14:19:14:26 | req.body | here | +| LoopBoundInjectionExitBad.js:20:22:20:24 | val | LoopBoundInjectionExitBad.js:8:9:8:16 | req.body | LoopBoundInjectionExitBad.js:20:22:20:24 | val | Iterating over user-controlled object with a potentially unbounded .length property from $@. | LoopBoundInjectionExitBad.js:8:9:8:16 | req.body | here | +| LoopBoundInjectionExitBad.js:34:22:34:24 | val | LoopBoundInjectionExitBad.js:10:9:10:16 | req.body | LoopBoundInjectionExitBad.js:34:22:34:24 | val | Iterating over user-controlled object with a potentially unbounded .length property from $@. | LoopBoundInjectionExitBad.js:10:9:10:16 | req.body | here | +| LoopBoundInjectionExitBad.js:49:22:49:24 | val | LoopBoundInjectionExitBad.js:12:10:12:17 | req.body | LoopBoundInjectionExitBad.js:49:22:49:24 | val | Iterating over user-controlled object with a potentially unbounded .length property from $@. | LoopBoundInjectionExitBad.js:12:10:12:17 | req.body | here | +| LoopBoundInjectionExitBad.js:60:8:60:10 | val | LoopBoundInjectionExitBad.js:14:14:14:21 | req.body | LoopBoundInjectionExitBad.js:60:8:60:10 | val | Iterating over user-controlled object with a potentially unbounded .length property from $@. | LoopBoundInjectionExitBad.js:14:14:14:21 | req.body | here | +| LoopBoundInjectionLodash.js:13:13:13:15 | val | LoopBoundInjectionLodash.js:9:13:9:20 | req.body | LoopBoundInjectionLodash.js:13:13:13:15 | val | Iterating over user-controlled object with a potentially unbounded .length property from $@. | LoopBoundInjectionLodash.js:9:13:9:20 | req.body | here | diff --git a/javascript/ql/test/query-tests/Security/CWE-834/LoopBoundInjection.qlref b/javascript/ql/test/query-tests/Security/CWE-834/LoopBoundInjection.qlref new file mode 100644 index 00000000000..8186c4fca6a --- /dev/null +++ b/javascript/ql/test/query-tests/Security/CWE-834/LoopBoundInjection.qlref @@ -0,0 +1 @@ +Security/CWE-834/LoopBoundInjection.ql \ No newline at end of file diff --git a/javascript/ql/test/query-tests/Security/CWE-834/TaintedLengthBad.js b/javascript/ql/test/query-tests/Security/CWE-834/LoopBoundInjectionBad.js similarity index 100% rename from javascript/ql/test/query-tests/Security/CWE-834/TaintedLengthBad.js rename to javascript/ql/test/query-tests/Security/CWE-834/LoopBoundInjectionBad.js diff --git a/javascript/ql/test/query-tests/Security/CWE-834/TaintedLengthExitBad.js b/javascript/ql/test/query-tests/Security/CWE-834/LoopBoundInjectionExitBad.js similarity index 100% rename from javascript/ql/test/query-tests/Security/CWE-834/TaintedLengthExitBad.js rename to javascript/ql/test/query-tests/Security/CWE-834/LoopBoundInjectionExitBad.js diff --git a/javascript/ql/test/query-tests/Security/CWE-834/TaintedLengthExitGood.js b/javascript/ql/test/query-tests/Security/CWE-834/LoopBoundInjectionExitGood.js similarity index 100% rename from javascript/ql/test/query-tests/Security/CWE-834/TaintedLengthExitGood.js rename to javascript/ql/test/query-tests/Security/CWE-834/LoopBoundInjectionExitGood.js diff --git a/javascript/ql/test/query-tests/Security/CWE-834/TaintedLengthGood.js b/javascript/ql/test/query-tests/Security/CWE-834/LoopBoundInjectionGood.js similarity index 100% rename from javascript/ql/test/query-tests/Security/CWE-834/TaintedLengthGood.js rename to javascript/ql/test/query-tests/Security/CWE-834/LoopBoundInjectionGood.js diff --git a/javascript/ql/test/query-tests/Security/CWE-834/TaintedLengthLodash.js b/javascript/ql/test/query-tests/Security/CWE-834/LoopBoundInjectionLodash.js similarity index 100% rename from javascript/ql/test/query-tests/Security/CWE-834/TaintedLengthLodash.js rename to javascript/ql/test/query-tests/Security/CWE-834/LoopBoundInjectionLodash.js diff --git a/javascript/ql/test/query-tests/Security/CWE-834/TaintedLengthNested.js