hohn/codeql
1
0
Fork 0
mirror of https://github.com/github/codeql.git synced 2026-05-03 12:45:27 +02:00
Code Issues Packages Projects Releases Wiki Activity

JS: Update locations in expected files

Browse Source
This commit is contained in:
Asger F
2025-08-28 13:08:12 +02:00
parent d117c52d2f
commit cc8fe10801
75 changed files with 3337 additions and 3337 deletions
Download Patch File Download Diff File Expand all files Collapse all files

36
javascript/ql/test/experimental/FormParsers/RemoteFlowSource.expected
View File

@@ -1,17 +1,17 @@
edges
| busybus.js:9:30:9:33 | file | busybus.js:13:23:13:23 | z | provenance | |
| busybus.js:9:36:9:39 | info | busybus.js:10:54:10:57 | info | provenance | |
| busybus.js:10:19:10:50 | { filen ... eType } | busybus.js:10:19:10:57 | encoding | provenance | |
| busybus.js:10:19:10:50 | { filen ... eType } | busybus.js:10:19:10:57 | filename | provenance | |
| busybus.js:10:19:10:50 | { filen ... eType } | busybus.js:10:19:10:57 | mimeType | provenance | |
| busybus.js:10:19:10:57 | encoding | busybus.js:12:28:12:35 | encoding | provenance | |
| busybus.js:10:19:10:57 | filename | busybus.js:12:18:12:25 | filename | provenance | |
| busybus.js:10:19:10:57 | mimeType | busybus.js:12:38:12:45 | mimeType | provenance | |
| busybus.js:10:19:10:50 | { filen ... eType } | busybus.js:10:21:10:28 | filename | provenance | |
| busybus.js:10:19:10:50 | { filen ... eType } | busybus.js:10:31:10:38 | encoding | provenance | |
| busybus.js:10:19:10:50 | { filen ... eType } | busybus.js:10:41:10:48 | mimeType | provenance | |
| busybus.js:10:21:10:28 | filename | busybus.js:12:18:12:25 | filename | provenance | |
| busybus.js:10:31:10:38 | encoding | busybus.js:12:28:12:35 | encoding | provenance | |
| busybus.js:10:41:10:48 | mimeType | busybus.js:12:38:12:45 | mimeType | provenance | |
| busybus.js:10:54:10:57 | info | busybus.js:10:19:10:50 | { filen ... eType } | provenance | |
| busybus.js:13:23:13:23 | z | busybus.js:13:31:13:36 | sink() | provenance | |
| busybus.js:15:30:15:33 | data | busybus.js:16:22:16:25 | data | provenance | |
| busybus.js:22:25:22:42 | data | busybus.js:23:26:23:29 | data | provenance | |
| busybus.js:22:32:22:42 | this.read() | busybus.js:22:25:22:42 | data | provenance | |
| busybus.js:22:25:22:28 | data | busybus.js:23:26:23:29 | data | provenance | |
| busybus.js:22:32:22:42 | this.read() | busybus.js:22:25:22:28 | data | provenance | |
| busybus.js:27:25:27:28 | name | busybus.js:28:18:28:21 | name | provenance | |
| busybus.js:27:31:27:33 | val | busybus.js:28:24:28:26 | val | provenance | |
| busybus.js:27:36:27:39 | info | busybus.js:28:29:28:32 | info | provenance | |
@@ -19,10 +19,10 @@ edges
| dicer.js:14:28:14:33 | header | dicer.js:16:22:16:27 | header | provenance | |
| dicer.js:16:22:16:27 | header | dicer.js:16:22:16:30 | header[h] | provenance | |
| dicer.js:19:26:19:29 | data | dicer.js:20:18:20:21 | data | provenance | |
| formidable.js:7:11:7:25 | [fields, files] | formidable.js:7:11:7:49 | fields | provenance | |
| formidable.js:7:11:7:25 | [fields, files] | formidable.js:7:11:7:49 | files | provenance | |
| formidable.js:7:11:7:49 | fields | formidable.js:8:10:8:15 | fields | provenance | |
| formidable.js:7:11:7:49 | files | formidable.js:8:18:8:22 | files | provenance | |
| formidable.js:7:11:7:25 | [fields, files] | formidable.js:7:12:7:17 | fields | provenance | |
| formidable.js:7:11:7:25 | [fields, files] | formidable.js:7:20:7:24 | files | provenance | |
| formidable.js:7:12:7:17 | fields | formidable.js:8:10:8:15 | fields | provenance | |
| formidable.js:7:20:7:24 | files | formidable.js:8:18:8:22 | files | provenance | |
| formidable.js:7:29:7:49 | await f ... se(req) | formidable.js:7:11:7:25 | [fields, files] | provenance | |
| formidable.js:7:35:7:49 | form.parse(req) | formidable.js:7:29:7:49 | await f ... se(req) | provenance | |
| formidable.js:9:27:9:34 | formname | formidable.js:10:14:10:21 | formname | provenance | |
@@ -39,9 +39,9 @@ nodes
| busybus.js:9:30:9:33 | file | semmle.label | file |
| busybus.js:9:36:9:39 | info | semmle.label | info |
| busybus.js:10:19:10:50 | { filen ... eType } | semmle.label | { filen ... eType } |
| busybus.js:10:19:10:57 | encoding | semmle.label | encoding |
| busybus.js:10:19:10:57 | filename | semmle.label | filename |
| busybus.js:10:19:10:57 | mimeType | semmle.label | mimeType |
| busybus.js:10:21:10:28 | filename | semmle.label | filename |
| busybus.js:10:31:10:38 | encoding | semmle.label | encoding |
| busybus.js:10:41:10:48 | mimeType | semmle.label | mimeType |
| busybus.js:10:54:10:57 | info | semmle.label | info |
| busybus.js:12:18:12:25 | filename | semmle.label | filename |
| busybus.js:12:28:12:35 | encoding | semmle.label | encoding |
@@ -50,7 +50,7 @@ nodes
| busybus.js:13:31:13:36 | sink() | semmle.label | sink() |
| busybus.js:15:30:15:33 | data | semmle.label | data |
| busybus.js:16:22:16:25 | data | semmle.label | data |
| busybus.js:22:25:22:42 | data | semmle.label | data |
| busybus.js:22:25:22:28 | data | semmle.label | data |
| busybus.js:22:32:22:42 | this.read() | semmle.label | this.read() |
| busybus.js:23:26:23:29 | data | semmle.label | data |
| busybus.js:27:25:27:28 | name | semmle.label | name |
@@ -67,8 +67,8 @@ nodes
| dicer.js:19:26:19:29 | data | semmle.label | data |
| dicer.js:20:18:20:21 | data | semmle.label | data |
| formidable.js:7:11:7:25 | [fields, files] | semmle.label | [fields, files] |
| formidable.js:7:11:7:49 | fields | semmle.label | fields |
| formidable.js:7:11:7:49 | files | semmle.label | files |
| formidable.js:7:12:7:17 | fields | semmle.label | fields |
| formidable.js:7:20:7:24 | files | semmle.label | files |
| formidable.js:7:29:7:49 | await f ... se(req) | semmle.label | await f ... se(req) |
| formidable.js:7:35:7:49 | form.parse(req) | semmle.label | form.parse(req) |
| formidable.js:8:10:8:15 | fields | semmle.label | fields |

