mirror of
https://github.com/github/codeql.git
synced 2025-12-17 09:13:20 +01:00
418 lines
12 KiB
JavaScript
418 lines
12 KiB
JavaScript
(function() {
|
|
const pg = require('pg');
|
|
|
|
const client = new pg.Client({
|
|
user: 'dbuser', // $ Alert
|
|
host: 'database.server.com',
|
|
database: 'mydb',
|
|
password: 'hgfedcba', // $ Alert
|
|
port: 3211,
|
|
});
|
|
client.connect();
|
|
})();
|
|
|
|
(function() {
|
|
require("http").request({auth: "user:hgfedcba"}); // $ MISSING: Alert
|
|
require("https").request({auth: "user:hgfedcba"}); // $ MISSING: Alert
|
|
function getCredentials() {
|
|
return "user:hgfedcba";
|
|
}
|
|
require("http").request({auth: getCredentials()}); // $ MISSING: Alert
|
|
require("http").request({auth: getUnknownCredentials()});
|
|
})();
|
|
|
|
(function() {
|
|
var basicAuth = require('express-basic-auth');
|
|
|
|
basicAuth({users: { 'admin': 'hgfedcba' }}); // $ Alert
|
|
var users = {};
|
|
users['unknown-admin-name'] = 'hgfedcba'; // $ Alert
|
|
basicAuth({users: users});
|
|
})();
|
|
|
|
(function() {
|
|
var basicAuth = require('basic-auth-connect');
|
|
basicAuth('username', 'hgfedcba'); // $ Alert
|
|
basicAuth(function(){});
|
|
})();
|
|
|
|
(function() {
|
|
var AWS = require('aws-sdk');
|
|
AWS.config.update({ accessKeyId: 'username', secretAccessKey: 'hgfedcba'}); // $ Alert
|
|
new AWS.Config({ accessKeyId: 'username', secretAccessKey: 'hgfedcba'}); // $ Alert
|
|
var config = new AWS.Config();
|
|
config.update({ accessKeyId: 'username', secretAccessKey: 'hgfedcba'}); // $ Alert
|
|
var o = {};
|
|
o.secretAccessKey = 'hgfedcba'; // $ Alert
|
|
config.update(o);
|
|
})();
|
|
|
|
(function() {
|
|
var request = require('request');
|
|
|
|
request.get(url).auth('username', 'hgfedcba'); // $ Alert
|
|
request.get(url, {
|
|
'auth': {
|
|
'user': 'username', // $ Alert
|
|
'pass': 'hgfedcba' // $ Alert
|
|
}
|
|
});
|
|
|
|
request.get(url).auth(null, null, _, 'bearerToken'); // $ Alert
|
|
|
|
request.get(url, {
|
|
'auth': {
|
|
'bearer': 'bearerToken' // $ Alert
|
|
}
|
|
});
|
|
|
|
request.post(url).auth('username', 'hgfedcba'); // $ Alert
|
|
request.head(url).auth('username', 'hgfedcba'); // $ Alert
|
|
|
|
request(url).auth('username', 'hgfedcba'); // $ Alert
|
|
request(url, {
|
|
'auth': {
|
|
'user': 'username', // $ Alert
|
|
'pass': 'hgfedcba' // $ Alert
|
|
}
|
|
});
|
|
})();
|
|
|
|
(function() {
|
|
const MsRest = require('ms-rest-azure');
|
|
|
|
MsRest.loginWithUsernamePassword('username', 'hgfedcba', function(){}); // $ Alert
|
|
MsRest.loginWithUsernamePassword(process.env.AZURE_USER, process.env.AZURE_PASS, function(){});
|
|
MsRest.loginWithServicePrincipalSecret('username', 'hgfedcba', function(){}); // $ Alert
|
|
})();
|
|
|
|
(function() {
|
|
var digitalocean = require('digitalocean');
|
|
digitalocean.client('TOKEN'); // $ Alert
|
|
digitalocean.client(process.env.DIGITAL_OCEAN_TOKEN);
|
|
})();
|
|
|
|
(function() {
|
|
var pkgcloud = require('pkgcloud');
|
|
pkgcloud.compute.createClient({
|
|
account: 'x1', // $ Alert
|
|
keyId: 'x2',// $ Alert
|
|
storageAccount: 'x3', // $ Alert
|
|
username: 'x4', // $ Alert
|
|
key: 'hgfedcba', // $ Alert
|
|
