github
/
codeql
зеркало из https://github.com/github/codeql.git
1
0
Форкнуть 0
Код Задачи Пакеты Проекты Релизы Вики Активность

JS: improve prototype pollution tests

This commit is contained in:
Esben Sparre Andreasen 2019-04-17 14:23:35 +02:00
Родитель af3f0b1d04
Коммит 1cea29d89f
5 изменённых файлов: 34 добавлений и 15 удалений
Показать статистику Скачать Patch файл Скачать Diff файл Показать все файлы Свернуть все файлы

26
javascript/ql/test/query-tests/Security/CWE-400/PrototypePollution.expected
Просмотреть файл

@ -1,15 +1,17 @@
nodes
| PrototypePollution.js:7:17:7:29 | req.query.foo |
| PrototypePollution.js:10:17:12:5 | {\\n ... K\\n } |
| PrototypePollution.js:11:16:11:30 | req.query.value |
| PrototypePollution.js:15:14:15:28 | req.query.value |
| PrototypePollution.js:17:17:19:5 | {\\n ... K\\n } |
| PrototypePollution.js:18:16:18:25 | opts.thing |
| src-non-vulnerable-lodash/tst.js:7:17:7:29 | req.query.foo |
| src-vulnerable-lodash/tst.js:7:17:7:29 | req.query.foo |
| src-vulnerable-lodash/tst.js:10:17:12:5 | {\\n ... K\\n } |
| src-vulnerable-lodash/tst.js:11:16:11:30 | req.query.value |
| src-vulnerable-lodash/tst.js:15:14:15:28 | req.query.value |
| src-vulnerable-lodash/tst.js:17:17:19:5 | {\\n ... K\\n } |
| src-vulnerable-lodash/tst.js:18:16:18:25 | opts.thing |
edges
| PrototypePollution.js:11:16:11:30 | req.query.value | PrototypePollution.js:10:17:12:5 | {\\n ... K\\n } |
| PrototypePollution.js:15:14:15:28 | req.query.value | PrototypePollution.js:18:16:18:25 | opts.thing |
| PrototypePollution.js:18:16:18:25 | opts.thing | PrototypePollution.js:17:17:19:5 | {\\n ... K\\n } |
| src-vulnerable-lodash/tst.js:11:16:11:30 | req.query.value | src-vulnerable-lodash/tst.js:10:17:12:5 | {\\n ... K\\n } |
| src-vulnerable-lodash/tst.js:15:14:15:28 | req.query.value | src-vulnerable-lodash/tst.js:18:16:18:25 | opts.thing |
| src-vulnerable-lodash/tst.js:18:16:18:25 | opts.thing | src-vulnerable-lodash/tst.js:17:17:19:5 | {\\n ... K\\n } |
#select
| PrototypePollution.js:7:17:7:29 | req.query.foo | PrototypePollution.js:7:17:7:29 | req.query.foo | PrototypePollution.js:7:17:7:29 | req.query.foo | Prototype pollution caused by merging a user-controlled value from $@. | PrototypePollution.js:7:17:7:29 | req.query.foo | here |
| PrototypePollution.js:10:17:12:5 | {\\n ... K\\n } | PrototypePollution.js:11:16:11:30 | req.query.value | PrototypePollution.js:10:17:12:5 | {\\n ... K\\n } | Prototype pollution caused by merging a user-controlled value from $@. | PrototypePollution.js:11:16:11:30 | req.query.value | here |
| PrototypePollution.js:17:17:19:5 | {\\n ... K\\n } | PrototypePollution.js:15:14:15:28 | req.query.value | PrototypePollution.js:17:17:19:5 | {\\n ... K\\n } | Prototype pollution caused by merging a user-controlled value from $@. | PrototypePollution.js:15:14:15:28 | req.query.value | here |
| src-non-vulnerable-lodash/tst.js:7:17:7:29 | req.query.foo | src-non-vulnerable-lodash/tst.js:7:17:7:29 | req.query.foo | src-non-vulnerable-lodash/tst.js:7:17:7:29 | req.query.foo | Prototype pollution caused by merging a user-controlled value from $@. | src-non-vulnerable-lodash/tst.js:7:17:7:29 | req.query.foo | here |
| src-vulnerable-lodash/tst.js:7:17:7:29 | req.query.foo | src-vulnerable-lodash/tst.js:7:17:7:29 | req.query.foo | src-vulnerable-lodash/tst.js:7:17:7:29 | req.query.foo | Prototype pollution caused by merging a user-controlled value from $@. | src-vulnerable-lodash/tst.js:7:17:7:29 | req.query.foo | here |
| src-vulnerable-lodash/tst.js:10:17:12:5 | {\\n ... K\\n } | src-vulnerable-lodash/tst.js:11:16:11:30 | req.query.value | src-vulnerable-lodash/tst.js:10:17:12:5 | {\\n ... K\\n } | Prototype pollution caused by merging a user-controlled value from $@. | src-vulnerable-lodash/tst.js:11:16:11:30 | req.query.value | here |
| src-vulnerable-lodash/tst.js:17:17:19:5 | {\\n ... K\\n } | src-vulnerable-lodash/tst.js:15:14:15:28 | req.query.value | src-vulnerable-lodash/tst.js:17:17:19:5 | {\\n ... K\\n } | Prototype pollution caused by merging a user-controlled value from $@. | src-vulnerable-lodash/tst.js:15:14:15:28 | req.query.value | here |

5
javascript/ql/test/query-tests/Security/CWE-400/src-non-vulnerable-lodash/package.json Normal file
Просмотреть файл

@ -0,0 +1,5 @@
{
"dependencies": {
"lodash": "4.17.12"
}
}

8
javascript/ql/test/query-tests/Security/CWE-400/src-non-vulnerable-lodash/tst.js Normal file
Просмотреть файл

@ -0,0 +1,8 @@
let express = require('express');
let _ = require('lodash');
let app = express();
app.get('/hello', function(req, res) {
_.merge({}, req.query.foo); // OK
});

5
javascript/ql/test/query-tests/Security/CWE-400/src-vulnerable-lodash/package.json Normal file
Просмотреть файл

@ -0,0 +1,5 @@
{
"dependencies": {
"lodash": "4.17.4"
}
}

5
javascript/ql/test/query-tests/Security/CWE-400/PrototypePollution.js → javascript/ql/test/query-tests/Security/CWE-400/src-vulnerable-lodash/tst.js
Просмотреть файл

@ -6,11 +6,11 @@ let app = express();
app.get('/hello', function(req, res) {
_.merge({}, req.query.foo); // NOT OK
_.merge({}, req.query); // NOT OK - but not flagged
_.merge({}, {
value: req.query.value // NOT OK
});
let opts = {
thing: req.query.value // wrapped and unwrapped value
};
@ -18,4 +18,3 @@ app.get('/hello', function(req, res) {
value: opts.thing // NOT OK
});
});