add test for unsafe-code-construction query

Author: erik-krogh

javascript/ql/test/query-tests/Security/CWE-094/CodeInjection/UnsafeCodeConstruction.expected

@@ -0,0 +1,21 @@
+nodes
+| lib/index.js:1:35:1:38 | data |
+| lib/index.js:1:35:1:38 | data |
+| lib/index.js:2:21:2:24 | data |
+| lib/index.js:2:21:2:24 | data |
+| lib/index.js:5:35:5:38 | name |
+| lib/index.js:5:35:5:38 | name |
+| lib/index.js:6:26:6:29 | name |
+| lib/index.js:6:26:6:29 | name |
+edges
+| lib/index.js:1:35:1:38 | data | lib/index.js:2:21:2:24 | data |
+| lib/index.js:1:35:1:38 | data | lib/index.js:2:21:2:24 | data |
+| lib/index.js:1:35:1:38 | data | lib/index.js:2:21:2:24 | data |
+| lib/index.js:1:35:1:38 | data | lib/index.js:2:21:2:24 | data |
+| lib/index.js:5:35:5:38 | name | lib/index.js:6:26:6:29 | name |
+| lib/index.js:5:35:5:38 | name | lib/index.js:6:26:6:29 | name |
+| lib/index.js:5:35:5:38 | name | lib/index.js:6:26:6:29 | name |
+| lib/index.js:5:35:5:38 | name | lib/index.js:6:26:6:29 | name |
+#select
+| lib/index.js:2:21:2:24 | data | lib/index.js:1:35:1:38 | data | lib/index.js:2:21:2:24 | data | $@ flows to here and is later $@. | lib/index.js:1:35:1:38 | data | Library input | lib/index.js:2:15:2:30 | "(" + data + ")" | interpreted as code |
+| lib/index.js:6:26:6:29 | name | lib/index.js:5:35:5:38 | name | lib/index.js:6:26:6:29 | name | $@ flows to here and is later $@. | lib/index.js:5:35:5:38 | name | Library input | lib/index.js:6:17:6:29 | "obj." + name | interpreted as code |

javascript/ql/test/query-tests/Security/CWE-094/CodeInjection/UnsafeCodeConstruction.qlref

@@ -0,0 +1 @@
+Security/CWE-094/UnsafeCodeConstruction.ql

javascript/ql/test/query-tests/Security/CWE-094/CodeInjection/lib/index.js

@@ -0,0 +1,11 @@
+export function unsafeDeserialize(data) {
+  return eval("(" + data + ")"); // NOT OK
+}
+
+export function unsafeGetter(obj, name) {
+    return eval("obj." + name); // NOT OK
+}
+
+export function safeAssignment(obj, value) {
+    eval("obj.foo = " + JSON.stringify(value)); // OK
+}

javascript/ql/test/query-tests/Security/CWE-094/CodeInjection/lib/package.json

@@ -0,0 +1,5 @@
+{
+    "name": "my-lib",
+    "version": "0.0.7",
+    "main": "index.js"
+}