hohn/codeql
1
0
Fork 0
mirror of https://github.com/github/codeql.git synced 2026-04-28 02:05:14 +02:00
Code Issues Packages Projects Releases Wiki Activity

Merge branch 'main' into aegilops/polyfill-io-compromised-script

Browse Source
This commit is contained in:
Paul Hodgkinson
2024-07-12 12:53:44 +01:00
committed by GitHub
parent 61df4d2f04 0839742daa
commit c9af53f050
519 changed files with 26045 additions and 4878 deletions
Download Patch File Download Diff File Expand all files Collapse all files

2
javascript/ql/test/query-tests/Security/CWE-693/InsecureHelmet.expected Normal file
View File

@@ -0,0 +1,2 @@
| InsecureHelmetBad.js:6:9:9:2 | helmet( ... uard\\n}) | Helmet security middleware, configured with security setting $@ set to 'false', which disables enforcing that feature. | InsecureHelmetBad.js:7:5:7:32 | content ... : false | contentSecurityPolicy |
| InsecureHelmetBad.js:6:9:9:2 | helmet( ... uard\\n}) | Helmet security middleware, configured with security setting $@ set to 'false', which disables enforcing that feature. | InsecureHelmetBad.js:8:5:8:21 | frameguard: false | frameguard |

1
javascript/ql/test/query-tests/Security/CWE-693/InsecureHelmet.qlref Normal file
View File

@@ -0,0 +1 @@
Security/CWE-693/InsecureHelmet.ql

17
javascript/ql/test/query-tests/Security/CWE-693/InsecureHelmetBad.js Normal file
View File

@@ -0,0 +1,17 @@
const express = require("express");
const helmet = require("helmet");
const app = express();
app.use(helmet({
contentSecurityPolicy: false, // BAD: switch off default CSP
frameguard: false // BAD: switch off default frameguard
}));
app.get("/", (req, res) => {
res.send("Hello, world!");
});
app.listen(3000, () => {
console.log("App is listening on port 3000");
});

14
javascript/ql/test/query-tests/Security/CWE-693/InsecureHelmetGood.js Normal file
View File

@@ -0,0 +1,14 @@
const express = require("express");
const helmet = require("helmet");
const app = express();
app.use(helmet()); // GOOD: use the defaults
app.get("/", (req, res) => {
res.send("Hello, world!");
});
app.listen(3000, () => {
console.log("App is listening on port 3000");
});