Skip to content

Commit 4ee290a

Browse files
author
Stephan Brandauer
committed
update test for 'node:' prefix
1 parent 20ea825 commit 4ee290a

File tree

2 files changed

+209
-1
lines changed

2 files changed

+209
-1
lines changed

‎javascript/ql/test/query-tests/Security/CWE-022/TaintedPath/TaintedPath.expected

Lines changed: 199 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -3121,6 +3121,92 @@ nodes
31213121
| tainted-access-paths.js:31:23:31:30 | obj.sub4 |
31223122
| tainted-access-paths.js:31:23:31:30 | obj.sub4 |
31233123
| tainted-access-paths.js:31:23:31:30 | obj.sub4 |
3124+
| tainted-access-paths.js:39:7:39:48 | path |
3125+
| tainted-access-paths.js:39:7:39:48 | path |
3126+
| tainted-access-paths.js:39:7:39:48 | path |
3127+
| tainted-access-paths.js:39:7:39:48 | path |
3128+
| tainted-access-paths.js:39:7:39:48 | path |
3129+
| tainted-access-paths.js:39:7:39:48 | path |
3130+
| tainted-access-paths.js:39:7:39:48 | path |
3131+
| tainted-access-paths.js:39:7:39:48 | path |
3132+
| tainted-access-paths.js:39:7:39:48 | path |
3133+
| tainted-access-paths.js:39:7:39:48 | path |
3134+
| tainted-access-paths.js:39:7:39:48 | path |
3135+
| tainted-access-paths.js:39:7:39:48 | path |
3136+
| tainted-access-paths.js:39:7:39:48 | path |
3137+
| tainted-access-paths.js:39:7:39:48 | path |
3138+
| tainted-access-paths.js:39:7:39:48 | path |
3139+
| tainted-access-paths.js:39:7:39:48 | path |
3140+
| tainted-access-paths.js:39:14:39:37 | url.par ... , true) |
3141+
| tainted-access-paths.js:39:14:39:37 | url.par ... , true) |
3142+
| tainted-access-paths.js:39:14:39:37 | url.par ... , true) |
3143+
| tainted-access-paths.js:39:14:39:37 | url.par ... , true) |
3144+
| tainted-access-paths.js:39:14:39:37 | url.par ... , true) |
3145+
| tainted-access-paths.js:39:14:39:37 | url.par ... , true) |
3146+
| tainted-access-paths.js:39:14:39:37 | url.par ... , true) |
3147+
| tainted-access-paths.js:39:14:39:37 | url.par ... , true) |
3148+
| tainted-access-paths.js:39:14:39:37 | url.par ... , true) |
3149+
| tainted-access-paths.js:39:14:39:37 | url.par ... , true) |
3150+
| tainted-access-paths.js:39:14:39:37 | url.par ... , true) |
3151+
| tainted-access-paths.js:39:14:39:37 | url.par ... , true) |
3152+
| tainted-access-paths.js:39:14:39:37 | url.par ... , true) |
3153+
| tainted-access-paths.js:39:14:39:37 | url.par ... , true) |
3154+
| tainted-access-paths.js:39:14:39:37 | url.par ... , true) |
3155+
| tainted-access-paths.js:39:14:39:37 | url.par ... , true) |
3156+
| tainted-access-paths.js:39:14:39:43 | url.par ... ).query |
3157+
| tainted-access-paths.js:39:14:39:43 | url.par ... ).query |
3158+
| tainted-access-paths.js:39:14:39:43 | url.par ... ).query |
3159+
| tainted-access-paths.js:39:14:39:43 | url.par ... ).query |
3160+
| tainted-access-paths.js:39:14:39:43 | url.par ... ).query |
3161+
| tainted-access-paths.js:39:14:39:43 | url.par ... ).query |
3162+
| tainted-access-paths.js:39:14:39:43 | url.par ... ).query |
3163+
| tainted-access-paths.js:39:14:39:43 | url.par ... ).query |
3164+
| tainted-access-paths.js:39:14:39:43 | url.par ... ).query |
3165+