apiKey: 'hgfedcba', // $ Alert
|
|
storageAccessKey: 'hgfedcba', // $ Alert
|
|
password: 'hgfedcba', // $ Alert
|
|
token: 'hgfedcba' // $ Alert
|
|
});
|
|
pkgcloud.compute.createClient({
|
|
INNOCENT_DATA: '42'
|
|
});
|
|
pkgcloud.providers.SOME_PROVIDER.compute.createClient({
|
|
username: 'x5', // $ Alert
|
|
password: 'hgfedcba' // $ Alert
|
|
});
|
|
pkgcloud.UNKNOWN_SERVICE.createClient({
|
|
username: 'x6',
|
|
password: 'hgfedcba'
|
|
});
|
|
pkgcloud.providers.SOME_PROVIDER.UNKNOWN_SERVICE.createClient({
|
|
username: 'x7',
|
|
password: 'hgfedcba'
|
|
});
|
|
pkgcloud.compute.createClient({
|
|
username: process.env.USERNAME,
|
|
password: process.env.PASSWORD
|
|
});
|
|
})();
|
|
|
|
(function(){
|
|
require('crypto').createHmac('sha256', 'hgfedcba'); // $ Alert
|
|
require("crypto-js/aes").encrypt('my message', 'hgfedcba'); // $ Alert
|
|
})()
|
|
|
|
(function(){
|
|
require("cookie-session")({ secret: "hgfedcba" }); // $ Alert
|
|
})()
|
|
|
|
(function(){
|
|
var request = require('request');
|
|
request.get(url, {
|
|
'auth': {
|
|
'user': '',
|
|
'pass': process.env.PASSWORD
|
|
}
|
|
});
|
|
})();
|
|
|
|
(function(){
|
|
var request = require('request');
|
|
let pass = getPassword() || '';
|
|
request.get(url, {
|
|
'auth': {
|
|
'user': process.env.USER || '',
|
|
'pass': pass,
|
|
}
|
|
});
|
|
})();
|
|
|
|
(function(){
|
|
require("cookie-session")({ secret: "oiuneawrgiyubaegr" }); // $ Alert
|
|
require('crypto').createHmac('sha256', 'oiuneawrgiyubaegr'); // $ Alert
|
|
|
|
var basicAuth = require('express-basic-auth');
|
|
basicAuth({users: { [adminName]: 'change_me' }});
|
|
})();
|
|
|
|
(async function () {
|
|
const base64 = require('base-64');
|
|
const fetch = require("node-fetch");
|
|
|
|
const USER = 'sdsdag'; // $ Alert
|
|
const PASS = 'sdsdag'; // $ Alert
|
|
const AUTH = base64.encode(`${USER}:${PASS}`);
|
|
|
|
const rsp = await fetch(ENDPOINT, {
|
|
method: 'get',
|
|
headers: new fetch.Headers({
|
|
"Authorization": `Basic ${AUTH}`, // $ Sink
|
|
"Content-Type": 'application/json'
|
|
})
|
|
});
|
|
|
|
fetch(ENDPOINT, {
|
|
method: 'post',
|
|
body: JSON.stringify(body),
|
|
headers: {
|
|
"Content-Type": 'application/json',
|
|
"Authorization": `Basic ${AUTH}` // $ Sink
|
|
},
|
|
})
|
|
|
|
var headers = new fetch.Headers({
|
|
"Content-Type": 'application/json'
|
|
});
|
|
headers.append("Authorization", `Basic ${AUTH}`) // $ Sink
|
|
fetch(ENDPOINT, {
|
|
method: 'get',
|
|
headers: headers
|
|
});
|
|
|
|
var headers2 = new fetch.Headers({
|
|
"Content-Type": 'application/json'
|
|
});
|
|
headers2.set("Authorization", `Basic ${AUTH}`) // $ Sink
|
|
fetch(ENDPOINT, {
|
|
method: 'get',
|
|
headers: headers2
|
|
});
|
|
});
|
|
|
|
(function () {
|
|
const base64 = require('base-64');
|
|
|
|
const USER = 'sdsdag'; // $ Alert
|
|
const PASS = 'sdsdag'; // $ Alert
|
|
const AUTH = base64.encode(`${USER}:${PASS}`);
|
|
|
|
// browser API
|
|
var headers = new Headers();
|
|
headers.append("Content-Type", 'application/json');
|
|
headers.append("Authorization", `Basic ${AUTH}`); // $ Sink
|
|
fetch(ENDPOINT, {
|
|
method: 'get',
|
|
headers: headers
|
|
});
|
|
});
|
|
|
|
(async function () {
|
|
