Skip to content

Commit 0b5c890

Browse files
valeria-melivaleria-meli
committed
tests
1 parent 595ea6c commit 0b5c890

File tree

7 files changed

+428
-0
lines changed

7 files changed

+428
-0
lines changed

‎javascript/ql/test/experimental/Security/CWE-918/SSRF.expected

Lines changed: 176 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,176 @@
1+
nodes
2+
| check-domain.js:16:9:16:27 | url |
3+
| check-domain.js:16:15:16:27 | req.query.url |
4+
| check-domain.js:16:15:16:27 | req.query.url |
5+
| check-domain.js:17:13:17:15 | url |
6+
| check-domain.js:17:13:17:15 | url |
7+
| check-domain.js:26:15:26:27 | req.query.url |
8+
| check-domain.js:26:15:26:27 | req.query.url |
9+
| check-domain.js:26:15:26:27 | req.query.url |
10+
| check-middleware.js:9:13:9:43 | "test.c ... tainted |
11+
| check-middleware.js:9:13:9:43 | "test.c ... tainted |
12+
| check-middleware.js:9:27:9:43 | req.query.tainted |
13+
| check-middleware.js:9:27:9:43 | req.query.tainted |
14+
| check-path.js:19:13:19:43 | 'test.c ... tainted |
15+
| check-path.js:19:13:19:43 | 'test.c ... tainted |
16+
| check-path.js:19:27:19:43 | req.query.tainted |
17+
| check-path.js:19:27:19:43 | req.query.tainted |
18+
| check-path.js:22:13:22:63 | 'test.c ... ainted) |
19+
| check-path.js:22:13:22:63 | 'test.c ... ainted) |
20+
| check-path.js:22:27:22:63 | encodeU ... ainted) |
21+
| check-path.js:22:46:22:62 | req.query.tainted |
22+
| check-path.js:22:46:22:62 | req.query.tainted |
23+
| check-path.js:23:13:23:45 | `/addre ... inted}` |
24+
| check-path.js:23:13:23:45 | `/addre ... inted}` |
25+
| check-path.js:23:27:23:43 | req.query.tainted |
26+
| check-path.js:23:27:23:43 | req.query.tainted |
27+
| check-path.js:24:13:24:65 | `/addre ... nted)}` |
28+
| check-path.js:24:13:24:65 | `/addre ... nted)}` |
29+
| check-path.js:24:27:24:63 | encodeU ... ainted) |
30+
| check-path.js:24:46:24:62 | req.query.tainted |
31+
| check-path.js:24:46:24:62 | req.query.tainted |
32+
| check-path.js:33:15:33:45 | 'test.c ... tainted |
33+
| check-path.js:33:15:33:45 | 'test.c ... tainted |
34+
| check-path.js:33:29:33:45 | req.query.tainted |
35+
| check-path.js:33:29:33:45 | req.query.tainted |
36+
| check-path.js:37:15:37:45 | 'test.c ... tainted |
37+
| check-path.js:37:15:37:45 | 'test.c ... tainted |
38+
| check-path.js:37:29:37:45 | req.query.tainted |
39+
| check-path.js:37:29:37:45 | req.query.tainted |
40+
| check-regex.js:24:15:24:42 | baseURL ... tainted |
41+
| check-regex.js:24:15:24:42 | baseURL ... tainted |
42+
| check-regex.js:24:25:24:42 | req.params.tainted |
43+
| check-regex.js:24:25:24:42 | req.params.tainted |
44+
| check-regex.js:31:15:31:45 | "test.c ... tainted |
45+
| check-regex.js:31:15:31:45 | "test.c ... tainted |
46+
| check-regex.js:31:29:31:45 | req.query.tainted |
47+
| check-regex.js:31:29:31:45 | req.query.tainted |
48+
| check-regex.js:34:15:34:42 | baseURL ... tainted |
49+
| check-regex.js:34:15:34:42 | baseURL ... tainted |
50+
| check-regex.js:34:25:34:42 | req.params.tainted |
51+
| check-regex.js:34:25:34:42 | req.params.tainted |
52+
| check-regex.js:41:13:41:43 | "test.c ... tainted |
53+
| check-regex.js:41:13:41:43 | "test.c ... tainted |
54+
| check-regex.js:41:27:41:43 | req.query.tainted |
55+
| check-regex.js:41:27:41:43 | req.query.tainted |
56+
| check-validator.js:15:15:15:45 | "test.c ... tainted |
57+
