hohn/codeql
1
0
Fork 0
mirror of https://github.com/github/codeql.git synced 2026-05-04 05:05:12 +02:00
Code Issues Packages Projects Releases Wiki Activity

Merge pull request #4753 from max-schaefer/js/more-nosql-query-args

Browse Source 
Approved by asgerf, mchammer01
This commit is contained in:
CodeQL CI
2020-12-03 08:46:47 +00:00
committed by GitHub
parent 04bacf4347 978d2db252
commit edbbc846d0
6 changed files with 134 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files

1
javascript/ql/test/query-tests/Security/CWE-089/untyped/DatabaseAccesses.expected
View File

@@ -32,6 +32,7 @@
| mongoose.js:96:2:96:52 | Documen ... query)) |
| mongoose.js:97:2:97:52 | Documen ... query)) |
| mongoose.js:99:2:99:50 | Documen ... query)) |
| mongoose.js:113:2:113:53 | Documen ... () { }) |
| socketio.js:11:5:11:54 | db.run( ... ndle}`) |
| tst2.js:7:3:7:62 | sql.que ... ms.id}` |
| tst2.js:9:3:9:85 | new sql ... + "'") |

94
javascript/ql/test/query-tests/Security/CWE-089/untyped/SqlInjection.expected
View File

@@ -138,6 +138,45 @@ nodes
| mongoose.js:96:46:96:50 | query |
| mongoose.js:111:14:111:18 | query |
| mongoose.js:111:14:111:18 | query |
| mongoose.js:113:31:113:35 | query |
| mongoose.js:113:31:113:35 | query |
| mongoose.js:115:6:115:22 | id |
| mongoose.js:115:11:115:22 | req.query.id |
| mongoose.js:115:11:115:22 | req.query.id |
| mongoose.js:115:25:115:45 | cond |
| mongoose.js:115:32:115:45 | req.query.cond |
| mongoose.js:115:32:115:45 | req.query.cond |
| mongoose.js:116:22:116:25 | cond |
| mongoose.js:116:22:116:25 | cond |
| mongoose.js:117:21:117:24 | cond |
| mongoose.js:117:21:117:24 | cond |
| mongoose.js:118:21:118:24 | cond |
| mongoose.js:118:21:118:24 | cond |
| mongoose.js:119:18:119:21 | cond |
| mongoose.js:119:18:119:21 | cond |
| mongoose.js:120:22:120:25 | cond |
| mongoose.js:120:22:120:25 | cond |
| mongoose.js:121:16:121:19 | cond |
| mongoose.js:121:16:121:19 | cond |
| mongoose.js:122:19:122:22 | cond |
| mongoose.js:122:19:122:22 | cond |
| mongoose.js:123:20:123:21 | id |
| mongoose.js:123:20:123:21 | id |
| mongoose.js:124:28:124:31 | cond |
| mongoose.js:124:28:124:31 | cond |
| mongoose.js:125:28:125:31 | cond |
| mongoose.js:125:28:125:31 | cond |
| mongoose.js:126:28:126:31 | cond |
| mongoose.js:126:28:126:31 | cond |
| mongoose.js:127:18:127:21 | cond |
| mongoose.js:127:18:127:21 | cond |
| mongoose.js:128:22:128:25 | cond |
| mongoose.js:128:22:128:25 | cond |
| mongoose.js:129:21:129:24 | cond |
| mongoose.js:129:21:129:24 | cond |
| mongoose.js:130:16:130:26 | { _id: id } |
| mongoose.js:130:16:130:26 | { _id: id } |
| mongoose.js:130:23:130:24 | id |
| mongooseJsonParse.js:19:11:19:20 | query |
| mongooseJsonParse.js:19:19:19:20 | {} |
| mongooseJsonParse.js:20:19:20:44 | JSON.pa ... y.data) |
@@ -369,6 +408,8 @@ edges
| mongoose.js:20:11:20:20 | query | mongoose.js:96:46:96:50 | query |
| mongoose.js:20:11:20:20 | query | mongoose.js:111:14:111:18 | query |
| mongoose.js:20:11:20:20 | query | mongoose.js:111:14:111:18 | query |
| mongoose.js:20:11:20:20 | query | mongoose.js:113:31:113:35 | query |
