hohn/codeql
1
0
Fork 0
mirror of https://github.com/github/codeql.git synced 2026-05-04 13:15:21 +02:00
Code Issues Packages Projects Releases Wiki Activity

JS: moved execa test cases outside experimental

Browse Source
This commit is contained in:
Napalys Klicius
2025-06-20 09:20:46 +02:00
parent d8b5cb5862
commit d05de1ba4e
9 changed files with 189 additions and 142 deletions
Download Patch File Download Diff File Expand all files Collapse all files

124
javascript/ql/test/query-tests/Security/CWE-078/CommandInjection/CommandInjection.expected
View File

@@ -24,6 +24,34 @@
| exec-sh2.js:10:12:10:57 | cp.spaw ... ptions) | exec-sh2.js:14:25:14:31 | req.url | exec-sh2.js:10:40:10:46 | command | This command line depends on a $@. | exec-sh2.js:14:25:14:31 | req.url | user-provided value |
| exec-sh.js:15:12:15:61 | cp.spaw ... ptions) | exec-sh.js:19:25:19:31 | req.url | exec-sh.js:15:44:15:50 | command | This command line depends on a $@. | exec-sh.js:19:25:19:31 | req.url | user-provided value |
| execSeries.js:14:41:14:47 | command | execSeries.js:18:34:18:40 | req.url | execSeries.js:14:41:14:47 | command | This command line depends on a $@. | execSeries.js:18:34:18:40 | req.url | user-provided value |
| execa.js:11:15:11:17 | cmd | execa.js:6:25:6:31 | req.url | execa.js:11:15:11:17 | cmd | This command line depends on a $@. | execa.js:6:25:6:31 | req.url | user-provided value |
| execa.js:13:32:13:34 | cmd | execa.js:6:25:6:31 | req.url | execa.js:13:32:13:34 | cmd | This command line depends on a $@. | execa.js:6:25:6:31 | req.url | user-provided value |
| execa.js:14:31:14:33 | cmd | execa.js:6:25:6:31 | req.url | execa.js:14:31:14:33 | cmd | This command line depends on a $@. | execa.js:6:25:6:31 | req.url | user-provided value |
| execa.js:17:14:17:16 | cmd | execa.js:6:25:6:31 | req.url | execa.js:17:14:17:16 | cmd | This command line depends on a $@. | execa.js:6:25:6:31 | req.url | user-provided value |
| execa.js:19:32:19:34 | cmd | execa.js:6:25:6:31 | req.url | execa.js:19:32:19:34 | cmd | This command line depends on a $@. | execa.js:6:25:6:31 | req.url | user-provided value |
| execa.js:20:33:20:35 | cmd | execa.js:6:25:6:31 | req.url | execa.js:20:33:20:35 | cmd | This command line depends on a $@. | execa.js:6:25:6:31 | req.url | user-provided value |
| execa.js:23:17:23:19 | cmd | execa.js:6:25:6:31 | req.url | execa.js:23:17:23:19 | cmd | This command line depends on a $@. | execa.js:6:25:6:31 | req.url | user-provided value |
| execa.js:24:17:24:19 | cmd | execa.js:6:25:6:31 | req.url | execa.js:24:17:24:19 | cmd | This command line depends on a $@. | execa.js:6:25:6:31 | req.url | user-provided value |
| execa.js:25:17:25:19 | cmd | execa.js:6:25:6:31 | req.url | execa.js:25:17:25:19 | cmd | This command line depends on a $@. | execa.js:6:25:6:31 | req.url | user-provided value |
| execa.js:26:17:26:19 | cmd | execa.js:6:25:6:31 | req.url | execa.js:26:17:26:19 | cmd | This command line depends on a $@. | execa.js:6:25:6:31 | req.url | user-provided value |
| execa.js:28:15:28:17 | cmd | execa.js:6:25:6:31 | req.url | execa.js:28:15:28:17 | cmd | This command line depends on a $@. | execa.js:6:25:6:31 | req.url | user-provided value |
| execa.js:29:15:29:17 | cmd | execa.js:6:25:6:31 | req.url | execa.js:29:15:29:17 | cmd | This command line depends on a $@. | execa.js:6:25:6:31 | req.url | user-provided value |
