Skip to content

Commit b209fc6

Browse files
erik-krogherik-krogh
committed
test the change to hardcoded-credentials
1 parent d9e8e0e commit b209fc6

File tree

2 files changed

+20
-12
lines changed

2 files changed

+20
-12
lines changed

‎javascript/ql/test/query-tests/Security/CWE-798/HardcodedCredentials.expected

Lines changed: 14 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -153,12 +153,12 @@ nodes
153153
| HardcodedCredentials.js:135:41:135:50 | "hgfedcba" |
154154
| HardcodedCredentials.js:135:41:135:50 | "hgfedcba" |
155155
| HardcodedCredentials.js:135:41:135:50 | "hgfedcba" |
156-
| HardcodedCredentials.js:160:38:160:48 | "change_me" |
157-
| HardcodedCredentials.js:160:38:160:48 | "change_me" |
158-
| HardcodedCredentials.js:160:38:160:48 | "change_me" |
159-
| HardcodedCredentials.js:161:41:161:51 | 'change_me' |
160-
| HardcodedCredentials.js:161:41:161:51 | 'change_me' |
161-
| HardcodedCredentials.js:161:41:161:51 | 'change_me' |
156+
| HardcodedCredentials.js:160:38:160:56 | "oiuneawrgiyubaegr" |
157+
| HardcodedCredentials.js:160:38:160:56 | "oiuneawrgiyubaegr" |
158+
| HardcodedCredentials.js:160:38:160:56 | "oiuneawrgiyubaegr" |
159+
| HardcodedCredentials.js:161:41:161:59 | 'oiuneawrgiyubaegr' |
160+
| HardcodedCredentials.js:161:41:161:59 | 'oiuneawrgiyubaegr' |
161+
| HardcodedCredentials.js:161:41:161:59 | 'oiuneawrgiyubaegr' |
162162
| HardcodedCredentials.js:164:35:164:45 | 'change_me' |
163163
| HardcodedCredentials.js:164:35:164:45 | 'change_me' |
164164
| HardcodedCredentials.js:164:35:164:45 | 'change_me' |
@@ -271,6 +271,9 @@ nodes
271271
| HardcodedCredentials.js:295:37:295:66 | `Basic ... 000001` |
272272
| HardcodedCredentials.js:295:37:295:66 | `Basic ... 000001` |
273273
| HardcodedCredentials.js:295:37:295:66 | `Basic ... 000001` |
274+
| HardcodedCredentials.js:299:44:299:52 | 'mytoken' |
275+
| HardcodedCredentials.js:299:44:299:52 | 'mytoken' |
276+
| HardcodedCredentials.js:299:44:299:52 | 'mytoken' |
274277
edges
275278
| HardcodedCredentials.js:5:15:5:22 | 'dbuser' | HardcodedCredentials.js:5:15:5:22 | 'dbuser' |
276279
| HardcodedCredentials.js:8:19:8:28 | 'hgfedcba' | HardcodedCredentials.js:8:19:8:28 | 'hgfedcba' |
@@ -326,8 +329,8 @@ edges
326329
| HardcodedCredentials.js:130:44:130:53 | 'hgfedcba' | HardcodedCredentials.js:130:44:130:53 | 'hgfedcba' |
327330
| HardcodedCredentials.js:131:52:131:61 | 'hgfedcba' | HardcodedCredentials.js:131:52:131:61 | 'hgfedcba' |
328331
| HardcodedCredentials.js:135:41:135:50 | "hgfedcba" | HardcodedCredentials.js:135:41:135:50 | "hgfedcba" |
329-
| HardcodedCredentials.js:160:38:160:48 | "change_me" | HardcodedCredentials.js:160:38:160:48 | "change_me" |
330-
| HardcodedCredentials.js:161:41:161:51 | 'change_me' | HardcodedCredentials.js:161:41:161:51 | 'change_me' |
332+
| HardcodedCredentials.js:160:38:160:56 | "oiuneawrgiyubaegr" | HardcodedCredentials.js:160:38:160:56 | "oiuneawrgiyubaegr" |
333+
| HardcodedCredentials.js:161:41:161:59 | 'oiuneawrgiyubaegr' | HardcodedCredentials.js:161:41:161:59 | 'oiuneawrgiyubaegr' |
331334
| HardcodedCredentials.js:164:35:164:45 | 'change_me' | HardcodedCredentials.js:164:35:164:45 | 'change_me' |
332335
| HardcodedCredentials.js:171:11:171:25 | USER | HardcodedCredentials.js:173:35:173:38 | USER |
333336
| HardcodedCredentials.js:171:18:171:25 | 'sdsdag' | HardcodedCredentials.js:171:11:171:25 | USER |
@@ -399,6 +402,7 @@ edges
399402
| HardcodedCredentials.js:293:37:293:65 | `Basic ... xxxxxx` | HardcodedCredentials.js:293:37:293:65 | `Basic ... xxxxxx` |
400403
| HardcodedCredentials.js:294:37:294:70 | `Basic ... gbbbbb` | HardcodedCredentials.js:294:37:294:70 | `Basic ... gbbbbb` |
401404
| HardcodedCredentials.js:295:37:295:66 | `Basic ... 000001` | HardcodedCredentials.js:295:37:295:66 | `Basic ... 000001` |
405+
| HardcodedCredentials.js:299:44:299:52 | 'mytoken' | HardcodedCredentials.js:299:44:299:52 | 'mytoken' |
402406
#select
403407
| HardcodedCredentials.js:5:15:5:22 | 'dbuser' | HardcodedCredentials.js:5:15:5:22 | 'dbuser' | HardcodedCredentials.js:5:15:5:22 | 'dbuser' | The hard-coded value "dbuser" is used as $@. | HardcodedCredentials.js:5:15:5:22 | 'dbuser' | user name |