| mongoose.js:20:11:20:20 | query | mongoose.js:113:31:113:35 | query |
| mongoose.js:20:19:20:20 | {} | mongoose.js:20:11:20:20 | query |
| mongoose.js:21:19:21:26 | req.body | mongoose.js:21:19:21:32 | req.body.title |
| mongoose.js:21:19:21:26 | req.body | mongoose.js:21:19:21:32 | req.body.title |
@@ -437,8 +478,45 @@ edges
| mongoose.js:21:19:21:32 | req.body.title | mongoose.js:96:46:96:50 | query |
| mongoose.js:21:19:21:32 | req.body.title | mongoose.js:111:14:111:18 | query |
| mongoose.js:21:19:21:32 | req.body.title | mongoose.js:111:14:111:18 | query |
| mongoose.js:21:19:21:32 | req.body.title | mongoose.js:113:31:113:35 | query |
| mongoose.js:21:19:21:32 | req.body.title | mongoose.js:113:31:113:35 | query |
| mongoose.js:24:25:24:29 | query | mongoose.js:24:24:24:30 | [query] |
| mongoose.js:24:25:24:29 | query | mongoose.js:24:24:24:30 | [query] |
| mongoose.js:115:6:115:22 | id | mongoose.js:123:20:123:21 | id |
| mongoose.js:115:6:115:22 | id | mongoose.js:123:20:123:21 | id |
| mongoose.js:115:6:115:22 | id | mongoose.js:130:23:130:24 | id |
| mongoose.js:115:11:115:22 | req.query.id | mongoose.js:115:6:115:22 | id |
| mongoose.js:115:11:115:22 | req.query.id | mongoose.js:115:6:115:22 | id |
| mongoose.js:115:25:115:45 | cond | mongoose.js:116:22:116:25 | cond |
| mongoose.js:115:25:115:45 | cond | mongoose.js:116:22:116:25 | cond |
| mongoose.js:115:25:115:45 | cond | mongoose.js:117:21:117:24 | cond |
| mongoose.js:115:25:115:45 | cond | mongoose.js:117:21:117:24 | cond |
| mongoose.js:115:25:115:45 | cond | mongoose.js:118:21:118:24 | cond |
| mongoose.js:115:25:115:45 | cond | mongoose.js:118:21:118:24 | cond |
| mongoose.js:115:25:115:45 | cond | mongoose.js:119:18:119:21 | cond |
| mongoose.js:115:25:115:45 | cond | mongoose.js:119:18:119:21 | cond |
| mongoose.js:115:25:115:45 | cond | mongoose.js:120:22:120:25 | cond |
| mongoose.js:115:25:115:45 | cond | mongoose.js:120:22:120:25 | cond |
| mongoose.js:115:25:115:45 | cond | mongoose.js:121:16:121:19 | cond |
| mongoose.js:115:25:115:45 | cond | mongoose.js:121:16:121:19 | cond |
| mongoose.js:115:25:115:45 | cond | mongoose.js:122:19:122:22 | cond |
| mongoose.js:115:25:115:45 | cond | mongoose.js:122:19:122:22 | cond |
| mongoose.js:115:25:115:45 | cond | mongoose.js:124:28:124:31 | cond |
| mongoose.js:115:25:115:45 | cond | mongoose.js:124:28:124:31 | cond |
| mongoose.js:115:25:115:45 | cond | mongoose.js:125:28:125:31 | cond |
| mongoose.js:115:25:115:45 | cond | mongoose.js:125:28:125:31 | cond |
| mongoose.js:115:25:115:45 | cond | mongoose.js:126:28:126:31 | cond |
| mongoose.js:115:25:115:45 | cond | mongoose.js:126:28:126:31 | cond |
| mongoose.js:115:25:115:45 | cond | mongoose.js:127:18:127:21 | cond |
| mongoose.js:115:25:115:45 | cond | mongoose.js:127:18:127:21 | cond |
| mongoose.js:115:25:115:45 | cond | mongoose.js:128:22:128:25 | cond |
| mongoose.js:115:25:115:45 | cond | mongoose.js:128:22:128:25 | cond |
| mongoose.js:115:25:115:45 | cond | mongoose.js:129:21:129:24 | cond |
| mongoose.js:115:25:115:45 | cond | mongoose.js:129:21:129:24 | cond |
| mongoose.js:115:32:115:45 | req.query.cond | mongoose.js:115:25:115:45 | cond |