| execa.js:31:24:31:47 | cmd + a ... + arg3 | execa.js:6:25:6:31 | req.url | execa.js:31:24:31:47 | cmd + a ... + arg3 | This command line depends on a $@. | execa.js:6:25:6:31 | req.url | user-provided value |
| execa.js:31:24:31:47 | cmd + a ... + arg3 | execa.js:7:26:7:32 | req.url | execa.js:31:24:31:47 | cmd + a ... + arg3 | This command line depends on a $@. | execa.js:7:26:7:32 | req.url | user-provided value |
| execa.js:31:24:31:47 | cmd + a ... + arg3 | execa.js:8:26:8:32 | req.url | execa.js:31:24:31:47 | cmd + a ... + arg3 | This command line depends on a $@. | execa.js:8:26:8:32 | req.url | user-provided value |
| execa.js:31:24:31:47 | cmd + a ... + arg3 | execa.js:9:26:9:32 | req.url | execa.js:31:24:31:47 | cmd + a ... + arg3 | This command line depends on a $@. | execa.js:9:26:9:32 | req.url | user-provided value |
| execa.js:32:24:32:47 | cmd + a ... + arg3 | execa.js:6:25:6:31 | req.url | execa.js:32:24:32:47 | cmd + a ... + arg3 | This command line depends on a $@. | execa.js:6:25:6:31 | req.url | user-provided value |
| execa.js:32:24:32:47 | cmd + a ... + arg3 | execa.js:7:26:7:32 | req.url | execa.js:32:24:32:47 | cmd + a ... + arg3 | This command line depends on a $@. | execa.js:7:26:7:32 | req.url | user-provided value |
| execa.js:32:24:32:47 | cmd + a ... + arg3 | execa.js:8:26:8:32 | req.url | execa.js:32:24:32:47 | cmd + a ... + arg3 | This command line depends on a $@. | execa.js:8:26:8:32 | req.url | user-provided value |
| execa.js:32:24:32:47 | cmd + a ... + arg3 | execa.js:9:26:9:32 | req.url | execa.js:32:24:32:47 | cmd + a ... + arg3 | This command line depends on a $@. | execa.js:9:26:9:32 | req.url | user-provided value |
| execa.js:34:22:34:45 | cmd + a ... + arg3 | execa.js:6:25:6:31 | req.url | execa.js:34:22:34:45 | cmd + a ... + arg3 | This command line depends on a $@. | execa.js:6:25:6:31 | req.url | user-provided value |
| execa.js:34:22:34:45 | cmd + a ... + arg3 | execa.js:7:26:7:32 | req.url | execa.js:34:22:34:45 | cmd + a ... + arg3 | This command line depends on a $@. | execa.js:7:26:7:32 | req.url | user-provided value |
| execa.js:34:22:34:45 | cmd + a ... + arg3 | execa.js:8:26:8:32 | req.url | execa.js:34:22:34:45 | cmd + a ... + arg3 | This command line depends on a $@. | execa.js:8:26:8:32 | req.url | user-provided value |
| execa.js:34:22:34:45 | cmd + a ... + arg3 | execa.js:9:26:9:32 | req.url | execa.js:34:22:34:45 | cmd + a ... + arg3 | This command line depends on a $@. | execa.js:9:26:9:32 | req.url | user-provided value |
| execa.js:35:22:35:45 | cmd + a ... + arg3 | execa.js:6:25:6:31 | req.url | execa.js:35:22:35:45 | cmd + a ... + arg3 | This command line depends on a $@. | execa.js:6:25:6:31 | req.url | user-provided value |
| execa.js:35:22:35:45 | cmd + a ... + arg3 | execa.js:7:26:7:32 | req.url | execa.js:35:22:35:45 | cmd + a ... + arg3 | This command line depends on a $@. | execa.js:7:26:7:32 | req.url | user-provided value |
| execa.js:35:22:35:45 | cmd + a ... + arg3 | execa.js:8:26:8:32 | req.url | execa.js:35:22:35:45 | cmd + a ... + arg3 | This command line depends on a $@. | execa.js:8:26:8:32 | req.url | user-provided value |
| execa.js:35:22:35:45 | cmd + a ... + arg3 | execa.js:9:26:9:32 | req.url | execa.js:35:22:35:45 | cmd + a ... + arg3 | This command line depends on a $@. | execa.js:9:26:9:32 | req.url | user-provided value |
