Skip to content

Commit e61d534

Browse files
asgerfasgerf
committed
JS: Add ambiguity test for template file resolution
1 parent 308461a commit e61d534

File tree

6 files changed

+100
-0
lines changed

6 files changed

+100
-0
lines changed

‎javascript/ql/test/library-tests/frameworks/Templating/Xss.expected

Lines changed: 40 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -50,6 +50,25 @@ nodes
5050
| projectA/views/subfolder/other.ejs:2:1:2:12 | <%- sinkA %> |
5151
| projectA/views/subfolder/other.ejs:2:1:2:12 | <%- sinkA %> |
5252
| projectA/views/subfolder/other.ejs:2:5:2:9 | sinkA |
53+
| projectB/src/index.js:8:16:8:30 | req.query.sinkB |
54+
| projectB/src/index.js:8:16:8:30 | req.query.sinkB |
55+
| projectB/src/index.js:13:16:13:30 | req.query.sinkB |
56+
| projectB/src/index.js:13:16:13:30 | req.query.sinkB |
57+
| projectB/src/index.js:18:16:18:30 | req.query.sinkB |
58+
| projectB/src/index.js:18:16:18:30 | req.query.sinkB |
59+
| projectB/src/index.js:33:16:33:30 | req.query.sinkB |
60+
| projectB/src/index.js:33:16:33:30 | req.query.sinkB |
61+
| projectB/src/index.js:38:16:38:30 | req.query.sinkB |
62+
| projectB/src/index.js:38:16:38:30 | req.query.sinkB |
63+
| projectB/views/main.ejs:3:1:3:12 | <%- sinkB %> |
64+
| projectB/views/main.ejs:3:1:3:12 | <%- sinkB %> |
65+
| projectB/views/main.ejs:3:5:3:9 | sinkB |
66+
| projectB/views/subfolder/index.ejs:3:1:3:12 | <%- sinkB %> |
67+
| projectB/views/subfolder/index.ejs:3:1:3:12 | <%- sinkB %> |
68+
| projectB/views/subfolder/index.ejs:3:5:3:9 | sinkB |
69+
| projectB/views/subfolder/other.ejs:3:1:3:12 | <%- sinkB %> |
70+
| projectB/views/subfolder/other.ejs:3:1:3:12 | <%- sinkB %> |
71+
| projectB/views/subfolder/other.ejs:3:5:3:9 | sinkB |
5372
| views/ejs_sinks.ejs:4:9:4:22 | <%- rawHtml %> |
5473
| views/ejs_sinks.ejs:4:9:4:22 | <%- rawHtml %> |
5574
| views/ejs_sinks.ejs:4:13:4:19 | rawHtml |
@@ -152,6 +171,22 @@ edges
152171
| projectA/views/subfolder/index.ejs:2:5:2:9 | sinkA | projectA/views/subfolder/index.ejs:2:1:2:12 | <%- sinkA %> |
153172
| projectA/views/subfolder/other.ejs:2:5:2:9 | sinkA | projectA/views/subfolder/other.ejs:2:1:2:12 | <%- sinkA %> |
154173
| projectA/views/subfolder/other.ejs:2:5:2:9 | sinkA | projectA/views/subfolder/other.ejs:2:1:2:12 | <%- sinkA %> |
174+
| projectB/src/index.js:8:16:8:30 | req.query.sinkB | projectB/views/main.ejs:3:5:3:9 | sinkB |
175+
| projectB/src/index.js:8:16:8:30 | req.query.sinkB | projectB/views/main.ejs:3:5:3:9 | sinkB |
176+
| projectB/src/index.js:13:16:13:30 | req.query.sinkB | projectB/views/main.ejs:3:5:3:9 | sinkB |
177+
| projectB/src/index.js:13:16:13:30 | req.query.sinkB | projectB/views/main.ejs:3:5:3:9 | sinkB |
178+
| projectB/src/index.js:18:16:18:30 | req.query.sinkB | projectB/views/subfolder/index.ejs:3:5:3:9 | sinkB |
179+
| projectB/src/index.js:18:16:18:30 | req.query.sinkB | projectB/views/subfolder/index.ejs:3:5:3:9 | sinkB |
180+
| projectB/src/index.js:33:16:33:30 | req.query.sinkB | projectB/views/subfolder/other.ejs:3:5:3:9 | sinkB |
181+
| projectB/src/index.js:33:16:33:30 | req.query.sinkB | projectB/views/subfolder/other.ejs:3:5:3:9 | sinkB |
182+
| projectB/src/index.js:38:16:38:30 | req.query.sinkB | projectB/views/subfolder/other.ejs:3:5:3:9 | sinkB |
183+
| projectB/src/index.js:38:16:38:30 | req.query.sinkB | projectB/views/subfolder/other.ejs:3:5:3:9 | sinkB |
184+
| projectB/views/main.ejs:3:5:3:9 | sinkB | projectB/views/main.ejs:3:1:3:12 | <%- sinkB %> |
185+
| projectB/views/main.ejs:3:5:3:9 | sinkB | projectB/views/main.ejs:3:1:3:12 | <%- sinkB %> |
186+
| projectB/views/subfolder/index.ejs:3:5:3:9 | sinkB | projectB/views/subfolder/index.ejs:3:1:3:12 | <%- sinkB %> |
187+
| projectB/views/subfolder/index.ejs:3:5:3:9 | sinkB | projectB/views/subfolder/index.ejs:3:1:3:12 | <%- sinkB %> |
