Skip to content

Commit 86b836c

Browse files
esbenaesbena
committed
JS: add tests for js/path-injection
1 parent aadb148 commit 86b836c

File tree

3 files changed

+190
-0
lines changed

3 files changed

+190
-0
lines changed

‎javascript/ql/test/query-tests/Security/CWE-022/TaintedPath/Consistency.expected

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,7 @@
11
| normalizedPaths.js:208:38:208:63 | // OK - ... anyway | Spurious alert |
2+
| normalizedPaths.js:259:26:259:30 | // OK | Spurious alert |
3+
| normalizedPaths.js:275:36:275:40 | // OK | Spurious alert |
4+
| normalizedPaths.js:282:36:282:40 | // OK | Spurious alert |
25
| tainted-string-steps.js:25:43:25:74 | // NOT ... flagged | Missing alert |
36
| tainted-string-steps.js:26:49:26:74 | // OK - ... flagged | Spurious alert |
47
| tainted-string-steps.js:28:39:28:70 | // NOT ... flagged | Missing alert |

‎javascript/ql/test/query-tests/Security/CWE-022/TaintedPath/TaintedPath.expected

Lines changed: 149 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1495,6 +1495,65 @@ nodes
14951495
| normalizedPaths.js:250:21:250:24 | path |
14961496
| normalizedPaths.js:250:21:250:24 | path |
14971497
| normalizedPaths.js:250:21:250:24 | path |
1498+
| normalizedPaths.js:256:6:256:26 | path |
1499+
| normalizedPaths.js:256:6:256:26 | path |
1500+
| normalizedPaths.js:256:6:256:26 | path |
1501+
| normalizedPaths.js:256:6:256:26 | path |
1502+
| normalizedPaths.js:256:13:256:26 | req.query.path |
1503+
| normalizedPaths.js:256:13:256:26 | req.query.path |
1504+
| normalizedPaths.js:256:13:256:26 | req.query.path |
1505+
| normalizedPaths.js:256:13:256:26 | req.query.path |
1506+
| normalizedPaths.js:256:13:256:26 | req.query.path |
1507+
| normalizedPaths.js:257:18:257:21 | path |
1508+
| normalizedPaths.js:257:18:257:21 | path |
1509+
| normalizedPaths.js:257:18:257:21 | path |
1510+
| normalizedPaths.js:257:18:257:21 | path |
1511+
| normalizedPaths.js:257:18:257:21 | path |
1512+
| normalizedPaths.js:259:19:259:22 | path |
1513+
| normalizedPaths.js:259:19:259:22 | path |
1514+
| normalizedPaths.js:259:19:259:22 | path |
1515+
| normalizedPaths.js:259:19:259:22 | path |
1516+
| normalizedPaths.js:259:19:259:22 | path |
1517+
| normalizedPaths.js:262:19:262:22 | path |
1518+
| normalizedPaths.js:262:19:262:22 | path |
1519+
| normalizedPaths.js:262:19:262:22 | path |
1520+
| normalizedPaths.js:262:19:262:22 | path |
1521+
| normalizedPaths.js:262:19:262:22 | path |
1522+
| normalizedPaths.js:266:19:266:22 | path |
1523+
| normalizedPaths.js:266:19:266:22 | path |
1524+
| normalizedPaths.js:266:19:266:22 | path |
1525+
| normalizedPaths.js:266:19:266:22 | path |
1526+
| normalizedPaths.js:266:19:266:22 | path |
1527+
| normalizedPaths.js:269:19:269:22 | path |
1528+
| normalizedPaths.js:269:19:269:22 | path |
1529+
| normalizedPaths.js:269:19:269:22 | path |
1530+
| normalizedPaths.js:269:19:269:22 | path |
1531+
| normalizedPaths.js:269:19:269:22 | path |
1532+
| normalizedPaths.js:273:6:273:49 | normalizedPath |
1533+
| normalizedPaths.js:273:6:273:49 | normalizedPath |
1534+
| normalizedPaths.js:273:6:273:49 | normalizedPath |
1535+
| normalizedPaths.js:273:23:273:49 | pathMod ... , path) |
1536+
| normalizedPaths.js:273:23:273:49 | pathMod ... , path) |
1537+
| normalizedPaths.js:273:23:273:49 | pathMod ... , path) |
1538+
| normalizedPaths.js:273:45:273:48 | path |
1539+
| normalizedPaths.js:273:45:273:48 | path |
1540+
