Skip to content

Commit 78744a0

Browse files
esbenaesbena
committed
add additional tests
1 parent e67c09f commit 78744a0

File tree

2 files changed

+75
-0
lines changed

2 files changed

+75
-0
lines changed

‎javascript/ql/test/query-tests/Security/CWE-798/HardcodedCredentials.expected

Lines changed: 60 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -223,6 +223,42 @@ nodes
223223
| HardcodedCredentials.js:268:39:268:46 | 'Bearer' |
224224
| HardcodedCredentials.js:268:50:268:56 | 'OAuth' |
225225
| HardcodedCredentials.js:268:50:268:56 | 'OAuth' |
226+
| HardcodedCredentials.js:275:36:275:59 | "user:{ ... ERE }}" |
227+
| HardcodedCredentials.js:275:36:275:59 | "user:{ ... ERE }}" |
228+
| HardcodedCredentials.js:275:36:275:59 | "user:{ ... ERE }}" |
229+
| HardcodedCredentials.js:276:36:276:65 | "user:t ... ERE }}" |
230+
| HardcodedCredentials.js:276:36:276:65 | "user:t ... ERE }}" |
231+
| HardcodedCredentials.js:276:36:276:65 | "user:t ... ERE }}" |
232+
| HardcodedCredentials.js:277:36:277:57 | "user:( ... HERE )" |
233+
| HardcodedCredentials.js:277:36:277:57 | "user:( ... HERE )" |
234+
| HardcodedCredentials.js:277:36:277:57 | "user:( ... HERE )" |
235+
| HardcodedCredentials.js:278:36:278:64 | "user:{ ... ken }}" |
236+
| HardcodedCredentials.js:278:36:278:64 | "user:{ ... ken }}" |
237+
| HardcodedCredentials.js:278:36:278:64 | "user:{ ... ken }}" |
238+
| HardcodedCredentials.js:279:36:279:50 | "user:abcdefgh" |
239+
| HardcodedCredentials.js:279:36:279:50 | "user:abcdefgh" |
240+
| HardcodedCredentials.js:279:36:279:50 | "user:abcdefgh" |
241+
| HardcodedCredentials.js:280:36:280:50 | "user:12345678" |
242+
| HardcodedCredentials.js:280:36:280:50 | "user:12345678" |
243+
| HardcodedCredentials.js:280:36:280:50 | "user:12345678" |
244+
| HardcodedCredentials.js:281:36:281:45 | "user:foo" |
245+
| HardcodedCredentials.js:281:36:281:45 | "user:foo" |
246+
| HardcodedCredentials.js:281:36:281:45 | "user:foo" |
247+
| HardcodedCredentials.js:282:36:282:52 | "user:mypassword" |
248+
| HardcodedCredentials.js:282:36:282:52 | "user:mypassword" |
249+
| HardcodedCredentials.js:282:36:282:52 | "user:mypassword" |
250+
| HardcodedCredentials.js:283:36:283:49 | "user:mytoken" |
251+
| HardcodedCredentials.js:283:36:283:49 | "user:mytoken" |
252+
| HardcodedCredentials.js:283:36:283:49 | "user:mytoken" |
253+
| HardcodedCredentials.js:284:36:284:52 | "user:fake token" |
254+
| HardcodedCredentials.js:284:36:284:52 | "user:fake token" |
255+
| HardcodedCredentials.js:284:36:284:52 | "user:fake token" |
256+
| HardcodedCredentials.js:285:36:285:46 | "user:dcba" |
257+
| HardcodedCredentials.js:285:36:285:46 | "user:dcba" |
258+
| HardcodedCredentials.js:285:36:285:46 | "user:dcba" |
259+
| HardcodedCredentials.js:286:36:286:55 | "user:custom string" |
260+
| HardcodedCredentials.js:286:36:286:55 | "user:custom string" |
261+
| HardcodedCredentials.js:286:36:286:55 | "user:custom string" |
226262
edges
227263
| HardcodedCredentials.js:5:15:5:22 | 'dbuser' | HardcodedCredentials.js:5:15:5:22 | 'dbuser' |
228264
| HardcodedCredentials.js:8:19:8:28 | 'hgfedcba' | HardcodedCredentials.js:8:19:8:28 | 'hgfedcba' |
@@ -335,6 +371,18 @@ edges
335371
| HardcodedCredentials.js:268:39:268:46 | 'Bearer' | HardcodedCredentials.js:268:33:268:56 | foo ? ' ... 'OAuth' |
336372
| HardcodedCredentials.js:268:50:268:56 | 'OAuth' | HardcodedCredentials.js:268:33:268:56 | foo ? ' ... 'OAuth' |
337373
| HardcodedCredentials.js:268:50:268:56 | 'OAuth' | HardcodedCredentials.js:268:33:268:56 | foo ? ' ... 'OAuth' |
374+
| HardcodedCredentials.js:275:36:275:59 | "user:{ ... ERE }}" | HardcodedCredentials.js:275:36:275:59 | "user:{ ... ERE }}" |
375+
| HardcodedCredentials.js:276:36:276:65 | "user:t ... ERE }}" | HardcodedCredentials.js:276:36:276:65 | "user:t ... ERE }}" |