| form-parsers.js:9:8:9:39 | "touch ... nalname | form-parsers.js:9:19:9:26 | req.file | form-parsers.js:9:8:9:39 | "touch ... nalname | This command line depends on a $@. | form-parsers.js:9:19:9:26 | req.file | user-provided value |
| form-parsers.js:14:10:14:37 | "touch ... nalname | form-parsers.js:13:3:13:11 | req.files | form-parsers.js:14:10:14:37 | "touch ... nalname | This command line depends on a $@. | form-parsers.js:13:3:13:11 | req.files | user-provided value |
| form-parsers.js:25:10:25:28 | "touch " + filename | form-parsers.js:24:48:24:55 | filename | form-parsers.js:25:10:25:28 | "touch " + filename | This command line depends on a $@. | form-parsers.js:24:48:24:55 | filename | user-provided value |
@@ -112,6 +140,58 @@ edges
| execSeries.js:18:34:18:40 | req.url | execSeries.js:18:13:18:47 | require ... , true) | provenance | |
| execSeries.js:19:12:19:16 | [cmd] [0] | execSeries.js:13:19:13:26 | commands [0] | provenance | |
| execSeries.js:19:13:19:15 | cmd | execSeries.js:19:12:19:16 | [cmd] [0] | provenance | |
| execa.js:6:9:6:54 | cmd | execa.js:11:15:11:17 | cmd | provenance | |
| execa.js:6:9:6:54 | cmd | execa.js:13:32:13:34 | cmd | provenance | |
| execa.js:6:9:6:54 | cmd | execa.js:14:31:14:33 | cmd | provenance | |
| execa.js:6:9:6:54 | cmd | execa.js:17:14:17:16 | cmd | provenance | |
| execa.js:6:9:6:54 | cmd | execa.js:19:32:19:34 | cmd | provenance | |
| execa.js:6:9:6:54 | cmd | execa.js:20:33:20:35 | cmd | provenance | |
| execa.js:6:9:6:54 | cmd | execa.js:23:17:23:19 | cmd | provenance | |
| execa.js:6:9:6:54 | cmd | execa.js:24:17:24:19 | cmd | provenance | |
| execa.js:6:9:6:54 | cmd | execa.js:25:17:25:19 | cmd | provenance | |
| execa.js:6:9:6:54 | cmd | execa.js:26:17:26:19 | cmd | provenance | |
| execa.js:6:9:6:54 | cmd | execa.js:28:15:28:17 | cmd | provenance | |
| execa.js:6:9:6:54 | cmd | execa.js:29:15:29:17 | cmd | provenance | |
| execa.js:6:9:6:54 | cmd | execa.js:31:24:31:26 | cmd | provenance | |
| execa.js:6:9:6:54 | cmd | execa.js:32:24:32:26 | cmd | provenance | |
| execa.js:6:9:6:54 | cmd | execa.js:34:22:34:24 | cmd | provenance | |
| execa.js:6:9:6:54 | cmd | execa.js:35:22:35:24 | cmd | provenance | |
| execa.js:6:15:6:38 | url.par ... , true) | execa.js:6:9:6:54 | cmd | provenance | |
| execa.js:6:25:6:31 | req.url | execa.js:6:15:6:38 | url.par ... , true) | provenance | |
| execa.js:7:9:7:53 | arg1 | execa.js:31:30:31:33 | arg1 | provenance | |
| execa.js:7:9:7:53 | arg1 | execa.js:32:30:32:33 | arg1 | provenance | |
| execa.js:7:9:7:53 | arg1 | execa.js:34:28:34:31 | arg1 | provenance | |
| execa.js:7:9:7:53 | arg1 | execa.js:35:28:35:31 | arg1 | provenance | |
| execa.js:7:16:7:39 | url.par ... , true) | execa.js:7:9:7:53 | arg1 | provenance | |
| execa.js:7:26:7:32 | req.url | execa.js:7:16:7:39 | url.par ... , true) | provenance | |
| execa.js:8:9:8:53 | arg2 | execa.js:31:37:31:40 | arg2 | provenance | |
| execa.js:8:9:8:53 | arg2 | execa.js:32:37:32:40 | arg2 | provenance | |
| execa.js:8:9:8:53 | arg2 | execa.js:34:35:34:38 | arg2 | provenance | |
| execa.js:8:9:8:53 | arg2 | execa.js:35:35:35:38 | arg2 | provenance | |
| execa.js:8:16:8:39 | url.par ... , true) | execa.js:8:9:8:53 | arg2 | provenance | |
| execa.js:8:26:8:32 | req.url | execa.js:8:16:8:39 | url.par ... , true) | provenance | |
| execa.js:9:9:9:53 | arg3 | execa.js:31:44:31:47 | arg3 | provenance | |
| execa.js:9:9:9:53 | arg3 | execa.js:32:44:32:47 | arg3 | provenance | |
| execa.js:9:9:9:53 | arg3 | execa.js:34:42:34:45 | arg3 | provenance | |