import fetch from 'node-fetch';
|
|
|
|
const username = 'sdsdag'; // $ Alert
|
|
const password = config.get('some_actually_secrect_password');
|
|
const response = await fetch(ENDPOINT, {
|
|
method: 'get',
|
|
headers: {
|
|
'Content-Type': 'application/json',
|
|
Authorization: 'Basic ' + Buffer.from(username + ':' + password).toString('base64'), // $ Sink
|
|
},
|
|
});
|
|
})
|
|
|
|
(function () {
|
|
import jwt from "jsonwebtoken";
|
|
|
|
var privateKey = "myHardCodedPrivateKey"; // $ Alert
|
|
var token = jwt.sign({ foo: 'bar' }, privateKey, { algorithm: 'RS256'}); // $ Sink
|
|
|
|
var publicKey = "myHardCodedPublicKey"; // $ Alert
|
|
jwt.verify(token, publicKey, function(err, decoded) { // $ Sink
|
|
console.log(decoded);
|
|
});
|
|
})();
|
|
|
|
(async function () {
|
|
const fetch = require("node-fetch");
|
|
|
|
const rsp = await fetch(ENDPOINT, {
|
|
method: 'get',
|
|
headers: new fetch.Headers({
|
|
"Authorization": `Basic foo`, // OK - dummy password
|
|
"Content-Type": 'application/json'
|
|
})
|
|
});
|
|
|
|
const rsp2 = await fetch(ENDPOINT, {
|
|
method: 'get',
|
|
headers: new fetch.Headers({
|
|
"Authorization": `${foo ? 'Bearer' : 'OAuth'} ${accessToken}`, // OK - just a protocol selector
|
|
"Content-Type": 'application/json'
|
|
})
|
|
});
|
|
});
|
|
|
|
(function() {
|
|
require("http").request({auth: "user:{{ INSERT_HERE }}"});
|
|
require("http").request({auth: "user:token {{ INSERT_HERE }}"});
|
|
require("http").request({auth: "user:( INSERT_HERE )"});
|
|
require("http").request({auth: "user:{{ env.access_token }}"});
|
|
require("http").request({auth: "user:abcdefgh"});
|
|
require("http").request({auth: "user:12345678"});
|
|
require("http").request({auth: "user:foo"});
|
|
require("http").request({auth: "user:mypassword"})
|
|
require("http").request({auth: "user:mytoken"})
|
|
require("http").request({auth: "user:fake token"})
|
|
require("http").request({auth: "user:dcba"})
|
|
require("http").request({auth: "user:custom string"})
|
|
});
|
|
|
|
(function () {
|
|
// browser API
|
|
var headers = new Headers();
|
|
headers.append("Authorization", `Basic sdsdag:sdsdag`); // $ Alert
|
|
headers.append("Authorization", `Basic sdsdag:xxxxxxxxxxxxxx`);
|
|
headers.append("Authorization", `Basic sdsdag:aaaiuogrweuibgbbbbb`); // $ Alert
|
|
headers.append("Authorization", `Basic sdsdag:000000000000001`);
|
|
});
|
|
|
|
(function () {
|
|
require('crypto').createHmac('sha256', 'mytoken');
|
|
require('crypto').createHmac('sha256', 'SampleToken');
|
|
require('crypto').createHmac('sha256', 'MyPassword');
|
|
require('crypto').createHmac('sha256', 'iubfewiaaweiybgaeuybgera'); // $ Alert
|
|
})();
|
|
|
|
(function () {
|
|
const jwt_simple = require("jwt-simple");
|
|
|
|
var privateKey = "myHardCodedPrivateKey"; // $ Alert
|
|
jwt_simple.decode(UserToken, privateKey); // $ Sink
|
|
})();
|
|
|
|
|
|
(async function () {
|
|
const jose = require("jose");
|
|
|
|
var privateKey = "myHardCodedPrivateKey"; // $ Alert
|
|
jose.jwtVerify(token, new TextEncoder().encode(privateKey)) // $ Sink
|
|
|
|
const spki = `-----BEGIN PUBLIC KEY-----
|
|
MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAwhYOFK2Ocbbpb/zVypi9...