| tainted-access-paths.js:39:14:39:43 | url.par ... ).query |
3166+
| tainted-access-paths.js:39:14:39:43 | url.par ... ).query |
3167+
| tainted-access-paths.js:39:14:39:43 | url.par ... ).query |
3168+
| tainted-access-paths.js:39:14:39:43 | url.par ... ).query |
3169+
| tainted-access-paths.js:39:14:39:43 | url.par ... ).query |
3170+
| tainted-access-paths.js:39:14:39:43 | url.par ... ).query |
3171+
| tainted-access-paths.js:39:14:39:43 | url.par ... ).query |
3172+
| tainted-access-paths.js:39:14:39:48 | url.par ... ry.path |
3173+
| tainted-access-paths.js:39:14:39:48 | url.par ... ry.path |
3174+
| tainted-access-paths.js:39:14:39:48 | url.par ... ry.path |
3175+
| tainted-access-paths.js:39:14:39:48 | url.par ... ry.path |
3176+
| tainted-access-paths.js:39:14:39:48 | url.par ... ry.path |
3177+
| tainted-access-paths.js:39:14:39:48 | url.par ... ry.path |
3178+
| tainted-access-paths.js:39:14:39:48 | url.par ... ry.path |
3179+
| tainted-access-paths.js:39:14:39:48 | url.par ... ry.path |
3180+
| tainted-access-paths.js:39:14:39:48 | url.par ... ry.path |
3181+
| tainted-access-paths.js:39:14:39:48 | url.par ... ry.path |
3182+
| tainted-access-paths.js:39:14:39:48 | url.par ... ry.path |
3183+
| tainted-access-paths.js:39:14:39:48 | url.par ... ry.path |
3184+
| tainted-access-paths.js:39:14:39:48 | url.par ... ry.path |
3185+
| tainted-access-paths.js:39:14:39:48 | url.par ... ry.path |
3186+
| tainted-access-paths.js:39:14:39:48 | url.par ... ry.path |
3187+
| tainted-access-paths.js:39:14:39:48 | url.par ... ry.path |
3188+
| tainted-access-paths.js:39:24:39:30 | req.url |
3189+
| tainted-access-paths.js:39:24:39:30 | req.url |
3190+
| tainted-access-paths.js:39:24:39:30 | req.url |
3191+
| tainted-access-paths.js:39:24:39:30 | req.url |
3192+
| tainted-access-paths.js:39:24:39:30 | req.url |
3193+
| tainted-access-paths.js:40:23:40:26 | path |
3194+
| tainted-access-paths.js:40:23:40:26 | path |
3195+
| tainted-access-paths.js:40:23:40:26 | path |
3196+
| tainted-access-paths.js:40:23:40:26 | path |
3197+
| tainted-access-paths.js:40:23:40:26 | path |
3198+
| tainted-access-paths.js:40:23:40:26 | path |
3199+
| tainted-access-paths.js:40:23:40:26 | path |
3200+
| tainted-access-paths.js:40:23:40:26 | path |
3201+
| tainted-access-paths.js:40:23:40:26 | path |
3202+
| tainted-access-paths.js:40:23:40:26 | path |
3203+
| tainted-access-paths.js:40:23:40:26 | path |
3204+
| tainted-access-paths.js:40:23:40:26 | path |
3205+
| tainted-access-paths.js:40:23:40:26 | path |
3206+
| tainted-access-paths.js:40:23:40:26 | path |
3207+
| tainted-access-paths.js:40:23:40:26 | path |
3208+
| tainted-access-paths.js:40:23:40:26 | path |
3209+
| tainted-access-paths.js:40:23:40:26 | path |
31243210
| tainted-require.js:7:19:7:37 | req.param("module") |
31253211
| tainted-require.js:7:19:7:37 | req.param("module") |
31263212
| tainted-require.js:7:19:7:37 | req.param("module") |
@@ -8501,6 +8587,118 @@ edges
85018587
| tainted-access-paths.js:31:23:31:25 | obj | tainted-access-paths.js:31:23:31:30 | obj.sub4 |
85028588
| tainted-access-paths.js:31:23:31:25 | obj | tainted-access-paths.js:31:23:31:30 | obj.sub4 |