376+
| HardcodedCredentials.js:277:36:277:57 | "user:( ... HERE )" | HardcodedCredentials.js:277:36:277:57 | "user:( ... HERE )" |
377+
| HardcodedCredentials.js:278:36:278:64 | "user:{ ... ken }}" | HardcodedCredentials.js:278:36:278:64 | "user:{ ... ken }}" |
378+
| HardcodedCredentials.js:279:36:279:50 | "user:abcdefgh" | HardcodedCredentials.js:279:36:279:50 | "user:abcdefgh" |
379+
| HardcodedCredentials.js:280:36:280:50 | "user:12345678" | HardcodedCredentials.js:280:36:280:50 | "user:12345678" |
380+
| HardcodedCredentials.js:281:36:281:45 | "user:foo" | HardcodedCredentials.js:281:36:281:45 | "user:foo" |
381+
| HardcodedCredentials.js:282:36:282:52 | "user:mypassword" | HardcodedCredentials.js:282:36:282:52 | "user:mypassword" |
382+
| HardcodedCredentials.js:283:36:283:49 | "user:mytoken" | HardcodedCredentials.js:283:36:283:49 | "user:mytoken" |
383+
| HardcodedCredentials.js:284:36:284:52 | "user:fake token" | HardcodedCredentials.js:284:36:284:52 | "user:fake token" |
384+
| HardcodedCredentials.js:285:36:285:46 | "user:dcba" | HardcodedCredentials.js:285:36:285:46 | "user:dcba" |
385+
| HardcodedCredentials.js:286:36:286:55 | "user:custom string" | HardcodedCredentials.js:286:36:286:55 | "user:custom string" |
338386
#select
339387
| HardcodedCredentials.js:5:15:5:22 | 'dbuser' | HardcodedCredentials.js:5:15:5:22 | 'dbuser' | HardcodedCredentials.js:5:15:5:22 | 'dbuser' | The hard-coded value "dbuser" is used as $@. | HardcodedCredentials.js:5:15:5:22 | 'dbuser' | user name |
340388
| HardcodedCredentials.js:8:19:8:28 | 'hgfedcba' | HardcodedCredentials.js:8:19:8:28 | 'hgfedcba' | HardcodedCredentials.js:8:19:8:28 | 'hgfedcba' | The hard-coded value "hgfedcba" is used as $@. | HardcodedCredentials.js:8:19:8:28 | 'hgfedcba' | password |
@@ -401,3 +449,15 @@ edges
401449
| HardcodedCredentials.js:215:18:215:25 | 'sdsdag' | HardcodedCredentials.js:215:18:215:25 | 'sdsdag' | HardcodedCredentials.js:221:37:221:51 | `Basic ${AUTH}` | The hard-coded value "sdsdag" is used as $@. | HardcodedCredentials.js:221:37:221:51 | `Basic ${AUTH}` | authorization header |
402450
| HardcodedCredentials.js:231:22:231:29 | 'sdsdag' | HardcodedCredentials.js:231:22:231:29 | 'sdsdag' | HardcodedCredentials.js:237:24:237:91 | 'Basic ... ase64') | The hard-coded value "sdsdag" is used as $@. | HardcodedCredentials.js:237:24:237:91 | 'Basic ... ase64') | authorization header |
403451
| HardcodedCredentials.js:245:22:245:44 | "myHard ... ateKey" | HardcodedCredentials.js:245:22:245:44 | "myHard ... ateKey" | HardcodedCredentials.js:246:42:246:51 | privateKey | The hard-coded value "myHardCodedPrivateKey" is used as $@. | HardcodedCredentials.js:246:42:246:51 | privateKey | key |
452+
| HardcodedCredentials.js:275:36:275:59 | "user:{ ... ERE }}" | HardcodedCredentials.js:275:36:275:59 | "user:{ ... ERE }}" | HardcodedCredentials.js:275:36:275:59 | "user:{ ... ERE }}" | The hard-coded value "user:{{ INSERT_HERE }}" is used as $@. | HardcodedCredentials.js:275:36:275:59 | "user:{ ... ERE }}" | credentials |
453+
| HardcodedCredentials.js:276:36:276:65 | "user:t ... ERE }}" | HardcodedCredentials.js:276:36:276:65 | "user:t ... ERE }}" | HardcodedCredentials.js:276:36:276:65 | "user:t ... ERE }}" | The hard-coded value "user:token {{ INSERT_HERE }}" is used as $@. | HardcodedCredentials.js:276:36:276:65 | "user:t ... ERE }}" | credentials |
454+
| HardcodedCredentials.js:277:36:277:57 | "user:( ... HERE )" | HardcodedCredentials.js:277:36:277:57 | "user:( ... HERE )" | HardcodedCredentials.js:277:36:277:57 | "user:( ... HERE )" | The hard-coded value "user:( INSERT_HERE )" is used as $@. | HardcodedCredentials.js:277:36:277:57 | "user:( ... HERE )" | credentials |
455+
