Skip to content

Commit 2c74dc2

Browse files
am0o0am0o0
committed
add second order command execution sinks to tests
1 parent a20ca78 commit 2c74dc2

File tree

2 files changed

+71
-67
lines changed

2 files changed

+71
-67
lines changed

‎javascript/ql/test/library-tests/frameworks/Execa/Execa.expected

Lines changed: 61 additions & 61 deletions
Original file line numberDiff line numberDiff line change
@@ -1,68 +1,68 @@
11
test_FileSystemAccess
2-
| tst.js:18:9:18:23 | { shell: true } |
3-
| tst.js:20:9:20:24 | { shell: false } |
4-
| tst.js:24:13:24:22 | 'aCommand' |
5-
| tst.js:24:25:24:36 | ['example1'] |
6-
| tst.js:26:13:26:18 | 'echo' |
7-
| tst.js:26:21:26:32 | ['example1'] |
8-
| tst.js:28:13:28:47 | 'echo e ... ple 11' |
9-
| tst.js:28:50:28:64 | { shell: true } |
10-
| tst.js:29:13:29:29 | 'echo example 10' |
11-
| tst.js:29:32:29:52 | ['; ech ... le 11'] |
12-
| tst.js:29:55:29:69 | { shell: true } |
13-
| tst.js:32:11:32:16 | 'echo' |
14-
| tst.js:32:19:32:35 | ['example5 sync'] |
15-
| tst.js:34:20:34:42 | "echo " ... gument" |
16-
| tst.js:35:20:35:52 | `echo $ ... ndSync` |
17-
| tst.js:37:18:37:20 | arg |
18-
| tst.js:39:18:39:39 | "echo 1 ... echo 2" |
19-
| tst.js:39:42:39:56 | { shell: true } |
20-
| tst.js:45:9:45:27 | { inputFile: file } |
21-
| tst.js:46:13:46:17 | 'cat' |
22-
| tst.js:46:20:46:38 | { inputFile: file } |
23-
| tst.js:47:13:47:18 | 'echo' |
24-
| tst.js:47:21:47:32 | ['example2'] |
25-
| tst.js:48:13:48:18 | 'echo' |
26-
| tst.js:48:21:48:32 | ['example3'] |
27-
| tst.js:49:13:49:18 | 'echo' |
28-
| tst.js:49:21:49:32 | ['example4'] |
29-
| tst.js:49:35:49:47 | { all: true } |
2+
| tst.js:22:9:22:23 | { shell: true } |
3+
| tst.js:24:9:24:24 | { shell: false } |
4+
| tst.js:28:13:28:22 | 'aCommand' |
5+
| tst.js:28:25:28:36 | ['example1'] |
6+
| tst.js:30:13:30:17 | 'git' |
7+
| tst.js:30:20:30:31 | ['example1'] |
8+
| tst.js:32:13:32:47 | 'echo e ... ple 11' |
9+
| tst.js:32:50:32:64 | { shell: true } |
10+
| tst.js:33:13:33:29 | 'echo example 10' |
11+
| tst.js:33:32:33:52 | ['; ech ... le 11'] |
12+
| tst.js:33:55:33:69 | { shell: true } |
13+
| tst.js:36:11:36:16 | 'echo' |
14+
| tst.js:36:19:36:35 | ['example5 sync'] |
15+
| tst.js:38:20:38:41 | "git " ... gument" |
16+
| tst.js:39:20:39:51 | `git ${ ... ndSync` |
17+
| tst.js:41:18:41:20 | arg |
18+
| tst.js:43:18:43:39 | "echo 1 ... echo 2" |
19+
| tst.js:43:42:43:56 | { shell: true } |
20+
| tst.js:49:9:49:27 | { inputFile: file } |
21+
| tst.js:50:13:50:17 | 'cat' |
22+
| tst.js:50:20:50:38 | { inputFile: file } |
23+
| tst.js:51:13:51:18 | 'echo' |
24+
| tst.js:51:21:51:32 | ['example2'] |
25+
| tst.js:52:13:52:18 | 'echo' |
26+
| tst.js:52:21:52:32 | ['example3'] |
27+
| tst.js:53:13:53:18 | 'echo' |
28+
| tst.js:53:21:53:32 | ['example4'] |
29+
| tst.js:53:35:53:47 | { all: true } |
3030
test_MissingFileSystemAccess
31-
| tst.js:43:35:43:38 | file |
32-
| tst.js:47:46:47:49 | file |
33-
| tst.js:48:46:48:49 | file |
34-
| tst.js:49:58:49:61 | file |
31+
| tst.js:47:35:47:38 | file |
32+
| tst.js:51:46:51:49 | file |
33+
| tst.js:52:46:52:49 | file |
34+
| tst.js:53:58:53:61 | file |
3535
test_SystemCommandExecution
3636
| tst.js:1:71:1:71 | $ |
37-
| tst.js:4:7:4:7 | $ |
38-
| tst.js:5:7:5:7 | $ |
39-
| tst.js:6:1:6:1 | $ |
40-
| tst.js:6:1:6:6 | $.sync |
41-
| tst.js:10:7:10:7 | $ |
42-
| tst.js:12:7:12:7 | $ |
43-
| tst.js:13:1:13:1 | $ |
44-
| tst.js:13:1:13:6 | $.sync |
45-
| tst.js:15:1:15:1 | $ |
46-
| tst.js:15:1:15:6 | $.sync |
37+
| tst.js:7:7:7:7 | $ |
38+
| tst.js:9:7:9:7 | $ |
39+
| tst.js:10:1:10:1 | $ |
40+
| tst.js:10:1:10:6 | $.sync |
41+
| tst.js:14:7:14:7 | $ |
4742
| tst.js:16:7:16:7 | $ |
48-
| tst.js:18:7:18:7 | $ |
49-
| tst.js:18:7:18:24 | $({ shell: true }) |
43+
| tst.js:17:1:17:1 | $ |
44+
| tst.js:17:1:17:6 | $.sync |
45+
| tst.js:19:1:19:1 | $ |
46+
| tst.js:19:1:19:6 | $.sync |
5047
| tst.js:20:7:20:7 | $ |
51-
| tst.js:20:7:20:25 | $({ shell: false }) |
52-
| tst.js:24:7:24:37 | execa(' ... ple1']) |
53-
| tst.js:26:7:26:33 | execa(' ... ple1']) |
54-
| tst.js:28:7:28:65 | execa(' ... true }) |
55-
| tst.js:29:7:29:70 | execa(' ... true }) |
56-
| tst.js:32:1:32:36 | execaSy ... sync']) |
57-
| tst.js:34:7:34:43 | execaCo ... ument") |
58-
| tst.js:35:7:35:53 | execaCo ... dSync`) |
59-
| tst.js:37:1:37:21 | execaCo ... nc(arg) |
60-
| tst.js:39:1:39:57 | execaCo ... true }) |
61-
| tst.js:43:7:43:7 | $ |
62-
| tst.js:45:7:45:7 | $ |
63-
| tst.js:45:7:45:28 | $({ inp ... file }) |
64-
| tst.js:46:7:46:39 | execa(' ... file }) |
65-
| tst.js:47:7:47:33 | execa(' ... ple2']) |
66-
| tst.js:48:7:48:33 | execa(' ... ple3']) |
67-
| tst.js:49:7:49:48 | execa(' ... true }) |
48+
| tst.js:22:7:22:7 | $ |
49+
| tst.js:22:7:22:24 | $({ shell: true }) |
50+
| tst.js:24:7:24:7 | $ |
51+
| tst.js:24:7:24:25 | $({ shell: false }) |
52+
| tst.js:28:7:28:37 | execa(' ... ple1']) |
53+
| tst.js:30:7:30:32 | execa(' ... ple1']) |
54+
| tst.js:32:7:32:65 | execa(' ... true }) |
55+
| tst.js:33:7:33:70 | execa(' ... true }) |
56+
| tst.js:36:1:36:36 | execaSy ... sync']) |
57+
| tst.js:38:7:38:42 | execaCo ... ument") |
58+
| tst.js:39:7:39:52 | execaCo ... dSync`) |
59+
| tst.js:41:1:41:21 | execaCo ... nc(arg) |
60+
| tst.js:43:1:43:57 | execaCo ... true }) |
61+
| tst.js:47:7:47:7 | $ |
62+
| tst.js:49:7:49:7 | $ |
63+
| tst.js:49:7:49:28 | $({ inp ... file }) |
64+
| tst.js:50:7:50:39 | execa(' ... file }) |
65+
| tst.js:51:7:51:33 | execa(' ... ple2']) |
66+
| tst.js:52:7:52:33 | execa(' ... ple3']) |
67+
| tst.js:53:7:53:48 | execa(' ... true }) |
6868
test_FileNameSource