28
javascript/ql/test/experimental/Security/CWE-094-dataURL/CodeInjection.expected
View File

@@ -1,33 +1,33 @@
edges
| test.js:5:11:5:44 | payload | test.js:6:30:6:36 | payload | provenance | |
| test.js:5:11:5:44 | payload | test.js:9:26:9:32 | payload | provenance | |
| test.js:5:21:5:44 | req.que ... rameter | test.js:5:11:5:44 | payload | provenance | |
| test.js:6:9:6:43 | payloadURL | test.js:7:16:7:25 | payloadURL | provenance | |
| test.js:6:22:6:43 | new URL ... + sth) | test.js:6:9:6:43 | payloadURL | provenance | |
| test.js:5:11:5:17 | payload | test.js:6:30:6:36 | payload | provenance | |
| test.js:5:11:5:17 | payload | test.js:9:26:9:32 | payload | provenance | |
| test.js:5:21:5:44 | req.que ... rameter | test.js:5:11:5:17 | payload | provenance | |
| test.js:6:9:6:18 | payloadURL | test.js:7:16:7:25 | payloadURL | provenance | |
| test.js:6:22:6:43 | new URL ... + sth) | test.js:6:9:6:18 | payloadURL | provenance | |
| test.js:6:30:6:36 | payload | test.js:6:30:6:42 | payload + sth | provenance | |
| test.js:6:30:6:42 | payload + sth | test.js:6:22:6:43 | new URL ... + sth) | provenance | Config |
| test.js:9:5:9:39 | payloadURL | test.js:10:16:10:25 | payloadURL | provenance | |
| test.js:9:18:9:39 | new URL ... + sth) | test.js:9:5:9:39 | payloadURL | provenance | |
| test.js:9:5:9:14 | payloadURL | test.js:10:16:10:25 | payloadURL | provenance | |
| test.js:9:18:9:39 | new URL ... + sth) | test.js:9:5:9:14 | payloadURL | provenance | |
| test.js:9:26:9:32 | payload | test.js:9:26:9:38 | payload + sth | provenance | |
| test.js:9:26:9:38 | payload + sth | test.js:9:18:9:39 | new URL ... + sth) | provenance | Config |
| test.js:17:11:17:44 | payload | test.js:18:18:18:24 | payload | provenance | |
| test.js:17:11:17:44 | payload | test.js:19:18:19:24 | payload | provenance | |
| test.js:17:21:17:44 | req.que ... rameter | test.js:17:11:17:44 | payload | provenance | |
| test.js:17:11:17:17 | payload | test.js:18:18:18:24 | payload | provenance | |
| test.js:17:11:17:17 | payload | test.js:19:18:19:24 | payload | provenance | |
| test.js:17:21:17:44 | req.que ... rameter | test.js:17:11:17:17 | payload | provenance | |
| test.js:19:18:19:24 | payload | test.js:19:18:19:30 | payload + sth | provenance | |
nodes
| test.js:5:11:5:44 | payload | semmle.label | payload |
| test.js:5:11:5:17 | payload | semmle.label | payload |
| test.js:5:21:5:44 | req.que ... rameter | semmle.label | req.que ... rameter |
| test.js:6:9:6:43 | payloadURL | semmle.label | payloadURL |
| test.js:6:9:6:18 | payloadURL | semmle.label | payloadURL |
| test.js:6:22:6:43 | new URL ... + sth) | semmle.label | new URL ... + sth) |
| test.js:6:30:6:36 | payload | semmle.label | payload |
| test.js:6:30:6:42 | payload + sth | semmle.label | payload + sth |
| test.js:7:16:7:25 | payloadURL | semmle.label | payloadURL |
| test.js:9:5:9:39 | payloadURL | semmle.label | payloadURL |
| test.js:9:5:9:14 | payloadURL | semmle.label | payloadURL |
| test.js:9:18:9:39 | new URL ... + sth) | semmle.label | new URL ... + sth) |
| test.js:9:26:9:32 | payload | semmle.label | payload |
| test.js:9:26:9:38 | payload + sth | semmle.label | payload + sth |
| test.js:10:16:10:25 | payloadURL | semmle.label | payloadURL |
| test.js:17:11:17:44 | payload | semmle.label | payload |
| test.js:17:11:17:17 | payload | semmle.label | payload |
| test.js:17:21:17:44 | req.que ... rameter | semmle.label | req.que ... rameter |
| test.js:18:18:18:24 | payload | semmle.label | payload |
| test.js:19:18:19:24 | payload | semmle.label | payload |