| check-validator.js:15:15:15:45 | "test.c ... tainted |
58+
| check-validator.js:15:29:15:45 | req.query.tainted |
59+
| check-validator.js:15:29:15:45 | req.query.tainted |
60+
| check-validator.js:27:15:27:45 | "test.c ... tainted |
61+
| check-validator.js:27:15:27:45 | "test.c ... tainted |
62+
| check-validator.js:27:29:27:45 | req.query.tainted |
63+
| check-validator.js:27:29:27:45 | req.query.tainted |
64+
| check-validator.js:50:15:50:45 | "test.c ... tainted |
65+
| check-validator.js:50:15:50:45 | "test.c ... tainted |
66+
| check-validator.js:50:29:50:45 | req.query.tainted |
67+
| check-validator.js:50:29:50:45 | req.query.tainted |
68+
| check-validator.js:54:9:54:37 | numberURL |
69+
| check-validator.js:54:21:54:37 | req.query.tainted |
70+
| check-validator.js:54:21:54:37 | req.query.tainted |
71+
| check-validator.js:59:15:59:45 | "test.c ... tainted |
72+
| check-validator.js:59:15:59:45 | "test.c ... tainted |
73+
| check-validator.js:59:29:59:45 | req.query.tainted |
74+
| check-validator.js:59:29:59:45 | req.query.tainted |
75+
| check-validator.js:62:15:62:37 | "test.c ... mberURL |
76+
| check-validator.js:62:15:62:37 | "test.c ... mberURL |
77+
| check-validator.js:62:29:62:37 | numberURL |
78+
| check-validator.js:68:15:68:45 | "test.c ... tainted |
79+
| check-validator.js:68:15:68:45 | "test.c ... tainted |
80+
| check-validator.js:68:29:68:45 | req.query.tainted |
81+
| check-validator.js:68:29:68:45 | req.query.tainted |
82+
edges
83+
| check-domain.js:16:9:16:27 | url | check-domain.js:17:13:17:15 | url |
84+
| check-domain.js:16:9:16:27 | url | check-domain.js:17:13:17:15 | url |
85+
| check-domain.js:16:15:16:27 | req.query.url | check-domain.js:16:9:16:27 | url |
86+
| check-domain.js:16:15:16:27 | req.query.url | check-domain.js:16:9:16:27 | url |
87+
| check-domain.js:26:15:26:27 | req.query.url | check-domain.js:26:15:26:27 | req.query.url |
88+
| check-middleware.js:9:27:9:43 | req.query.tainted | check-middleware.js:9:13:9:43 | "test.c ... tainted |
89+
| check-middleware.js:9:27:9:43 | req.query.tainted | check-middleware.js:9:13:9:43 | "test.c ... tainted |
90+
| check-middleware.js:9:27:9:43 | req.query.tainted | check-middleware.js:9:13:9:43 | "test.c ... tainted |
91+
| check-middleware.js:9:27:9:43 | req.query.tainted | check-middleware.js:9:13:9:43 | "test.c ... tainted |
92+
| check-path.js:19:27:19:43 | req.query.tainted | check-path.js:19:13:19:43 | 'test.c ... tainted |
93+
| check-path.js:19:27:19:43 | req.query.tainted | check-path.js:19:13:19:43 | 'test.c ... tainted |
94+
| check-path.js:19:27:19:43 | req.query.tainted | check-path.js:19:13:19:43 | 'test.c ... tainted |
95+
| check-path.js:19:27:19:43 | req.query.tainted | check-path.js:19:13:19:43 | 'test.c ... tainted |
96+
| check-path.js:22:27:22:63 | encodeU ... ainted) | check-path.js:22:13:22:63 | 'test.c ... ainted) |
97+
| check-path.js:22:27:22:63 | encodeU ... ainted) | check-path.js:22:13:22:63 | 'test.c ... ainted) |
98+
| check-path.js:22:46:22:62 | req.query.tainted | check-path.js:22:27:22:63 | encodeU ... ainted) |
99+
| check-path.js:22:46:22:62 | req.query.tainted | check-path.js:22:27:22:63 | encodeU ... ainted) |
100+
| check-path.js:23:27:23:43 | req.query.tainted | check-path.js:23:13:23:45 | `/addre ... inted}` |
101+
| check-path.js:23:27:23:43 | req.query.tainted | check-path.js:23:13:23:45 | `/addre ... inted}` |