85038589
| tainted-access-paths.js:31:23:31:25 | obj | tainted-access-paths.js:31:23:31:30 | obj.sub4 |
8590+
| tainted-access-paths.js:39:7:39:48 | path | tainted-access-paths.js:40:23:40:26 | path |
8591+
| tainted-access-paths.js:39:7:39:48 | path | tainted-access-paths.js:40:23:40:26 | path |
8592+
| tainted-access-paths.js:39:7:39:48 | path | tainted-access-paths.js:40:23:40:26 | path |
8593+
| tainted-access-paths.js:39:7:39:48 | path | tainted-access-paths.js:40:23:40:26 | path |
8594+
| tainted-access-paths.js:39:7:39:48 | path | tainted-access-paths.js:40:23:40:26 | path |
8595+
| tainted-access-paths.js:39:7:39:48 | path | tainted-access-paths.js:40:23:40:26 | path |
8596+
| tainted-access-paths.js:39:7:39:48 | path | tainted-access-paths.js:40:23:40:26 | path |
8597+
| tainted-access-paths.js:39:7:39:48 | path | tainted-access-paths.js:40:23:40:26 | path |
8598+
| tainted-access-paths.js:39:7:39:48 | path | tainted-access-paths.js:40:23:40:26 | path |
8599+
| tainted-access-paths.js:39:7:39:48 | path | tainted-access-paths.js:40:23:40:26 | path |
8600+
| tainted-access-paths.js:39:7:39:48 | path | tainted-access-paths.js:40:23:40:26 | path |
8601+
| tainted-access-paths.js:39:7:39:48 | path | tainted-access-paths.js:40:23:40:26 | path |
8602+
| tainted-access-paths.js:39:7:39:48 | path | tainted-access-paths.js:40:23:40:26 | path |
8603+
| tainted-access-paths.js:39:7:39:48 | path | tainted-access-paths.js:40:23:40:26 | path |
8604+
| tainted-access-paths.js:39:7:39:48 | path | tainted-access-paths.js:40:23:40:26 | path |
8605+
| tainted-access-paths.js:39:7:39:48 | path | tainted-access-paths.js:40:23:40:26 | path |
8606+
| tainted-access-paths.js:39:7:39:48 | path | tainted-access-paths.js:40:23:40:26 | path |
8607+
| tainted-access-paths.js:39:7:39:48 | path | tainted-access-paths.js:40:23:40:26 | path |
8608+
| tainted-access-paths.js:39:7:39:48 | path | tainted-access-paths.js:40:23:40:26 | path |
8609+
| tainted-access-paths.js:39:7:39:48 | path | tainted-access-paths.js:40:23:40:26 | path |
8610+
| tainted-access-paths.js:39:7:39:48 | path | tainted-access-paths.js:40:23:40:26 | path |
8611+
| tainted-access-paths.js:39:7:39:48 | path | tainted-access-paths.js:40:23:40:26 | path |
8612+
| tainted-access-paths.js:39:7:39:48 | path | tainted-access-paths.js:40:23:40:26 | path |
8613+
| tainted-access-paths.js:39:7:39:48 | path | tainted-access-paths.js:40:23:40:26 | path |
8614+
| tainted-access-paths.js:39:7:39:48 | path | tainted-access-paths.js:40:23:40:26 | path |
8615+
| tainted-access-paths.js:39:7:39:48 | path | tainted-access-paths.js:40:23:40:26 | path |
8616+
| tainted-access-paths.js:39:7:39:48 | path | tainted-access-paths.js:40:23:40:26 | path |
8617+
| tainted-access-paths.js:39:7:39:48 | path | tainted-access-paths.js:40:23:40:26 | path |
8618+
| tainted-access-paths.js:39:7:39:48 | path | tainted-access-paths.js:40:23:40:26 | path |
8619+
| tainted-access-paths.js:39:7:39:48 | path | tainted-access-paths.js:40:23:40:26 | path |
8620+
| tainted-access-paths.js:39:7:39:48 | path | tainted-access-paths.js:40:23:40:26 | path |
8621+