28
javascript/ql/test/experimental/Security/CWE-099/EnvValueAndKeyInjection/EnvValueAndKeyInjection.expected
View File

@@ -1,28 +1,28 @@
edges
| test.js:5:9:5:28 | { EnvValue, EnvKey } | test.js:5:9:5:39 | EnvKey | provenance | |
| test.js:5:9:5:28 | { EnvValue, EnvKey } | test.js:5:9:5:39 | EnvValue | provenance | |
| test.js:5:9:5:39 | EnvKey | test.js:6:15:6:20 | EnvKey | provenance | |
| test.js:5:9:5:39 | EnvKey | test.js:7:15:7:20 | EnvKey | provenance | |
| test.js:5:9:5:39 | EnvValue | test.js:6:25:6:32 | EnvValue | provenance | |
| test.js:5:9:5:39 | EnvValue | test.js:7:25:7:32 | EnvValue | provenance | |
| test.js:5:9:5:28 | { EnvValue, EnvKey } | test.js:5:11:5:18 | EnvValue | provenance | |
| test.js:5:9:5:28 | { EnvValue, EnvKey } | test.js:5:21:5:26 | EnvKey | provenance | |
| test.js:5:11:5:18 | EnvValue | test.js:6:25:6:32 | EnvValue | provenance | |
| test.js:5:11:5:18 | EnvValue | test.js:7:25:7:32 | EnvValue | provenance | |
| test.js:5:21:5:26 | EnvKey | test.js:6:15:6:20 | EnvKey | provenance | |
| test.js:5:21:5:26 | EnvKey | test.js:7:15:7:20 | EnvKey | provenance | |
| test.js:5:32:5:39 | req.body | test.js:5:9:5:28 | { EnvValue, EnvKey } | provenance | |
| test.js:13:9:13:28 | { EnvValue, EnvKey } | test.js:13:9:13:39 | EnvKey | provenance | |
| test.js:13:9:13:28 | { EnvValue, EnvKey } | test.js:13:9:13:39 | EnvValue | provenance | |
| test.js:13:9:13:39 | EnvKey | test.js:15:15:15:20 | EnvKey | provenance | |
| test.js:13:9:13:39 | EnvValue | test.js:16:26:16:33 | EnvValue | provenance | |
| test.js:13:9:13:28 | { EnvValue, EnvKey } | test.js:13:11:13:18 | EnvValue | provenance | |
| test.js:13:9:13:28 | { EnvValue, EnvKey } | test.js:13:21:13:26 | EnvKey | provenance | |
| test.js:13:11:13:18 | EnvValue | test.js:16:26:16:33 | EnvValue | provenance | |
| test.js:13:21:13:26 | EnvKey | test.js:15:15:15:20 | EnvKey | provenance | |
| test.js:13:32:13:39 | req.body | test.js:13:9:13:28 | { EnvValue, EnvKey } | provenance | |
nodes
| test.js:5:9:5:28 | { EnvValue, EnvKey } | semmle.label | { EnvValue, EnvKey } |
| test.js:5:9:5:39 | EnvKey | semmle.label | EnvKey |
| test.js:5:9:5:39 | EnvValue | semmle.label | EnvValue |
| test.js:5:11:5:18 | EnvValue | semmle.label | EnvValue |
| test.js:5:21:5:26 | EnvKey | semmle.label | EnvKey |
| test.js:5:32:5:39 | req.body | semmle.label | req.body |
| test.js:6:15:6:20 | EnvKey | semmle.label | EnvKey |
| test.js:6:25:6:32 | EnvValue | semmle.label | EnvValue |
| test.js:7:15:7:20 | EnvKey | semmle.label | EnvKey |
| test.js:7:25:7:32 | EnvValue | semmle.label | EnvValue |
| test.js:13:9:13:28 | { EnvValue, EnvKey } | semmle.label | { EnvValue, EnvKey } |
| test.js:13:9:13:39 | EnvKey | semmle.label | EnvKey |
| test.js:13:9:13:39 | EnvValue | semmle.label | EnvValue |
| test.js:13:11:13:18 | EnvValue | semmle.label | EnvValue |
| test.js:13:21:13:26 | EnvKey | semmle.label | EnvKey |
| test.js:13:32:13:39 | req.body | semmle.label | req.body |
| test.js:15:15:15:20 | EnvKey | semmle.label | EnvKey |
| test.js:16:26:16:33 | EnvValue | semmle.label | EnvValue |

10
javascript/ql/test/experimental/Security/CWE-099/EnvValueInjection/EnvValueInjection.expected
View File

@@ -1,12 +1,12 @@
edges
| test.js:4:9:4:20 | { EnvValue } | test.js:4:9:4:31 | EnvValue | provenance | |
| test.js:4:9:4:31 | EnvValue | test.js:5:35:5:42 | EnvValue | provenance | |
| test.js:4:9:4:31 | EnvValue | test.js:6:23:6:30 | EnvValue | provenance | |
| test.js:4:9:4:31 | EnvValue | test.js:7:22:7:29 | EnvValue | provenance | |
| test.js:4:9:4:20 | { EnvValue } | test.js:4:11:4:18 | EnvValue | provenance | |
| test.js:4:11:4:18 | EnvValue | test.js:5:35:5:42 | EnvValue | provenance | |
| test.js:4:11:4:18 | EnvValue | test.js:6:23:6:30 | EnvValue | provenance | |
| test.js:4:11:4:18 | EnvValue | test.js:7:22:7:29 | EnvValue | provenance | |
| test.js:4:24:4:31 | req.body | test.js:4:9:4:20 | { EnvValue } | provenance | |
nodes
| test.js:4:9:4:20 | { EnvValue } | semmle.label | { EnvValue } |
| test.js:4:9:4:31 | EnvValue | semmle.label | EnvValue |
| test.js:4:11:4:18 | EnvValue | semmle.label | EnvValue |
| test.js:4:24:4:31 | req.body | semmle.label | req.body |
| test.js:5:35:5:42 | EnvValue | semmle.label | EnvValue |
| test.js:6:23:6:30 | EnvValue | semmle.label | EnvValue |