102+
| check-path.js:23:27:23:43 | req.query.tainted | check-path.js:23:13:23:45 | `/addre ... inted}` |
103+
| check-path.js:23:27:23:43 | req.query.tainted | check-path.js:23:13:23:45 | `/addre ... inted}` |
104+
| check-path.js:24:27:24:63 | encodeU ... ainted) | check-path.js:24:13:24:65 | `/addre ... nted)}` |
105+
| check-path.js:24:27:24:63 | encodeU ... ainted) | check-path.js:24:13:24:65 | `/addre ... nted)}` |
106+
| check-path.js:24:46:24:62 | req.query.tainted | check-path.js:24:27:24:63 | encodeU ... ainted) |
107+
| check-path.js:24:46:24:62 | req.query.tainted | check-path.js:24:27:24:63 | encodeU ... ainted) |
108+
| check-path.js:33:29:33:45 | req.query.tainted | check-path.js:33:15:33:45 | 'test.c ... tainted |
109+
| check-path.js:33:29:33:45 | req.query.tainted | check-path.js:33:15:33:45 | 'test.c ... tainted |
110+
| check-path.js:33:29:33:45 | req.query.tainted | check-path.js:33:15:33:45 | 'test.c ... tainted |
111+
| check-path.js:33:29:33:45 | req.query.tainted | check-path.js:33:15:33:45 | 'test.c ... tainted |
112+
| check-path.js:37:29:37:45 | req.query.tainted | check-path.js:37:15:37:45 | 'test.c ... tainted |
113+
| check-path.js:37:29:37:45 | req.query.tainted | check-path.js:37:15:37:45 | 'test.c ... tainted |
114+
| check-path.js:37:29:37:45 | req.query.tainted | check-path.js:37:15:37:45 | 'test.c ... tainted |
115+
| check-path.js:37:29:37:45 | req.query.tainted | check-path.js:37:15:37:45 | 'test.c ... tainted |
116+
| check-regex.js:24:25:24:42 | req.params.tainted | check-regex.js:24:15:24:42 | baseURL ... tainted |
117+
| check-regex.js:24:25:24:42 | req.params.tainted | check-regex.js:24:15:24:42 | baseURL ... tainted |
118+
| check-regex.js:24:25:24:42 | req.params.tainted | check-regex.js:24:15:24:42 | baseURL ... tainted |
119+
| check-regex.js:24:25:24:42 | req.params.tainted | check-regex.js:24:15:24:42 | baseURL ... tainted |
120+
| check-regex.js:31:29:31:45 | req.query.tainted | check-regex.js:31:15:31:45 | "test.c ... tainted |
121+
| check-regex.js:31:29:31:45 | req.query.tainted | check-regex.js:31:15:31:45 | "test.c ... tainted |
122+
| check-regex.js:31:29:31:45 | req.query.tainted | check-regex.js:31:15:31:45 | "test.c ... tainted |
123+
| check-regex.js:31:29:31:45 | req.query.tainted | check-regex.js:31:15:31:45 | "test.c ... tainted |
124+
| check-regex.js:34:25:34:42 | req.params.tainted | check-regex.js:34:15:34:42 | baseURL ... tainted |
125+
| check-regex.js:34:25:34:42 | req.params.tainted | check-regex.js:34:15:34:42 | baseURL ... tainted |
126+
| check-regex.js:34:25:34:42 | req.params.tainted | check-regex.js:34:15:34:42 | baseURL ... tainted |
127+
| check-regex.js:34:25:34:42 | req.params.tainted | check-regex.js:34:15:34:42 | baseURL ... tainted |
128+
| check-regex.js:41:27:41:43 | req.query.tainted | check-regex.js:41:13:41:43 | "test.c ... tainted |
129+
| check-regex.js:41:27:41:43 | req.query.tainted | check-regex.js:41:13:41:43 | "test.c ... tainted |
130+
| check-regex.js:41:27:41:43 | req.query.tainted | check-regex.js:41:13:41:43 | "test.c ... tainted |
131+
| check-regex.js:41:27:41:43 | req.query.tainted | check-regex.js:41:13:41:43 | "test.c ... tainted |
132+
| check-validator.js:15:29:15:45 | req.query.tainted | check-validator.js:15:15:15:45 | "test.c ... tainted |
133+
| check-validator.js:15:29:15:45 | req.query.tainted | check-validator.js:15:15:15:45 | "test.c ... tainted |
