Skip to content

Commit 83edcf5

Browse files
asgerfasgerf
committed
JS: Add test for regexp-based sanitizer
1 parent 54fba2d commit 83edcf5

File tree

3 files changed

+76
-1
lines changed

3 files changed

+76
-1
lines changed

‎javascript/ql/test/query-tests/Security/CWE-022/TaintedPath/Consistency.expected

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,3 @@
1+
| query-tests/Security/CWE-022/TaintedPath/normalizedPaths.js:390 | did not expect an alert, but found an alert for TaintedPath | OK | |
2+
| query-tests/Security/CWE-022/TaintedPath/normalizedPaths.js:393 | did not expect an alert, but found an alert for TaintedPath | OK | |
3+
| query-tests/Security/CWE-022/TaintedPath/normalizedPaths.js:396 | did not expect an alert, but found an alert for TaintedPath | OK | |

‎javascript/ql/test/query-tests/Security/CWE-022/TaintedPath/TaintedPath.expected

Lines changed: 53 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -2116,6 +2116,28 @@ nodes
21162116
| normalizedPaths.js:381:25:381:28 | path |
21172117
| normalizedPaths.js:381:25:381:28 | path |
21182118
| normalizedPaths.js:381:25:381:28 | path |
2119+
| normalizedPaths.js:385:7:385:46 | path |
2120+
| normalizedPaths.js:385:7:385:46 | path |
2121+
| normalizedPaths.js:385:14:385:46 | pathMod ... uery.x) |
2122+
| normalizedPaths.js:385:14:385:46 | pathMod ... uery.x) |
2123+
| normalizedPaths.js:385:35:385:45 | req.query.x |
2124+
| normalizedPaths.js:385:35:385:45 | req.query.x |
2125+
| normalizedPaths.js:385:35:385:45 | req.query.x |
2126+
| normalizedPaths.js:388:19:388:22 | path |
2127+
| normalizedPaths.js:388:19:388:22 | path |
2128+
| normalizedPaths.js:388:19:388:22 | path |
2129+
| normalizedPaths.js:390:21:390:24 | path |
2130+
| normalizedPaths.js:390:21:390:24 | path |
2131+
| normalizedPaths.js:390:21:390:24 | path |
2132+
| normalizedPaths.js:393:21:393:24 | path |
2133+
| normalizedPaths.js:393:21:393:24 | path |
2134+
| normalizedPaths.js:393:21:393:24 | path |
2135+
| normalizedPaths.js:396:21:396:24 | path |
2136+
| normalizedPaths.js:396:21:396:24 | path |
2137+
| normalizedPaths.js:396:21:396:24 | path |
2138+
| normalizedPaths.js:399:21:399:24 | path |
2139+
| normalizedPaths.js:399:21:399:24 | path |
2140+
| normalizedPaths.js:399:21:399:24 | path |
21192141
| other-fs-libraries.js:9:7:9:48 | path |
21202142
| other-fs-libraries.js:9:7:9:48 | path |
21212143
| other-fs-libraries.js:9:7:9:48 | path |
@@ -6998,6 +7020,32 @@ edges
69987020
| normalizedPaths.js:381:25:381:28 | path | normalizedPaths.js:381:19:381:29 | slash(path) |
69997021
| normalizedPaths.js:381:25:381:28 | path | normalizedPaths.js:381:19:381:29 | slash(path) |
70007022
| normalizedPaths.js:381:25:381:28 | path | normalizedPaths.js:381:19:381:29 | slash(path) |
7023+
| normalizedPaths.js:385:7:385:46 | path | normalizedPaths.js:388:19:388:22 | path |
7024+
| normalizedPaths.js:385:7:385:46 | path | normalizedPaths.js:388:19:388:22 | path |
7025+
| normalizedPaths.js:385:7:385:46 | path | normalizedPaths.js:388:19:388:22 | path |
7026+
| normalizedPaths.js:385:7:385:46 | path | normalizedPaths.js:388:19:388:22 | path |
7027+
| normalizedPaths.js:385:7:385:46 | path | normalizedPaths.js:390:21:390:24 | path |
7028+
| normalizedPaths.js:385:7:385:46 | path | normalizedPaths.js:390:21:390:24 | path |
7029+
| normalizedPaths.js:385:7:385:46 | path | normalizedPaths.js:390:21:390:24 | path |
7030+
| normalizedPaths.js:385:7:385:46 | path | normalizedPaths.js:390:21:390:24 | path |
7031+
| normalizedPaths.js:385:7:385:46 | path | normalizedPaths.js:393:21:393:24 | path |
7032+
| normalizedPaths.js:385:7:385:46 | path | normalizedPaths.js:393:21:393:24 | path |
7033+
| normalizedPaths.js:385:7:385:46 | path | normalizedPaths.js:393:21:393:24 | path |
7034+
| normalizedPaths.js:385:7:385:46 | path | normalizedPaths.js:393:21:393:24 | path |
7035+
| normalizedPaths.js:385:7:385:46 | path | normalizedPaths.js:396:21:396:24 | path |
7036+
| normalizedPaths.js:385:7:385:46 | path | normalizedPaths.js:396:21:396:24 | path |
7037+
| normalizedPaths.js:385:7:385:46 | path | normalizedPaths.js:396:21:396:24 | path |
7038+
| normalizedPaths.js:385:7:385:46 | path | normalizedPaths.js:396:21:396:24 | path |
7039+
| normalizedPaths.js:385:7:385:46 | path | normalizedPaths.js:399:21:399:24 | path |
7040+
| normalizedPaths.js:385:7:385:46 | path | normalizedPaths.js:399:21:399:24 | path |
7041+
| normalizedPaths.js:385:7:385:46 | path | normalizedPaths.js:399:21:399:24 | path |
7042+
| normalizedPaths.js:385:7:385:46 | path | normalizedPaths.js:399:21:399:24 | path |