188+
| projectB/views/subfolder/other.ejs:3:5:3:9 | sinkB | projectB/views/subfolder/other.ejs:3:1:3:12 | <%- sinkB %> |
189+
| projectB/views/subfolder/other.ejs:3:5:3:9 | sinkB | projectB/views/subfolder/other.ejs:3:1:3:12 | <%- sinkB %> |
155190
| views/ejs_sinks.ejs:4:13:4:19 | rawHtml | views/ejs_sinks.ejs:4:9:4:22 | <%- rawHtml %> |
156191
| views/ejs_sinks.ejs:4:13:4:19 | rawHtml | views/ejs_sinks.ejs:4:9:4:22 | <%- rawHtml %> |
157192
| views/ejs_sinks.ejs:7:13:7:30 | object.rawHtmlProp | views/ejs_sinks.ejs:7:9:7:33 | <%- object.rawHtmlProp %> |
@@ -180,6 +215,11 @@ edges
180215
| projectA/views/subfolder/index.ejs:2:1:2:12 | <%- sinkA %> | projectA/src/index.js:17:16:17:30 | req.query.sinkA | projectA/views/subfolder/index.ejs:2:1:2:12 | <%- sinkA %> | Cross-site scripting vulnerability due to $@. | projectA/src/index.js:17:16:17:30 | req.query.sinkA | user-provided value |
181216
| projectA/views/subfolder/other.ejs:2:1:2:12 | <%- sinkA %> | projectA/src/index.js:32:16:32:30 | req.query.sinkA | projectA/views/subfolder/other.ejs:2:1:2:12 | <%- sinkA %> | Cross-site scripting vulnerability due to $@. | projectA/src/index.js:32:16:32:30 | req.query.sinkA | user-provided value |
182217
| projectA/views/subfolder/other.ejs:2:1:2:12 | <%- sinkA %> | projectA/src/index.js:37:16:37:30 | req.query.sinkA | projectA/views/subfolder/other.ejs:2:1:2:12 | <%- sinkA %> | Cross-site scripting vulnerability due to $@. | projectA/src/index.js:37:16:37:30 | req.query.sinkA | user-provided value |
218+
| projectB/views/main.ejs:3:1:3:12 | <%- sinkB %> | projectB/src/index.js:8:16:8:30 | req.query.sinkB | projectB/views/main.ejs:3:1:3:12 | <%- sinkB %> | Cross-site scripting vulnerability due to $@. | projectB/src/index.js:8:16:8:30 | req.query.sinkB | user-provided value |
219+
| projectB/views/main.ejs:3:1:3:12 | <%- sinkB %> | projectB/src/index.js:13:16:13:30 | req.query.sinkB | projectB/views/main.ejs:3:1:3:12 | <%- sinkB %> | Cross-site scripting vulnerability due to $@. | projectB/src/index.js:13:16:13:30 | req.query.sinkB | user-provided value |
220+
| projectB/views/subfolder/index.ejs:3:1:3:12 | <%- sinkB %> | projectB/src/index.js:18:16:18:30 | req.query.sinkB | projectB/views/subfolder/index.ejs:3:1:3:12 | <%- sinkB %> | Cross-site scripting vulnerability due to $@. | projectB/src/index.js:18:16:18:30 | req.query.sinkB | user-provided value |
221+
| projectB/views/subfolder/other.ejs:3:1:3:12 | <%- sinkB %> | projectB/src/index.js:33:16:33:30 | req.query.sinkB | projectB/views/subfolder/other.ejs:3:1:3:12 | <%- sinkB %> | Cross-site scripting vulnerability due to $@. | projectB/src/index.js:33:16:33:30 | req.query.sinkB | user-provided value |
222+
| projectB/views/subfolder/other.ejs:3:1:3:12 | <%- sinkB %> | projectB/src/index.js:38:16:38:30 | req.query.sinkB | projectB/views/subfolder/other.ejs:3:1:3:12 | <%- sinkB %> | Cross-site scripting vulnerability due to $@. | projectB/src/index.js:38:16:38:30 | req.query.sinkB | user-provided value |
183223
| views/ejs_sinks.ejs:4:9:4:22 | <%- rawHtml %> | app.js:8:18:8:34 | req.query.rawHtml | views/ejs_sinks.ejs:4:9:4:22 | <%- rawHtml %> | Cross-site scripting vulnerability due to $@. | app.js:8:18:8:34 | req.query.rawHtml | user-provided value |
184224
| views/ejs_sinks.ejs:7:9:7:33 | <%- object.rawHtmlProp %> | app.js:11:26:11:46 | req.que ... tmlProp | views/ejs_sinks.ejs:7:9:7:33 | <%- object.rawHtmlProp %> | Cross-site scripting vulnerability due to $@. | app.js:11:26:11:46 | req.que ... tmlProp | user-provided value |
185225
| views/ejs_sinks.ejs:11:43:11:71 | <%- dataInStringLiteralRaw %> | app.js:14:33:14:64 | req.que ... eralRaw | views/ejs_sinks.ejs:11:43:11:71 | <%- dataInStringLiteralRaw %> | Cross-site scripting vulnerability due to $@. | app.js:14:33:14:64 | req.que ... eralRaw | user-provided value |

