Skip to content

Commit 7045fb4

Browse files
asgerfasgerf
committed
JS: Expand on test
1 parent ec5e028 commit 7045fb4

File tree

8 files changed

+158
-0
lines changed

8 files changed

+158
-0
lines changed

‎javascript/ql/test/library-tests/frameworks/Templating/CodeInjection.expected

Lines changed: 33 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,33 @@
1+
nodes
2+
| app.js:15:30:15:58 | req.que ... tedCode |
3+
| app.js:15:30:15:58 | req.que ... tedCode |
4+
| app.js:17:25:17:48 | req.que ... shSink1 |
5+
| app.js:17:25:17:48 | req.que ... shSink1 |
6+
| app.js:19:35:19:68 | req.que ... rString |
7+
| app.js:19:35:19:68 | req.que ... rString |
8+
| views/ejs_sinks.ejs:13:39:13:64 | <%= dataInGeneratedCode %> |
9+
| views/ejs_sinks.ejs:13:39:13:64 | <%= dataInGeneratedCode %> |
10+
| views/ejs_sinks.ejs:13:43:13:61 | dataInGeneratedCode |
11+
| views/ejs_sinks.ejs:16:19:16:39 | <%= backslashSink1 %> |
12+
| views/ejs_sinks.ejs:16:19:16:39 | <%= backslashSink1 %> |
13+
| views/ejs_sinks.ejs:16:23:16:36 | backslashSink1 |
14+
| views/ejs_sinks.ejs:21:39:21:69 | <%= dataInEventHandlerString %> |
15+
| views/ejs_sinks.ejs:21:39:21:69 | <%= dataInEventHandlerString %> |
16+
| views/ejs_sinks.ejs:21:43:21:66 | dataInE ... rString |
17+
edges
18+
| app.js:15:30:15:58 | req.que ... tedCode | views/ejs_sinks.ejs:13:43:13:61 | dataInGeneratedCode |
19+
| app.js:15:30:15:58 | req.que ... tedCode | views/ejs_sinks.ejs:13:43:13:61 | dataInGeneratedCode |
20+
| app.js:17:25:17:48 | req.que ... shSink1 | views/ejs_sinks.ejs:16:23:16:36 | backslashSink1 |
21+
| app.js:17:25:17:48 | req.que ... shSink1 | views/ejs_sinks.ejs:16:23:16:36 | backslashSink1 |
22+
| app.js:19:35:19:68 | req.que ... rString | views/ejs_sinks.ejs:21:43:21:66 | dataInE ... rString |
23+
| app.js:19:35:19:68 | req.que ... rString | views/ejs_sinks.ejs:21:43:21:66 | dataInE ... rString |
24+
| views/ejs_sinks.ejs:13:43:13:61 | dataInGeneratedCode | views/ejs_sinks.ejs:13:39:13:64 | <%= dataInGeneratedCode %> |
25+
| views/ejs_sinks.ejs:13:43:13:61 | dataInGeneratedCode | views/ejs_sinks.ejs:13:39:13:64 | <%= dataInGeneratedCode %> |
26+
| views/ejs_sinks.ejs:16:23:16:36 | backslashSink1 | views/ejs_sinks.ejs:16:19:16:39 | <%= backslashSink1 %> |
27+
| views/ejs_sinks.ejs:16:23:16:36 | backslashSink1 | views/ejs_sinks.ejs:16:19:16:39 | <%= backslashSink1 %> |
28+
| views/ejs_sinks.ejs:21:43:21:66 | dataInE ... rString | views/ejs_sinks.ejs:21:39:21:69 | <%= dataInEventHandlerString %> |
29+
| views/ejs_sinks.ejs:21:43:21:66 | dataInE ... rString | views/ejs_sinks.ejs:21:39:21:69 | <%= dataInEventHandlerString %> |
30+
#select
31+
| views/ejs_sinks.ejs:13:39:13:64 | <%= dataInGeneratedCode %> | app.js:15:30:15:58 | req.que ... tedCode | views/ejs_sinks.ejs:13:39:13:64 | <%= dataInGeneratedCode %> | $@ flows to here and is interpreted as code. | app.js:15:30:15:58 | req.que ... tedCode | User-provided value |
32+
| views/ejs_sinks.ejs:16:19:16:39 | <%= backslashSink1 %> | app.js:17:25:17:48 | req.que ... shSink1 | views/ejs_sinks.ejs:16:19:16:39 | <%= backslashSink1 %> | $@ flows to here and is interpreted as code. | app.js:17:25:17:48 | req.que ... shSink1 | User-provided value |
33+
| views/ejs_sinks.ejs:21:39:21:69 | <%= dataInEventHandlerString %> | app.js:19:35:19:68 | req.que ... rString | views/ejs_sinks.ejs:21:39:21:69 | <%= dataInEventHandlerString %> | $@ flows to here and is interpreted as code. | app.js:19:35:19:68 | req.que ... rString | User-provided value |

