Skip to content

Commit 1f1c09a

Browse files
erik-krogherik-krogh
committed
update consistency comments for CWE-601
1 parent ce6a211 commit 1f1c09a

File tree

3 files changed

+54
-55
lines changed

3 files changed

+54
-55
lines changed

‎javascript/ql/test/query-tests/Security/CWE-601/ServerSideUrlRedirect/ServerSideUrlRedirect.expected

Lines changed: 52 additions & 52 deletions
Original file line numberDiff line numberDiff line change
@@ -56,32 +56,32 @@ nodes
5656
| koa.js:14:16:14:18 | url |
5757
| koa.js:20:16:20:18 | url |
5858
| koa.js:20:16:20:18 | url |
59-
| node.js:6:7:6:52 | target |
60-
| node.js:6:16:6:39 | url.par ... , true) |
61-
| node.js:6:16:6:45 | url.par ... ).query |
62-
| node.js:6:16:6:52 | url.par ... .target |
63-
| node.js:6:26:6:32 | req.url |
64-
| node.js:6:26:6:32 | req.url |
65-
| node.js:7:34:7:39 | target |
66-
| node.js:7:34:7:39 | target |
67-
| node.js:11:7:11:52 | target |
68-
| node.js:11:16:11:39 | url.par ... , true) |
69-
| node.js:11:16:11:45 | url.par ... ).query |
70-
| node.js:11:16:11:52 | url.par ... .target |
71-
| node.js:11:26:11:32 | req.url |
72-
| node.js:11:26:11:32 | req.url |
73-
| node.js:15:34:15:45 | '/' + target |
74-
| node.js:15:34:15:45 | '/' + target |
75-
| node.js:15:40:15:45 | target |
76-
| node.js:29:7:29:52 | target |
77-
| node.js:29:16:29:39 | url.par ... , true) |
78-
| node.js:29:16:29:45 | url.par ... ).query |
79-
| node.js:29:16:29:52 | url.par ... .target |
80-
| node.js:29:26:29:32 | req.url |
81-
| node.js:29:26:29:32 | req.url |
82-
| node.js:32:34:32:39 | target |
83-
| node.js:32:34:32:55 | target ... =" + me |
84-
| node.js:32:34:32:55 | target ... =" + me |
59+
| node.js:5:7:5:52 | target |
60+
| node.js:5:16:5:39 | url.par ... , true) |
61+
| node.js:5:16:5:45 | url.par ... ).query |
62+
| node.js:5:16:5:52 | url.par ... .target |
63+
| node.js:5:26:5:32 | req.url |
64+
| node.js:5:26:5:32 | req.url |
65+
| node.js:6:34:6:39 | target |
66+
| node.js:6:34:6:39 | target |
67+
| node.js:10:7:10:52 | target |
68+
| node.js:10:16:10:39 | url.par ... , true) |
69+
| node.js:10:16:10:45 | url.par ... ).query |
70+
| node.js:10:16:10:52 | url.par ... .target |
71+
| node.js:10:26:10:32 | req.url |
72+
| node.js:10:26:10:32 | req.url |
73+
| node.js:14:34:14:45 | '/' + target |
74+
| node.js:14:34:14:45 | '/' + target |
75+
| node.js:14:40:14:45 | target |
76+
| node.js:28:7:28:52 | target |
77+
| node.js:28:16:28:39 | url.par ... , true) |
78+
| node.js:28:16:28:45 | url.par ... ).query |
79+
| node.js:28:16:28:52 | url.par ... .target |
80+
| node.js:28:26:28:32 | req.url |
81+
| node.js:28:26:28:32 | req.url |
82+
| node.js:31:34:31:39 | target |
83+
| node.js:31:34:31:55 | target ... =" + me |
84+
| node.js:31:34:31:55 | target ... =" + me |
8585
| react-native.js:7:7:7:33 | tainted |
8686
| react-native.js:7:17:7:33 | req.param("code") |
8787
| react-native.js:7:17:7:33 | req.param("code") |
@@ -139,29 +139,29 @@ edges
139139
| koa.js:6:12:6:27 | ctx.query.target | koa.js:6:6:6:27 | url |
140140
| koa.js:8:18:8:20 | url | koa.js:8:15:8:26 | `${url}${x}` |
141141
| koa.js:8:18:8:20 | url | koa.js:8:15:8:26 | `${url}${x}` |
142-
| node.js:6:7:6:52 | target | node.js:7:34:7:39 | target |
143-
| node.js:6:7:6:52 | target | node.js:7:34:7:39 | target |
144-
| node.js:6:16:6:39 | url.par ... , true) | node.js:6:16:6:45 | url.par ... ).query |
145-
| node.js:6:16:6:45 | url.par ... ).query | node.js:6:16:6:52 | url.par ... .target |
146-
| node.js:6:16:6:52 | url.par ... .target | node.js:6:7:6:52 | target |
147-
| node.js:6:26:6:32 | req.url | node.js:6:16:6:39 | url.par ... , true) |
148-
| node.js:6:26:6:32 | req.url | node.js:6:16:6:39 | url.par ... , true) |
149-
| node.js:11:7:11:52 | target | node.js:15:40:15:45 | target |
150-
| node.js:11:16:11:39 | url.par ... , true) | node.js:11:16:11:45 | url.par ... ).query |
151-
| node.js:11:16:11:45 | url.par ... ).query | node.js:11:16:11:52 | url.par ... .target |
152-
| node.js:11:16:11:52 | url.par ... .target | node.js:11:7:11:52 | target |
153-
| node.js:11:26:11:32 | req.url | node.js:11:16:11:39 | url.par ... , true) |
154-
| node.js:11:26:11:32 | req.url | node.js:11:16:11:39 | url.par ... , true) |
155-
| node.js:15:40:15:45 | target | node.js:15:34:15:45 | '/' + target |
156-
| node.js:15:40:15:45 | target | node.js:15:34:15:45 | '/' + target |
157-
| node.js:29:7:29:52 | target | node.js:32:34:32:39 | target |
158-
| node.js:29:16:29:39 | url.par ... , true) | node.js:29:16:29:45 | url.par ... ).query |
159-
| node.js:29:16:29:45 | url.par ... ).query | node.js:29:16:29:52 | url.par ... .target |
160-
| node.js:29:16:29:52 | url.par ... .target | node.js:29:7:29:52 | target |
161-