| normalizedPaths.js:273:45:273:48 | path |
1541+
| normalizedPaths.js:275:19:275:32 | normalizedPath |
1542+
| normalizedPaths.js:275:19:275:32 | normalizedPath |
1543+
| normalizedPaths.js:275:19:275:32 | normalizedPath |
1544+
| normalizedPaths.js:275:19:275:32 | normalizedPath |
1545+
| normalizedPaths.js:278:19:278:32 | normalizedPath |
1546+
| normalizedPaths.js:278:19:278:32 | normalizedPath |
1547+
| normalizedPaths.js:278:19:278:32 | normalizedPath |
1548+
| normalizedPaths.js:278:19:278:32 | normalizedPath |
1549+
| normalizedPaths.js:282:19:282:32 | normalizedPath |
1550+
| normalizedPaths.js:282:19:282:32 | normalizedPath |
1551+
| normalizedPaths.js:282:19:282:32 | normalizedPath |
1552+
| normalizedPaths.js:282:19:282:32 | normalizedPath |
1553+
| normalizedPaths.js:285:19:285:32 | normalizedPath |
1554+
| normalizedPaths.js:285:19:285:32 | normalizedPath |
1555+
| normalizedPaths.js:285:19:285:32 | normalizedPath |
1556+
| normalizedPaths.js:285:19:285:32 | normalizedPath |
14981557
| tainted-require.js:7:19:7:37 | req.param("module") |
14991558
| tainted-require.js:7:19:7:37 | req.param("module") |
15001559
| tainted-require.js:7:19:7:37 | req.param("module") |
@@ -4228,6 +4287,87 @@ edges
42284287
| normalizedPaths.js:236:33:236:46 | req.query.path | normalizedPaths.js:236:14:236:47 | pathMod ... y.path) |
42294288
| normalizedPaths.js:236:33:236:46 | req.query.path | normalizedPaths.js:236:14:236:47 | pathMod ... y.path) |
42304289
| normalizedPaths.js:236:33:236:46 | req.query.path | normalizedPaths.js:236:14:236:47 | pathMod ... y.path) |
4290+
| normalizedPaths.js:256:6:256:26 | path | normalizedPaths.js:257:18:257:21 | path |
4291+
| normalizedPaths.js:256:6:256:26 | path | normalizedPaths.js:257:18:257:21 | path |
4292+
| normalizedPaths.js:256:6:256:26 | path | normalizedPaths.js:257:18:257:21 | path |
4293+
| normalizedPaths.js:256:6:256:26 | path | normalizedPaths.js:257:18:257:21 | path |
4294+
| normalizedPaths.js:256:6:256:26 | path | normalizedPaths.js:257:18:257:21 | path |
4295+
| normalizedPaths.js:256:6:256:26 | path | normalizedPaths.js:257:18:257:21 | path |
4296+
| normalizedPaths.js:256:6:256:26 | path | normalizedPaths.js:257:18:257:21 | path |
4297+
| normalizedPaths.js:256:6:256:26 | path | normalizedPaths.js:257:18:257:21 | path |
4298+
| normalizedPaths.js:256:6:256:26 | path | normalizedPaths.js:259:19:259:22 | path |
4299+
| normalizedPaths.js:256:6:256:26 | path | normalizedPaths.js:259:19:259:22 | path |
4300+
| normalizedPaths.js:256:6:256:26 | path | normalizedPaths.js:259:19:259:22 | path |
4301+
| normalizedPaths.js:256:6:256:26 | path | normalizedPaths.js:259:19:259:22 | path |
4302+
| normalizedPaths.js:256:6:256:26 | path | normalizedPaths.js:259:19:259:22 | path |
4303+
| normalizedPaths.js:256:6:256:26 | path | normalizedPaths.js:259:19:259:22 | path |
4304+
| normalizedPaths.js:256:6:256:26 | path | normalizedPaths.js:259:19:259:22 | path |
4305+
| normalizedPaths.js:256:6:256:26 | path | normalizedPaths.js:259:19:259:22 | path |
4306+
| normalizedPaths.js:256:6:256:26 | path | normalizedPaths.js:262:19:262:22 | path |
4307+
| normalizedPaths.js:256:6:256:26 | path | normalizedPaths.js:262:19:262:22 | path |
4308+
| normalizedPaths.js:256:6:256:26 | path | normalizedPaths.js:262:19:262:22 | path |
4309+
| normalizedPaths.js:256:6:256:26 | path | normalizedPaths.js:262:19:262:22 | path |
4310+
| normalizedPaths.js:256:6:256:26 | path | normalizedPaths.js:262:19:262:22 | path |