| execa.js:9:9:9:53 | arg3 | execa.js:35:42:35:45 | arg3 | provenance | |
| execa.js:9:16:9:39 | url.par ... , true) | execa.js:9:9:9:53 | arg3 | provenance | |
| execa.js:9:26:9:32 | req.url | execa.js:9:16:9:39 | url.par ... , true) | provenance | |
| execa.js:31:24:31:26 | cmd | execa.js:31:24:31:47 | cmd + a ... + arg3 | provenance | |
| execa.js:31:30:31:33 | arg1 | execa.js:31:24:31:47 | cmd + a ... + arg3 | provenance | |
| execa.js:31:37:31:40 | arg2 | execa.js:31:24:31:47 | cmd + a ... + arg3 | provenance | |
| execa.js:31:44:31:47 | arg3 | execa.js:31:24:31:47 | cmd + a ... + arg3 | provenance | |
| execa.js:32:24:32:26 | cmd | execa.js:32:24:32:47 | cmd + a ... + arg3 | provenance | |
| execa.js:32:30:32:33 | arg1 | execa.js:32:24:32:47 | cmd + a ... + arg3 | provenance | |
| execa.js:32:37:32:40 | arg2 | execa.js:32:24:32:47 | cmd + a ... + arg3 | provenance | |
| execa.js:32:44:32:47 | arg3 | execa.js:32:24:32:47 | cmd + a ... + arg3 | provenance | |
| execa.js:34:22:34:24 | cmd | execa.js:34:22:34:45 | cmd + a ... + arg3 | provenance | |
| execa.js:34:28:34:31 | arg1 | execa.js:34:22:34:45 | cmd + a ... + arg3 | provenance | |
| execa.js:34:35:34:38 | arg2 | execa.js:34:22:34:45 | cmd + a ... + arg3 | provenance | |
| execa.js:34:42:34:45 | arg3 | execa.js:34:22:34:45 | cmd + a ... + arg3 | provenance | |
| execa.js:35:22:35:24 | cmd | execa.js:35:22:35:45 | cmd + a ... + arg3 | provenance | |
| execa.js:35:28:35:31 | arg1 | execa.js:35:22:35:45 | cmd + a ... + arg3 | provenance | |
| execa.js:35:35:35:38 | arg2 | execa.js:35:22:35:45 | cmd + a ... + arg3 | provenance | |
| execa.js:35:42:35:45 | arg3 | execa.js:35:22:35:45 | cmd + a ... + arg3 | provenance | |
| form-parsers.js:9:19:9:26 | req.file | form-parsers.js:9:8:9:39 | "touch ... nalname | provenance | |
| form-parsers.js:13:3:13:11 | req.files | form-parsers.js:13:21:13:24 | file | provenance | |
| form-parsers.js:13:21:13:24 | file | form-parsers.js:14:21:14:24 | file | provenance | |
@@ -216,6 +296,50 @@ nodes
| execSeries.js:18:34:18:40 | req.url | semmle.label | req.url |
| execSeries.js:19:12:19:16 | [cmd] [0] | semmle.label | [cmd] [0] |
| execSeries.js:19:13:19:15 | cmd | semmle.label | cmd |
| execa.js:6:9:6:54 | cmd | semmle.label | cmd |
| execa.js:6:15:6:38 | url.par ... , true) | semmle.label | url.par ... , true) |
| execa.js:6:25:6:31 | req.url | semmle.label | req.url |
| execa.js:7:9:7:53 | arg1 | semmle.label | arg1 |
| execa.js:7:16:7:39 | url.par ... , true) | semmle.label | url.par ... , true) |
| execa.js:7:26:7:32 | req.url | semmle.label | req.url |
| execa.js:8:9:8:53 | arg2 | semmle.label | arg2 |
| execa.js:8:16:8:39 | url.par ... , true) | semmle.label | url.par ... , true) |
| execa.js:8:26:8:32 | req.url | semmle.label | req.url |
| execa.js:9:9:9:53 | arg3 | semmle.label | arg3 |
| execa.js:9:16:9:39 | url.par ... , true) | semmle.label | url.par ... , true) |
| execa.js:9:26:9:32 | req.url | semmle.label | req.url |
| execa.js:11:15:11:17 | cmd | semmle.label | cmd |
| execa.js:13:32:13:34 | cmd | semmle.label | cmd |
| execa.js:14:31:14:33 | cmd | semmle.label | cmd |
| execa.js:17:14:17:16 | cmd | semmle.label | cmd |
| execa.js:19:32:19:34 | cmd | semmle.label | cmd |
| execa.js:20:33:20:35 | cmd | semmle.label | cmd |
| execa.js:23:17:23:19 | cmd | semmle.label | cmd |
| execa.js:24:17:24:19 | cmd | semmle.label | cmd |
| execa.js:25:17:25:19 | cmd | semmle.label | cmd |