84
javascript/ql/test/experimental/Security/CWE-347/localsource/decodeJwtWithoutVerificationLocalSource.expected
View File

@@ -1,74 +1,74 @@
edges
| JsonWebToken.js:13:11:13:28 | UserToken | JsonWebToken.js:16:28:16:36 | UserToken | provenance | |
| JsonWebToken.js:13:23:13:28 | aJwt() | JsonWebToken.js:13:11:13:28 | UserToken | provenance | |
| JsonWebToken.js:20:11:20:28 | UserToken | JsonWebToken.js:23:28:23:36 | UserToken | provenance | |
| JsonWebToken.js:20:11:20:28 | UserToken | JsonWebToken.js:24:28:24:36 | UserToken | provenance | |
| JsonWebToken.js:20:23:20:28 | aJwt() | JsonWebToken.js:20:11:20:28 | UserToken | provenance | |
| JsonWebToken.js:28:11:28:28 | UserToken | JsonWebToken.js:31:28:31:36 | UserToken | provenance | |
| JsonWebToken.js:28:23:28:28 | aJwt() | JsonWebToken.js:28:11:28:28 | UserToken | provenance | |
| JsonWebToken.js:35:11:35:28 | UserToken | JsonWebToken.js:38:28:38:36 | UserToken | provenance | |
| JsonWebToken.js:35:11:35:28 | UserToken | JsonWebToken.js:39:28:39:36 | UserToken | provenance | |
| JsonWebToken.js:35:23:35:28 | aJwt() | JsonWebToken.js:35:11:35:28 | UserToken | provenance | |
| JsonWebToken.js:43:11:43:28 | UserToken | JsonWebToken.js:46:28:46:36 | UserToken | provenance | |
| JsonWebToken.js:43:11:43:28 | UserToken | JsonWebToken.js:47:28:47:36 | UserToken | provenance | |
| JsonWebToken.js:43:23:43:28 | aJwt() | JsonWebToken.js:43:11:43:28 | UserToken | provenance | |
| jose.js:12:11:12:28 | UserToken | jose.js:15:20:15:28 | UserToken | provenance | |
| jose.js:12:23:12:28 | aJwt() | jose.js:12:11:12:28 | UserToken | provenance | |
| jose.js:19:11:19:28 | UserToken | jose.js:22:20:22:28 | UserToken | provenance | |
| jose.js:19:11:19:28 | UserToken | jose.js:23:26:23:34 | UserToken | provenance | |
| jose.js:19:23:19:28 | aJwt() | jose.js:19:11:19:28 | UserToken | provenance | |
| jose.js:27:11:27:28 | UserToken | jose.js:30:26:30:34 | UserToken | provenance | |
| jose.js:27:23:27:28 | aJwt() | jose.js:27:11:27:28 | UserToken | provenance | |
| jwtDecode.js:13:11:13:28 | UserToken | jwtDecode.js:17:16:17:24 | UserToken | provenance | |
| jwtDecode.js:13:23:13:28 | aJwt() | jwtDecode.js:13:11:13:28 | UserToken | provenance | |
| jwtSimple.js:13:11:13:28 | UserToken | jwtSimple.js:16:23:16:31 | UserToken | provenance | |
| jwtSimple.js:13:23:13:28 | aJwt() | jwtSimple.js:13:11:13:28 | UserToken | provenance | |
| jwtSimple.js:20:11:20:28 | UserToken | jwtSimple.js:23:23:23:31 | UserToken | provenance | |
| jwtSimple.js:20:11:20:28 | UserToken | jwtSimple.js:24:23:24:31 | UserToken | provenance | |
| jwtSimple.js:20:23:20:28 | aJwt() | jwtSimple.js:20:11:20:28 | UserToken | provenance | |
| jwtSimple.js:28:11:28:28 | UserToken | jwtSimple.js:31:23:31:31 | UserToken | provenance | |
| jwtSimple.js:28:11:28:28 | UserToken | jwtSimple.js:32:23:32:31 | UserToken | provenance | |
| jwtSimple.js:28:23:28:28 | aJwt() | jwtSimple.js:28:11:28:28 | UserToken | provenance | |
| JsonWebToken.js:13:11:13:19 | UserToken | JsonWebToken.js:16:28:16:36 | UserToken | provenance | |
| JsonWebToken.js:13:23:13:28 | aJwt() | JsonWebToken.js:13:11:13:19 | UserToken | provenance | |
| JsonWebToken.js:20:11:20:19 | UserToken | JsonWebToken.js:23:28:23:36 | UserToken | provenance | |
| JsonWebToken.js:20:11:20:19 | UserToken | JsonWebToken.js:24:28:24:36 | UserToken | provenance | |
| JsonWebToken.js:20:23:20:28 | aJwt() | JsonWebToken.js:20:11:20:19 | UserToken | provenance | |
| JsonWebToken.js:28:11:28:19 | UserToken | JsonWebToken.js:31:28:31:36 | UserToken | provenance | |
| JsonWebToken.js:28:23:28:28 | aJwt() | JsonWebToken.js:28:11:28:19 | UserToken | provenance | |
| JsonWebToken.js:35:11:35:19 | UserToken | JsonWebToken.js:38:28:38:36 | UserToken | provenance | |
| JsonWebToken.js:35:11:35:19 | UserToken | JsonWebToken.js:39:28:39:36 | UserToken | provenance | |
| JsonWebToken.js:35:23:35:28 | aJwt() | JsonWebToken.js:35:11:35:19 | UserToken | provenance | |
| JsonWebToken.js:43:11:43:19 | UserToken | JsonWebToken.js:46:28:46:36 | UserToken | provenance | |
| JsonWebToken.js:43:11:43:19 | UserToken | JsonWebToken.js:47:28:47:36 | UserToken | provenance | |
| JsonWebToken.js:43:23:43:28 | aJwt() | JsonWebToken.js:43:11:43:19 | UserToken | provenance | |
| jose.js:12:11:12:19 | UserToken | jose.js:15:20:15:28 | UserToken | provenance | |
| jose.js:12:23:12:28 | aJwt() | jose.js:12:11:12:19 | UserToken | provenance | |
| jose.js:19:11:19:19 | UserToken | jose.js:22:20:22:28 | UserToken | provenance | |
| jose.js:19:11:19:19 | UserToken | jose.js:23:26:23:34 | UserToken | provenance | |
| jose.js:19:23:19:28 | aJwt() | jose.js:19:11:19:19 | UserToken | provenance | |