4311+
| normalizedPaths.js:256:6:256:26 | path | normalizedPaths.js:262:19:262:22 | path |
4312+
| normalizedPaths.js:256:6:256:26 | path | normalizedPaths.js:262:19:262:22 | path |
4313+
| normalizedPaths.js:256:6:256:26 | path | normalizedPaths.js:262:19:262:22 | path |
4314+
| normalizedPaths.js:256:6:256:26 | path | normalizedPaths.js:266:19:266:22 | path |
4315+
| normalizedPaths.js:256:6:256:26 | path | normalizedPaths.js:266:19:266:22 | path |
4316+
| normalizedPaths.js:256:6:256:26 | path | normalizedPaths.js:266:19:266:22 | path |
4317+
| normalizedPaths.js:256:6:256:26 | path | normalizedPaths.js:266:19:266:22 | path |
4318+
| normalizedPaths.js:256:6:256:26 | path | normalizedPaths.js:266:19:266:22 | path |
4319+
| normalizedPaths.js:256:6:256:26 | path | normalizedPaths.js:266:19:266:22 | path |
4320+
| normalizedPaths.js:256:6:256:26 | path | normalizedPaths.js:266:19:266:22 | path |
4321+
| normalizedPaths.js:256:6:256:26 | path | normalizedPaths.js:266:19:266:22 | path |
4322+
| normalizedPaths.js:256:6:256:26 | path | normalizedPaths.js:269:19:269:22 | path |
4323+
| normalizedPaths.js:256:6:256:26 | path | normalizedPaths.js:269:19:269:22 | path |
4324+
| normalizedPaths.js:256:6:256:26 | path | normalizedPaths.js:269:19:269:22 | path |
4325+
| normalizedPaths.js:256:6:256:26 | path | normalizedPaths.js:269:19:269:22 | path |
4326+
| normalizedPaths.js:256:6:256:26 | path | normalizedPaths.js:269:19:269:22 | path |
4327+
| normalizedPaths.js:256:6:256:26 | path | normalizedPaths.js:269:19:269:22 | path |
4328+
| normalizedPaths.js:256:6:256:26 | path | normalizedPaths.js:269:19:269:22 | path |
4329+
| normalizedPaths.js:256:6:256:26 | path | normalizedPaths.js:269:19:269:22 | path |
4330+
| normalizedPaths.js:256:6:256:26 | path | normalizedPaths.js:273:45:273:48 | path |
4331+
| normalizedPaths.js:256:6:256:26 | path | normalizedPaths.js:273:45:273:48 | path |
4332+
| normalizedPaths.js:256:6:256:26 | path | normalizedPaths.js:273:45:273:48 | path |
4333+
| normalizedPaths.js:256:13:256:26 | req.query.path | normalizedPaths.js:256:6:256:26 | path |
4334+
| normalizedPaths.js:256:13:256:26 | req.query.path | normalizedPaths.js:256:6:256:26 | path |
4335+
| normalizedPaths.js:256:13:256:26 | req.query.path | normalizedPaths.js:256:6:256:26 | path |
4336+
| normalizedPaths.js:256:13:256:26 | req.query.path | normalizedPaths.js:256:6:256:26 | path |
4337+
| normalizedPaths.js:256:13:256:26 | req.query.path | normalizedPaths.js:256:6:256:26 | path |
4338+
| normalizedPaths.js:256:13:256:26 | req.query.path | normalizedPaths.js:256:6:256:26 | path |
4339+
| normalizedPaths.js:256:13:256:26 | req.query.path | normalizedPaths.js:256:6:256:26 | path |
4340+
| normalizedPaths.js:256:13:256:26 | req.query.path | normalizedPaths.js:256:6:256:26 | path |
4341+
| normalizedPaths.js:273:6:273:49 | normalizedPath | normalizedPaths.js:275:19:275:32 | normalizedPath |
4342+
| normalizedPaths.js:273:6:273:49 | normalizedPath | normalizedPaths.js:275:19:275:32 | normalizedPath |
4343+
| normalizedPaths.js:273:6:273:49 | normalizedPath | normalizedPaths.js:275:19:275:32 | normalizedPath |
4344+
| normalizedPaths.js:273:6:273:49 | normalizedPath | normalizedPaths.js:275:19:275:32 | normalizedPath |
4345+
| normalizedPaths.js:273:6:273:49 | normalizedPath | normalizedPaths.js:275:19:275:32 | normalizedPath |
4346+
| normalizedPaths.js:273:6:273:49 | normalizedPath | normalizedPaths.js:275:19:275:32 | normalizedPath |