‎javascript/ql/test/library-tests/frameworks/Execa/tst.js

Lines changed: 10 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -1,8 +1,12 @@
11
import { execa, execaSync, execaCommand, execaCommandSync, execaNode, $ } from 'execa';
22

3+
const arg = process.argv[0];
4+
35
// Node.js scripts
6+
// GOOD
47
await $`echo example1`.pipeStderr(`tmp`);
5-
await $`echo ${"example2"}`.pipeStderr(`tmp`);
8+
// BAD argument injection
9+
await $`ssh ${"example2"}`.pipeStderr(`tmp`);
610
$.sync`echo example2 sync`
711
// Multiple arguments
812
const args = ["arg:" + arg, 'example3', '&', 'rainbows!'];
@@ -12,8 +16,8 @@ await $`${arg} sth`;
1216
await $`${arg}`;
1317
$.sync`${arg}`
1418
// BAD argument injection
15-
$.sync`echo ${args} ${args}`
16-
await $`echo ${["-a", "-lps"]}`
19+
$.sync`git ${args} ${args}`
20+
await $`git ${["-o", "-lps"]}`
1721
// if shell: true then all inputs except first are dangerous
1822
await $({ shell: true })`echo example6 ${";echo example6 > tmpdir/example6"}`
1923
// GOOD
@@ -23,16 +27,16 @@ await $({ shell: false })`echo example6 ${";echo example6 > tmpdir/example6"}`
2327
// GOOD
2428
await execa('aCommand', ['example1']);
2529
// BAD argument injection
26-
await execa('echo', ['example1']);
30+
await execa('git', ['example1']);
2731
// BAD shell is enable
2832
await execa('echo example 10 ; echo example 11', { shell: true });
2933
await execa('echo example 10', ['; echo example 11'], { shell: true });
3034

3135
// BAD argument injection
3236
execaSync('echo', ['example5 sync']);
3337
// BAD argument injection
34-
await execaCommand("echo " + "badArgument");
35-
await execaCommand(`echo ${"arg1"} execaCommandSync`);
38+
await execaCommand("git " + "badArgument");
39+
await execaCommand(`git ${"arg1"} execaCommandSync`);
3640
// bad totally controllable argument
3741
execaCommandSync(arg);
3842
// BAD shell is enable

0 commit comments

Comments
 (0)