134+
| check-validator.js:15:29:15:45 | req.query.tainted | check-validator.js:15:15:15:45 | "test.c ... tainted |
135+
| check-validator.js:15:29:15:45 | req.query.tainted | check-validator.js:15:15:15:45 | "test.c ... tainted |
136+
| check-validator.js:27:29:27:45 | req.query.tainted | check-validator.js:27:15:27:45 | "test.c ... tainted |
137+
| check-validator.js:27:29:27:45 | req.query.tainted | check-validator.js:27:15:27:45 | "test.c ... tainted |
138+
| check-validator.js:27:29:27:45 | req.query.tainted | check-validator.js:27:15:27:45 | "test.c ... tainted |
139+
| check-validator.js:27:29:27:45 | req.query.tainted | check-validator.js:27:15:27:45 | "test.c ... tainted |
140+
| check-validator.js:50:29:50:45 | req.query.tainted | check-validator.js:50:15:50:45 | "test.c ... tainted |
141+
| check-validator.js:50:29:50:45 | req.query.tainted | check-validator.js:50:15:50:45 | "test.c ... tainted |
142+
| check-validator.js:50:29:50:45 | req.query.tainted | check-validator.js:50:15:50:45 | "test.c ... tainted |
143+
| check-validator.js:50:29:50:45 | req.query.tainted | check-validator.js:50:15:50:45 | "test.c ... tainted |
144+
| check-validator.js:54:9:54:37 | numberURL | check-validator.js:62:29:62:37 | numberURL |
145+
| check-validator.js:54:21:54:37 | req.query.tainted | check-validator.js:54:9:54:37 | numberURL |
146+
| check-validator.js:54:21:54:37 | req.query.tainted | check-validator.js:54:9:54:37 | numberURL |
147+
| check-validator.js:59:29:59:45 | req.query.tainted | check-validator.js:59:15:59:45 | "test.c ... tainted |
148+
| check-validator.js:59:29:59:45 | req.query.tainted | check-validator.js:59:15:59:45 | "test.c ... tainted |
149+
| check-validator.js:59:29:59:45 | req.query.tainted | check-validator.js:59:15:59:45 | "test.c ... tainted |
150+
| check-validator.js:59:29:59:45 | req.query.tainted | check-validator.js:59:15:59:45 | "test.c ... tainted |
151+
| check-validator.js:62:29:62:37 | numberURL | check-validator.js:62:15:62:37 | "test.c ... mberURL |
152+
| check-validator.js:62:29:62:37 | numberURL | check-validator.js:62:15:62:37 | "test.c ... mberURL |
153+
| check-validator.js:68:29:68:45 | req.query.tainted | check-validator.js:68:15:68:45 | "test.c ... tainted |
154+
| check-validator.js:68:29:68:45 | req.query.tainted | check-validator.js:68:15:68:45 | "test.c ... tainted |
155+
| check-validator.js:68:29:68:45 | req.query.tainted | check-validator.js:68:15:68:45 | "test.c ... tainted |
156+
| check-validator.js:68:29:68:45 | req.query.tainted | check-validator.js:68:15:68:45 | "test.c ... tainted |
157+
#select
158+
| check-domain.js:17:13:17:15 | url | check-domain.js:16:15:16:27 | req.query.url | check-domain.js:17:13:17:15 | url | The URL of this request depends on a user-provided value |
159+
| check-domain.js:26:15:26:27 | req.query.url | check-domain.js:26:15:26:27 | req.query.url | check-domain.js:26:15:26:27 | req.query.url | The URL of this request depends on a user-provided value |
160+
| check-middleware.js:9:13:9:43 | "test.c ... tainted | check-middleware.js:9:27:9:43 | req.query.tainted | check-middleware.js:9:13:9:43 | "test.c ... tainted | The URL of this request depends on a user-provided value |
161+
| check-path.js:19:13:19:43 | 'test.c ... tainted | check-path.js:19:27:19:43 | req.query.tainted | check-path.js:19:13:19:43 | 'test.c ... tainted | The URL of this request depends on a user-provided value |
