mirror of
https://github.com/github/codeql.git
synced 2025-12-20 18:56:32 +01:00
165 lines
14 KiB
Plaintext
165 lines
14 KiB
Plaintext
nodes
|
|
| RegExpInjection.js:5:7:5:28 | key |
|
|
| RegExpInjection.js:5:13:5:28 | req.param("key") |
|
|
| RegExpInjection.js:5:13:5:28 | req.param("key") |
|
|
| RegExpInjection.js:5:31:5:56 | input |
|
|
| RegExpInjection.js:5:39:5:56 | req.param("input") |
|
|
| RegExpInjection.js:5:39:5:56 | req.param("input") |
|
|
| RegExpInjection.js:8:23:8:45 | "\\\\b" + ... (.*)\\n" |
|
|
| RegExpInjection.js:8:23:8:45 | "\\\\b" + ... (.*)\\n" |
|
|
| RegExpInjection.js:8:31:8:33 | key |
|
|
| RegExpInjection.js:19:14:19:22 | wrap(key) |
|
|
| RegExpInjection.js:19:14:19:22 | wrap(key) |
|
|
| RegExpInjection.js:19:19:19:21 | key |
|
|
| RegExpInjection.js:21:14:21:22 | wrap(key) |
|
|
| RegExpInjection.js:21:14:21:22 | wrap(key) |
|
|
| RegExpInjection.js:21:19:21:21 | key |
|
|
| RegExpInjection.js:24:12:24:27 | req.param("key") |
|
|
| RegExpInjection.js:24:12:24:27 | req.param("key") |
|
|
| RegExpInjection.js:27:14:27:21 | getKey() |
|
|
| RegExpInjection.js:27:14:27:21 | getKey() |
|
|
| RegExpInjection.js:29:21:29:21 | s |
|
|
| RegExpInjection.js:29:21:29:21 | s |
|
|
| RegExpInjection.js:31:23:31:23 | s |
|
|
| RegExpInjection.js:31:23:31:23 | s |
|
|
| RegExpInjection.js:31:23:31:23 | s |
|
|
| RegExpInjection.js:33:12:33:14 | key |
|
|
| RegExpInjection.js:34:12:34:19 | getKey() |
|
|
| RegExpInjection.js:40:23:40:27 | input |
|
|
| RegExpInjection.js:40:23:40:27 | input |
|
|
| RegExpInjection.js:41:26:41:30 | input |
|
|
| RegExpInjection.js:41:26:41:30 | input |
|
|
| RegExpInjection.js:42:25:42:29 | input |
|
|
| RegExpInjection.js:42:25:42:29 | input |
|
|
| RegExpInjection.js:45:24:45:28 | input |
|
|
| RegExpInjection.js:45:24:45:28 | input |
|
|
| RegExpInjection.js:46:27:46:31 | input |
|
|
| RegExpInjection.js:46:27:46:31 | input |
|
|
| RegExpInjection.js:47:26:47:30 | input |
|
|
| RegExpInjection.js:47:26:47:30 | input |
|
|
| RegExpInjection.js:54:14:54:16 | key |
|
|
| RegExpInjection.js:54:14:54:27 | key.split(".") |
|
|
| RegExpInjection.js:54:14:54:42 | key.spl ... x => x) |
|
|
| RegExpInjection.js:54:14:54:52 | key.spl ... in("-") |
|
|
| RegExpInjection.js:54:14:54:52 | key.spl ... in("-") |
|
|
| RegExpInjection.js:60:31:60:56 | input |
|
|
| RegExpInjection.js:60:39:60:56 | req.param("input") |
|
|
| RegExpInjection.js:60:39:60:56 | req.param("input") |
|
|
| RegExpInjection.js:64:14:64:18 | input |
|
|
| RegExpInjection.js:64:14:64:18 | input |
|
|
| RegExpInjection.js:82:7:82:32 | input |
|
|
| RegExpInjection.js:82:15:82:32 | req.param("input") |
|
|
| RegExpInjection.js:82:15:82:32 | req.param("input") |
|
|
| RegExpInjection.js:87:14:87:55 | "^.*\\.( ... + ")$" |
|
|
| RegExpInjection.js:87:14:87:55 | "^.*\\.( ... + ")$" |
|
|
| RegExpInjection.js:87:25:87:29 | input |
|
|
| RegExpInjection.js:87:25:87:48 | input.r ... g, "\|") |
|
|
| RegExpInjection.js:91:16:91:50 | `^${pro ... r.app$` |