7043+
| normalizedPaths.js:385:14:385:46 | pathMod ... uery.x) | normalizedPaths.js:385:7:385:46 | path |
7044+
| normalizedPaths.js:385:14:385:46 | pathMod ... uery.x) | normalizedPaths.js:385:7:385:46 | path |
7045+
| normalizedPaths.js:385:35:385:45 | req.query.x | normalizedPaths.js:385:14:385:46 | pathMod ... uery.x) |
7046+
| normalizedPaths.js:385:35:385:45 | req.query.x | normalizedPaths.js:385:14:385:46 | pathMod ... uery.x) |
7047+
| normalizedPaths.js:385:35:385:45 | req.query.x | normalizedPaths.js:385:14:385:46 | pathMod ... uery.x) |
7048+
| normalizedPaths.js:385:35:385:45 | req.query.x | normalizedPaths.js:385:14:385:46 | pathMod ... uery.x) |
70017049
| other-fs-libraries.js:9:7:9:48 | path | other-fs-libraries.js:11:19:11:22 | path |
70027050
| other-fs-libraries.js:9:7:9:48 | path | other-fs-libraries.js:11:19:11:22 | path |
70037051
| other-fs-libraries.js:9:7:9:48 | path | other-fs-libraries.js:11:19:11:22 | path |
@@ -9670,6 +9718,11 @@ edges
96709718
| normalizedPaths.js:363:21:363:31 | requestPath | normalizedPaths.js:354:14:354:27 | req.query.path | normalizedPaths.js:363:21:363:31 | requestPath | This path depends on $@. | normalizedPaths.js:354:14:354:27 | req.query.path | a user-provided value |
96719719
| normalizedPaths.js:379:19:379:22 | path | normalizedPaths.js:377:14:377:27 | req.query.path | normalizedPaths.js:379:19:379:22 | path | This path depends on $@. | normalizedPaths.js:377:14:377:27 | req.query.path | a user-provided value |
96729720
| normalizedPaths.js:381:19:381:29 | slash(path) | normalizedPaths.js:377:14:377:27 | req.query.path | normalizedPaths.js:381:19:381:29 | slash(path) | This path depends on $@. | normalizedPaths.js:377:14:377:27 | req.query.path | a user-provided value |
9721+
| normalizedPaths.js:388:19:388:22 | path | normalizedPaths.js:385:35:385:45 | req.query.x | normalizedPaths.js:388:19:388:22 | path | This path depends on $@. | normalizedPaths.js:385:35:385:45 | req.query.x | a user-provided value |
9722+
| normalizedPaths.js:390:21:390:24 | path | normalizedPaths.js:385:35:385:45 | req.query.x | normalizedPaths.js:390:21:390:24 | path | This path depends on $@. | normalizedPaths.js:385:35:385:45 | req.query.x | a user-provided value |
9723+
| normalizedPaths.js:393:21:393:24 | path | normalizedPaths.js:385:35:385:45 | req.query.x | normalizedPaths.js:393:21:393:24 | path | This path depends on $@. | normalizedPaths.js:385:35:385:45 | req.query.x | a user-provided value |
9724+
| normalizedPaths.js:396:21:396:24 | path | normalizedPaths.js:385:35:385:45 | req.query.x | normalizedPaths.js:396:21:396:24 | path | This path depends on $@. | normalizedPaths.js:385:35:385:45 | req.query.x | a user-provided value |
9725+
| normalizedPaths.js:399:21:399:24 | path | normalizedPaths.js:385:35:385:45 | req.query.x | normalizedPaths.js:399:21:399:24 | path | This path depends on $@. | normalizedPaths.js:385:35:385:45 | req.query.x | a user-provided value |
96739726
| other-fs-libraries.js:11:19:11:22 | path | other-fs-libraries.js:9:24:9:30 | req.url | other-fs-libraries.js:11:19:11:22 | path | This path depends on $@. | other-fs-libraries.js:9:24:9:30 | req.url | a user-provided value |
96749727
| other-fs-libraries.js:12:27:12:30 | path | other-fs-libraries.js:9:24:9:30 | req.url | other-fs-libraries.js:12:27:12:30 | path | This path depends on $@. | other-fs-libraries.js:9:24:9:30 | req.url | a user-provided value |
96759728
| other-fs-libraries.js:13:24:13:27 | path | other-fs-libraries.js:9:24:9:30 | req.url | other-fs-libraries.js:13:24:13:27 | path | This path depends on $@. | other-fs-libraries.js:9:24:9:30 | req.url | a user-provided value |

‎javascript/ql/test/query-tests/Security/CWE-022/TaintedPath/normalizedPaths.js

Lines changed: 20 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -379,4 +379,23 @@ app.get('/slash-stuff', (req, res) => {
379379
fs.readFileSync(path); // NOT OK
380380

381381
fs.readFileSync(slash(path)); // NOT OK
382-
});
382+
});
383+
384+
app.get('/dotdot-regexp', (req, res) => {
385+
let path = pathModule.normalize(req.query.x);
386+
if (pathModule.isAbsolute(path))
387+
return;
388+
fs.readFileSync(path); // NOT OK
389+
if (!path.match(/\./)) {
390+
fs.readFileSync(path); // OK
391+
}
392+
if (!path.match(/\.\./)) {
393+
fs.readFileSync(path); // OK
394+
}
395+
if (!path.match(/\.\.\//)) {
396+
fs.readFileSync(path); // OK
397+
}
398+
if (!path.match(/\.\.\/foo/)) {
399+
fs.readFileSync(path); // NOT OK
400+
}
401+
});

0 commit comments

Comments
 (0)