| tainted-access-paths.js:39:7:39:48 | path | tainted-access-paths.js:40:23:40:26 | path |
8622+
| tainted-access-paths.js:39:14:39:37 | url.par ... , true) | tainted-access-paths.js:39:14:39:43 | url.par ... ).query |
8623+
| tainted-access-paths.js:39:14:39:37 | url.par ... , true) | tainted-access-paths.js:39:14:39:43 | url.par ... ).query |
8624+
| tainted-access-paths.js:39:14:39:37 | url.par ... , true) | tainted-access-paths.js:39:14:39:43 | url.par ... ).query |
8625+
| tainted-access-paths.js:39:14:39:37 | url.par ... , true) | tainted-access-paths.js:39:14:39:43 | url.par ... ).query |
8626+
| tainted-access-paths.js:39:14:39:37 | url.par ... , true) | tainted-access-paths.js:39:14:39:43 | url.par ... ).query |
8627+
| tainted-access-paths.js:39:14:39:37 | url.par ... , true) | tainted-access-paths.js:39:14:39:43 | url.par ... ).query |
8628+
| tainted-access-paths.js:39:14:39:37 | url.par ... , true) | tainted-access-paths.js:39:14:39:43 | url.par ... ).query |
8629+
| tainted-access-paths.js:39:14:39:37 | url.par ... , true) | tainted-access-paths.js:39:14:39:43 | url.par ... ).query |
8630+
| tainted-access-paths.js:39:14:39:37 | url.par ... , true) | tainted-access-paths.js:39:14:39:43 | url.par ... ).query |
8631+
| tainted-access-paths.js:39:14:39:37 | url.par ... , true) | tainted-access-paths.js:39:14:39:43 | url.par ... ).query |
8632+
| tainted-access-paths.js:39:14:39:37 | url.par ... , true) | tainted-access-paths.js:39:14:39:43 | url.par ... ).query |
8633+
| tainted-access-paths.js:39:14:39:37 | url.par ... , true) | tainted-access-paths.js:39:14:39:43 | url.par ... ).query |
8634+
| tainted-access-paths.js:39:14:39:37 | url.par ... , true) | tainted-access-paths.js:39:14:39:43 | url.par ... ).query |
8635+
| tainted-access-paths.js:39:14:39:37 | url.par ... , true) | tainted-access-paths.js:39:14:39:43 | url.par ... ).query |
8636+
| tainted-access-paths.js:39:14:39:37 | url.par ... , true) | tainted-access-paths.js:39:14:39:43 | url.par ... ).query |
8637+
| tainted-access-paths.js:39:14:39:37 | url.par ... , true) | tainted-access-paths.js:39:14:39:43 | url.par ... ).query |
8638+
| tainted-access-paths.js:39:14:39:43 | url.par ... ).query | tainted-access-paths.js:39:14:39:48 | url.par ... ry.path |
8639+
| tainted-access-paths.js:39:14:39:43 | url.par ... ).query | tainted-access-paths.js:39:14:39:48 | url.par ... ry.path |
8640+
| tainted-access-paths.js:39:14:39:43 | url.par ... ).query | tainted-access-paths.js:39:14:39:48 | url.par ... ry.path |
8641+
| tainted-access-paths.js:39:14:39:43 | url.par ... ).query | tainted-access-paths.js:39:14:39:48 | url.par ... ry.path |
8642+
| tainted-access-paths.js:39:14:39:43 | url.par ... ).query | tainted-access-paths.js:39:14:39:48 | url.par ... ry.path |
8643+
| tainted-access-paths.js:39:14:39:43 | url.par ... ).query | tainted-access-paths.js:39:14:39:48 | url.par ... ry.path |
8644+
| tainted-access-paths.js:39:14:39:43 | url.par ... ).query | tainted-access-paths.js:39:14:39:48 | url.par ... ry.path |
8645+
| tainted-access-paths.js:39:14:39:43 | url.par ... ).query | tainted-access-paths.js:39:14:39:48 | url.par ... ry.path |
