hohn/codeql
1
0
Fork 0
mirror of https://github.com/github/codeql.git synced 2026-04-24 00:05:14 +02:00
Code Issues Packages Projects Releases Wiki Activity

JS: Mark what seems to be missing alerts for fflate

Browse Source 
The query doesn't seem to model or even mention fflate. Not sure if the library is safe or just not modeled.
This commit is contained in:
Asger F
2025-02-21 20:18:57 +01:00
parent 3f7f74b925
commit cd788bc509
1 changed files with 9 additions and 8 deletions
Download Patch File Download Diff File Expand all files Collapse all files

17
javascript/ql/test/query-tests/Security/CWE-522-DecompressionBombs/fflate.js
View File

@@ -9,14 +9,15 @@ app.listen(3000, () => {
});
app.post('/upload', async (req, res) => {
fflate.unzlibSync(new Uint8Array(req.files.CompressedFile.data)); // $ Alert
fflate.unzip(new Uint8Array(new Uint8Array(req.files.CompressedFile.data)));
fflate.unzlib(new Uint8Array(req.files.CompressedFile.data));
fflate.unzlibSync(new Uint8Array(req.files.CompressedFile.data));
fflate.gunzip(new Uint8Array(req.files.CompressedFile.data));
fflate.gunzipSync(new Uint8Array(req.files.CompressedFile.data));
fflate.decompress(new Uint8Array(req.files.CompressedFile.data));
fflate.decompressSync(new Uint8Array(req.files.CompressedFile.data));
// Not sure if these are vulnerable, but currently not modeled
fflate.unzlibSync(new Uint8Array(req.files.CompressedFile.data)); // $ MISSING: Alert
fflate.unzip(new Uint8Array(new Uint8Array(req.files.CompressedFile.data))); // $ MISSING: Alert
fflate.unzlib(new Uint8Array(req.files.CompressedFile.data)); // $ MISSING: Alert
fflate.unzlibSync(new Uint8Array(req.files.CompressedFile.data)); // $ MISSING: Alert
fflate.gunzip(new Uint8Array(req.files.CompressedFile.data)); // $ MISSING: Alert
fflate.gunzipSync(new Uint8Array(req.files.CompressedFile.data)); // $ MISSING: Alert
fflate.decompress(new Uint8Array(req.files.CompressedFile.data)); // $ MISSING: Alert
fflate.decompressSync(new Uint8Array(req.files.CompressedFile.data)); // $ MISSING: Alert
fflate.unzlibSync(new Uint8Array(req.files.CompressedFile.data), {