404408
| HardcodedCredentials.js:8:19:8:28 | 'hgfedcba' | HardcodedCredentials.js:8:19:8:28 | 'hgfedcba' | HardcodedCredentials.js:8:19:8:28 | 'hgfedcba' | The hard-coded value "hgfedcba" is used as $@. | HardcodedCredentials.js:8:19:8:28 | 'hgfedcba' | password |
@@ -448,8 +452,8 @@ edges
448452
| HardcodedCredentials.js:130:44:130:53 | 'hgfedcba' | HardcodedCredentials.js:130:44:130:53 | 'hgfedcba' | HardcodedCredentials.js:130:44:130:53 | 'hgfedcba' | The hard-coded value "hgfedcba" is used as $@. | HardcodedCredentials.js:130:44:130:53 | 'hgfedcba' | key |
449453
| HardcodedCredentials.js:131:52:131:61 | 'hgfedcba' | HardcodedCredentials.js:131:52:131:61 | 'hgfedcba' | HardcodedCredentials.js:131:52:131:61 | 'hgfedcba' | The hard-coded value "hgfedcba" is used as $@. | HardcodedCredentials.js:131:52:131:61 | 'hgfedcba' | key |
450454
| HardcodedCredentials.js:135:41:135:50 | "hgfedcba" | HardcodedCredentials.js:135:41:135:50 | "hgfedcba" | HardcodedCredentials.js:135:41:135:50 | "hgfedcba" | The hard-coded value "hgfedcba" is used as $@. | HardcodedCredentials.js:135:41:135:50 | "hgfedcba" | key |
451-
| HardcodedCredentials.js:160:38:160:48 | "change_me" | HardcodedCredentials.js:160:38:160:48 | "change_me" | HardcodedCredentials.js:160:38:160:48 | "change_me" | The hard-coded value "change_me" is used as $@. | HardcodedCredentials.js:160:38:160:48 | "change_me" | key |
452-
| HardcodedCredentials.js:161:41:161:51 | 'change_me' | HardcodedCredentials.js:161:41:161:51 | 'change_me' | HardcodedCredentials.js:161:41:161:51 | 'change_me' | The hard-coded value "change_me" is used as $@. | HardcodedCredentials.js:161:41:161:51 | 'change_me' | key |
455+
| HardcodedCredentials.js:160:38:160:56 | "oiuneawrgiyubaegr" | HardcodedCredentials.js:160:38:160:56 | "oiuneawrgiyubaegr" | HardcodedCredentials.js:160:38:160:56 | "oiuneawrgiyubaegr" | The hard-coded value "oiuneawrgiyubaegr" is used as $@. | HardcodedCredentials.js:160:38:160:56 | "oiuneawrgiyubaegr" | key |
456+
| HardcodedCredentials.js:161:41:161:59 | 'oiuneawrgiyubaegr' | HardcodedCredentials.js:161:41:161:59 | 'oiuneawrgiyubaegr' | HardcodedCredentials.js:161:41:161:59 | 'oiuneawrgiyubaegr' | The hard-coded value "oiuneawrgiyubaegr" is used as $@. | HardcodedCredentials.js:161:41:161:59 | 'oiuneawrgiyubaegr' | key |
453457
| HardcodedCredentials.js:171:18:171:25 | 'sdsdag' | HardcodedCredentials.js:171:18:171:25 | 'sdsdag' | HardcodedCredentials.js:178:30:178:44 | `Basic ${AUTH}` | The hard-coded value "sdsdag" is used as $@. | HardcodedCredentials.js:178:30:178:44 | `Basic ${AUTH}` | authorization header |
454458
| HardcodedCredentials.js:171:18:171:25 | 'sdsdag' | HardcodedCredentials.js:171:18:171:25 | 'sdsdag' | HardcodedCredentials.js:188:30:188:44 | `Basic ${AUTH}` | The hard-coded value "sdsdag" is used as $@. | HardcodedCredentials.js:188:30:188:44 | `Basic ${AUTH}` | authorization header |
455459
| HardcodedCredentials.js:171:18:171:25 | 'sdsdag' | HardcodedCredentials.js:171:18:171:25 | 'sdsdag' | HardcodedCredentials.js:195:37:195:51 | `Basic ${AUTH}` | The hard-coded value "sdsdag" is used as $@. | HardcodedCredentials.js:195:37:195:51 | `Basic ${AUTH}` | authorization header |

‎javascript/ql/test/query-tests/Security/CWE-798/HardcodedCredentials.js

Lines changed: 6 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -157,8 +157,8 @@
157157
})();
158158

159159
(function(){
160-
require("cookie-session")({ secret: "change_me" }); // NOT OK
161-
require('crypto').createHmac('sha256', 'change_me'); // NOT OK
160+
require("cookie-session")({ secret: "oiuneawrgiyubaegr" }); // NOT OK
161+
require('crypto').createHmac('sha256', 'oiuneawrgiyubaegr'); // NOT OK
162162

163163
var basicAuth = require('express-basic-auth');
164164
basicAuth({users: { [adminName]: 'change_me' }}); // OK
@@ -294,3 +294,7 @@
294294
headers.append("Authorization", `Basic sdsdag:aaaiuogrweuibgbbbbb`); // NOT OK
295295
headers.append("Authorization", `Basic sdsdag:000000000000001`); // OK
296296
});
297+
298+
(function () {
299+
require('crypto').createHmac('sha256', 'mytoken'); // OK
300+
})();

0 commit comments

Comments
 (0)