| node.js:29:26:29:32 | req.url | node.js:29:16:29:39 | url.par ... , true) |
162-
| node.js:29:26:29:32 | req.url | node.js:29:16:29:39 | url.par ... , true) |
163-
| node.js:32:34:32:39 | target | node.js:32:34:32:55 | target ... =" + me |
164-
| node.js:32:34:32:39 | target | node.js:32:34:32:55 | target ... =" + me |
142+
| node.js:5:7:5:52 | target | node.js:6:34:6:39 | target |
143+
| node.js:5:7:5:52 | target | node.js:6:34:6:39 | target |
144+
| node.js:5:16:5:39 | url.par ... , true) | node.js:5:16:5:45 | url.par ... ).query |
145+
| node.js:5:16:5:45 | url.par ... ).query | node.js:5:16:5:52 | url.par ... .target |
146+
| node.js:5:16:5:52 | url.par ... .target | node.js:5:7:5:52 | target |
147+
| node.js:5:26:5:32 | req.url | node.js:5:16:5:39 | url.par ... , true) |
148+
| node.js:5:26:5:32 | req.url | node.js:5:16:5:39 | url.par ... , true) |
149+
| node.js:10:7:10:52 | target | node.js:14:40:14:45 | target |
150+
| node.js:10:16:10:39 | url.par ... , true) | node.js:10:16:10:45 | url.par ... ).query |
151+
| node.js:10:16:10:45 | url.par ... ).query | node.js:10:16:10:52 | url.par ... .target |
152+
| node.js:10:16:10:52 | url.par ... .target | node.js:10:7:10:52 | target |
153+
| node.js:10:26:10:32 | req.url | node.js:10:16:10:39 | url.par ... , true) |
154+
| node.js:10:26:10:32 | req.url | node.js:10:16:10:39 | url.par ... , true) |
155+
| node.js:14:40:14:45 | target | node.js:14:34:14:45 | '/' + target |
156+
| node.js:14:40:14:45 | target | node.js:14:34:14:45 | '/' + target |
157+
| node.js:28:7:28:52 | target | node.js:31:34:31:39 | target |
158+
| node.js:28:16:28:39 | url.par ... , true) | node.js:28:16:28:45 | url.par ... ).query |
159+
| node.js:28:16:28:45 | url.par ... ).query | node.js:28:16:28:52 | url.par ... .target |
160+
| node.js:28:16:28:52 | url.par ... .target | node.js:28:7:28:52 | target |
161+
| node.js:28:26:28:32 | req.url | node.js:28:16:28:39 | url.par ... , true) |
162+
| node.js:28:26:28:32 | req.url | node.js:28:16:28:39 | url.par ... , true) |
163+
| node.js:31:34:31:39 | target | node.js:31:34:31:55 | target ... =" + me |
164+
| node.js:31:34:31:39 | target | node.js:31:34:31:55 | target ... =" + me |
165165
| react-native.js:7:7:7:33 | tainted | react-native.js:8:17:8:23 | tainted |
166166
| react-native.js:7:7:7:33 | tainted | react-native.js:8:17:8:23 | tainted |
167167
| react-native.js:7:7:7:33 | tainted | react-native.js:9:26:9:32 | tainted |
@@ -185,8 +185,8 @@ edges
185185
| koa.js:8:15:8:26 | `${url}${x}` | koa.js:6:12:6:27 | ctx.query.target | koa.js:8:15:8:26 | `${url}${x}` | Untrusted URL redirection due to $@. | koa.js:6:12:6:27 | ctx.query.target | user-provided value |
186186
| koa.js:14:16:14:18 | url | koa.js:6:12:6:27 | ctx.query.target | koa.js:14:16:14:18 | url | Untrusted URL redirection due to $@. | koa.js:6:12:6:27 | ctx.query.target | user-provided value |
187187
| koa.js:20:16:20:18 | url | koa.js:6:12:6:27 | ctx.query.target | koa.js:20:16:20:18 | url | Untrusted URL redirection due to $@. | koa.js:6:12:6:27 | ctx.query.target | user-provided value |
188-
| node.js:7:34:7:39 | target | node.js:6:26:6:32 | req.url | node.js:7:34:7:39 | target | Untrusted URL redirection due to $@. | node.js:6:26:6:32 | req.url | user-provided value |
189-
| node.js:15:34:15:45 | '/' + target | node.js:11:26:11:32 | req.url | node.js:15:34:15:45 | '/' + target | Untrusted URL redirection due to $@. | node.js:11:26:11:32 | req.url | user-provided value |
190-
| node.js:32:34:32:55 | target ... =" + me | node.js:29:26:29:32 | req.url | node.js:32:34:32:55 | target ... =" + me | Untrusted URL redirection due to $@. | node.js:29:26:29:32 | req.url | user-provided value |
188+
| node.js:6:34:6:39 | target | node.js:5:26:5:32 | req.url | node.js:6:34:6:39 | target | Untrusted URL redirection due to $@. | node.js:5:26:5:32 | req.url | user-provided value |
189+
| node.js:14:34:14:45 | '/' + target | node.js:10:26:10:32 | req.url | node.js:14:34:14:45 | '/' + target | Untrusted URL redirection due to $@. | node.js:10:26:10:32 | req.url | user-provided value |
190+
| node.js:31:34:31:55 | target ... =" + me | node.js:28:26:28:32 | req.url | node.js:31:34:31:55 | target ... =" + me | Untrusted URL redirection due to $@. | node.js:28:26:28:32 | req.url | user-provided value |
191191
| react-native.js:8:17:8:23 | tainted | react-native.js:7:17:7:33 | req.param("code") | react-native.js:8:17:8:23 | tainted | Untrusted URL redirection due to $@. | react-native.js:7:17:7:33 | req.param("code") | user-provided value |
192192
| react-native.js:9:26:9:32 | tainted | react-native.js:7:17:7:33 | req.param("code") | react-native.js:9:26:9:32 | tainted | Untrusted URL redirection due to $@. | react-native.js:7:17:7:33 | req.param("code") | user-provided value |

