Skip to content

Commit 9b5ff66

Browse files
erik-krogherik-krogh
committed
naively port tests from ldap examples
1 parent 2b286a8 commit 9b5ff66

File tree

2 files changed

+101
-0
lines changed

2 files changed

+101
-0
lines changed

‎javascript/ql/test/query-tests/Security/CWE-089/untyped/SqlInjection.expected

Lines changed: 37 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -68,6 +68,22 @@ nodes
6868
| json-schema-validator.js:59:22:59:26 | query |
6969
| json-schema-validator.js:61:22:61:26 | query |
7070
| json-schema-validator.js:61:22:61:26 | query |
71+
| ldap.js:20:7:20:34 | q |
72+
| ldap.js:20:11:20:34 | url.par ... , true) |
73+
| ldap.js:20:21:20:27 | req.url |
74+
| ldap.js:20:21:20:27 | req.url |
75+
| ldap.js:22:7:22:33 | username |
76+
| ldap.js:22:18:22:18 | q |
77+
| ldap.js:22:18:22:24 | q.query |
78+
| ldap.js:22:18:22:33 | q.query.username |
79+
| ldap.js:25:13:25:57 | `(\|(nam ... ame}))` |
80+
| ldap.js:25:13:25:57 | `(\|(nam ... ame}))` |
81+
| ldap.js:25:24:25:31 | username |
82+
| ldap.js:25:46:25:53 | username |
83+
| ldap.js:32:15:32:59 | `(\|(nam ... ame}))` |
84+
| ldap.js:32:15:32:59 | `(\|(nam ... ame}))` |
85+
| ldap.js:32:26:32:33 | username |
86+
| ldap.js:32:48:32:55 | username |
7187
| marsdb-flow-to.js:10:9:10:18 | query |
7288
| marsdb-flow-to.js:10:17:10:18 | {} |
7389
| marsdb-flow-to.js:11:17:11:24 | req.body |
@@ -444,6 +460,25 @@ edges
444460
| json-schema-validator.js:50:23:50:48 | JSON.pa ... y.data) | json-schema-validator.js:50:15:50:48 | query |
445461
| json-schema-validator.js:50:34:50:47 | req.query.data | json-schema-validator.js:50:23:50:48 | JSON.pa ... y.data) |
446462
| json-schema-validator.js:50:34:50:47 | req.query.data | json-schema-validator.js:50:23:50:48 | JSON.pa ... y.data) |
463+
| ldap.js:20:7:20:34 | q | ldap.js:22:18:22:18 | q |
464+
| ldap.js:20:11:20:34 | url.par ... , true) | ldap.js:20:7:20:34 | q |
465+
| ldap.js:20:21:20:27 | req.url | ldap.js:20:11:20:34 | url.par ... , true) |
466+
| ldap.js:20:21:20:27 | req.url | ldap.js:20:11:20:34 | url.par ... , true) |
467+
| ldap.js:22:7:22:33 | username | ldap.js:25:24:25:31 | username |
468+
| ldap.js:22:7:22:33 | username | ldap.js:25:46:25:53 | username |
469+
| ldap.js:22:7:22:33 | username | ldap.js:32:26:32:33 | username |
470+
| ldap.js:22:7:22:33 | username | ldap.js:32:48:32:55 | username |
471+
| ldap.js:22:18:22:18 | q | ldap.js:22:18:22:24 | q.query |
472+
| ldap.js:22:18:22:24 | q.query | ldap.js:22:18:22:33 | q.query.username |
473+
| ldap.js:22:18:22:33 | q.query.username | ldap.js:22:7:22:33 | username |
474+
| ldap.js:25:24:25:31 | username | ldap.js:25:13:25:57 | `(\|(nam ... ame}))` |
475+
| ldap.js:25:24:25:31 | username | ldap.js:25:13:25:57 | `(\|(nam ... ame}))` |
476+
| ldap.js:25:46:25:53 | username | ldap.js:25:13:25:57 | `(\|(nam ... ame}))` |
477+
| ldap.js:25:46:25:53 | username | ldap.js:25:13:25:57 | `(\|(nam ... ame}))` |
478+
| ldap.js:32:26:32:33 | username | ldap.js:32:15:32:59 | `(\|(nam ... ame}))` |
479+
| ldap.js:32:26:32:33 | username | ldap.js:32:15:32:59 | `(\|(nam ... ame}))` |
480+
| ldap.js:32:48:32:55 | username | ldap.js:32:15:32:59 | `(\|(nam ... ame}))` |
481+
| ldap.js:32:48:32:55 | username | ldap.js:32:15:32:59 | `(\|(nam ... ame}))` |
447482
| marsdb-flow-to.js:10:9:10:18 | query | marsdb-flow-to.js:14:17:14:21 | query |
448483
| marsdb-flow-to.js:10:9:10:18 | query | marsdb-flow-to.js:14:17:14:21 | query |
449484
| marsdb-flow-to.js:10:17:10:18 | {} | marsdb-flow-to.js:10:9:10:18 | query |
@@ -852,6 +887,8 @@ edges
852887
| json-schema-validator.js:55:22:55:26 | query | json-schema-validator.js:50:34:50:47 | req.query.data | json-schema-validator.js:55:22:55:26 | query | This query depends on $@. | json-schema-validator.js:50:34:50:47 | req.query.data | a user-provided value |
853888
| json-schema-validator.js:59:22:59:26 | query | json-schema-validator.js:50:34:50:47 | req.query.data | json-schema-validator.js:59:22:59:26 | query | This query depends on $@. | json-schema-validator.js:50:34:50:47 | req.query.data | a user-provided value |
854889
| json-schema-validator.js:61:22:61:26 | query | json-schema-validator.js:50:34:50:47 | req.query.data | json-schema-validator.js:61:22:61:26 | query | This query depends on $@. | json-schema-validator.js:50:34:50:47 | req.query.data | a user-provided value |
890+
| ldap.js:25:13:25:57 | `(\|(nam ... ame}))` | ldap.js:20:21:20:27 | req.url | ldap.js:25:13:25:57 | `(\|(nam ... ame}))` | This query depends on $@. | ldap.js:20:21:20:27 | req.url | a user-provided value |
891+
| ldap.js:32:15:32:59 | `(\|(nam ... ame}))` | ldap.js:20:21:20:27 | req.url | ldap.js:32:15:32:59 | `(\|(nam ... ame}))` | This query depends on $@. | ldap.js:20:21:20:27 | req.url | a user-provided value |
855892
| marsdb-flow-to.js:14:17:14:21 | query | marsdb-flow-to.js:11:17:11:24 | req.body | marsdb-flow-to.js:14:17:14:21 | query | This query depends on $@. | marsdb-flow-to.js:11:17:11:24 | req.body | a user-provided value |
856893
| marsdb.js:16:12:16:16 | query | marsdb.js:13:17:13:24 | req.body | marsdb.js:16:12:16:16 | query | This query depends on $@. | marsdb.js:13:17:13:24 | req.body | a user-provided value |
857894
| minimongo.js:18:12:18:16 | query | minimongo.js:15:17:15:24 | req.body | minimongo.js:18:12:18:16 | query | This query depends on $@. | minimongo.js:15:17:15:24 | req.body | a user-provided value |