‎javascript/ql/test/library-tests/frameworks/Templating/CodeInjection.qlref

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1 @@
1+
Security/CWE-094/CodeInjection.ql

‎javascript/ql/test/library-tests/frameworks/Templating/Xss.expected

Lines changed: 53 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,53 @@
1+
nodes
2+
| app.js:8:18:8:34 | req.query.rawHtml |
3+
| app.js:8:18:8:34 | req.query.rawHtml |
4+
| app.js:11:26:11:46 | req.que ... tmlProp |
5+
| app.js:11:26:11:46 | req.que ... tmlProp |
6+
| app.js:14:33:14:64 | req.que ... eralRaw |
7+
| app.js:14:33:14:64 | req.que ... eralRaw |
8+
| app.js:16:33:16:64 | req.que ... CodeRaw |
9+
| app.js:16:33:16:64 | req.que ... CodeRaw |
10+
| app.js:20:38:20:74 | req.que ... ringRaw |
11+
| app.js:20:38:20:74 | req.que ... ringRaw |
12+
| views/ejs_sinks.ejs:4:9:4:22 | <%- rawHtml %> |
13+
| views/ejs_sinks.ejs:4:9:4:22 | <%- rawHtml %> |
14+
| views/ejs_sinks.ejs:4:13:4:19 | rawHtml |
15+
| views/ejs_sinks.ejs:7:9:7:33 | <%- object.rawHtmlProp %> |
16+
| views/ejs_sinks.ejs:7:9:7:33 | <%- object.rawHtmlProp %> |
17+
| views/ejs_sinks.ejs:7:13:7:30 | object.rawHtmlProp |
18+
| views/ejs_sinks.ejs:11:43:11:71 | <%- dataInStringLiteralRaw %> |
19+
| views/ejs_sinks.ejs:11:43:11:71 | <%- dataInStringLiteralRaw %> |
20+
| views/ejs_sinks.ejs:11:47:11:68 | dataInS ... eralRaw |
21+
| views/ejs_sinks.ejs:14:42:14:70 | <%- dataInGeneratedCodeRaw %> |
22+
| views/ejs_sinks.ejs:14:42:14:70 | <%- dataInGeneratedCodeRaw %> |
23+
| views/ejs_sinks.ejs:14:46:14:67 | dataInG ... CodeRaw |
24+
| views/ejs_sinks.ejs:22:39:22:72 | <%- dataInEventHandlerStringRaw %> |
25+
| views/ejs_sinks.ejs:22:39:22:72 | <%- dataInEventHandlerStringRaw %> |
26+
| views/ejs_sinks.ejs:22:43:22:69 | dataInE ... ringRaw |
27+
edges
28+
| app.js:8:18:8:34 | req.query.rawHtml | views/ejs_sinks.ejs:4:13:4:19 | rawHtml |
29+
| app.js:8:18:8:34 | req.query.rawHtml | views/ejs_sinks.ejs:4:13:4:19 | rawHtml |
30+
| app.js:11:26:11:46 | req.que ... tmlProp | views/ejs_sinks.ejs:7:13:7:30 | object.rawHtmlProp |
31+
| app.js:11:26:11:46 | req.que ... tmlProp | views/ejs_sinks.ejs:7:13:7:30 | object.rawHtmlProp |
32+
| app.js:14:33:14:64 | req.que ... eralRaw | views/ejs_sinks.ejs:11:47:11:68 | dataInS ... eralRaw |
33+
| app.js:14:33:14:64 | req.que ... eralRaw | views/ejs_sinks.ejs:11:47:11:68 | dataInS ... eralRaw |
34+
| app.js:16:33:16:64 | req.que ... CodeRaw | views/ejs_sinks.ejs:14:46:14:67 | dataInG ... CodeRaw |
35+
| app.js:16:33:16:64 | req.que ... CodeRaw | views/ejs_sinks.ejs:14:46:14:67 | dataInG ... CodeRaw |
36+
| app.js:20:38:20:74 | req.que ... ringRaw | views/ejs_sinks.ejs:22:43:22:69 | dataInE ... ringRaw |
37+
| app.js:20:38:20:74 | req.que ... ringRaw | views/ejs_sinks.ejs:22:43:22:69 | dataInE ... ringRaw |
38+
| views/ejs_sinks.ejs:4:13:4:19 | rawHtml | views/ejs_sinks.ejs:4:9:4:22 | <%- rawHtml %> |
39+
| views/ejs_sinks.ejs:4:13:4:19 | rawHtml | views/ejs_sinks.ejs:4:9:4:22 | <%- rawHtml %> |
40+
| views/ejs_sinks.ejs:7:13:7:30 | object.rawHtmlProp | views/ejs_sinks.ejs:7:9:7:33 | <%- object.rawHtmlProp %> |
41+
| views/ejs_sinks.ejs:7:13:7:30 | object.rawHtmlProp | views/ejs_sinks.ejs:7:9:7:33 | <%- object.rawHtmlProp %> |
42+
| views/ejs_sinks.ejs:11:47:11:68 | dataInS ... eralRaw | views/ejs_sinks.ejs:11:43:11:71 | <%- dataInStringLiteralRaw %> |
43+
| views/ejs_sinks.ejs:11:47:11:68 | dataInS ... eralRaw | views/ejs_sinks.ejs:11:43:11:71 | <%- dataInStringLiteralRaw %> |
44+
| views/ejs_sinks.ejs:14:46:14:67 | dataInG ... CodeRaw | views/ejs_sinks.ejs:14:42:14:70 | <%- dataInGeneratedCodeRaw %> |
45+
| views/ejs_sinks.ejs:14:46:14:67 | dataInG ... CodeRaw | views/ejs_sinks.ejs:14:42:14:70 | <%- dataInGeneratedCodeRaw %> |
46+
| views/ejs_sinks.ejs:22:43:22:69 | dataInE ... ringRaw | views/ejs_sinks.ejs:22:39:22:72 | <%- dataInEventHandlerStringRaw %> |
47+
| views/ejs_sinks.ejs:22:43:22:69 | dataInE ... ringRaw | views/ejs_sinks.ejs:22:39:22:72 | <%- dataInEventHandlerStringRaw %> |
48+
#select
49+
| views/ejs_sinks.ejs:4:9:4:22 | <%- rawHtml %> | app.js:8:18:8:34 | req.query.rawHtml | views/ejs_sinks.ejs:4:9:4:22 | <%- rawHtml %> | Cross-site scripting vulnerability due to $@. | app.js:8:18:8:34 | req.query.rawHtml | user-provided value |
50+
| views/ejs_sinks.ejs:7:9:7:33 | <%- object.rawHtmlProp %> | app.js:11:26:11:46 | req.que ... tmlProp | views/ejs_sinks.ejs:7:9:7:33 | <%- object.rawHtmlProp %> | Cross-site scripting vulnerability due to $@. | app.js:11:26:11:46 | req.que ... tmlProp | user-provided value |
51+
| views/ejs_sinks.ejs:11:43:11:71 | <%- dataInStringLiteralRaw %> | app.js:14:33:14:64 | req.que ... eralRaw | views/ejs_sinks.ejs:11:43:11:71 | <%- dataInStringLiteralRaw %> | Cross-site scripting vulnerability due to $@. | app.js:14:33:14:64 | req.que ... eralRaw | user-provided value |
52+
| views/ejs_sinks.ejs:14:42:14:70 | <%- dataInGeneratedCodeRaw %> | app.js:16:33:16:64 | req.que ... CodeRaw | views/ejs_sinks.ejs:14:42:14:70 | <%- dataInGeneratedCodeRaw %> | Cross-site scripting vulnerability due to $@. | app.js:16:33:16:64 | req.que ... CodeRaw | user-provided value |
53+
| views/ejs_sinks.ejs:22:39:22:72 | <%- dataInEventHandlerStringRaw %> | app.js:20:38:20:74 | req.que ... ringRaw | views/ejs_sinks.ejs:22:39:22:72 | <%- dataInEventHandlerStringRaw %> | Cross-site scripting vulnerability due to $@. | app.js:20:38:20:74 | req.que ... ringRaw | user-provided value |