4347+
| normalizedPaths.js:273:6:273:49 | normalizedPath | normalizedPaths.js:278:19:278:32 | normalizedPath |
4348+
| normalizedPaths.js:273:6:273:49 | normalizedPath | normalizedPaths.js:278:19:278:32 | normalizedPath |
4349+
| normalizedPaths.js:273:6:273:49 | normalizedPath | normalizedPaths.js:278:19:278:32 | normalizedPath |
4350+
| normalizedPaths.js:273:6:273:49 | normalizedPath | normalizedPaths.js:278:19:278:32 | normalizedPath |
4351+
| normalizedPaths.js:273:6:273:49 | normalizedPath | normalizedPaths.js:278:19:278:32 | normalizedPath |
4352+
| normalizedPaths.js:273:6:273:49 | normalizedPath | normalizedPaths.js:278:19:278:32 | normalizedPath |
4353+
| normalizedPaths.js:273:6:273:49 | normalizedPath | normalizedPaths.js:282:19:282:32 | normalizedPath |
4354+
| normalizedPaths.js:273:6:273:49 | normalizedPath | normalizedPaths.js:282:19:282:32 | normalizedPath |
4355+
| normalizedPaths.js:273:6:273:49 | normalizedPath | normalizedPaths.js:282:19:282:32 | normalizedPath |
4356+
| normalizedPaths.js:273:6:273:49 | normalizedPath | normalizedPaths.js:282:19:282:32 | normalizedPath |
4357+
| normalizedPaths.js:273:6:273:49 | normalizedPath | normalizedPaths.js:282:19:282:32 | normalizedPath |
4358+
| normalizedPaths.js:273:6:273:49 | normalizedPath | normalizedPaths.js:282:19:282:32 | normalizedPath |
4359+
| normalizedPaths.js:273:6:273:49 | normalizedPath | normalizedPaths.js:285:19:285:32 | normalizedPath |
4360+
| normalizedPaths.js:273:6:273:49 | normalizedPath | normalizedPaths.js:285:19:285:32 | normalizedPath |
4361+
| normalizedPaths.js:273:6:273:49 | normalizedPath | normalizedPaths.js:285:19:285:32 | normalizedPath |
4362+
| normalizedPaths.js:273:6:273:49 | normalizedPath | normalizedPaths.js:285:19:285:32 | normalizedPath |
4363+
| normalizedPaths.js:273:6:273:49 | normalizedPath | normalizedPaths.js:285:19:285:32 | normalizedPath |
4364+
| normalizedPaths.js:273:6:273:49 | normalizedPath | normalizedPaths.js:285:19:285:32 | normalizedPath |
4365+
| normalizedPaths.js:273:23:273:49 | pathMod ... , path) | normalizedPaths.js:273:6:273:49 | normalizedPath |
4366+
| normalizedPaths.js:273:23:273:49 | pathMod ... , path) | normalizedPaths.js:273:6:273:49 | normalizedPath |
4367+
| normalizedPaths.js:273:23:273:49 | pathMod ... , path) | normalizedPaths.js:273:6:273:49 | normalizedPath |
4368+
| normalizedPaths.js:273:45:273:48 | path | normalizedPaths.js:273:23:273:49 | pathMod ... , path) |
4369+
| normalizedPaths.js:273:45:273:48 | path | normalizedPaths.js:273:23:273:49 | pathMod ... , path) |
4370+
| normalizedPaths.js:273:45:273:48 | path | normalizedPaths.js:273:23:273:49 | pathMod ... , path) |
42314371
| tainted-require.js:7:19:7:37 | req.param("module") | tainted-require.js:7:19:7:37 | req.param("module") |
42324372
| tainted-sendFile.js:8:16:8:33 | req.param("gimme") | tainted-sendFile.js:8:16:8:33 | req.param("gimme") |
42334373
| tainted-sendFile.js:10:16:10:33 | req.param("gimme") | tainted-sendFile.js:10:16:10:33 | req.param("gimme") |
@@ -5096,6 +5236,15 @@ edges
50965236
| normalizedPaths.js:238:19:238:22 | path | normalizedPaths.js:236:33:236:46 | req.query.path | normalizedPaths.js:238:19:238:22 | path | This path depends on $@. | normalizedPaths.js:236:33:236:46 | req.query.path | a user-provided value |
50975237
| normalizedPaths.js:245:21:245:24 | path | normalizedPaths.js:236:33:236:46 | req.query.path | normalizedPaths.js:245:21:245:24 | path | This path depends on $@. | normalizedPaths.js:236:33:236:46 | req.query.path | a user-provided value |
