Skip to content

Commit be8ef1b

Browse files
erik-krogherik-krogh
committed
add failing test
1 parent 45aaeb8 commit be8ef1b

File tree

2 files changed

+56
-0
lines changed

2 files changed

+56
-0
lines changed

‎javascript/ql/test/query-tests/Security/CWE-918/RequestForgery.expected

Lines changed: 40 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -88,6 +88,25 @@ nodes
8888
| serverSide.js:115:25:115:35 | request.url |
8989
| serverSide.js:117:27:117:29 | url |
9090
| serverSide.js:117:27:117:29 | url |
91+
| serverSide.js:123:9:123:52 | tainted |
92+
| serverSide.js:123:19:123:42 | url.par ... , true) |
93+
| serverSide.js:123:19:123:48 | url.par ... ).query |
94+
| serverSide.js:123:19:123:52 | url.par ... ery.url |
95+
| serverSide.js:123:29:123:35 | req.url |
96+
| serverSide.js:123:29:123:35 | req.url |
97+
| serverSide.js:127:14:127:20 | tainted |
98+
| serverSide.js:127:14:127:20 | tainted |
99+
| serverSide.js:130:9:130:45 | myUrl |
100+
| serverSide.js:130:17:130:45 | `${some ... inted}` |
101+
| serverSide.js:130:37:130:43 | tainted |
102+
| serverSide.js:131:15:131:19 | myUrl |
103+
| serverSide.js:131:15:131:19 | myUrl |
104+
| serverSide.js:133:9:133:72 | myEncodedUrl |
105+
| serverSide.js:133:24:133:72 | `${some ... nted)}` |
106+
| serverSide.js:133:44:133:70 | encodeU ... ainted) |
107+
| serverSide.js:133:63:133:69 | tainted |
108+
| serverSide.js:134:15:134:26 | myEncodedUrl |
109+
| serverSide.js:134:15:134:26 | myEncodedUrl |
91110
edges
92111
| serverSide.js:14:9:14:52 | tainted | serverSide.js:18:13:18:19 | tainted |
93112
| serverSide.js:14:9:14:52 | tainted | serverSide.js:18:13:18:19 | tainted |
@@ -172,6 +191,24 @@ edges
172191
| serverSide.js:115:17:115:42 | new URL ... , base) | serverSide.js:115:11:115:42 | url |
173192
| serverSide.js:115:25:115:35 | request.url | serverSide.js:115:17:115:42 | new URL ... , base) |
174193
| serverSide.js:115:25:115:35 | request.url | serverSide.js:115:17:115:42 | new URL ... , base) |
194+
| serverSide.js:123:9:123:52 | tainted | serverSide.js:127:14:127:20 | tainted |
195+
| serverSide.js:123:9:123:52 | tainted | serverSide.js:127:14:127:20 | tainted |
196+
| serverSide.js:123:9:123:52 | tainted | serverSide.js:130:37:130:43 | tainted |
197+
| serverSide.js:123:9:123:52 | tainted | serverSide.js:133:63:133:69 | tainted |
198+
| serverSide.js:123:19:123:42 | url.par ... , true) | serverSide.js:123:19:123:48 | url.par ... ).query |
199+
| serverSide.js:123:19:123:48 | url.par ... ).query | serverSide.js:123:19:123:52 | url.par ... ery.url |
200+
| serverSide.js:123:19:123:52 | url.par ... ery.url | serverSide.js:123:9:123:52 | tainted |
201+
| serverSide.js:123:29:123:35 | req.url | serverSide.js:123:19:123:42 | url.par ... , true) |
202+
| serverSide.js:123:29:123:35 | req.url | serverSide.js:123:19:123:42 | url.par ... , true) |
203+
| serverSide.js:130:9:130:45 | myUrl | serverSide.js:131:15:131:19 | myUrl |
204+
| serverSide.js:130:9:130:45 | myUrl | serverSide.js:131:15:131:19 | myUrl |
205+
| serverSide.js:130:17:130:45 | `${some ... inted}` | serverSide.js:130:9:130:45 | myUrl |
206+
| serverSide.js:130:37:130:43 | tainted | serverSide.js:130:17:130:45 | `${some ... inted}` |
207+
| serverSide.js:133:9:133:72 | myEncodedUrl | serverSide.js:134:15:134:26 | myEncodedUrl |
208+
| serverSide.js:133:9:133:72 | myEncodedUrl | serverSide.js:134:15:134:26 | myEncodedUrl |
