Asger F
017f458534
Update javascript/ql/test/query-tests/Security/CWE-078/UselessUseOfCat/uselesscat.js
...
Co-authored-by: Napalys Klicius <napalys@github.com >
2025-03-10 14:18:22 +01:00
Asger F
24c9b2ef9b
Update javascript/ql/test/query-tests/Security/CWE-078/UselessUseOfCat/uselesscat.js
...
Co-authored-by: Napalys Klicius <napalys@github.com >
2025-03-10 14:18:02 +01:00
Asger F
2a194a53af
raw test output
2025-02-28 13:29:39 +01:00
Asger F
64d39da5f8
JS: Accept Sources/Sink tags
2025-02-28 13:29:30 +01:00
Asger F
576dbcb020
JS: Stop overriding entire module.exports object in test
...
Doing `module.exports = blah` prevents other exports from being seen as library inputs.
2025-02-28 13:28:09 +01:00
Asger F
b095fe2a19
JS: Fix some bugs in a test case
...
'args' was a redeclared block-level variable, and 'myArgs' was not used when clearly intended to be used
2025-02-28 13:27:59 +01:00
Asger F
e026b9e048
JS: Mark regressions due to lack of local field steps
2025-02-28 13:27:52 +01:00
Asger F
07a876b4e9
JS: Accept some alerts at the SystemCommandExecution location
2025-02-28 13:27:46 +01:00
Asger F
10a7294327
JS: Accept trivial test changes
...
This adds Alert annotations for alerts that seem intentional by the test
but has not been annotated with 'NOT OK', or the comment was in the wrong
place.
In a few cases I included 'Source' expectations to make it easier to see
what happened. Other 'Source' expectations will be added in bulk a later
commit.
2025-02-28 13:27:43 +01:00
Asger F
86932c51bc
JS: Move some alerts to their correct location
...
One of the diffs look confusing but:
Previously parameter {2,3} where flagged, now parameter {1,2} are flagged.
Note that for command injection, the SystemCommandExecution is flagged
despite the test file claiming otherwise.
2025-02-28 13:27:40 +01:00
Asger F
f5911c9e5a
JS: Accept raw test output
2025-02-28 13:27:38 +01:00
Asger F
d0ce53ed82
JS: Enable post-processing for all .qlref files
2025-02-28 13:27:33 +01:00
Asger F
426edd55f2
JS: Update output after line number change
...
Some OK-style comments had to be moved to the following line, shifting line numbers.
In selected range also included the comments themselves.
Lastly, the result sets were reordered by the CLI in some cases.
2025-02-28 13:27:31 +01:00
Asger F
9be041e27d
JS: Update OK-style comments to $-style
2025-02-28 13:27:28 +01:00
Asger F
7e5c24a8ec
JS: Remove uses of old inline expectation test library
2025-02-28 13:27:26 +01:00
Asger F
d79f429978
JS: Update changes to nodes/edges/subpaths
...
No changes in actual alerts
2025-02-17 10:36:05 +01:00
Asger F
b2d62a080b
JS: Move a test failure explanation into the test suite
...
We have an issue for fixing the underlying problem
2025-01-09 09:57:44 +01:00
Asger F
f8dc7eb25b
JS: Update output from tests that changed on main
2024-12-19 15:25:47 +01:00
Asger F
3acd4814de
Merge branch 'main' into js/shared-dataflow-merge-main
2024-12-19 10:14:38 +01:00
Michael Nebel
c3fe3e468c
Javascript: Update all test util paths to point to the new location.
2024-12-12 13:54:25 +01:00
Asger F
08d25c122d
JS: Deprecate more uses of ConsistencyConfiguration
2024-12-03 14:30:27 +01:00
Asger F
0ce1fe767d
JS: Deprecate ConsistencyChecking to avoid deprecation warnings
2024-12-03 14:30:23 +01:00
Napalys
a0df33c3ac
JS: UnsafeShellCommand Using unknown flags in the RegExp object is no longer flagged as bad sanitization to reduce false positives.