|
|
-----END PUBLIC KEY-----` // $ Alert
|
|
let publicKey = await jose.importSPKI(spki, 'RS256')
|
|
jose.jwtVerify(token, publicKey) // $ Sink
|
|
|
|
const alg = 'RS256'
|
|
const jwk = {
|
|
kty: 'RSA',
|
|
n: 'whYOFK2Ocbbpb_zVypi9SeKiNUqKQH0zTKN1-6f...', // $ Alert
|
|
e: 'AQAB',
|
|
}
|
|
publicKey = await jose.importJWK(jwk, alg)
|
|
const jwt =
|
|
'eyJhbGciOiJSUzI1NiJ9.eyJ1cm46ZXhhbXBsZTpjbGFpbSI6dHJ1ZSwiaWF0IjoxNjY5MDU2NDg4LCJpc3MiOiJ1cm46ZXhhbXBsZTppc3N1ZXIiLCJhdWQiOiJ1cm46ZXhhbXBsZTphdWRpZW5jZSJ9.gXrPZ3yM_60dMXGE69dusbpzYASNA-XIOwsb5D5xYnSxyj6_D6OR_uR_1vqhUm4AxZxcrH1_-XJAve9HCw8az_QzHcN-nETt-v6stCsYrn6Bv1YOc-mSJRZ8ll57KVqLbCIbjKwerNX5r2_Qg2TwmJzQdRs-AQDhy-s_DlJd8ql6wR4n-kDZpar-pwIvz4fFIN0Fj57SXpAbLrV6Eo4Byzl0xFD8qEYEpBwjrMMfxCZXTlAVhAq6KCoGlDTwWuExps342-0UErEtyIqDnDGcrfNWiUsoo8j-29IpKd-w9-C388u-ChCxoHz--H8WmMSZzx3zTXsZ5lXLZ9IKfanDKg'
|
|
|
|
await jose.jwtVerify(jwt, publicKey, { // $ Sink
|
|
issuer: 'urn:example:issuer',
|
|
audience: 'urn:example:audience',
|
|
})
|
|
})();
|
|
|
|
(function () {
|
|
const expressjwt = require("express-jwt");
|
|
|
|
var secretKey = "myHardCodedPrivateKey"; // $ Alert
|
|
|
|
app.get(
|
|
"/protected",
|
|
expressjwt.expressjwt({
|
|
secret: secretKey, algorithms: ["HS256"] // $ Sink
|
|
}),
|
|
function (req, res) {
|
|
if (!req.auth.admin) return res.sendStatus(401);
|
|
res.sendStatus(200);
|
|
}
|
|
);
|
|
|
|
app.get(
|
|
"/protected",
|
|
expressjwt.expressjwt({
|
|
secret: Buffer.from(secretKey, "base64"), // $ Sink
|
|
algorithms: ["RS256"],
|
|
}),
|
|
function (req, res) {
|
|
if (!req.auth.admin) return res.sendStatus(401);
|
|
res.sendStatus(200);
|
|
}
|
|
);
|
|
|
|
})();
|
|
|
|
(function () {
|
|
const JwtStrategy = require('passport-jwt').Strategy;
|
|
const passport = require('passport')
|
|
|
|
var secretKey = "myHardCodedPrivateKey"; // $ Alert
|
|
|
|
const opts = {}
|
|
opts.secretOrKey = secretKey; // $ Sink
|
|
passport.use(new JwtStrategy(opts, function (jwt_payload, done) {
|
|
return done(null, false);
|
|
}));
|
|
|
|
passport.use(new JwtStrategy({
|
|
secretOrKeyProvider: function (request, rawJwtToken, done) {
|
|
return done(null, secretKey) // $ Sink
|
|
}
|
|
}, function (jwt_payload, done) {
|
|
return done(null, false);
|
|
}));
|
|
})();
|
|
|
|
(function () {
|
|
import NextAuth from "next-auth"
|
|
import AppleProvider from "next-auth/providers/apple"
|
|
|
|
var secretKey = "myHardCodedPrivateKey"; // $ Alert
|
|
|
|
NextAuth({
|
|
secret: secretKey, // $ Sink
|
|
providers: [
|
|
AppleProvider({
|
|
clientId: process.env.APPLE_ID,
|
|
clientSecret: process.env.APPLE_SECRET,
|
|
}),
|
|
],
|
|
})
|
|
})();
|
|
|
|
(function () {
|
|
const Koa = require('koa');
|
|
const jwt = require('koa-jwt');
|
|
const app = new Koa();
|
|
|
|
var secretKey = "myHardCodedPrivateKey"; // $ Alert
|
|
|
|
app.use(jwt({ secret: secretKey })); // $ Sink
|
|
})();
|