|
|
| RegExpInjection.js:91:16:91:50 | `^${pro ... r.app$` |
|
|
| RegExpInjection.js:91:20:91:30 | process.env |
|
|
| RegExpInjection.js:91:20:91:30 | process.env |
|
|
| RegExpInjection.js:91:20:91:35 | process.env.HOME |
|
|
| RegExpInjection.js:93:16:93:49 | `^${pro ... r.app$` |
|
|
| RegExpInjection.js:93:16:93:49 | `^${pro ... r.app$` |
|
|
| RegExpInjection.js:93:20:93:31 | process.argv |
|
|
| RegExpInjection.js:93:20:93:31 | process.argv |
|
|
| RegExpInjection.js:93:20:93:34 | process.argv[1] |
|
|
| tst.js:1:46:1:46 | e |
|
|
| tst.js:1:46:1:46 | e |
|
|
| tst.js:2:9:2:21 | data |
|
|
| tst.js:2:16:2:16 | e |
|
|
| tst.js:2:16:2:21 | e.data |
|
|
| tst.js:3:16:3:35 | "^"+ data.name + "$" |
|
|
| tst.js:3:16:3:35 | "^"+ data.name + "$" |
|
|
| tst.js:3:21:3:24 | data |
|
|
| tst.js:3:21:3:29 | data.name |
|
|
edges
|
|
| RegExpInjection.js:5:7:5:28 | key | RegExpInjection.js:8:31:8:33 | key |
|
|
| RegExpInjection.js:5:7:5:28 | key | RegExpInjection.js:19:19:19:21 | key |
|
|
| RegExpInjection.js:5:7:5:28 | key | RegExpInjection.js:21:19:21:21 | key |
|
|
| RegExpInjection.js:5:7:5:28 | key | RegExpInjection.js:33:12:33:14 | key |
|
|
| RegExpInjection.js:5:7:5:28 | key | RegExpInjection.js:54:14:54:16 | key |
|
|
| RegExpInjection.js:5:13:5:28 | req.param("key") | RegExpInjection.js:5:7:5:28 | key |
|
|
| RegExpInjection.js:5:13:5:28 | req.param("key") | RegExpInjection.js:5:7:5:28 | key |
|
|
| RegExpInjection.js:5:31:5:56 | input | RegExpInjection.js:40:23:40:27 | input |
|
|
| RegExpInjection.js:5:31:5:56 | input | RegExpInjection.js:40:23:40:27 | input |
|
|
| RegExpInjection.js:5:31:5:56 | input | RegExpInjection.js:41:26:41:30 | input |
|
|
| RegExpInjection.js:5:31:5:56 | input | RegExpInjection.js:41:26:41:30 | input |
|
|
| RegExpInjection.js:5:31:5:56 | input | RegExpInjection.js:42:25:42:29 | input |
|
|
| RegExpInjection.js:5:31:5:56 | input | RegExpInjection.js:42:25:42:29 | input |
|
|
| RegExpInjection.js:5:31:5:56 | input | RegExpInjection.js:45:24:45:28 | input |
|
|
| RegExpInjection.js:5:31:5:56 | input | RegExpInjection.js:45:24:45:28 | input |
|
|
| RegExpInjection.js:5:31:5:56 | input | RegExpInjection.js:46:27:46:31 | input |
|
|
| RegExpInjection.js:5:31:5:56 | input | RegExpInjection.js:46:27:46:31 | input |
|
|
| RegExpInjection.js:5:31:5:56 | input | RegExpInjection.js:47:26:47:30 | input |
|
|
| RegExpInjection.js:5:31:5:56 | input | RegExpInjection.js:47:26:47:30 | input |
|
|
| RegExpInjection.js:5:39:5:56 | req.param("input") | RegExpInjection.js:5:31:5:56 | input |
|
|
| RegExpInjection.js:5:39:5:56 | req.param("input") | RegExpInjection.js:5:31:5:56 | input |
|
|
| RegExpInjection.js:8:31:8:33 | key | RegExpInjection.js:8:23:8:45 | "\\\\b" + ... (.*)\\n" |
|
|
| RegExpInjection.js:8:31:8:33 | key | RegExpInjection.js:8:23:8:45 | "\\\\b" + ... (.*)\\n" |
|
|
| RegExpInjection.js:19:19:19:21 | key | RegExpInjection.js:19:14:19:22 | wrap(key) |
|
|
| RegExpInjection.js:19:19:19:21 | key | RegExpInjection.js:19:14:19:22 | wrap(key) |