‎javascript/ql/test/library-tests/frameworks/Templating/Xss.qlref

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1 @@
1+
Security/CWE-079/Xss.ql

‎javascript/ql/test/library-tests/frameworks/Templating/app.js

Lines changed: 22 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,22 @@
1+
const express = require('express');
2+
3+
let app = express();
4+
5+
app.get('/ejs', (req, res) => {
6+
res.render('ejs_sinks', {
7+
escapedHtml: req.query.escapedHtml,
8+
rawHtml: req.query.rawHtml,
9+
rawHtmlSafeValue: 'safe',
10+
object: {
11+
rawHtmlProp: req.query.rawHtmlProp
12+
},
13+
dataInStringLiteral: req.query.dataInStringLiteral,
14+
dataInStringLiteralRaw: req.query.dataInStringLiteralRaw,
15+
dataInGeneratedCode: req.query.dataInGeneratedCode,
16+
dataInGeneratedCodeRaw: req.query.dataInGeneratedCodeRaw,
17+
backslashSink1: req.query.backslashSink1,
18+
backslashSink2: req.query.backslashSink2,
19+
dataInEventHandlerString: req.query.dataInEventHandlerString,
20+
dataInEventHandlerStringRaw: req.query.dataInEventHandlerStringRaw,
21+
});
22+
});

