Skip to content

Commit 61887be

Browse files
asgerfasgerf
committed
JS: Add test case for false positive
1 parent cc1a28a commit 61887be

File tree

4 files changed

+47
-6
lines changed

4 files changed

+47
-6
lines changed

‎javascript/ql/test/query-tests/Security/CWE-094/CodeInjection/CodeInjection.expected

Lines changed: 16 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -65,7 +65,8 @@
6565
| module.js:11:17:11:30 | req.query.code | module.js:11:17:11:30 | req.query.code | module.js:11:17:11:30 | req.query.code | This code execution depends on a $@. | module.js:11:17:11:30 | req.query.code | user-provided value |
6666
| react-native.js:8:32:8:38 | tainted | react-native.js:7:17:7:33 | req.param("code") | react-native.js:8:32:8:38 | tainted | This code execution depends on a $@. | react-native.js:7:17:7:33 | req.param("code") | user-provided value |
6767
| react-native.js:10:23:10:29 | tainted | react-native.js:7:17:7:33 | req.param("code") | react-native.js:10:23:10:29 | tainted | This code execution depends on a $@. | react-native.js:7:17:7:33 | req.param("code") | user-provided value |
68-
| react.js:10:56:10:77 | documen ... on.hash | react.js:10:56:10:77 | documen ... on.hash | react.js:10:56:10:77 | documen ... on.hash | This code execution depends on a $@. | react.js:10:56:10:77 | documen ... on.hash | user-provided value |
68+
| react.js:11:56:11:77 | documen ... on.hash | react.js:11:56:11:77 | documen ... on.hash | react.js:11:56:11:77 | documen ... on.hash | This code execution depends on a $@. | react.js:11:56:11:77 | documen ... on.hash | user-provided value |
69+
| react.js:25:8:25:11 | data | react-server-function.js:3:35:3:35 | x | react.js:25:8:25:11 | data | This code execution depends on a $@. | react-server-function.js:3:35:3:35 | x | user-provided value |
6970
| template-sinks.js:20:17:20:23 | tainted | template-sinks.js:18:19:18:31 | req.query.foo | template-sinks.js:20:17:20:23 | tainted | Template, which may contain code, depends on a $@. | template-sinks.js:18:19:18:31 | req.query.foo | user-provided value |
7071
| template-sinks.js:21:16:21:22 | tainted | template-sinks.js:18:19:18:31 | req.query.foo | template-sinks.js:21:16:21:22 | tainted | Template, which may contain code, depends on a $@. | template-sinks.js:18:19:18:31 | req.query.foo | user-provided value |
7172
| template-sinks.js:22:18:22:24 | tainted | template-sinks.js:18:19:18:31 | req.query.foo | template-sinks.js:22:18:22:24 | tainted | Template, which may contain code, depends on a $@. | template-sinks.js:18:19:18:31 | req.query.foo | user-provided value |
@@ -156,6 +157,12 @@ edges
156157
| react-native.js:7:7:7:33 | tainted | react-native.js:8:32:8:38 | tainted | provenance | |
157158
| react-native.js:7:7:7:33 | tainted | react-native.js:10:23:10:29 | tainted | provenance | |
158159
| react-native.js:7:17:7:33 | req.param("code") | react-native.js:7:7:7:33 | tainted | provenance | |
160+
| react-server-function.js:3:35:3:35 | x | react-server-function.js:4:12:4:12 | x | provenance | |
161+
| react-server-function.js:4:12:4:12 | x | react-server-function.js:4:12:4:29 | x + " from server" | provenance | |
162+
| react-server-function.js:4:12:4:29 | x + " from server" | react.js:24:20:24:44 | echoSer ... value") [PromiseValue] | provenance | |
163+
| react.js:24:9:24:45 | data | react.js:25:8:25:11 | data | provenance | |
164+
| react.js:24:16:24:45 | use(ech ... alue")) | react.js:24:9:24:45 | data | provenance | |
165+
| react.js:24:20:24:44 | echoSer ... value") [PromiseValue] | react.js:24:16:24:45 | use(ech ... alue")) | provenance | |
159166
| template-sinks.js:18:9:18:31 | tainted | template-sinks.js:20:17:20:23 | tainted | provenance | |
160167
| template-sinks.js:18:9:18:31 | tainted | template-sinks.js:21:16:21:22 | tainted | provenance | |
161168
| template-sinks.js:18:9:18:31 | tainted | template-sinks.js:22:18:22:24 | tainted | provenance | |
@@ -287,7 +294,14 @@ nodes
287294
| react-native.js:7:17:7:33 | req.param("code") | semmle.label | req.param("code") |
288295
| react-native.js:8:32:8:38 | tainted | semmle.label | tainted |
289296
| react-native.js:10:23:10:29 | tainted | semmle.label | tainted |
290-
| react.js:10:56:10:77 | documen ... on.hash | semmle.label | documen ... on.hash |
297+
| react-server-function.js:3:35:3:35 | x | semmle.label | x |
298+
| react-server-function.js:4:12:4:12 | x | semmle.label | x |
299+
| react-server-function.js:4:12:4:29 | x + " from server" | semmle.label | x + " from server" |
300+
| react.js:11:56:11:77 | documen ... on.hash | semmle.label | documen ... on.hash |
301+
| react.js:24:9:24:45 | data | semmle.label | data |
302+
| react.js:24:16:24:45 | use(ech ... alue")) | semmle.label | use(ech ... alue")) |
303+
| react.js:24:20:24:44 | echoSer ... value") [PromiseValue] | semmle.label | echoSer ... value") [PromiseValue] |
304+
| react.js:25:8:25:11 | data | semmle.label | data |
291305
| template-sinks.js:18:9:18:31 | tainted | semmle.label | tainted |
292306
| template-sinks.js:18:19:18:31 | req.query.foo | semmle.label | req.query.foo |
293307
| template-sinks.js:20:17:20:23 | tainted | semmle.label | tainted |