209+
| serverSide.js:133:24:133:72 | `${some ... nted)}` | serverSide.js:133:9:133:72 | myEncodedUrl |
210+
| serverSide.js:133:44:133:70 | encodeU ... ainted) | serverSide.js:133:24:133:72 | `${some ... nted)}` |
211+
| serverSide.js:133:63:133:69 | tainted | serverSide.js:133:44:133:70 | encodeU ... ainted) |
175212
#select
176213
| serverSide.js:18:5:18:20 | request(tainted) | serverSide.js:14:29:14:35 | req.url | serverSide.js:18:13:18:19 | tainted | The $@ of this request depends on a $@. | serverSide.js:18:13:18:19 | tainted | URL | serverSide.js:14:29:14:35 | req.url | user-provided value |
177214
| serverSide.js:20:5:20:24 | request.get(tainted) | serverSide.js:14:29:14:35 | req.url | serverSide.js:20:17:20:23 | tainted | The $@ of this request depends on a $@. | serverSide.js:20:17:20:23 | tainted | URL | serverSide.js:14:29:14:35 | req.url | user-provided value |
@@ -195,3 +232,6 @@ edges
195232
| serverSide.js:100:5:100:26 | new Web ... ainted) | serverSide.js:98:29:98:35 | req.url | serverSide.js:100:19:100:25 | tainted | The $@ of this request depends on a $@. | serverSide.js:100:19:100:25 | tainted | URL | serverSide.js:98:29:98:35 | req.url | user-provided value |
196233
| serverSide.js:109:20:109:30 | new ws(url) | serverSide.js:108:17:108:27 | request.url | serverSide.js:109:27:109:29 | url | The $@ of this request depends on a $@. | serverSide.js:109:27:109:29 | url | URL | serverSide.js:108:17:108:27 | request.url | user-provided value |
197234
| serverSide.js:117:20:117:30 | new ws(url) | serverSide.js:115:25:115:35 | request.url | serverSide.js:117:27:117:29 | url | The $@ of this request depends on a $@. | serverSide.js:117:27:117:29 | url | URL | serverSide.js:115:25:115:35 | request.url | user-provided value |
235+
| serverSide.js:125:5:128:6 | axios({ ... \\n }) | serverSide.js:123:29:123:35 | req.url | serverSide.js:127:14:127:20 | tainted | The $@ of this request depends on a $@. | serverSide.js:127:14:127:20 | tainted | URL | serverSide.js:123:29:123:35 | req.url | user-provided value |
236+
| serverSide.js:131:5:131:20 | axios.get(myUrl) | serverSide.js:123:29:123:35 | req.url | serverSide.js:131:15:131:19 | myUrl | The $@ of this request depends on a $@. | serverSide.js:131:15:131:19 | myUrl | URL | serverSide.js:123:29:123:35 | req.url | user-provided value |
237+
| serverSide.js:134:5:134:27 | axios.g ... dedUrl) | serverSide.js:123:29:123:35 | req.url | serverSide.js:134:15:134:26 | myEncodedUrl | The $@ of this request depends on a $@. | serverSide.js:134:15:134:26 | myEncodedUrl | URL | serverSide.js:123:29:123:35 | req.url | user-provided value |

‎javascript/ql/test/query-tests/Security/CWE-918/serverSide.js

Lines changed: 16 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -117,3 +117,19 @@ new ws.Server({ port: 8080 }).on('connection', function (socket, request) {
117117
const socket = new ws(url);
118118
});
119119
});
120+
121+
122+
var server2 = http.createServer(function(req, res) {
123+
var tainted = url.parse(req.url, true).query.url;
124+
125+
axios({
126+
method: 'get',
127+
url: tainted // NOT OK
128+
})
129+
130+
var myUrl = `${something}/bla/${tainted}`;
131+
axios.get(myUrl); // NOT OK
132+
133+
var myEncodedUrl = `${something}/bla/${encodeURIComponent(tainted)}`;
134+
axios.get(myEncodedUrl); // OK - but still flagged [INCONSISTENCY]
135+
})

0 commit comments

Comments
 (0)