mirror of
https://github.com/github/codeql.git
synced 2025-12-17 01:03:14 +01:00
36 lines
1.9 KiB
JavaScript
36 lines
1.9 KiB
JavaScript
import { execa, execaSync, execaCommand, execaCommandSync, $ } from 'execa';
|
|
import http from 'node:http'
|
|
import url from 'url'
|
|
|
|
http.createServer(async function (req, res) {
|
|
let cmd = url.parse(req.url, true).query["cmd"][0];
|
|
let arg1 = url.parse(req.url, true).query["arg1"];
|
|
let arg2 = url.parse(req.url, true).query["arg2"];
|
|
let arg3 = url.parse(req.url, true).query["arg3"];
|
|
|
|
await $`${cmd} ${arg1} ${arg2} ${arg3}`; // test: CommandInjection
|
|
await $`ssh ${arg1} ${arg2} ${arg3}`; // test: CommandInjection
|
|
$({ shell: false }).sync`${cmd} ${arg1} ${arg2} ${arg3}`; // test: CommandInjection
|
|
$({ shell: true }).sync`${cmd} ${arg1} ${arg2} ${arg3}`; // test: CommandInjection
|
|
$({ shell: false }).sync`ssh ${arg1} ${arg2} ${arg3}`; // test: CommandInjection
|
|
|
|
$.sync`${cmd} ${arg1} ${arg2} ${arg3}`; // test: CommandInjection
|
|
$.sync`ssh ${arg1} ${arg2} ${arg3}`; // test: CommandInjection
|
|
await $({ shell: true })`${cmd} ${arg1} ${arg2} ${arg3}` // test: CommandInjection
|
|
await $({ shell: false })`${cmd} ${arg1} ${arg2} ${arg3}` // test: CommandInjection
|
|
await $({ shell: false })`ssh ${arg1} ${arg2} ${arg3}` // test: CommandInjection
|
|
|
|
await execa(cmd, [arg1, arg2, arg3]); // test: CommandInjection
|
|
await execa(cmd, { shell: true }); // test: CommandInjection
|
|
await execa(cmd, { shell: true }); // test: CommandInjection
|
|
await execa(cmd, [arg1, arg2, arg3], { shell: true }); // test: CommandInjection
|
|
|
|
execaSync(cmd, [arg1, arg2, arg3]); // test: CommandInjection
|
|
execaSync(cmd, [arg1, arg2, arg3], { shell: true }); // test: CommandInjection
|
|
|
|
await execaCommand(cmd + arg1 + arg2 + arg3); // test: CommandInjection
|
|
await execaCommand(cmd + arg1 + arg2 + arg3, { shell: true }); // test: CommandInjection
|
|
|
|
execaCommandSync(cmd + arg1 + arg2 + arg3); // test: CommandInjection
|
|
execaCommandSync(cmd + arg1 + arg2 + arg3, { shell: true }); // test: CommandInjection
|
|
}); |