50985238
| normalizedPaths.js:250:21:250:24 | path | normalizedPaths.js:236:33:236:46 | req.query.path | normalizedPaths.js:250:21:250:24 | path | This path depends on $@. | normalizedPaths.js:236:33:236:46 | req.query.path | a user-provided value |
5239+
| normalizedPaths.js:257:18:257:21 | path | normalizedPaths.js:256:13:256:26 | req.query.path | normalizedPaths.js:257:18:257:21 | path | This path depends on $@. | normalizedPaths.js:256:13:256:26 | req.query.path | a user-provided value |
5240+
| normalizedPaths.js:259:19:259:22 | path | normalizedPaths.js:256:13:256:26 | req.query.path | normalizedPaths.js:259:19:259:22 | path | This path depends on $@. | normalizedPaths.js:256:13:256:26 | req.query.path | a user-provided value |
5241+
| normalizedPaths.js:262:19:262:22 | path | normalizedPaths.js:256:13:256:26 | req.query.path | normalizedPaths.js:262:19:262:22 | path | This path depends on $@. | normalizedPaths.js:256:13:256:26 | req.query.path | a user-provided value |
5242+
| normalizedPaths.js:266:19:266:22 | path | normalizedPaths.js:256:13:256:26 | req.query.path | normalizedPaths.js:266:19:266:22 | path | This path depends on $@. | normalizedPaths.js:256:13:256:26 | req.query.path | a user-provided value |
5243+
| normalizedPaths.js:269:19:269:22 | path | normalizedPaths.js:256:13:256:26 | req.query.path | normalizedPaths.js:269:19:269:22 | path | This path depends on $@. | normalizedPaths.js:256:13:256:26 | req.query.path | a user-provided value |
5244+
| normalizedPaths.js:275:19:275:32 | normalizedPath | normalizedPaths.js:256:13:256:26 | req.query.path | normalizedPaths.js:275:19:275:32 | normalizedPath | This path depends on $@. | normalizedPaths.js:256:13:256:26 | req.query.path | a user-provided value |
5245+
| normalizedPaths.js:278:19:278:32 | normalizedPath | normalizedPaths.js:256:13:256:26 | req.query.path | normalizedPaths.js:278:19:278:32 | normalizedPath | This path depends on $@. | normalizedPaths.js:256:13:256:26 | req.query.path | a user-provided value |
5246+
| normalizedPaths.js:282:19:282:32 | normalizedPath | normalizedPaths.js:256:13:256:26 | req.query.path | normalizedPaths.js:282:19:282:32 | normalizedPath | This path depends on $@. | normalizedPaths.js:256:13:256:26 | req.query.path | a user-provided value |
5247+
| normalizedPaths.js:285:19:285:32 | normalizedPath | normalizedPaths.js:256:13:256:26 | req.query.path | normalizedPaths.js:285:19:285:32 | normalizedPath | This path depends on $@. | normalizedPaths.js:256:13:256:26 | req.query.path | a user-provided value |
50995248
| tainted-require.js:7:19:7:37 | req.param("module") | tainted-require.js:7:19:7:37 | req.param("module") | tainted-require.js:7:19:7:37 | req.param("module") | This path depends on $@. | tainted-require.js:7:19:7:37 | req.param("module") | a user-provided value |
51005249
| tainted-sendFile.js:8:16:8:33 | req.param("gimme") | tainted-sendFile.js:8:16:8:33 | req.param("gimme") | tainted-sendFile.js:8:16:8:33 | req.param("gimme") | This path depends on $@. | tainted-sendFile.js:8:16:8:33 | req.param("gimme") | a user-provided value |
51015250
| tainted-sendFile.js:10:16:10:33 | req.param("gimme") | tainted-sendFile.js:10:16:10:33 | req.param("gimme") | tainted-sendFile.js:10:16:10:33 | req.param("gimme") | This path depends on $@. | tainted-sendFile.js:10:16:10:33 | req.param("gimme") | a user-provided value |