b/javascript/ql/test/query-tests/Security/CWE-834/LoopBoundInjectionNested.js similarity index 100% rename from javascript/ql/test/query-tests/Security/CWE-834/TaintedLengthNested.js rename to javascript/ql/test/query-tests/Security/CWE-834/LoopBoundInjectionNested.js diff --git a/javascript/ql/test/query-tests/Security/CWE-834/TaintedLengthObviousLengthCheck.js b/javascript/ql/test/query-tests/Security/CWE-834/LoopBoundInjectionObviousLengthCheck.js similarity index 100% rename from javascript/ql/test/query-tests/Security/CWE-834/TaintedLengthObviousLengthCheck.js rename to javascript/ql/test/query-tests/Security/CWE-834/LoopBoundInjectionObviousLengthCheck.js diff --git a/javascript/ql/test/query-tests/Security/CWE-834/TaintedLengthObviousNullPointer.js b/javascript/ql/test/query-tests/Security/CWE-834/LoopBoundInjectionObviousNullPointer.js similarity index 100% rename from javascript/ql/test/query-tests/Security/CWE-834/TaintedLengthObviousNullPointer.js rename to javascript/ql/test/query-tests/Security/CWE-834/LoopBoundInjectionObviousNullPointer.js diff --git a/javascript/ql/test/query-tests/Security/CWE-834/TaintedLengthObviousNullPointerInPreviousLoop.js b/javascript/ql/test/query-tests/Security/CWE-834/LoopBoundInjectionObviousNullPointerInPreviousLoop.js similarity index 100% rename from javascript/ql/test/query-tests/Security/CWE-834/TaintedLengthObviousNullPointerInPreviousLoop.js rename to javascript/ql/test/query-tests/Security/CWE-834/LoopBoundInjectionObviousNullPointerInPreviousLoop.js diff --git a/javascript/ql/test/query-tests/Security/CWE-834/TaintedLength.expected b/javascript/ql/test/query-tests/Security/CWE-834/TaintedLength.expected deleted file mode 100644 index 470cbe6b24b..00000000000 --- a/javascript/ql/test/query-tests/Security/CWE-834/TaintedLength.expected +++ /dev/null @@ -1,57 +0,0 @@ -nodes -| TaintedLengthBad.js:8:13:8:20 | req.body | -| TaintedLengthBad.js:10:15:10:22 | req.body | -| TaintedLengthBad.js:12:25:12:32 | req.body | -| TaintedLengthBad.js:14:19:14:26 | req.body | -| TaintedLengthBad.js:17:18:17:20 | val | -| TaintedLengthBad.js:20:25:20:27 | val | -| TaintedLengthBad.js:25:20:25:22 | val | -| TaintedLengthBad.js:29:16:29:18 | val | -| TaintedLengthBad.js:35:30:35:32 | val | -| TaintedLengthBad.js:38:15:38:17 | val | -| TaintedLengthBad.js:46:24:46:26 | val | -| TaintedLengthBad.js:51:25:51:27 | val | -| TaintedLengthExitBad.js:8:9:8:16 | req.body | -| TaintedLengthExitBad.js:10:9:10:16 | req.body | -| TaintedLengthExitBad.js:12:10:12:17 | req.body | -| TaintedLengthExitBad.js:14:14:14:21 | req.body | -| TaintedLengthExitBad.js:17:17:17:19 | val | -| TaintedLengthExitBad.js:20:22:20:24 | val | -| TaintedLengthExitBad.js:31:17:31:19 | val | -| TaintedLengthExitBad.js:34:22:34:24 | val | -| TaintedLengthExitBad.js:46:18:46:20 | val | -| TaintedLengthExitBad.js:49:22:49:24 | val | -| TaintedLengthExitBad.js:59:22:59:24 | val | -| TaintedLengthExitBad.js:60:8:60:10 | val | -| TaintedLengthLodash.js:9:13:9:20 | req.body | -| TaintedLengthLodash.js:12:18:12:20 | val | -| TaintedLengthLodash.js:13:13:13:15 | val | -edges -| TaintedLengthBad.js:8:13:8:20 | req.body | TaintedLengthBad.js:17:18:17:20 | val | -| TaintedLengthBad.js:10:15:10:22 | req.body | TaintedLengthBad.js:25:20:25:22 | val | -| TaintedLengthBad.js:12:25:12:32 | req.body | TaintedLengthBad.js:35:30:35:32 | val | -| TaintedLengthBad.js:14:19:14:26 | req.body | TaintedLengthBad.js:46:24:46:26 | val | -| TaintedLengthBad.js:17:18:17:20 | val | TaintedLengthBad.js:20:25:20:27 | val | -| TaintedLengthBad.js:25:20:25:22 | val | TaintedLengthBad.js:29:16:29:18 | val | -| TaintedLengthBad.js:35:30:35:32 | val | TaintedLengthBad.js:38:15:38:17 | val | -| TaintedLengthBad.js:46:24:46:26 | val | TaintedLengthBad.js:51:25:51:27 | val | -| TaintedLengthExitBad.js:8:9:8:16 | req.body | TaintedLengthExitBad.js:17:17:17:19 | val | -| TaintedLengthExitBad.js:10:9:10:16 | req.body | TaintedLengthExitBad.js:31:17:31:19 | val | -| TaintedLengthExitBad.js:12:10:12:17 | req.body | TaintedLengthExitBad.js:46:18:46:20 | val | -| TaintedLengthExitBad.js:14:14:14:21 | req.body | TaintedLengthExitBad.js:59:22:59:24 | val | -| TaintedLengthExitBad.js:17:17:17:19 | val | TaintedLengthExitBad.js:20:22:20:24 | val | -| TaintedLengthExitBad.js:31:17:31:19 | val | TaintedLengthExitBad.js:34:22:34:24 | val | -| TaintedLengthExitBad.js:46:18:46:20 | val | TaintedLengthExitBad.js:49:22:49:24 | val | -| TaintedLengthExitBad.js:59:22:59:24 | val | TaintedLengthExitBad.js:60:8:60:10 | val | -| TaintedLengthLodash.js:9:13:9:20 | req.body | TaintedLengthLodash.js:12:18:12:20 | val | -| TaintedLengthLodash.js:12:18:12:20 | val | TaintedLengthLodash.js:13:13:13:15 | val | -#select -| TaintedLengthBad.js:20:25:20:27 | val | TaintedLengthBad.js:8:13:8:20 | req.body | TaintedLengthBad.js:20:25:20:27 | val | Iterating over user-controlled object with a potentially unbounded .length property from $@. | TaintedLengthBad.js:8:13:8:20 | req.body | here | -| TaintedLengthBad.js:29:16:29:18 | val | TaintedLengthBad.js:10:15:10:22 | req.body | TaintedLengthBad.js:29:16:29:18 | val | Iterating over user-controlled object with a potentially unbounded .length property from $@. | TaintedLengthBad.js:10:15:10:22 | req.body | here | -| TaintedLengthBad.js:38:15:38:17 | val | TaintedLengthBad.js:12:25:12:32 | req.body | TaintedLengthBad.js:38:15:38:17 | val | Iterating over user-controlled object with a potentially unbounded .length property from $@. | TaintedLengthBad.js:12:25:12:32 | req.body | here | -| TaintedLengthBad.js:51:25:51:27 | val | TaintedLengthBad.js:14:19:14:26 | req.body | TaintedLengthBad.js:51:25:51:27 | val | Iterating over user-controlled object with a potentially unbounded .length property from $@. | TaintedLengthBad.js:14:19:14:26 | req.body | here | -| TaintedLengthExitBad.js:20:22:20:24 | val | TaintedLengthExitBad.js:8:9:8:16 | req.body | TaintedLengthExitBad.js:20:22:20:24 | val | Iterating over user-controlled object with a potentially unbounded .length property from $@. | TaintedLengthExitBad.js:8:9:8:16 | req.body | here | -| TaintedLengthExitBad.js:34:22:34:24 | val | TaintedLengthExitBad.js:10:9:10:16 | req.body | TaintedLengthExitBad.js:34:22:34:24 | val | Iterating over user-controlled object with a potentially unbounded .length property from $@. | TaintedLengthExitBad.js:10:9:10:16 | req.body | here | -| TaintedLengthExitBad.js:49:22:49:24 | val | TaintedLengthExitBad.js:12:10:12:17 | req.body | TaintedLengthExitBad.js:49:22:49:24 | val | Iterating over user-controlled object with a potentially unbounded .length property from $@. | TaintedLengthExitBad.js:12:10:12:17 | req.body | here | -| TaintedLengthExitBad.js:60:8:60:10 | val | TaintedLengthExitBad.js:14:14:14:21 | req.body | TaintedLengthExitBad.js:60:8:60:10 | val | Iterating over user-controlled object with a potentially unbounded .length property from $@. | TaintedLengthExitBad.js:14:14:14:21 | req.body | here | -| TaintedLengthLodash.js:13:13:13:15 | val | TaintedLengthLodash.js:9:13:9:20 | req.body | TaintedLengthLodash.js:13:13:13:15 | val | Iterating over user-controlled object with a potentially unbounded .length property from $@. | TaintedLengthLodash.js:9:13:9:20 | req.body | here | diff --git a/javascript/ql/test/query-tests/Security/CWE-834/TaintedLength.qlref b/javascript/ql/test/query-tests/Security/CWE-834/TaintedLength.qlref deleted file mode 100644 index 88fa98656c8..00000000000 --- a/javascript/ql/test/query-tests/Security/CWE-834/TaintedLength.qlref +++ /dev/null @@ -1 +0,0 @@ -Security/CWE-834/TaintedLength.ql \ No newline at end of file