162+
| check-path.js:22:13:22:63 | 'test.c ... ainted) | check-path.js:22:46:22:62 | req.query.tainted | check-path.js:22:13:22:63 | 'test.c ... ainted) | The URL of this request depends on a user-provided value |
163+
| check-path.js:23:13:23:45 | `/addre ... inted}` | check-path.js:23:27:23:43 | req.query.tainted | check-path.js:23:13:23:45 | `/addre ... inted}` | The URL of this request depends on a user-provided value |
164+
| check-path.js:24:13:24:65 | `/addre ... nted)}` | check-path.js:24:46:24:62 | req.query.tainted | check-path.js:24:13:24:65 | `/addre ... nted)}` | The URL of this request depends on a user-provided value |
165+
| check-path.js:33:15:33:45 | 'test.c ... tainted | check-path.js:33:29:33:45 | req.query.tainted | check-path.js:33:15:33:45 | 'test.c ... tainted | The URL of this request depends on a user-provided value |
166+
| check-path.js:37:15:37:45 | 'test.c ... tainted | check-path.js:37:29:37:45 | req.query.tainted | check-path.js:37:15:37:45 | 'test.c ... tainted | The URL of this request depends on a user-provided value |
167+
| check-regex.js:24:15:24:42 | baseURL ... tainted | check-regex.js:24:25:24:42 | req.params.tainted | check-regex.js:24:15:24:42 | baseURL ... tainted | The URL of this request depends on a user-provided value |
168+
| check-regex.js:31:15:31:45 | "test.c ... tainted | check-regex.js:31:29:31:45 | req.query.tainted | check-regex.js:31:15:31:45 | "test.c ... tainted | The URL of this request depends on a user-provided value |
169+
| check-regex.js:34:15:34:42 | baseURL ... tainted | check-regex.js:34:25:34:42 | req.params.tainted | check-regex.js:34:15:34:42 | baseURL ... tainted | The URL of this request depends on a user-provided value |
170+
| check-regex.js:41:13:41:43 | "test.c ... tainted | check-regex.js:41:27:41:43 | req.query.tainted | check-regex.js:41:13:41:43 | "test.c ... tainted | The URL of this request depends on a user-provided value |
171+
| check-validator.js:15:15:15:45 | "test.c ... tainted | check-validator.js:15:29:15:45 | req.query.tainted | check-validator.js:15:15:15:45 | "test.c ... tainted | The URL of this request depends on a user-provided value |
172+
| check-validator.js:27:15:27:45 | "test.c ... tainted | check-validator.js:27:29:27:45 | req.query.tainted | check-validator.js:27:15:27:45 | "test.c ... tainted | The URL of this request depends on a user-provided value |
173+
| check-validator.js:50:15:50:45 | "test.c ... tainted | check-validator.js:50:29:50:45 | req.query.tainted | check-validator.js:50:15:50:45 | "test.c ... tainted | The URL of this request depends on a user-provided value |
174+
| check-validator.js:59:15:59:45 | "test.c ... tainted | check-validator.js:59:29:59:45 | req.query.tainted | check-validator.js:59:15:59:45 | "test.c ... tainted | The URL of this request depends on a user-provided value |
175+
| check-validator.js:62:15:62:37 | "test.c ... mberURL | check-validator.js:54:21:54:37 | req.query.tainted | check-validator.js:62:15:62:37 | "test.c ... mberURL | The URL of this request depends on a user-provided value |
176+
| check-validator.js:68:15:68:45 | "test.c ... tainted | check-validator.js:68:29:68:45 | req.query.tainted | check-validator.js:68:15:68:45 | "test.c ... tainted | The URL of this request depends on a user-provided value |