‎javascript/ql/test/library-tests/frameworks/Templating/projectB/src/index.js

Lines changed: 40 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,40 @@
1+
const express = require('express');
2+
3+
const app = express();
4+
5+
app.get('/fooA', (req, res) => {
6+
res.render('main', {
7+
sinkA: req.query.sinkA,
8+
sinkB: req.query.sinkB,
9+
});
10+
11+
res.render('main.ejs', {
12+
sinkA: req.query.sinkA,
13+
sinkB: req.query.sinkB,
14+
});
15+
16+
res.render('subfolder', {
17+
sinkA: req.query.sinkA,
18+
sinkB: req.query.sinkB,
19+
});
20+
21+
res.render('subfolder/index', {
22+
sinkA: req.query.sinkA,
23+
sinkB: req.query.sinkB,
24+
});
25+
26+
res.render('subfolder/index.ejs', {
27+
sinkA: req.query.sinkA,
28+
sinkB: req.query.sinkB,
29+
});
30+
31+
res.render('subfolder/other', {
32+
sinkA: req.query.sinkA,
33+
sinkB: req.query.sinkB,
34+
});
35+
36+
res.render('subfolder/other.ejs', {
37+
sinkA: req.query.sinkA,
38+
sinkB: req.query.sinkB,
39+
});
40+
});