| jose.js:27:11:27:19 | UserToken | jose.js:30:26:30:34 | UserToken | provenance | |
| jose.js:27:23:27:28 | aJwt() | jose.js:27:11:27:19 | UserToken | provenance | |
| jwtDecode.js:13:11:13:19 | UserToken | jwtDecode.js:17:16:17:24 | UserToken | provenance | |
| jwtDecode.js:13:23:13:28 | aJwt() | jwtDecode.js:13:11:13:19 | UserToken | provenance | |
| jwtSimple.js:13:11:13:19 | UserToken | jwtSimple.js:16:23:16:31 | UserToken | provenance | |
| jwtSimple.js:13:23:13:28 | aJwt() | jwtSimple.js:13:11:13:19 | UserToken | provenance | |
| jwtSimple.js:20:11:20:19 | UserToken | jwtSimple.js:23:23:23:31 | UserToken | provenance | |
| jwtSimple.js:20:11:20:19 | UserToken | jwtSimple.js:24:23:24:31 | UserToken | provenance | |
| jwtSimple.js:20:23:20:28 | aJwt() | jwtSimple.js:20:11:20:19 | UserToken | provenance | |
| jwtSimple.js:28:11:28:19 | UserToken | jwtSimple.js:31:23:31:31 | UserToken | provenance | |
| jwtSimple.js:28:11:28:19 | UserToken | jwtSimple.js:32:23:32:31 | UserToken | provenance | |
| jwtSimple.js:28:23:28:28 | aJwt() | jwtSimple.js:28:11:28:19 | UserToken | provenance | |
nodes
| JsonWebToken.js:13:11:13:28 | UserToken | semmle.label | UserToken |
| JsonWebToken.js:13:11:13:19 | UserToken | semmle.label | UserToken |
| JsonWebToken.js:13:23:13:28 | aJwt() | semmle.label | aJwt() |
| JsonWebToken.js:16:28:16:36 | UserToken | semmle.label | UserToken |
| JsonWebToken.js:20:11:20:28 | UserToken | semmle.label | UserToken |
| JsonWebToken.js:20:11:20:19 | UserToken | semmle.label | UserToken |
| JsonWebToken.js:20:23:20:28 | aJwt() | semmle.label | aJwt() |
| JsonWebToken.js:23:28:23:36 | UserToken | semmle.label | UserToken |
| JsonWebToken.js:24:28:24:36 | UserToken | semmle.label | UserToken |
| JsonWebToken.js:28:11:28:28 | UserToken | semmle.label | UserToken |
| JsonWebToken.js:28:11:28:19 | UserToken | semmle.label | UserToken |
| JsonWebToken.js:28:23:28:28 | aJwt() | semmle.label | aJwt() |
| JsonWebToken.js:31:28:31:36 | UserToken | semmle.label | UserToken |
| JsonWebToken.js:35:11:35:28 | UserToken | semmle.label | UserToken |
| JsonWebToken.js:35:11:35:19 | UserToken | semmle.label | UserToken |
| JsonWebToken.js:35:23:35:28 | aJwt() | semmle.label | aJwt() |
| JsonWebToken.js:38:28:38:36 | UserToken | semmle.label | UserToken |
| JsonWebToken.js:39:28:39:36 | UserToken | semmle.label | UserToken |
| JsonWebToken.js:43:11:43:28 | UserToken | semmle.label | UserToken |
| JsonWebToken.js:43:11:43:19 | UserToken | semmle.label | UserToken |
| JsonWebToken.js:43:23:43:28 | aJwt() | semmle.label | aJwt() |
| JsonWebToken.js:46:28:46:36 | UserToken | semmle.label | UserToken |
| JsonWebToken.js:47:28:47:36 | UserToken | semmle.label | UserToken |
| jose.js:12:11:12:28 | UserToken | semmle.label | UserToken |
| jose.js:12:11:12:19 | UserToken | semmle.label | UserToken |
| jose.js:12:23:12:28 | aJwt() | semmle.label | aJwt() |
| jose.js:15:20:15:28 | UserToken | semmle.label | UserToken |
| jose.js:19:11:19:28 | UserToken | semmle.label | UserToken |
| jose.js:19:11:19:19 | UserToken | semmle.label | UserToken |
| jose.js:19:23:19:28 | aJwt() | semmle.label | aJwt() |
| jose.js:22:20:22:28 | UserToken | semmle.label | UserToken |
| jose.js:23:26:23:34 | UserToken | semmle.label | UserToken |
| jose.js:27:11:27:28 | UserToken | semmle.label | UserToken |
| jose.js:27:11:27:19 | UserToken | semmle.label | UserToken |
| jose.js:27:23:27:28 | aJwt() | semmle.label | aJwt() |
| jose.js:30:26:30:34 | UserToken | semmle.label | UserToken |
| jwtDecode.js:13:11:13:28 | UserToken | semmle.label | UserToken |
| jwtDecode.js:13:11:13:19 | UserToken | semmle.label | UserToken |
| jwtDecode.js:13:23:13:28 | aJwt() | semmle.label | aJwt() |
| jwtDecode.js:17:16:17:24 | UserToken | semmle.label | UserToken |
| jwtSimple.js:13:11:13:28 | UserToken | semmle.label | UserToken |
| jwtSimple.js:13:11:13:19 | UserToken | semmle.label | UserToken |
| jwtSimple.js:13:23:13:28 | aJwt() | semmle.label | aJwt() |
| jwtSimple.js:16:23:16:31 | UserToken | semmle.label | UserToken |
| jwtSimple.js:20:11:20:28 | UserToken | semmle.label | UserToken |
| jwtSimple.js:20:11:20:19 | UserToken | semmle.label | UserToken |
| jwtSimple.js:20:23:20:28 | aJwt() | semmle.label | aJwt() |
| jwtSimple.js:23:23:23:31 | UserToken | semmle.label | UserToken |
| jwtSimple.js:24:23:24:31 | UserToken | semmle.label | UserToken |
| jwtSimple.js:28:11:28:28 | UserToken | semmle.label | UserToken |
| jwtSimple.js:28:11:28:19 | UserToken | semmle.label | UserToken |
| jwtSimple.js:28:23:28:28 | aJwt() | semmle.label | aJwt() |
| jwtSimple.js:31:23:31:31 | UserToken | semmle.label | UserToken |
| jwtSimple.js:32:23:32:31 | UserToken | semmle.label | UserToken |

