Napalys
32d6ac8da7
Add test case to ensure exec calls without middleware injection into Express are not flagged.
2025-03-30 14:09:15 +02:00
Napalys
4cdc40d115
Added SQL injection detection for exec method embeded Express client from hdbext.
2025-03-25 18:39:54 +01:00
Napalys
7cc0634f57
Added createProcStatement as potential sql sink.
2025-03-25 14:50:38 +01:00
Napalys
0285cb6c7a
Added @sap/hdbext.loadProccedure as sql sink.
2025-03-25 14:48:40 +01:00
Napalys
e595def8b0
Modeled execute as potential hana's sink.
2025-03-25 14:44:37 +01:00
Napalys
d28af9508a
Added sink models for hana's client prepare function.
2025-03-25 14:42:27 +01:00
Napalys
9229962096
Add sink model for SQL injection detection in exec clients.
2025-03-25 14:36:13 +01:00
Napalys
032cfc134f
Added test cases for hana clients.
2025-03-25 14:29:06 +01:00
Asger F
2a194a53af
raw test output
2025-02-28 13:29:39 +01:00
Asger F
64d39da5f8
JS: Accept Sources/Sink tags
2025-02-28 13:29:30 +01:00
Asger F
cf33db78cc
JS: Fix the spurious flow
2025-02-28 13:28:02 +01:00
Asger F
c051b4c98d
JS: Add spurious alert marker
2025-02-28 13:28:00 +01:00
Asger F
10a7294327
JS: Accept trivial test changes
...
This adds Alert annotations for alerts that seem intentional by the test
but has not been annotated with 'NOT OK', or the comment was in the wrong
place.
In a few cases I included 'Source' expectations to make it easier to see
what happened. Other 'Source' expectations will be added in bulk a later
commit.
2025-02-28 13:27:43 +01:00
Asger F
86932c51bc
JS: Move some alerts to their correct location
...
One of the diffs look confusing but:
Previously parameter {2,3} where flagged, now parameter {1,2} are flagged.
Note that for command injection, the SystemCommandExecution is flagged
despite the test file claiming otherwise.
2025-02-28 13:27:40 +01:00
Asger F
f5911c9e5a
JS: Accept raw test output
2025-02-28 13:27:38 +01:00
Asger F
d0ce53ed82
JS: Enable post-processing for all .qlref files
2025-02-28 13:27:33 +01:00
Asger F
426edd55f2
JS: Update output after line number change
...
Some OK-style comments had to be moved to the following line, shifting line numbers.
In selected range also included the comments themselves.
Lastly, the result sets were reordered by the CLI in some cases.
2025-02-28 13:27:31 +01:00
Asger F
9be041e27d
JS: Update OK-style comments to $-style
2025-02-28 13:27:28 +01:00
Asger F
7e5c24a8ec
JS: Remove uses of old inline expectation test library
2025-02-28 13:27:26 +01:00
Asger F
d79f429978
JS: Update changes to nodes/edges/subpaths
...
No changes in actual alerts
2025-02-17 10:36:05 +01:00
Asger F
3acd4814de
Merge branch 'main' into js/shared-dataflow-merge-main
2024-12-19 10:14:38 +01:00
Michael Nebel
c3fe3e468c
Javascript: Update all test util paths to point to the new location.
2024-12-12 13:54:25 +01:00
Asger F
e6680dec8f
JS: Avoid use of LabeledSanitizerGuardNode in TaintedObject
...
Drive-by bugfix: Rename sanitizes -> blocksExpr.
This fixes a bug that caused the sanitizer guard not to work in df2.
The test output reflects the fact that the barrier guard works now.
2024-12-03 14:30:24 +01:00
Asger F
0ce1fe767d
JS: Deprecate ConsistencyChecking to avoid deprecation warnings
2024-12-03 14:30:23 +01:00
Asger F
8818fcc207
JS: Benign test output changes
2024-11-26 15:47:13 +01:00
Asger F
d52bc971b8
Merge branch 'main' into js/shared-dataflow-merge-main
2024-11-20 14:05:03 +01:00
Asger F
52ba91a7f8
JS: Updates to nodes/edges in tests
...
Only changes to nodes/edges for various reasons, no actual result changes
2024-10-29 08:32:13 +01:00
Rasmus Wriedt Larsen
1726287bf4
JS: Add e2e threat-model test
2024-10-25 15:03:44 +02:00
Asger F
12e316b99d
JS: Update test output after merging in 'main'
...
- Paths are now relative to the test case, not the qlpack
- Paths going through an implicit reads have changed slightly
2024-10-08 10:11:15 +02:00
Asger F
2e2181be2c
JS: Update test output that only affects nodes/edges/subpaths
2024-08-27 11:35:33 +02:00
Asger F
c3806a2210
JS: Messy test output updates
...
These initially got messed up by a merge conflict where I couldn't rerun the tests due to breaking
changes in the data flow library. I wanted the breaking-change updates to live in their own commits,
not just eaten by a merge resolution commit, so the test output became broken for a while.
The '#select' result set is unchanged in all of these, so they should be safe to accept.
2024-06-27 11:59:56 +02:00
Asger F
53efb5837b
JS: Update some tests with provenance columns
...
Only includes the changes that purely contain the new provenance columns
2024-06-26 13:51:44 +02:00
Asger F
547a8a958a
JS: Port SqlInjection
2023-10-13 13:15:03 +02:00
erik-krogh
3fd9f26b52
use consistent indentation in mongoose.js
2023-06-12 16:40:42 +02:00
erik-krogh
cd6f738f72
add mongoose.Types.ObjectId.isValid as a sanitizer-guard for NoSQL injection
2023-06-12 16:38:11 +02:00
erik-krogh
b343dcaadd
put string/object in the alert-message for sql-injection
2023-05-31 08:06:04 +02:00
Asger F
d4b4d22378
JS: Step through HTML sanitizers in SQL injection query
2023-03-06 15:10:26 +01:00
erik-krogh
9549cac3e5
add an additional barrier guard that finds "=== true" versions of previous barrier guards
2023-02-14 14:15:23 +01:00
erik-krogh
c355a26657
add failing test
2023-02-14 14:12:35 +01:00
erik-krogh
ba2734909f
JS: don't use deprecated files in tests
2022-11-17 22:12:50 +01:00
erik-krogh
368f84785b
fix some more style-guide violations in the alert-messages
2022-10-07 11:22:22 +02:00
Asger F
47f1d62569
JS: Add generated typings to SQL models
2022-09-20 11:40:16 +02:00
Asger Feldthaus
708408a458
JS: Recognize "sql" option as a query string
2022-01-13 13:04:41 +01:00
Esben Sparre Andreasen
c66d29998e
update test output for additional DatabaseAccesses
2021-12-13 13:42:28 +01:00
Erik Krogh Kristensen
6a9277b5ce
recognize string sanitizers for ldap-injection
2021-10-01 09:01:29 +02:00
Erik Krogh Kristensen
2062afc868
add calls to parseDN as sinks for ldap-injection
2021-10-01 09:01:28 +02:00
Erik Krogh Kristensen
c55b7bcd85
model ldap filters as taint steps
2021-10-01 09:00:10 +02:00
Erik Krogh Kristensen
9b5ff66b68
naively port tests from ldap examples
2021-10-01 09:00:10 +02:00
Erik Krogh Kristensen
416c986cbc
add support for graphql in @actions/github
2021-06-15 09:43:11 +02:00
Erik Krogh Kristensen
50d574d20d
add graphql injection to the sql-injection query
2021-06-10 21:01:54 +02:00