‎javascript/ql/test/query-tests/Security/CWE-022/TaintedPath/normalizedPaths.js

Lines changed: 38 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -249,3 +249,41 @@ app.get('/resolve-path', (req, res) => {
249249
else
250250
fs.readFileSync(path); // NOT OK - wrong polarity
251251
});
252+
253+
var isPathInside = require("is-path-inside"),
254+
pathIsInside = require("path-is-inside");
255+
app.get('/pseudo-normalizations', (req, res) => {
256+
let path = req.query.path;
257+
fs.readFileSync(path); // NOT OK
258+
if (isPathInside(path, SAFE)) {
259+
fs.readFileSync(path); // OK
260+
return;
261+
} else {
262+
fs.readFileSync(path); // NOT OK
263+
264+
}
265+
if (pathIsInside(path, SAFE)) {
266+
fs.readFileSync(path); // NOT OK - can be of the form 'safe/directory/../../../etc/passwd'
267+
return;
268+
} else {
269+
fs.readFileSync(path); // NOT OK
270+
271+
}
272+
273+
let normalizedPath = pathModule.join(SAFE, path);
274+
if (pathIsInside(normalizedPath, SAFE)) {
275+
fs.readFileSync(normalizedPath); // OK
276+
return;
277+
} else {
278+
fs.readFileSync(normalizedPath); // NOT OK
279+
}
280+
281+
if (pathIsInside(normalizedPath, SAFE)) {
282+
fs.readFileSync(normalizedPath); // OK
283+
return;
284+
} else {
285+
fs.readFileSync(normalizedPath); // NOT OK
286+
287+
}
288+
289+
});

0 commit comments

Comments
 (0)