|
|
| RegExpInjection.js:21:19:21:21 | key | RegExpInjection.js:21:14:21:22 | wrap(key) |
|
|
| RegExpInjection.js:21:19:21:21 | key | RegExpInjection.js:21:14:21:22 | wrap(key) |
|
|
| RegExpInjection.js:24:12:24:27 | req.param("key") | RegExpInjection.js:27:14:27:21 | getKey() |
|
|
| RegExpInjection.js:24:12:24:27 | req.param("key") | RegExpInjection.js:27:14:27:21 | getKey() |
|
|
| RegExpInjection.js:24:12:24:27 | req.param("key") | RegExpInjection.js:27:14:27:21 | getKey() |
|
|
| RegExpInjection.js:24:12:24:27 | req.param("key") | RegExpInjection.js:27:14:27:21 | getKey() |
|
|
| RegExpInjection.js:24:12:24:27 | req.param("key") | RegExpInjection.js:34:12:34:19 | getKey() |
|
|
| RegExpInjection.js:24:12:24:27 | req.param("key") | RegExpInjection.js:34:12:34:19 | getKey() |
|
|
| RegExpInjection.js:29:21:29:21 | s | RegExpInjection.js:31:23:31:23 | s |
|
|
| RegExpInjection.js:29:21:29:21 | s | RegExpInjection.js:31:23:31:23 | s |
|
|
| RegExpInjection.js:29:21:29:21 | s | RegExpInjection.js:31:23:31:23 | s |
|
|
| RegExpInjection.js:29:21:29:21 | s | RegExpInjection.js:31:23:31:23 | s |
|
|
| RegExpInjection.js:33:12:33:14 | key | RegExpInjection.js:29:21:29:21 | s |
|
|
| RegExpInjection.js:34:12:34:19 | getKey() | RegExpInjection.js:29:21:29:21 | s |
|
|
| RegExpInjection.js:54:14:54:16 | key | RegExpInjection.js:54:14:54:27 | key.split(".") |
|
|
| RegExpInjection.js:54:14:54:27 | key.split(".") | RegExpInjection.js:54:14:54:42 | key.spl ... x => x) |
|
|
| RegExpInjection.js:54:14:54:42 | key.spl ... x => x) | RegExpInjection.js:54:14:54:52 | key.spl ... in("-") |
|
|
| RegExpInjection.js:54:14:54:42 | key.spl ... x => x) | RegExpInjection.js:54:14:54:52 | key.spl ... in("-") |
|
|
| RegExpInjection.js:60:31:60:56 | input | RegExpInjection.js:64:14:64:18 | input |
|
|
| RegExpInjection.js:60:31:60:56 | input | RegExpInjection.js:64:14:64:18 | input |
|
|
| RegExpInjection.js:60:39:60:56 | req.param("input") | RegExpInjection.js:60:31:60:56 | input |
|
|
| RegExpInjection.js:60:39:60:56 | req.param("input") | RegExpInjection.js:60:31:60:56 | input |
|
|
| RegExpInjection.js:82:7:82:32 | input | RegExpInjection.js:87:25:87:29 | input |
|
|
| RegExpInjection.js:82:15:82:32 | req.param("input") | RegExpInjection.js:82:7:82:32 | input |
|
|
| RegExpInjection.js:82:15:82:32 | req.param("input") | RegExpInjection.js:82:7:82:32 | input |
|
|
| RegExpInjection.js:87:25:87:29 | input | RegExpInjection.js:87:25:87:48 | input.r ... g, "\|") |
|
|
| RegExpInjection.js:87:25:87:48 | input.r ... g, "\|") | RegExpInjection.js:87:14:87:55 | "^.*\\.( ... + ")$" |
|
|
| RegExpInjection.js:87:25:87:48 | input.r ... g, "\|") | RegExpInjection.js:87:14:87:55 | "^.*\\.( ... + ")$" |
|
|
| RegExpInjection.js:91:20:91:30 | process.env | RegExpInjection.js:91:20:91:35 | process.env.HOME |
|
|
| RegExpInjection.js:91:20:91:30 | process.env | RegExpInjection.js:91:20:91:35 | process.env.HOME |
|
|