‎javascript/ql/test/query-tests/Security/CWE-601/ServerSideUrlRedirect/express.js

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -135,6 +135,6 @@ app.get('/redirect/:user', function(req, res) {
135135
res.redirect('//' + req.params.user); // BAD - could go to //evil.com
136136
res.redirect('u' + req.params.user); // BAD - could go to u.evil.com
137137

138-
res.redirect('/' + ('/u' + req.params.user)); // BAD - could go to //u.evil.com, but not flagged
138+
res.redirect('/' + ('/u' + req.params.user)); // BAD - could go to //u.evil.com, but not flagged [INCONSISTENCY]
139139
res.redirect('/u' + req.params.user); // GOOD
140140
});

‎javascript/ql/test/query-tests/Security/CWE-601/ServerSideUrlRedirect/node.js

Lines changed: 1 addition & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -2,9 +2,8 @@ var https = require('https');
22
var url = require('url');
33

44
var server = https.createServer(function(req, res) {
5-
// BAD: a request parameter is incorporated without validation into a URL redirect
65
let target = url.parse(req.url, true).query.target;
7-
res.writeHead(302, { Location: target });
6+
res.writeHead(302, { Location: target }); // BAD: a request parameter is incorporated without validation into a URL redirect
87
})
98

109
server.on('request', (req, res) => {

0 commit comments

Comments
 (0)