‎javascript/ql/test/query-tests/Security/CWE-094/CodeInjection/HeuristicSourceCodeInjection.expected

Lines changed: 14 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -58,6 +58,12 @@ edges
5858
| react-native.js:7:7:7:33 | tainted | react-native.js:8:32:8:38 | tainted | provenance | |
5959
| react-native.js:7:7:7:33 | tainted | react-native.js:10:23:10:29 | tainted | provenance | |
6060
| react-native.js:7:17:7:33 | req.param("code") | react-native.js:7:7:7:33 | tainted | provenance | |
61+
| react-server-function.js:3:35:3:35 | x | react-server-function.js:4:12:4:12 | x | provenance | |
62+
| react-server-function.js:4:12:4:12 | x | react-server-function.js:4:12:4:29 | x + " from server" | provenance | |
63+
| react-server-function.js:4:12:4:29 | x + " from server" | react.js:24:20:24:44 | echoSer ... value") [PromiseValue] | provenance | |
64+
| react.js:24:9:24:45 | data | react.js:25:8:25:11 | data | provenance | |
65+
| react.js:24:16:24:45 | use(ech ... alue")) | react.js:24:9:24:45 | data | provenance | |
66+
| react.js:24:20:24:44 | echoSer ... value") [PromiseValue] | react.js:24:16:24:45 | use(ech ... alue")) | provenance | |
6167
| template-sinks.js:18:9:18:31 | tainted | template-sinks.js:20:17:20:23 | tainted | provenance | |
6268
| template-sinks.js:18:9:18:31 | tainted | template-sinks.js:21:16:21:22 | tainted | provenance | |
6369
| template-sinks.js:18:9:18:31 | tainted | template-sinks.js:22:18:22:24 | tainted | provenance | |
@@ -191,7 +197,14 @@ nodes
191197
| react-native.js:7:17:7:33 | req.param("code") | semmle.label | req.param("code") |
192198
| react-native.js:8:32:8:38 | tainted | semmle.label | tainted |
193199
| react-native.js:10:23:10:29 | tainted | semmle.label | tainted |
194-
| react.js:10:56:10:77 | documen ... on.hash | semmle.label | documen ... on.hash |
200+
| react-server-function.js:3:35:3:35 | x | semmle.label | x |
201+
| react-server-function.js:4:12:4:12 | x | semmle.label | x |
202+
| react-server-function.js:4:12:4:29 | x + " from server" | semmle.label | x + " from server" |
203+
| react.js:11:56:11:77 | documen ... on.hash | semmle.label | documen ... on.hash |
204+
| react.js:24:9:24:45 | data | semmle.label | data |
205+
| react.js:24:16:24:45 | use(ech ... alue")) | semmle.label | use(ech ... alue")) |
206+
| react.js:24:20:24:44 | echoSer ... value") [PromiseValue] | semmle.label | echoSer ... value") [PromiseValue] |
207+
| react.js:25:8:25:11 | data | semmle.label | data |
195208
| template-sinks.js:18:9:18:31 | tainted | semmle.label | tainted |
196209
| template-sinks.js:18:19:18:31 | req.query.foo | semmle.label | req.query.foo |
197210
| template-sinks.js:20:17:20:23 | tainted | semmle.label | tainted |

‎javascript/ql/test/query-tests/Security/CWE-094/CodeInjection/react-server-function.js

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,5 @@
1+
"use server";
2+
3+
export async function echoService(x) { // $ Source[js/code-injection]
4+
return x + " from server";
5+
}

‎javascript/ql/test/query-tests/Security/CWE-094/CodeInjection/react.js

Lines changed: 12 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,7 @@
1-
import React from "react";
1+
import React, { use } from "react";
22
import {Helmet} from "react-helmet";
3-
3+
import { echoService } from "./react-server-function";
4+
45
class Application extends React.Component {
56
render () {
67
return (
@@ -14,4 +15,12 @@ class Application extends React.Component {
1415
}
1516
};
1617

17-
export default Application
18+
export default Application
19+
20+
export function Component() {
21+
// We currently get false-positive flow through server functions in cases where a safe value
22+
// is passed as the argument, which flows to the return value. In this case, the tainted parameter
23+
// flows out of the return value regardless.
24+
const data = use(echoService("safe value"));
25+
eval(data); // $ SPURIOUS: Alert[js/code-injection]
26+
}

0 commit comments

Comments
 (0)