Skip to content

Commit eafef91

Browse files
committed
JS: Update test output after ExtendCall restriction
1 parent 0247606 commit eafef91

File tree

2 files changed

+0
-25
lines changed

2 files changed

+0
-25
lines changed
Lines changed: 0 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,2 +1 @@
11
| query-tests/Security/CWE-915/PrototypePollutingAssignment/tst.js:120 | did not expect an alert, but found an alert for PrototypePollutingAssignment | OK - 'object' is not Object.prototype itself (but possibly a copy) | PrototypePollutingAssignment |
2-
| query-tests/Security/CWE-915/PrototypePollutingAssignment/tst.js:124 | did not expect an alert, but found an alert for PrototypePollutingAssignment | OK - 'dest' is not Object.prototype itself (but possibly a copy) | PrototypePollutingAssignment |

javascript/ql/test/query-tests/Security/CWE-915/PrototypePollutingAssignment/PrototypePollutingAssignment.expected

Lines changed: 0 additions & 24 deletions
Original file line numberDiff line numberDiff line change
@@ -196,20 +196,10 @@ nodes
196196
| tst.js:116:24:116:37 | req.query.data |
197197
| tst.js:119:9:119:51 | object |
198198
| tst.js:119:18:119:51 | Object. ... taint]) |
199-
| tst.js:119:32:119:33 | {} |
200-
| tst.js:119:32:119:33 | {} |
201199
| tst.js:119:36:119:50 | plainObj[taint] |
202200
| tst.js:119:45:119:49 | taint |
203201
| tst.js:120:5:120:10 | object |
204202
| tst.js:120:5:120:10 | object |
205-
| tst.js:122:9:122:17 | dest |
206-
| tst.js:122:16:122:17 | {} |
207-
| tst.js:123:19:123:22 | dest |
208-
| tst.js:123:19:123:22 | dest |
209-
| tst.js:123:25:123:39 | plainObj[taint] |
210-
| tst.js:123:34:123:38 | taint |
211-
| tst.js:124:5:124:8 | dest |
212-
| tst.js:124:5:124:8 | dest |
213203
edges
214204
| lib.js:1:38:1:40 | obj | lib.js:6:7:6:9 | obj |
215205
| lib.js:1:38:1:40 | obj | lib.js:6:7:6:9 | obj |
@@ -387,25 +377,14 @@ edges
387377
| tst.js:105:12:105:16 | taint | tst.js:105:5:105:17 | object[taint] |
388378
| tst.js:105:12:105:16 | taint | tst.js:105:5:105:17 | object[taint] |
389379
| tst.js:116:9:116:38 | taint | tst.js:119:45:119:49 | taint |
390-
| tst.js:116:9:116:38 | taint | tst.js:123:34:123:38 | taint |
391380
| tst.js:116:17:116:38 | String( ... y.data) | tst.js:116:9:116:38 | taint |
392381
| tst.js:116:24:116:37 | req.query.data | tst.js:116:17:116:38 | String( ... y.data) |
393382
| tst.js:116:24:116:37 | req.query.data | tst.js:116:17:116:38 | String( ... y.data) |
394383
| tst.js:119:9:119:51 | object | tst.js:120:5:120:10 | object |
395384
| tst.js:119:9:119:51 | object | tst.js:120:5:120:10 | object |
396385
| tst.js:119:18:119:51 | Object. ... taint]) | tst.js:119:9:119:51 | object |
397-
| tst.js:119:32:119:33 | {} | tst.js:119:18:119:51 | Object. ... taint]) |
398386
| tst.js:119:36:119:50 | plainObj[taint] | tst.js:119:18:119:51 | Object. ... taint]) |
399-
| tst.js:119:36:119:50 | plainObj[taint] | tst.js:119:32:119:33 | {} |
400-
| tst.js:119:36:119:50 | plainObj[taint] | tst.js:119:32:119:33 | {} |
401387
| tst.js:119:45:119:49 | taint | tst.js:119:36:119:50 | plainObj[taint] |
402-
| tst.js:122:9:122:17 | dest | tst.js:123:19:123:22 | dest |
403-
| tst.js:122:9:122:17 | dest | tst.js:123:19:123:22 | dest |
404-
| tst.js:122:9:122:17 | dest | tst.js:124:5:124:8 | dest |
405-
| tst.js:122:9:122:17 | dest | tst.js:124:5:124:8 | dest |
406-
| tst.js:122:16:122:17 | {} | tst.js:122:9:122:17 | dest |
407-
| tst.js:123:25:123:39 | plainObj[taint] | tst.js:122:16:122:17 | {} |
408-
| tst.js:123:34:123:38 | taint | tst.js:123:25:123:39 | plainObj[taint] |
409388
#select
410389
| lib.js:6:7:6:9 | obj | lib.js:1:43:1:46 | path | lib.js:6:7:6:9 | obj | This assignment may alter Object.prototype if a malicious '__proto__' string is injected from $@. | lib.js:1:43:1:46 | path | library input |
411390
| lib.js:15:3:15:14 | obj[path[0]] | lib.js:14:38:14:41 | path | lib.js:15:3:15:14 | obj[path[0]] | This assignment may alter Object.prototype if a malicious '__proto__' string is injected from $@. | lib.js:14:38:14:41 | path | library input |
@@ -434,7 +413,4 @@ edges
434413
| tst.js:94:5:94:37 | obj[req ... ', '')] | tst.js:94:9:94:19 | req.query.x | tst.js:94:5:94:37 | obj[req ... ', '')] | This assignment may alter Object.prototype if a malicious '__proto__' string is injected from $@. | tst.js:94:9:94:19 | req.query.x | user controlled input |
435414
| tst.js:97:5:97:46 | obj[req ... g, '')] | tst.js:97:9:97:19 | req.query.x | tst.js:97:5:97:46 | obj[req ... g, '')] | This assignment may alter Object.prototype if a malicious '__proto__' string is injected from $@. | tst.js:97:9:97:19 | req.query.x | user controlled input |
436415
| tst.js:105:5:105:17 | object[taint] | tst.js:102:24:102:37 | req.query.data | tst.js:105:5:105:17 | object[taint] | This assignment may alter Object.prototype if a malicious '__proto__' string is injected from $@. | tst.js:102:24:102:37 | req.query.data | user controlled input |
437-
| tst.js:119:32:119:33 | {} | tst.js:116:24:116:37 | req.query.data | tst.js:119:32:119:33 | {} | This assignment may alter Object.prototype if a malicious '__proto__' string is injected from $@. | tst.js:116:24:116:37 | req.query.data | user controlled input |
438416
| tst.js:120:5:120:10 | object | tst.js:116:24:116:37 | req.query.data | tst.js:120:5:120:10 | object | This assignment may alter Object.prototype if a malicious '__proto__' string is injected from $@. | tst.js:116:24:116:37 | req.query.data | user controlled input |
439-
| tst.js:123:19:123:22 | dest | tst.js:116:24:116:37 | req.query.data | tst.js:123:19:123:22 | dest | This assignment may alter Object.prototype if a malicious '__proto__' string is injected from $@. | tst.js:116:24:116:37 | req.query.data | user controlled input |
440-
| tst.js:124:5:124:8 | dest | tst.js:116:24:116:37 | req.query.data | tst.js:124:5:124:8 | dest | This assignment may alter Object.prototype if a malicious '__proto__' string is injected from $@. | tst.js:116:24:116:37 | req.query.data | user controlled input |

0 commit comments

Comments
 (0)