| HardcodedCredentials.js:278:36:278:64 | "user:{ ... ken }}" | HardcodedCredentials.js:278:36:278:64 | "user:{ ... ken }}" | HardcodedCredentials.js:278:36:278:64 | "user:{ ... ken }}" | The hard-coded value "user:{{ env.access_token }}" is used as $@. | HardcodedCredentials.js:278:36:278:64 | "user:{ ... ken }}" | credentials |
456+
| HardcodedCredentials.js:279:36:279:50 | "user:abcdefgh" | HardcodedCredentials.js:279:36:279:50 | "user:abcdefgh" | HardcodedCredentials.js:279:36:279:50 | "user:abcdefgh" | The hard-coded value "user:abcdefgh" is used as $@. | HardcodedCredentials.js:279:36:279:50 | "user:abcdefgh" | credentials |
457+
| HardcodedCredentials.js:280:36:280:50 | "user:12345678" | HardcodedCredentials.js:280:36:280:50 | "user:12345678" | HardcodedCredentials.js:280:36:280:50 | "user:12345678" | The hard-coded value "user:12345678" is used as $@. | HardcodedCredentials.js:280:36:280:50 | "user:12345678" | credentials |
458+
| HardcodedCredentials.js:281:36:281:45 | "user:foo" | HardcodedCredentials.js:281:36:281:45 | "user:foo" | HardcodedCredentials.js:281:36:281:45 | "user:foo" | The hard-coded value "user:foo" is used as $@. | HardcodedCredentials.js:281:36:281:45 | "user:foo" | credentials |
459+
| HardcodedCredentials.js:282:36:282:52 | "user:mypassword" | HardcodedCredentials.js:282:36:282:52 | "user:mypassword" | HardcodedCredentials.js:282:36:282:52 | "user:mypassword" | The hard-coded value "user:mypassword" is used as $@. | HardcodedCredentials.js:282:36:282:52 | "user:mypassword" | credentials |
460+
| HardcodedCredentials.js:283:36:283:49 | "user:mytoken" | HardcodedCredentials.js:283:36:283:49 | "user:mytoken" | HardcodedCredentials.js:283:36:283:49 | "user:mytoken" | The hard-coded value "user:mytoken" is used as $@. | HardcodedCredentials.js:283:36:283:49 | "user:mytoken" | credentials |
461+
| HardcodedCredentials.js:284:36:284:52 | "user:fake token" | HardcodedCredentials.js:284:36:284:52 | "user:fake token" | HardcodedCredentials.js:284:36:284:52 | "user:fake token" | The hard-coded value "user:fake token" is used as $@. | HardcodedCredentials.js:284:36:284:52 | "user:fake token" | credentials |
462+
| HardcodedCredentials.js:285:36:285:46 | "user:dcba" | HardcodedCredentials.js:285:36:285:46 | "user:dcba" | HardcodedCredentials.js:285:36:285:46 | "user:dcba" | The hard-coded value "user:dcba" is used as $@. | HardcodedCredentials.js:285:36:285:46 | "user:dcba" | credentials |
463+
| HardcodedCredentials.js:286:36:286:55 | "user:custom string" | HardcodedCredentials.js:286:36:286:55 | "user:custom string" | HardcodedCredentials.js:286:36:286:55 | "user:custom string" | The hard-coded value "user:custom string" is used as $@. | HardcodedCredentials.js:286:36:286:55 | "user:custom string" | credentials |

‎javascript/ql/test/query-tests/Security/CWE-798/HardcodedCredentials.js

Lines changed: 15 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -269,4 +269,19 @@
269269
"Content-Type": 'application/json'
270270
})
271271
});
272+
});
273+
274+
(function() {
275+
require("http").request({auth: "user:{{ INSERT_HERE }}"}); // OK
276+
require("http").request({auth: "user:token {{ INSERT_HERE }}"}); // OK
277+
require("http").request({auth: "user:( INSERT_HERE )"}); // OK
278+
require("http").request({auth: "user:{{ env.access_token }}"}); // OK
279+
require("http").request({auth: "user:abcdefgh"}); // OK
280+
require("http").request({auth: "user:12345678"}); // OK
281+
require("http").request({auth: "user:foo"}); // OK
282+
require("http").request({auth: "user:mypassword"}) // OK
283+
require("http").request({auth: "user:mytoken"}) // OK
284+
require("http").request({auth: "user:fake token"}) // OK
285+
require("http").request({auth: "user:dcba"}) // OK
286+
require("http").request({auth: "user:custom string"}) // OK
272287
});

0 commit comments

Comments
 (0)