| RegExpInjection.js:91:20:91:35 | process.env.HOME | RegExpInjection.js:91:16:91:50 | `^${pro ... r.app$` |
|
|
| RegExpInjection.js:91:20:91:35 | process.env.HOME | RegExpInjection.js:91:16:91:50 | `^${pro ... r.app$` |
|
|
| RegExpInjection.js:93:20:93:31 | process.argv | RegExpInjection.js:93:20:93:34 | process.argv[1] |
|
|
| RegExpInjection.js:93:20:93:31 | process.argv | RegExpInjection.js:93:20:93:34 | process.argv[1] |
|
|
| RegExpInjection.js:93:20:93:34 | process.argv[1] | RegExpInjection.js:93:16:93:49 | `^${pro ... r.app$` |
|
|
| RegExpInjection.js:93:20:93:34 | process.argv[1] | RegExpInjection.js:93:16:93:49 | `^${pro ... r.app$` |
|
|
| tst.js:1:46:1:46 | e | tst.js:2:16:2:16 | e |
|
|
| tst.js:1:46:1:46 | e | tst.js:2:16:2:16 | e |
|
|
| tst.js:2:9:2:21 | data | tst.js:3:21:3:24 | data |
|
|
| tst.js:2:16:2:16 | e | tst.js:2:16:2:21 | e.data |
|
|
| tst.js:2:16:2:21 | e.data | tst.js:2:9:2:21 | data |
|
|
| tst.js:3:21:3:24 | data | tst.js:3:21:3:29 | data.name |
|
|
| tst.js:3:21:3:29 | data.name | tst.js:3:16:3:35 | "^"+ data.name + "$" |
|
|
| tst.js:3:21:3:29 | data.name | tst.js:3:16:3:35 | "^"+ data.name + "$" |
|
|
#select
|
|
| RegExpInjection.js:8:23:8:45 | "\\\\b" + ... (.*)\\n" | RegExpInjection.js:5:13:5:28 | req.param("key") | RegExpInjection.js:8:23:8:45 | "\\\\b" + ... (.*)\\n" | This regular expression is constructed from a $@. | RegExpInjection.js:5:13:5:28 | req.param("key") | user-provided value |
|
|
| RegExpInjection.js:19:14:19:22 | wrap(key) | RegExpInjection.js:5:13:5:28 | req.param("key") | RegExpInjection.js:19:14:19:22 | wrap(key) | This regular expression is constructed from a $@. | RegExpInjection.js:5:13:5:28 | req.param("key") | user-provided value |
|
|
| RegExpInjection.js:21:14:21:22 | wrap(key) | RegExpInjection.js:5:13:5:28 | req.param("key") | RegExpInjection.js:21:14:21:22 | wrap(key) | This regular expression is constructed from a $@. | RegExpInjection.js:5:13:5:28 | req.param("key") | user-provided value |
|
|
| RegExpInjection.js:27:14:27:21 | getKey() | RegExpInjection.js:24:12:24:27 | req.param("key") | RegExpInjection.js:27:14:27:21 | getKey() | This regular expression is constructed from a $@. | RegExpInjection.js:24:12:24:27 | req.param("key") | user-provided value |
|
|
| RegExpInjection.js:31:23:31:23 | s | RegExpInjection.js:5:13:5:28 | req.param("key") | RegExpInjection.js:31:23:31:23 | s | This regular expression is constructed from a $@. | RegExpInjection.js:5:13:5:28 | req.param("key") | user-provided value |
|
|
| RegExpInjection.js:31:23:31:23 | s | RegExpInjection.js:24:12:24:27 | req.param("key") | RegExpInjection.js:31:23:31:23 | s | This regular expression is constructed from a $@. | RegExpInjection.js:24:12:24:27 | req.param("key") | user-provided value |
|
|
| RegExpInjection.js:40:23:40:27 | input | RegExpInjection.js:5:39:5:56 | req.param("input") | RegExpInjection.js:40:23:40:27 | input | This regular expression is constructed from a $@. | RegExpInjection.js:5:39:5:56 | req.param("input") | user-provided value |