8646+
| tainted-access-paths.js:39:14:39:43 | url.par ... ).query | tainted-access-paths.js:39:14:39:48 | url.par ... ry.path |
8647+
| tainted-access-paths.js:39:14:39:43 | url.par ... ).query | tainted-access-paths.js:39:14:39:48 | url.par ... ry.path |
8648+
| tainted-access-paths.js:39:14:39:43 | url.par ... ).query | tainted-access-paths.js:39:14:39:48 | url.par ... ry.path |
8649+
| tainted-access-paths.js:39:14:39:43 | url.par ... ).query | tainted-access-paths.js:39:14:39:48 | url.par ... ry.path |
8650+
| tainted-access-paths.js:39:14:39:43 | url.par ... ).query | tainted-access-paths.js:39:14:39:48 | url.par ... ry.path |
8651+
| tainted-access-paths.js:39:14:39:43 | url.par ... ).query | tainted-access-paths.js:39:14:39:48 | url.par ... ry.path |
8652+
| tainted-access-paths.js:39:14:39:43 | url.par ... ).query | tainted-access-paths.js:39:14:39:48 | url.par ... ry.path |
8653+
| tainted-access-paths.js:39:14:39:43 | url.par ... ).query | tainted-access-paths.js:39:14:39:48 | url.par ... ry.path |
8654+
| tainted-access-paths.js:39:14:39:48 | url.par ... ry.path | tainted-access-paths.js:39:7:39:48 | path |
8655+
| tainted-access-paths.js:39:14:39:48 | url.par ... ry.path | tainted-access-paths.js:39:7:39:48 | path |
8656+
| tainted-access-paths.js:39:14:39:48 | url.par ... ry.path | tainted-access-paths.js:39:7:39:48 | path |
8657+
| tainted-access-paths.js:39:14:39:48 | url.par ... ry.path | tainted-access-paths.js:39:7:39:48 | path |
8658+
| tainted-access-paths.js:39:14:39:48 | url.par ... ry.path | tainted-access-paths.js:39:7:39:48 | path |
8659+
| tainted-access-paths.js:39:14:39:48 | url.par ... ry.path | tainted-access-paths.js:39:7:39:48 | path |
8660+
| tainted-access-paths.js:39:14:39:48 | url.par ... ry.path | tainted-access-paths.js:39:7:39:48 | path |
8661+
| tainted-access-paths.js:39:14:39:48 | url.par ... ry.path | tainted-access-paths.js:39:7:39:48 | path |
8662+
| tainted-access-paths.js:39:14:39:48 | url.par ... ry.path | tainted-access-paths.js:39:7:39:48 | path |
8663+
| tainted-access-paths.js:39:14:39:48 | url.par ... ry.path | tainted-access-paths.js:39:7:39:48 | path |
8664+
| tainted-access-paths.js:39:14:39:48 | url.par ... ry.path | tainted-access-paths.js:39:7:39:48 | path |
8665+
| tainted-access-paths.js:39:14:39:48 | url.par ... ry.path | tainted-access-paths.js:39:7:39:48 | path |
8666+
| tainted-access-paths.js:39:14:39:48 | url.par ... ry.path | tainted-access-paths.js:39:7:39:48 | path |
8667+
| tainted-access-paths.js:39:14:39:48 | url.par ... ry.path | tainted-access-paths.js:39:7:39:48 | path |
8668+
| tainted-access-paths.js:39:14:39:48 | url.par ... ry.path | tainted-access-paths.js:39:7:39:48 | path |
8669+
| tainted-access-paths.js:39:14:39:48 | url.par ... ry.path | tainted-access-paths.js:39:7:39:48 | path |
8670+
| tainted-access-paths.js:39:24:39:30 | req.url | tainted-access-paths.js:39:14:39:37 | url.par ... , true) |
8671+
| tainted-access-paths.js:39:24:39:30 | req.url | tainted-access-paths.js:39:14:39:37 | url.par ... , true) |
8672+
| tainted-access-paths.js:39:24:39:30 | req.url | tainted-access-paths.js:39:14:39:37 | url.par ... , true) |