‎javascript/ql/test/experimental/Security/CWE-918/SSRF.qlref

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1 @@
1+
./experimental/Security/CWE-918/SSRF.ql

‎javascript/ql/test/experimental/Security/CWE-918/check-domain.js

Lines changed: 34 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,34 @@
1+
// native modules
2+
const url = require('url');
3+
4+
// dependencies
5+
const axios = require('axios');
6+
const express = require('express');
7+
8+
// constants
9+
const VALID_DOMAINS = ['example.com', 'example-2.com'];
10+
11+
// start
12+
const app = express();
13+
14+
app.get('/check-with-axios', req => {
15+
// without validation
16+
const url = req.query.url;
17+
axios.get(url); //SSRF
18+
19+
// validating domain only
20+
const decodedURI = decodeURIComponent(req.query.url);
21+
const { hostname } = url.parse(decodedURI);
22+
23+
const { hostname } = url.parse(decodedURI);
24+
25+
if (isValidDomain(hostname, validDomains)) {
26+
axios.get(req.query.url); //SSRF
27+
}
28+
});
29+
30+
const isValidDomain = (hostname, validDomains) => (
31+
validDomains.some(domain => (
32+
hostname === domain || hostname.endsWith(`.${domain}`))
33+
)
34+
);

‎javascript/ql/test/experimental/Security/CWE-918/check-middleware.js

Lines changed: 19 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,19 @@
1+
// dependencies
2+
const axios = require('axios');
3+
const express = require('express');
4+
5+
// start
6+
const app = express();
7+
8+
app.get('/check-with-axios', validationMiddleware, req => {
9+
axios.get("test.com/" + req.query.tainted); // OK is sanitized by the middleware - False Positive
10+
});
11+
12+
13+
const validationMiddleware = (req, res, next) => {
14+
if (!Number.isInteger(req.query.tainted)) {
15+
return res.sendStatus(400);
16+
}
17+
18+
next();
19+
}