| mongoose.js:115:32:115:45 | req.query.cond | mongoose.js:115:25:115:45 | cond |
| mongoose.js:130:23:130:24 | id | mongoose.js:130:16:130:26 | { _id: id } |
| mongoose.js:130:23:130:24 | id | mongoose.js:130:16:130:26 | { _id: id } |
| mongooseJsonParse.js:19:11:19:20 | query | mongooseJsonParse.js:23:19:23:23 | query |
| mongooseJsonParse.js:19:11:19:20 | query | mongooseJsonParse.js:23:19:23:23 | query |
| mongooseJsonParse.js:19:19:19:20 | {} | mongooseJsonParse.js:19:11:19:20 | query |
@@ -551,6 +629,22 @@ edges
| mongoose.js:94:51:94:55 | query | mongoose.js:21:19:21:26 | req.body | mongoose.js:94:51:94:55 | query | This query depends on $@. | mongoose.js:21:19:21:26 | req.body | a user-provided value |
| mongoose.js:96:46:96:50 | query | mongoose.js:21:19:21:26 | req.body | mongoose.js:96:46:96:50 | query | This query depends on $@. | mongoose.js:21:19:21:26 | req.body | a user-provided value |
| mongoose.js:111:14:111:18 | query | mongoose.js:21:19:21:26 | req.body | mongoose.js:111:14:111:18 | query | This query depends on $@. | mongoose.js:21:19:21:26 | req.body | a user-provided value |
| mongoose.js:113:31:113:35 | query | mongoose.js:21:19:21:26 | req.body | mongoose.js:113:31:113:35 | query | This query depends on $@. | mongoose.js:21:19:21:26 | req.body | a user-provided value |
| mongoose.js:116:22:116:25 | cond | mongoose.js:115:32:115:45 | req.query.cond | mongoose.js:116:22:116:25 | cond | This query depends on $@. | mongoose.js:115:32:115:45 | req.query.cond | a user-provided value |
| mongoose.js:117:21:117:24 | cond | mongoose.js:115:32:115:45 | req.query.cond | mongoose.js:117:21:117:24 | cond | This query depends on $@. | mongoose.js:115:32:115:45 | req.query.cond | a user-provided value |
| mongoose.js:118:21:118:24 | cond | mongoose.js:115:32:115:45 | req.query.cond | mongoose.js:118:21:118:24 | cond | This query depends on $@. | mongoose.js:115:32:115:45 | req.query.cond | a user-provided value |
| mongoose.js:119:18:119:21 | cond | mongoose.js:115:32:115:45 | req.query.cond | mongoose.js:119:18:119:21 | cond | This query depends on $@. | mongoose.js:115:32:115:45 | req.query.cond | a user-provided value |
| mongoose.js:120:22:120:25 | cond | mongoose.js:115:32:115:45 | req.query.cond | mongoose.js:120:22:120:25 | cond | This query depends on $@. | mongoose.js:115:32:115:45 | req.query.cond | a user-provided value |
| mongoose.js:121:16:121:19 | cond | mongoose.js:115:32:115:45 | req.query.cond | mongoose.js:121:16:121:19 | cond | This query depends on $@. | mongoose.js:115:32:115:45 | req.query.cond | a user-provided value |
| mongoose.js:122:19:122:22 | cond | mongoose.js:115:32:115:45 | req.query.cond | mongoose.js:122:19:122:22 | cond | This query depends on $@. | mongoose.js:115:32:115:45 | req.query.cond | a user-provided value |
| mongoose.js:123:20:123:21 | id | mongoose.js:115:11:115:22 | req.query.id | mongoose.js:123:20:123:21 | id | This query depends on $@. | mongoose.js:115:11:115:22 | req.query.id | a user-provided value |