2024-11-28 11:26:43 +01:00
Napalys
155f1fca85
JS: Added test cases for unsafe shell command sanitization with RegExpr Object, instead of literal
2024-11-28 11:26:42 +01:00
Asger F
8818fcc207
JS: Benign test output changes
2024-11-26 15:47:13 +01:00
Asger F
52ba91a7f8
JS: Updates to nodes/edges in tests
...
Only changes to nodes/edges for various reasons, no actual result changes
2024-10-29 08:32:13 +01:00
Asger F
12e316b99d
JS: Update test output after merging in 'main'
...
- Paths are now relative to the test case, not the qlpack
- Paths going through an implicit reads have changed slightly
2024-10-08 10:11:15 +02:00
Asger F
cf90c83604
JS: Accept changes to nodes/edges results
2024-09-12 13:42:19 +02:00
Asger F
2e2181be2c
JS: Update test output that only affects nodes/edges/subpaths
2024-08-27 11:35:33 +02:00
Asger F
ee10702e73
JS: Another provanance test output update
2024-06-27 11:56:01 +02:00
Asger F
2473274681
JS: Benign test output changes
2024-06-27 09:06:45 +02:00
Asger F
53efb5837b
JS: Update some tests with provenance columns
...
Only includes the changes that purely contain the new provenance columns
2024-06-26 13:51:44 +02:00
Asger F
bd3fccd1a8
JS: Update test output with provenance column
2024-06-25 10:30:56 +02:00
Asger F
ba9edb4e54
JS: Port UnsafeShellCommandConstruction
2023-10-13 13:15:06 +02:00
Asger F
d446444667
JS: Port ShellCommandInjectionFromEnvironment
2023-10-13 13:15:05 +02:00
Asger F
06835a800c
JS: Port SecondOrderCommandInjection
2023-10-13 13:15:05 +02:00
Asger F
8c001916b6
JS: Port IndirectCommandInjection
2023-10-13 13:15:05 +02:00
Asger F
17233a6749
JS: Port CommandInjection
2023-10-13 13:15:03 +02:00
erik-krogh
3293a55e8f
require arguments to be shell interpreted to be flagged by indirect-command-injection
2023-05-17 11:07:45 +02:00
Asger F
1a9956354e
JS: Restrict getInput to indirect command injection query
2023-05-03 16:10:03 +02:00
Asger F
b9ad4177f9
JS: List safe environment variables in IndirectCommandInjection
2023-05-03 10:48:14 +02:00
Asger F
cb95dbfa14
JS: Add tests
2023-05-01 11:42:17 +02:00
erik-krogh
943bdeca6d
make appliesTo recursive
2023-02-14 14:16:45 +01:00
erik-krogh
9549cac3e5
add an additional barrier guard that finds "=== true" versions of previous barrier guards
2023-02-14 14:15:23 +01:00
erik-krogh
68656274f4
dont recognize regexps that match dot as sanitizers
2023-02-13 17:36:51 +01:00
Erik Krogh Kristensen
fc66c905ff
Merge pull request #11859 from erik-krogh/moreShell
...
JS: slightly broaden the regular expression that recognizes bad string-concats used as shell commands
2023-01-23 22:26:17 +01:00
erik-krogh
23a847b1cf
track shell:true more in js/shell-command-constructed-from-input
2023-01-10 15:27:37 +01:00
erik-krogh
79e161e046
slightly broaden the regular expression that recognizes bad string-concats used as shell commands
2023-01-10 12:49:37 +01:00
Erik Krogh Kristensen
f67219965e
Merge pull request #11082 from erik-krogh/shellArr
...
JS: treat arrays that gets executed with shell:true as a sink for `js/shell-command-constructed-from-input`
2022-11-22 13:03:50 +01:00
erik-krogh
ba2734909f
JS: don't use deprecated files in tests
2022-11-17 22:12:50 +01:00