8673+
| tainted-access-paths.js:39:24:39:30 | req.url | tainted-access-paths.js:39:14:39:37 | url.par ... , true) |
8674+
| tainted-access-paths.js:39:24:39:30 | req.url | tainted-access-paths.js:39:14:39:37 | url.par ... , true) |
8675+
| tainted-access-paths.js:39:24:39:30 | req.url | tainted-access-paths.js:39:14:39:37 | url.par ... , true) |
8676+
| tainted-access-paths.js:39:24:39:30 | req.url | tainted-access-paths.js:39:14:39:37 | url.par ... , true) |
8677+
| tainted-access-paths.js:39:24:39:30 | req.url | tainted-access-paths.js:39:14:39:37 | url.par ... , true) |
8678+
| tainted-access-paths.js:39:24:39:30 | req.url | tainted-access-paths.js:39:14:39:37 | url.par ... , true) |
8679+
| tainted-access-paths.js:39:24:39:30 | req.url | tainted-access-paths.js:39:14:39:37 | url.par ... , true) |
8680+
| tainted-access-paths.js:39:24:39:30 | req.url | tainted-access-paths.js:39:14:39:37 | url.par ... , true) |
8681+
| tainted-access-paths.js:39:24:39:30 | req.url | tainted-access-paths.js:39:14:39:37 | url.par ... , true) |
8682+
| tainted-access-paths.js:39:24:39:30 | req.url | tainted-access-paths.js:39:14:39:37 | url.par ... , true) |
8683+
| tainted-access-paths.js:39:24:39:30 | req.url | tainted-access-paths.js:39:14:39:37 | url.par ... , true) |
8684+
| tainted-access-paths.js:39:24:39:30 | req.url | tainted-access-paths.js:39:14:39:37 | url.par ... , true) |
8685+
| tainted-access-paths.js:39:24:39:30 | req.url | tainted-access-paths.js:39:14:39:37 | url.par ... , true) |
8686+
| tainted-access-paths.js:39:24:39:30 | req.url | tainted-access-paths.js:39:14:39:37 | url.par ... , true) |
8687+
| tainted-access-paths.js:39:24:39:30 | req.url | tainted-access-paths.js:39:14:39:37 | url.par ... , true) |
8688+
| tainted-access-paths.js:39:24:39:30 | req.url | tainted-access-paths.js:39:14:39:37 | url.par ... , true) |
8689+
| tainted-access-paths.js:39:24:39:30 | req.url | tainted-access-paths.js:39:14:39:37 | url.par ... , true) |
8690+
| tainted-access-paths.js:39:24:39:30 | req.url | tainted-access-paths.js:39:14:39:37 | url.par ... , true) |
8691+
| tainted-access-paths.js:39:24:39:30 | req.url | tainted-access-paths.js:39:14:39:37 | url.par ... , true) |
8692+
| tainted-access-paths.js:39:24:39:30 | req.url | tainted-access-paths.js:39:14:39:37 | url.par ... , true) |
8693+
| tainted-access-paths.js:39:24:39:30 | req.url | tainted-access-paths.js:39:14:39:37 | url.par ... , true) |
8694+
| tainted-access-paths.js:39:24:39:30 | req.url | tainted-access-paths.js:39:14:39:37 | url.par ... , true) |
8695+
| tainted-access-paths.js:39:24:39:30 | req.url | tainted-access-paths.js:39:14:39:37 | url.par ... , true) |
8696+
| tainted-access-paths.js:39:24:39:30 | req.url | tainted-access-paths.js:39:14:39:37 | url.par ... , true) |
8697+
| tainted-access-paths.js:39:24:39:30 | req.url | tainted-access-paths.js:39:14:39:37 | url.par ... , true) |
8698+
| tainted-access-paths.js:39:24:39:30 | req.url | tainted-access-paths.js:39:14:39:37 | url.par ... , true) |
8699+
| tainted-access-paths.js:39:24:39:30 | req.url | tainted-access-paths.js:39:14:39:37 | url.par ... , true) |