|
|
| RegExpInjection.js:41:26:41:30 | input | RegExpInjection.js:5:39:5:56 | req.param("input") | RegExpInjection.js:41:26:41:30 | input | This regular expression is constructed from a $@. | RegExpInjection.js:5:39:5:56 | req.param("input") | user-provided value |
|
|
| RegExpInjection.js:42:25:42:29 | input | RegExpInjection.js:5:39:5:56 | req.param("input") | RegExpInjection.js:42:25:42:29 | input | This regular expression is constructed from a $@. | RegExpInjection.js:5:39:5:56 | req.param("input") | user-provided value |
|
|
| RegExpInjection.js:45:24:45:28 | input | RegExpInjection.js:5:39:5:56 | req.param("input") | RegExpInjection.js:45:24:45:28 | input | This regular expression is constructed from a $@. | RegExpInjection.js:5:39:5:56 | req.param("input") | user-provided value |
|
|
| RegExpInjection.js:46:27:46:31 | input | RegExpInjection.js:5:39:5:56 | req.param("input") | RegExpInjection.js:46:27:46:31 | input | This regular expression is constructed from a $@. | RegExpInjection.js:5:39:5:56 | req.param("input") | user-provided value |
|
|
| RegExpInjection.js:47:26:47:30 | input | RegExpInjection.js:5:39:5:56 | req.param("input") | RegExpInjection.js:47:26:47:30 | input | This regular expression is constructed from a $@. | RegExpInjection.js:5:39:5:56 | req.param("input") | user-provided value |
|
|
| RegExpInjection.js:54:14:54:52 | key.spl ... in("-") | RegExpInjection.js:5:13:5:28 | req.param("key") | RegExpInjection.js:54:14:54:52 | key.spl ... in("-") | This regular expression is constructed from a $@. | RegExpInjection.js:5:13:5:28 | req.param("key") | user-provided value |
|
|
| RegExpInjection.js:64:14:64:18 | input | RegExpInjection.js:60:39:60:56 | req.param("input") | RegExpInjection.js:64:14:64:18 | input | This regular expression is constructed from a $@. | RegExpInjection.js:60:39:60:56 | req.param("input") | user-provided value |
|
|
| RegExpInjection.js:87:14:87:55 | "^.*\\.( ... + ")$" | RegExpInjection.js:82:15:82:32 | req.param("input") | RegExpInjection.js:87:14:87:55 | "^.*\\.( ... + ")$" | This regular expression is constructed from a $@. | RegExpInjection.js:82:15:82:32 | req.param("input") | user-provided value |
|
|
| RegExpInjection.js:91:16:91:50 | `^${pro ... r.app$` | RegExpInjection.js:91:20:91:30 | process.env | RegExpInjection.js:91:16:91:50 | `^${pro ... r.app$` | This regular expression is constructed from a $@. | RegExpInjection.js:91:20:91:30 | process.env | environment variable |
|
|
| RegExpInjection.js:93:16:93:49 | `^${pro ... r.app$` | RegExpInjection.js:93:20:93:31 | process.argv | RegExpInjection.js:93:16:93:49 | `^${pro ... r.app$` | This regular expression is constructed from a $@. | RegExpInjection.js:93:20:93:31 | process.argv | command-line argument |
|
|
| tst.js:3:16:3:35 | "^"+ data.name + "$" | tst.js:1:46:1:46 | e | tst.js:3:16:3:35 | "^"+ data.name + "$" | This regular expression is constructed from a $@. | tst.js:1:46:1:46 | e | user-provided value |
|