56
javascript/ql/test/experimental/Security/CWE-347/remotesource/decodeJwtWithoutVerification.expected
View File

@@ -1,50 +1,50 @@
edges
| JsonWebToken.js:10:11:10:47 | UserToken | JsonWebToken.js:13:28:13:36 | UserToken | provenance | |
| JsonWebToken.js:10:23:10:47 | req.hea ... ization | JsonWebToken.js:10:11:10:47 | UserToken | provenance | |
| JsonWebToken.js:17:11:17:47 | UserToken | JsonWebToken.js:20:28:20:36 | UserToken | provenance | |
| JsonWebToken.js:17:11:17:47 | UserToken | JsonWebToken.js:21:28:21:36 | UserToken | provenance | |
| JsonWebToken.js:17:23:17:47 | req.hea ... ization | JsonWebToken.js:17:11:17:47 | UserToken | provenance | |
| JsonWebToken.js:32:11:32:47 | UserToken | JsonWebToken.js:35:28:35:36 | UserToken | provenance | |
| JsonWebToken.js:32:23:32:47 | req.hea ... ization | JsonWebToken.js:32:11:32:47 | UserToken | provenance | |
| JsonWebToken.js:40:11:40:47 | UserToken | JsonWebToken.js:43:28:43:36 | UserToken | provenance | |
| JsonWebToken.js:40:23:40:47 | req.hea ... ization | JsonWebToken.js:40:11:40:47 | UserToken | provenance | |
| jose.js:11:11:11:47 | UserToken | jose.js:13:20:13:28 | UserToken | provenance | |
| jose.js:11:23:11:47 | req.hea ... ization | jose.js:11:11:11:47 | UserToken | provenance | |
| jose.js:24:11:24:47 | UserToken | jose.js:26:20:26:28 | UserToken | provenance | |
| jose.js:24:23:24:47 | req.hea ... ization | jose.js:24:11:24:47 | UserToken | provenance | |
| jwtDecode.js:11:11:11:47 | UserToken | jwtDecode.js:15:16:15:24 | UserToken | provenance | |
| jwtDecode.js:11:23:11:47 | req.hea ... ization | jwtDecode.js:11:11:11:47 | UserToken | provenance | |
| jwtSimple.js:10:11:10:47 | UserToken | jwtSimple.js:13:23:13:31 | UserToken | provenance | |
| jwtSimple.js:10:23:10:47 | req.hea ... ization | jwtSimple.js:10:11:10:47 | UserToken | provenance | |
| jwtSimple.js:25:11:25:47 | UserToken | jwtSimple.js:28:23:28:31 | UserToken | provenance | |
| jwtSimple.js:25:23:25:47 | req.hea ... ization | jwtSimple.js:25:11:25:47 | UserToken | provenance | |
| JsonWebToken.js:10:11:10:19 | UserToken | JsonWebToken.js:13:28:13:36 | UserToken | provenance | |
| JsonWebToken.js:10:23:10:47 | req.hea ... ization | JsonWebToken.js:10:11:10:19 | UserToken | provenance | |
| JsonWebToken.js:17:11:17:19 | UserToken | JsonWebToken.js:20:28:20:36 | UserToken | provenance | |
| JsonWebToken.js:17:11:17:19 | UserToken | JsonWebToken.js:21:28:21:36 | UserToken | provenance | |
| JsonWebToken.js:17:23:17:47 | req.hea ... ization | JsonWebToken.js:17:11:17:19 | UserToken | provenance | |
| JsonWebToken.js:32:11:32:19 | UserToken | JsonWebToken.js:35:28:35:36 | UserToken | provenance | |
| JsonWebToken.js:32:23:32:47 | req.hea ... ization | JsonWebToken.js:32:11:32:19 | UserToken | provenance | |
| JsonWebToken.js:40:11:40:19 | UserToken | JsonWebToken.js:43:28:43:36 | UserToken | provenance | |
| JsonWebToken.js:40:23:40:47 | req.hea ... ization | JsonWebToken.js:40:11:40:19 | UserToken | provenance | |
| jose.js:11:11:11:19 | UserToken | jose.js:13:20:13:28 | UserToken | provenance | |
| jose.js:11:23:11:47 | req.hea ... ization | jose.js:11:11:11:19 | UserToken | provenance | |
| jose.js:24:11:24:19 | UserToken | jose.js:26:20:26:28 | UserToken | provenance | |
| jose.js:24:23:24:47 | req.hea ... ization | jose.js:24:11:24:19 | UserToken | provenance | |