| mongoose.js:124:28:124:31 | cond | mongoose.js:115:32:115:45 | req.query.cond | mongoose.js:124:28:124:31 | cond | This query depends on $@. | mongoose.js:115:32:115:45 | req.query.cond | a user-provided value |
| mongoose.js:125:28:125:31 | cond | mongoose.js:115:32:115:45 | req.query.cond | mongoose.js:125:28:125:31 | cond | This query depends on $@. | mongoose.js:115:32:115:45 | req.query.cond | a user-provided value |
| mongoose.js:126:28:126:31 | cond | mongoose.js:115:32:115:45 | req.query.cond | mongoose.js:126:28:126:31 | cond | This query depends on $@. | mongoose.js:115:32:115:45 | req.query.cond | a user-provided value |
| mongoose.js:127:18:127:21 | cond | mongoose.js:115:32:115:45 | req.query.cond | mongoose.js:127:18:127:21 | cond | This query depends on $@. | mongoose.js:115:32:115:45 | req.query.cond | a user-provided value |
| mongoose.js:128:22:128:25 | cond | mongoose.js:115:32:115:45 | req.query.cond | mongoose.js:128:22:128:25 | cond | This query depends on $@. | mongoose.js:115:32:115:45 | req.query.cond | a user-provided value |
| mongoose.js:129:21:129:24 | cond | mongoose.js:115:32:115:45 | req.query.cond | mongoose.js:129:21:129:24 | cond | This query depends on $@. | mongoose.js:115:32:115:45 | req.query.cond | a user-provided value |
| mongoose.js:130:16:130:26 | { _id: id } | mongoose.js:115:11:115:22 | req.query.id | mongoose.js:130:16:130:26 | { _id: id } | This query depends on $@. | mongoose.js:115:11:115:22 | req.query.id | a user-provided value |
| mongooseJsonParse.js:23:19:23:23 | query | mongooseJsonParse.js:20:30:20:43 | req.query.data | mongooseJsonParse.js:23:19:23:23 | query | This query depends on $@. | mongooseJsonParse.js:20:30:20:43 | req.query.data | a user-provided value |
| mongooseModelClient.js:11:16:11:24 | { id: v } | mongooseModelClient.js:10:22:10:29 | req.body | mongooseModelClient.js:11:16:11:24 | { id: v } | This query depends on $@. | mongooseModelClient.js:10:22:10:29 | req.body | a user-provided value |
| mongooseModelClient.js:12:16:12:34 | { id: req.body.id } | mongooseModelClient.js:12:22:12:29 | req.body | mongooseModelClient.js:12:16:12:34 | { id: req.body.id } | This query depends on $@. | mongooseModelClient.js:12:22:12:29 | req.body | a user-provided value |

20
javascript/ql/test/query-tests/Security/CWE-089/untyped/mongoose.js
View File

@@ -109,4 +109,24 @@ app.post('/documents/find', (req, res) => {
var C = getQueryConstructor();
new C(X, Y, query); // NOT OK
Document.findOneAndUpdate(X, query, function () { }); // NOT OK
let id = req.query.id, cond = req.query.cond;
Document.deleteMany(cond); // NOT OK
Document.deleteOne(cond); // NOT OK
Document.geoSearch(cond); // NOT OK
Document.remove(cond); // NOT OK
Document.replaceOne(cond, Y); // NOT OK
Document.find(cond); // NOT OK
Document.findOne(cond); // NOT OK
Document.findById(id); // NOT OK
Document.findOneAndDelete(cond); // NOT OK
Document.findOneAndRemove(cond); // NOT OK
Document.findOneAndUpdate(cond, Y); // NOT OK
Document.update(cond, Y); // NOT OK
Document.updateMany(cond, Y); // NOT OK
Document.updateOne(cond, Y); // NOT OK
Document.find({ _id: id }); // NOT OK
Document.find({ _id: { $eq: id } }); // OK
});