8700+
| tainted-access-paths.js:39:24:39:30 | req.url | tainted-access-paths.js:39:14:39:37 | url.par ... , true) |
8701+
| tainted-access-paths.js:39:24:39:30 | req.url | tainted-access-paths.js:39:14:39:37 | url.par ... , true) |
85048702
| tainted-require.js:7:19:7:37 | req.param("module") | tainted-require.js:7:19:7:37 | req.param("module") |
85058703
| tainted-require.js:12:29:12:47 | req.param("module") | tainted-require.js:12:29:12:47 | req.param("module") |
85068704
| tainted-require.js:14:11:14:29 | req.param("module") | tainted-require.js:14:11:14:29 | req.param("module") |
@@ -9739,6 +9937,7 @@ edges
97399937
| tainted-access-paths.js:29:21:29:28 | obj.sub4 | tainted-access-paths.js:6:24:6:30 | req.url | tainted-access-paths.js:29:21:29:28 | obj.sub4 | This path depends on $@. | tainted-access-paths.js:6:24:6:30 | req.url | a user-provided value |
97409938
| tainted-access-paths.js:30:23:30:30 | obj.sub4 | tainted-access-paths.js:6:24:6:30 | req.url | tainted-access-paths.js:30:23:30:30 | obj.sub4 | This path depends on $@. | tainted-access-paths.js:6:24:6:30 | req.url | a user-provided value |
97419939
| tainted-access-paths.js:31:23:31:30 | obj.sub4 | tainted-access-paths.js:6:24:6:30 | req.url | tainted-access-paths.js:31:23:31:30 | obj.sub4 | This path depends on $@. | tainted-access-paths.js:6:24:6:30 | req.url | a user-provided value |
9940+
| tainted-access-paths.js:40:23:40:26 | path | tainted-access-paths.js:39:24:39:30 | req.url | tainted-access-paths.js:40:23:40:26 | path | This path depends on $@. | tainted-access-paths.js:39:24:39:30 | req.url | a user-provided value |
97429941
| tainted-require.js:7:19:7:37 | req.param("module") | tainted-require.js:7:19:7:37 | req.param("module") | tainted-require.js:7:19:7:37 | req.param("module") | This path depends on $@. | tainted-require.js:7:19:7:37 | req.param("module") | a user-provided value |
97439942
| tainted-require.js:12:29:12:47 | req.param("module") | tainted-require.js:12:29:12:47 | req.param("module") | tainted-require.js:12:29:12:47 | req.param("module") | This path depends on $@. | tainted-require.js:12:29:12:47 | req.param("module") | a user-provided value |
97449943
| tainted-require.js:14:11:14:29 | req.param("module") | tainted-require.js:14:11:14:29 | req.param("module") | tainted-require.js:14:11:14:29 | req.param("module") | This path depends on $@. | tainted-require.js:14:11:14:29 | req.param("module") | a user-provided value |

‎javascript/ql/test/query-tests/Security/CWE-022/TaintedPath/tainted-access-paths.js

Lines changed: 10 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,4 @@
1-
var fs = require('node:fs'),
1+
var fs = require('fs'),
22
http = require('http'),
33
url = require('url');
44

@@ -32,3 +32,12 @@ var server = http.createServer(function(req, res) {
3232
});
3333

3434
server.listen();
35+
36+
var nodefs = require('node:fs');
37+
38+
var server2 = http.createServer(function(req, res) {
39+
let path = url.parse(req.url, true).query.path;
40+
nodefs.readFileSync(path); // NOT OK
41+
});
42+
43+
server2.listen();

0 commit comments

Comments
 (0)