| jwtDecode.js:11:11:11:19 | UserToken | jwtDecode.js:15:16:15:24 | UserToken | provenance | |
| jwtDecode.js:11:23:11:47 | req.hea ... ization | jwtDecode.js:11:11:11:19 | UserToken | provenance | |
| jwtSimple.js:10:11:10:19 | UserToken | jwtSimple.js:13:23:13:31 | UserToken | provenance | |
| jwtSimple.js:10:23:10:47 | req.hea ... ization | jwtSimple.js:10:11:10:19 | UserToken | provenance | |
| jwtSimple.js:25:11:25:19 | UserToken | jwtSimple.js:28:23:28:31 | UserToken | provenance | |
| jwtSimple.js:25:23:25:47 | req.hea ... ization | jwtSimple.js:25:11:25:19 | UserToken | provenance | |
nodes
| JsonWebToken.js:10:11:10:47 | UserToken | semmle.label | UserToken |
| JsonWebToken.js:10:11:10:19 | UserToken | semmle.label | UserToken |
| JsonWebToken.js:10:23:10:47 | req.hea ... ization | semmle.label | req.hea ... ization |
| JsonWebToken.js:13:28:13:36 | UserToken | semmle.label | UserToken |
| JsonWebToken.js:17:11:17:47 | UserToken | semmle.label | UserToken |
| JsonWebToken.js:17:11:17:19 | UserToken | semmle.label | UserToken |
| JsonWebToken.js:17:23:17:47 | req.hea ... ization | semmle.label | req.hea ... ization |
| JsonWebToken.js:20:28:20:36 | UserToken | semmle.label | UserToken |
| JsonWebToken.js:21:28:21:36 | UserToken | semmle.label | UserToken |
| JsonWebToken.js:32:11:32:47 | UserToken | semmle.label | UserToken |
| JsonWebToken.js:32:11:32:19 | UserToken | semmle.label | UserToken |
| JsonWebToken.js:32:23:32:47 | req.hea ... ization | semmle.label | req.hea ... ization |
| JsonWebToken.js:35:28:35:36 | UserToken | semmle.label | UserToken |
| JsonWebToken.js:40:11:40:47 | UserToken | semmle.label | UserToken |
| JsonWebToken.js:40:11:40:19 | UserToken | semmle.label | UserToken |
| JsonWebToken.js:40:23:40:47 | req.hea ... ization | semmle.label | req.hea ... ization |
| JsonWebToken.js:43:28:43:36 | UserToken | semmle.label | UserToken |
| jose.js:11:11:11:47 | UserToken | semmle.label | UserToken |
| jose.js:11:11:11:19 | UserToken | semmle.label | UserToken |
| jose.js:11:23:11:47 | req.hea ... ization | semmle.label | req.hea ... ization |
| jose.js:13:20:13:28 | UserToken | semmle.label | UserToken |
| jose.js:24:11:24:47 | UserToken | semmle.label | UserToken |
| jose.js:24:11:24:19 | UserToken | semmle.label | UserToken |
| jose.js:24:23:24:47 | req.hea ... ization | semmle.label | req.hea ... ization |
| jose.js:26:20:26:28 | UserToken | semmle.label | UserToken |
| jwtDecode.js:11:11:11:47 | UserToken | semmle.label | UserToken |
| jwtDecode.js:11:11:11:19 | UserToken | semmle.label | UserToken |
| jwtDecode.js:11:23:11:47 | req.hea ... ization | semmle.label | req.hea ... ization |
| jwtDecode.js:15:16:15:24 | UserToken | semmle.label | UserToken |
| jwtSimple.js:10:11:10:47 | UserToken | semmle.label | UserToken |
| jwtSimple.js:10:11:10:19 | UserToken | semmle.label | UserToken |
| jwtSimple.js:10:23:10:47 | req.hea ... ization | semmle.label | req.hea ... ization |
| jwtSimple.js:13:23:13:31 | UserToken | semmle.label | UserToken |
| jwtSimple.js:25:11:25:47 | UserToken | semmle.label | UserToken |
| jwtSimple.js:25:11:25:19 | UserToken | semmle.label | UserToken |
| jwtSimple.js:25:23:25:47 | req.hea ... ization | semmle.label | req.hea ... ization |
| jwtSimple.js:28:23:28:31 | UserToken | semmle.label | UserToken |
subpaths