| execa.js:26:17:26:19 | cmd | semmle.label | cmd |
| execa.js:28:15:28:17 | cmd | semmle.label | cmd |
| execa.js:29:15:29:17 | cmd | semmle.label | cmd |
| execa.js:31:24:31:26 | cmd | semmle.label | cmd |
| execa.js:31:24:31:47 | cmd + a ... + arg3 | semmle.label | cmd + a ... + arg3 |
| execa.js:31:30:31:33 | arg1 | semmle.label | arg1 |
| execa.js:31:37:31:40 | arg2 | semmle.label | arg2 |
| execa.js:31:44:31:47 | arg3 | semmle.label | arg3 |
| execa.js:32:24:32:26 | cmd | semmle.label | cmd |
| execa.js:32:24:32:47 | cmd + a ... + arg3 | semmle.label | cmd + a ... + arg3 |
| execa.js:32:30:32:33 | arg1 | semmle.label | arg1 |
| execa.js:32:37:32:40 | arg2 | semmle.label | arg2 |
| execa.js:32:44:32:47 | arg3 | semmle.label | arg3 |
| execa.js:34:22:34:24 | cmd | semmle.label | cmd |
| execa.js:34:22:34:45 | cmd + a ... + arg3 | semmle.label | cmd + a ... + arg3 |
| execa.js:34:28:34:31 | arg1 | semmle.label | arg1 |
| execa.js:34:35:34:38 | arg2 | semmle.label | arg2 |
| execa.js:34:42:34:45 | arg3 | semmle.label | arg3 |
| execa.js:35:22:35:24 | cmd | semmle.label | cmd |
| execa.js:35:22:35:45 | cmd + a ... + arg3 | semmle.label | cmd + a ... + arg3 |
| execa.js:35:28:35:31 | arg1 | semmle.label | arg1 |
| execa.js:35:35:35:38 | arg2 | semmle.label | arg2 |
| execa.js:35:42:35:45 | arg3 | semmle.label | arg3 |
| form-parsers.js:9:8:9:39 | "touch ... nalname | semmle.label | "touch ... nalname |
| form-parsers.js:9:19:9:26 | req.file | semmle.label | req.file |
| form-parsers.js:13:3:13:11 | req.files | semmle.label | req.files |

36
javascript/ql/test/query-tests/Security/CWE-078/CommandInjection/execa.js Normal file
View File

@@ -0,0 +1,36 @@
import { execa, execaSync, execaCommand, execaCommandSync, $ } from 'execa';
import http from 'node:http'
import url from 'url'
http.createServer(async function (req, res) {
let cmd = url.parse(req.url, true).query["cmd"][0]; // $Source
let arg1 = url.parse(req.url, true).query["arg1"]; // $Source
let arg2 = url.parse(req.url, true).query["arg2"]; // $Source
let arg3 = url.parse(req.url, true).query["arg3"]; // $Source
await $`${cmd} ${arg1} ${arg2} ${arg3}`; // $Alert
await $`ssh ${arg1} ${arg2} ${arg3}`; // safely escapes variables, preventing shell injection.
$({ shell: false }).sync`${cmd} ${arg1} ${arg2} ${arg3}`; // $Alert
$({ shell: true }).sync`${cmd} ${arg1} ${arg2} ${arg3}`; // $Alert
$({ shell: false }).sync`ssh ${arg1} ${arg2} ${arg3}`; // safely escapes variables, preventing shell injection.
$.sync`${cmd} ${arg1} ${arg2} ${arg3}`; // $Alert
$.sync`ssh ${arg1} ${arg2} ${arg3}`; // safely escapes variables, preventing shell injection.
await $({ shell: true })`${cmd} ${arg1} ${arg2} ${arg3}` // $Alert
await $({ shell: false })`${cmd} ${arg1} ${arg2} ${arg3}` // $Alert
await $({ shell: false })`ssh ${arg1} ${arg2} ${arg3}` // safely escapes variables, preventing shell injection.
await execa(cmd, [arg1, arg2, arg3]); // $Alert
await execa(cmd, { shell: true }); // $Alert
await execa(cmd, { shell: true }); // $Alert
await execa(cmd, [arg1, arg2, arg3], { shell: true }); // $Alert
execaSync(cmd, [arg1, arg2, arg3]); // $Alert
execaSync(cmd, [arg1, arg2, arg3], { shell: true }); // $Alert
await execaCommand(cmd + arg1 + arg2 + arg3); // $Alert
await execaCommand(cmd + arg1 + arg2 + arg3, { shell: true }); // $Alert
execaCommandSync(cmd + arg1 + arg2 + arg3); // $Alert
execaCommandSync(cmd + arg1 + arg2 + arg3, { shell: true }); // $Alert
});