‎javascript/ql/test/experimental/Security/CWE-918/check-path.js

Lines changed: 54 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,54 @@
1+
// native modules
2+
const path = require('path');
3+
const url = require('url');
4+
5+
// dependencies
6+
const axios = require('axios');
7+
const express = require('express');
8+
9+
// constants
10+
const VALID_PATHS = ['/api/users/me', '/help', '/system/health'];
11+
12+
// start
13+
const app = express();
14+
15+
app.get('/check-with-axios', req => {
16+
const hardcoded = 'hardcodeado';
17+
18+
axios.get('test.com/' + hardcoded); // OK
19+
axios.get('test.com/' + req.query.tainted); // SSRF
20+
axios.get('test.com/' + Number(req.query.tainted)); // OK
21+
axios.get('test.com/' + req.user.id); // OK
22+
axios.get('test.com/' + encodeURIComponent(req.query.tainted)); // SSRF
23+
axios.get(`/addresses/${req.query.tainted}`); // SSRF
24+
axios.get(`/addresses/${encodeURIComponent(req.query.tainted)}`); // SSRF
25+
26+
if (Number.isInteger(req.query.tainted)) {
27+
axios.get('test.com/' + req.query.tainted); // OK
28+
}
29+
30+
if (isValidInput(req.query.tainted)){
31+
axios.get('test.com/' + req.query.tainted); // OK
32+
} else {
33+
axios.get('test.com/' + req.query.tainted); // SSRF
34+
}
35+
36+
if (doesntCheckAnything(req.query.tainted)) {
37+
axios.get('test.com/' + req.query.tainted); // SSRF
38+
}
39+
40+
if (isValidPath(req.query.tainted, VALID_PATHS)) {
41+
axios.get('test.com/' + req.query.tainted) // OK
42+
}
43+
44+
if(!isValidInput(req.query.tainted)) {
45+
return;
46+
}
47+
axios.get("test.com/" + req.query.tainted); // OK
48+
});
49+
50+
const isValidPath = (path, validPaths) => validPaths.includes(path);
51+
52+
const isValidInput = (path) => Number.isInteger(path);
53+
54+
const doesntCheckAnything = (path) => true;

‎javascript/ql/test/experimental/Security/CWE-918/check-regex.js

Lines changed: 46 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,46 @@
1+
// dependencies
2+
const axios = require('axios');
3+
const express = require('express');
4+
5+
// start
6+
const app = express();
7+
8+
app.get('/check-with-axios', req => {
9+
if (req.query.tainted.match(/^[0-9a-z]+$/)) { // letters and numbers
10+
axios.get("test.com/" + req.query.tainted); // OK
11+
}
12+
if (req.query.tainted.match(/^[0-9a-z\-_]+$/)) { // letters, numbers, - and _
13+
axios.get("test.com/" + req.query.tainted); // OK
14+
}
15+
if (req.query.tainted.match(/^.*$/)) { // anything
16+
axios.get("test.com/" + req.query.tainted); // SSRF - False Negative
17+
}
18+
19+
const baseURL = "test.com/"
20+
if (isValidPath(req.params.tainted) ) {
21+
axios.get(baseURL + req.params.tainted); // OK
22+
}
23+
if (!isValidPath(req.params.tainted) ) {
24+
axios.get(baseURL + req.params.tainted); // SSRF
25+
} else {
26+
axios.get(baseURL + req.params.tainted); // OK
27+
}
28+
29+
// Blacklists are not safe
30+
if (!req.query.tainted.match(/^[/\.%]+$/)) {
31+
axios.get("test.com/" + req.query.tainted); // SSRF
32+
}
33+
if (!isInBlacklist(req.params.tainted) ) {
34+
axios.get(baseURL + req.params.tainted); // SSRF
35+
}
36+
37+
if (!isValidPath(req.params.tainted)) {
38+
return;
39+
}
40+
41+
axios.get("test.com/" + req.query.tainted); // OK - False Positive
42+
});
43+
44+
const isValidPath = path => path.match(/^[0-9a-z]+$/);
45+
46+
const isInBlackList = path => path.match(/^[/\.%]+$/);

0 commit comments

Comments
 (0)