‎javascript/ql/test/library-tests/frameworks/Templating/test.expected

Lines changed: 15 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -2,8 +2,23 @@ getTemplateInstantiationSyntax
22
| consolidate.js:3:1:3:83 | consoli ... => {}) | ejs |
33
| consolidate.js:4:1:4:90 | consoli ... => {}) | mustache |
44
getLikelyTemplateSyntax
5+
| views/ejs_sinks.ejs:0:0:0:0 | views/ejs_sinks.ejs | ejs |
56
| views/instantiated_as_ejs.html:0:0:0:0 | views/instantiated_as_ejs.html | ejs |
67
| views/instantiated_as_hbs.html:0:0:0:0 | views/instantiated_as_hbs.html | mustache |
8+
getTargetFile
9+
| app.js:6:5:21:6 | res.ren ... \\n }) | views/ejs_sinks.ejs:0:0:0:0 | views/ejs_sinks.ejs |
10+
| consolidate.js:3:1:3:83 | consoli ... => {}) | views/instantiated_as_ejs.html:0:0:0:0 | views/instantiated_as_ejs.html |
11+
| consolidate.js:4:1:4:90 | consoli ... => {}) | views/instantiated_as_hbs.html:0:0:0:0 | views/instantiated_as_hbs.html |
712
xssSink
13+
| views/ejs_sinks.ejs:4:9:4:22 | <%- rawHtml %> |
14+
| views/ejs_sinks.ejs:5:9:5:31 | <%- rawHtmlSafeValue %> |
15+
| views/ejs_sinks.ejs:7:9:7:33 | <%- object.rawHtmlProp %> |
16+
| views/ejs_sinks.ejs:11:43:11:71 | <%- dataInStringLiteralRaw %> |
17+
| views/ejs_sinks.ejs:14:42:14:70 | <%- dataInGeneratedCodeRaw %> |
18+
| views/ejs_sinks.ejs:22:39:22:72 | <%- dataInEventHandlerStringRaw %> |
819
| views/instantiated_as_ejs.html:4:9:4:23 | <%- xss_sink %> |
920
| views/instantiated_as_hbs.html:7:9:7:24 | {{{ xss_sink }}} |
21+
codeInjectionSink
22+
| views/ejs_sinks.ejs:13:39:13:64 | <%= dataInGeneratedCode %> |
23+
| views/ejs_sinks.ejs:16:19:16:39 | <%= backslashSink1 %> |
24+
| views/ejs_sinks.ejs:21:39:21:69 | <%= dataInEventHandlerString %> |

‎javascript/ql/test/library-tests/frameworks/Templating/test.ql

Lines changed: 9 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,6 @@
11
import javascript
22
import semmle.javascript.security.dataflow.Xss
3+
import semmle.javascript.security.dataflow.CodeInjectionCustomizations
34

45
query Templating::TemplateSyntax getTemplateInstantiationSyntax(Templating::TemplateInstantiaton inst) {
56
result = inst.getTemplateSyntax()
@@ -9,6 +10,14 @@ query Templating::TemplateSyntax getLikelyTemplateSyntax(Templating::TemplateFil
910
result = Templating::getLikelyTemplateSyntax(file)
1011
}
1112

13+
query Templating::TemplateFile getTargetFile(Templating::TemplateInstantiaton inst) {
14+
result = inst.getTemplateFile()
15+
}
16+
1217
query DomBasedXss::Sink xssSink() {
1318
any()
1419
}
20+
21+
query CodeInjection::Sink codeInjectionSink() {
22+
any()
23+
}

‎javascript/ql/test/library-tests/frameworks/Templating/views/ejs_sinks.ejs

Lines changed: 24 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,24 @@
1+
<html>
2+
<body>
3+
<%= escapedHtml %>
4+
<%- rawHtml %>
5+
<%- rawHtmlSafeValue %>
6+
7+
<%- object.rawHtmlProp %>
8+
9+
<script>
10+
var dataInStringLiteral = "<%= dataInStringLiteral %>";
11+
var dataInStringLiteralRaw = "<%- dataInStringLiteralRaw %>";
12+
13+
var dataInGeneratedCode = <%= dataInGeneratedCode %>;
14+
var dataInGeneratedCodeRaw = <%- dataInGeneratedCodeRaw %>;
15+
16+
init("<%= backslashSink1 %>", "<%= backslashSink2 %>");
17+
18+
var mustache = "{{ rawHtml }}";
19+
</script>
20+
21+
<button onclick="doSomething('<%= dataInEventHandlerString %>')">Click me</button>
22+
<button onclick="doSomething('<%- dataInEventHandlerStringRaw %>')">Click me</button>
23+
</body>
24+
</html>

0 commit comments

Comments
 (0)