12
javascript/ql/test/experimental/Security/CWE-918/SSRF.expected
View File

@@ -1,6 +1,6 @@
edges
| check-domain.js:16:9:16:27 | url | check-domain.js:17:13:17:15 | url | provenance | |
| check-domain.js:16:15:16:27 | req.query.url | check-domain.js:16:9:16:27 | url | provenance | |
| check-domain.js:16:9:16:11 | url | check-domain.js:17:13:17:15 | url | provenance | |
| check-domain.js:16:15:16:27 | req.query.url | check-domain.js:16:9:16:11 | url | provenance | |
| check-middleware.js:9:27:9:43 | req.query.tainted | check-middleware.js:9:13:9:43 | "test.c ... tainted | provenance | |
| check-path.js:19:27:19:43 | req.query.tainted | check-path.js:19:13:19:43 | 'test.c ... tainted | provenance | |
| check-path.js:23:27:23:43 | req.query.tainted | check-path.js:23:13:23:45 | `/addre ... inted}` | provenance | |
@@ -16,13 +16,13 @@ edges
| check-validator.js:15:29:15:45 | req.query.tainted | check-validator.js:15:15:15:45 | "test.c ... tainted | provenance | |
| check-validator.js:27:29:27:45 | req.query.tainted | check-validator.js:27:15:27:45 | "test.c ... tainted | provenance | |
| check-validator.js:50:29:50:45 | req.query.tainted | check-validator.js:50:15:50:45 | "test.c ... tainted | provenance | |
| check-validator.js:54:9:54:37 | numberURL | check-validator.js:62:29:62:37 | numberURL | provenance | |
| check-validator.js:54:21:54:37 | req.query.tainted | check-validator.js:54:9:54:37 | numberURL | provenance | |
| check-validator.js:54:9:54:17 | numberURL | check-validator.js:62:29:62:37 | numberURL | provenance | |
| check-validator.js:54:21:54:37 | req.query.tainted | check-validator.js:54:9:54:17 | numberURL | provenance | |
| check-validator.js:59:29:59:45 | req.query.tainted | check-validator.js:59:15:59:45 | "test.c ... tainted | provenance | |
| check-validator.js:62:29:62:37 | numberURL | check-validator.js:62:15:62:37 | "test.c ... mberURL | provenance | |
| check-validator.js:68:29:68:45 | req.query.tainted | check-validator.js:68:15:68:45 | "test.c ... tainted | provenance | |
nodes
| check-domain.js:16:9:16:27 | url | semmle.label | url |
| check-domain.js:16:9:16:11 | url | semmle.label | url |
| check-domain.js:16:15:16:27 | req.query.url | semmle.label | req.query.url |
| check-domain.js:17:13:17:15 | url | semmle.label | url |
| check-domain.js:26:15:26:27 | req.query.url | semmle.label | req.query.url |
@@ -56,7 +56,7 @@ nodes
| check-validator.js:27:29:27:45 | req.query.tainted | semmle.label | req.query.tainted |
| check-validator.js:50:15:50:45 | "test.c ... tainted | semmle.label | "test.c ... tainted |
| check-validator.js:50:29:50:45 | req.query.tainted | semmle.label | req.query.tainted |
| check-validator.js:54:9:54:37 | numberURL | semmle.label | numberURL |
| check-validator.js:54:9:54:17 | numberURL | semmle.label | numberURL |
| check-validator.js:54:21:54:37 | req.query.tainted | semmle.label | req.query.tainted |
| check-validator.js:59:15:59:45 | "test.c ... tainted | semmle.label | "test.c ... tainted |
| check-validator.js:59:29:59:45 | req.query.tainted | semmle.label | req.query.tainted |

18
javascript/ql/test/experimental/Security/CWE-942/CorsPermissiveConfiguration.expected
View File

@@ -1,16 +1,16 @@
edges
| apollo-test.js:8:9:8:59 | user_origin | apollo-test.js:26:25:26:35 | user_origin | provenance | |
| apollo-test.js:8:9:8:59 | user_origin | apollo-test.js:26:25:26:35 | user_origin | provenance | |
| apollo-test.js:8:23:8:46 | url.par ... , true) | apollo-test.js:8:9:8:59 | user_origin | provenance | |
| apollo-test.js:8:23:8:46 | url.par ... , true) | apollo-test.js:8:9:8:59 | user_origin | provenance | |
| apollo-test.js:8:9:8:19 | user_origin | apollo-test.js:26:25:26:35 | user_origin | provenance | |
| apollo-test.js:8:9:8:19 | user_origin | apollo-test.js:26:25:26:35 | user_origin | provenance | |
| apollo-test.js:8:23:8:46 | url.par ... , true) | apollo-test.js:8:9:8:19 | user_origin | provenance | |
| apollo-test.js:8:23:8:46 | url.par ... , true) | apollo-test.js:8:9:8:19 | user_origin | provenance | |
| apollo-test.js:8:33:8:39 | req.url | apollo-test.js:8:23:8:46 | url.par ... , true) | provenance | |
| apollo-test.js:8:42:8:45 | true | apollo-test.js:8:23:8:46 | url.par ... , true) | provenance | |
| express-test.js:10:9:10:59 | user_origin | express-test.js:33:17:33:27 | user_origin | provenance | |
| express-test.js:10:23:10:46 | url.par ... , true) | express-test.js:10:9:10:59 | user_origin | provenance | |
| express-test.js:10:9:10:19 | user_origin | express-test.js:33:17:33:27 | user_origin | provenance | |
| express-test.js:10:23:10:46 | url.par ... , true) | express-test.js:10:9:10:19 | user_origin | provenance | |
| express-test.js:10:33:10:39 | req.url | express-test.js:10:23:10:46 | url.par ... , true) | provenance | |
nodes
| apollo-test.js:8:9:8:59 | user_origin | semmle.label | user_origin |
| apollo-test.js:8:9:8:59 | user_origin | semmle.label | user_origin |
| apollo-test.js:8:9:8:19 | user_origin | semmle.label | user_origin |
| apollo-test.js:8:9:8:19 | user_origin | semmle.label | user_origin |
| apollo-test.js:8:23:8:46 | url.par ... , true) | semmle.label | url.par ... , true) |
| apollo-test.js:8:23:8:46 | url.par ... , true) | semmle.label | url.par ... , true) |
| apollo-test.js:8:33:8:39 | req.url | semmle.label | req.url |
@@ -19,7 +19,7 @@ nodes
| apollo-test.js:21:25:21:28 | null | semmle.label | null |
| apollo-test.js:26:25:26:35 | user_origin | semmle.label | user_origin |
| apollo-test.js:26:25:26:35 | user_origin | semmle.label | user_origin |
| express-test.js:10:9:10:59 | user_origin | semmle.label | user_origin |
| express-test.js:10:9:10:19 | user_origin | semmle.label | user_origin |
| express-test.js:10:23:10:46 | url.par ... , true) | semmle.label | url.par ... , true) |
| express-test.js:10:33:10:39 | req.url | semmle.label | req.url |
| express-test.js:26:17:26:19 | '*' | semmle.label | '*' |