Skip to content

Commit 5ce2987

Browse files
committed
adjust comments to reflect that tainted-path have no array-steps
1 parent ed4e1bb commit 5ce2987

File tree

2 files changed

+2
-4
lines changed

2 files changed

+2
-4
lines changed
Lines changed: 0 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,2 +0,0 @@
1-
| query-tests/Security/CWE-022/TaintedPath/tainted-array-steps.js:10 | expected an alert, but found none | BAD: taint is preserved |
2-
| query-tests/Security/CWE-022/TaintedPath/tainted-array-steps.js:14 | expected an alert, but found none | BAD: taint is preserved |

javascript/ql/test/query-tests/Security/CWE-022/TaintedPath/tainted-array-steps.js

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -7,11 +7,11 @@ var fs = require('fs'),
77

88
var server = http.createServer(function(req, res) {
99
let path = url.parse(req.url, true).query.path;
10-
res.write(fs.readFileSync(['public', path].join('/'))); // BAD: taint is preserved
10+
res.write(fs.readFileSync(['public', path].join('/'))); // BAD - but not flagged because we have no array-steps [INCONSISTENCY]
1111

1212
let parts = ['public', path];
1313
parts = parts.map(x => x.toLowerCase());
14-
res.write(fs.readFileSync(parts.join('/'))); // BAD: taint is preserved
14+
res.write(fs.readFileSync(parts.join('/'))); // BAD - but not flagged because we have no array-steps [INCONSISTENCY]
1515
});
1616

1717
server.listen();

0 commit comments

Comments
 (0)