‎javascript/ql/test/query-tests/Security/CWE-089/untyped/ldap.js

Lines changed: 64 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,64 @@
1+
const http = require("http");
2+
const url = require("url");
3+
const ldap = require("ldapjs");
4+
const client = ldap.createClient({
5+
url: "ldap://127.0.0.1:1389",
6+
});
7+
8+
// https://github.com/vesse/node-ldapauth-fork/commit/3feea43e243698bcaeffa904a7324f4d96df60e4
9+
const sanitizeInput = function (input) {
10+
return input
11+
.replace(/\*/g, "\\2a")
12+
.replace(/\(/g, "\\28")
13+
.replace(/\)/g, "\\29")
14+
.replace(/\\/g, "\\5c")
15+
.replace(/\0/g, "\\00")
16+
.replace(/\//g, "\\2f");
17+
};
18+
19+
const server = http.createServer((req, res) => {
20+
let q = url.parse(req.url, true);
21+
22+
let username = q.query.username;
23+
24+
var opts1 = {
25+
filter: `(|(name=${username})(username=${username}))`, // NOT OK
26+
};
27+
28+
client.search("o=example", opts1, function (err, res) {});
29+
30+
client.search(
31+
"o=example",
32+
{ filter: `(|(name=${username})(username=${username}))` }, // NOT OK
33+
function (err, res) {}
34+
);
35+
36+
// GOOD
37+
client.search(
38+
"o=example",
39+
{
40+
filter: `(|(name=${sanitizeInput(username)})(username=${sanitizeInput(
41+
username
42+
)}))`,
43+
},
44+
function (err, res) {}
45+
);
46+
47+
// GOOD (https://github.com/ldapjs/node-ldapjs/issues/181)
48+
let f = new OrFilter({
49+
filters: [
50+
new EqualityFilter({
51+
attribute: "name",
52+
value: username,
53+
}),
54+
new EqualityFilter({
55+
attribute: "username",
56+
value: username,
57+
}),
58+
],
59+
});
60+
61+
client.search("o=example", { filter: f }, function (err, res) {});
62+
});
63+
64+
server.listen(389, () => {});

0 commit comments

Comments
 (0)