‎javascript/ql/test/library-tests/frameworks/Templating/projectB/views/main.ejs

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,3 @@
1+
Project B
2+
<%= sinkA %>
3+
<%- sinkB %>

‎javascript/ql/test/library-tests/frameworks/Templating/projectB/views/subfolder/index.ejs

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,3 @@
1+
Subfolder/index
2+
<%= sinkA %>
3+
<%- sinkB %>

‎javascript/ql/test/library-tests/frameworks/Templating/projectB/views/subfolder/other.ejs

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,3 @@
1+
Subfolder/other
2+
<%= sinkA %>
3+
<%- sinkB %>

‎javascript/ql/test/library-tests/frameworks/Templating/test.expected

Lines changed: 11 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -5,6 +5,9 @@ getLikelyTemplateSyntax
55
| projectA/views/main.ejs:0:0:0:0 | projectA/views/main.ejs | ejs |
66
| projectA/views/subfolder/index.ejs:0:0:0:0 | projectA/views/subfolder/index.ejs | ejs |
77
| projectA/views/subfolder/other.ejs:0:0:0:0 | projectA/views/subfolder/other.ejs | ejs |
8+
| projectB/views/main.ejs:0:0:0:0 | projectB/views/main.ejs | ejs |
9+
| projectB/views/subfolder/index.ejs:0:0:0:0 | projectB/views/subfolder/index.ejs | ejs |
10+
| projectB/views/subfolder/other.ejs:0:0:0:0 | projectB/views/subfolder/other.ejs | ejs |
811
| views/ejs_sinks.ejs:0:0:0:0 | views/ejs_sinks.ejs | ejs |
912
| views/hbs_sinks.hbs:0:0:0:0 | views/hbs_sinks.hbs | mustache |
1013
| views/instantiated_as_ejs.html:0:0:0:0 | views/instantiated_as_ejs.html | ejs |
@@ -21,10 +24,18 @@ getTargetFile
2124
| projectA/src/index.js:16:5:19:6 | res.ren ... \\n }) | projectA/views/subfolder/index.ejs:0:0:0:0 | projectA/views/subfolder/index.ejs |
2225
| projectA/src/index.js:31:5:34:6 | res.ren ... \\n }) | projectA/views/subfolder/other.ejs:0:0:0:0 | projectA/views/subfolder/other.ejs |
2326
| projectA/src/index.js:36:5:39:6 | res.ren ... \\n }) | projectA/views/subfolder/other.ejs:0:0:0:0 | projectA/views/subfolder/other.ejs |
27+
| projectB/src/index.js:6:5:9:6 | res.ren ... \\n }) | projectB/views/main.ejs:0:0:0:0 | projectB/views/main.ejs |
28+
| projectB/src/index.js:11:5:14:6 | res.ren ... \\n }) | projectB/views/main.ejs:0:0:0:0 | projectB/views/main.ejs |
29+
| projectB/src/index.js:16:5:19:6 | res.ren ... \\n }) | projectB/views/subfolder/index.ejs:0:0:0:0 | projectB/views/subfolder/index.ejs |
30+
| projectB/src/index.js:31:5:34:6 | res.ren ... \\n }) | projectB/views/subfolder/other.ejs:0:0:0:0 | projectB/views/subfolder/other.ejs |
31+
| projectB/src/index.js:36:5:39:6 | res.ren ... \\n }) | projectB/views/subfolder/other.ejs:0:0:0:0 | projectB/views/subfolder/other.ejs |
2432
xssSink
2533
| projectA/views/main.ejs:2:1:2:12 | <%- sinkA %> |
2634
| projectA/views/subfolder/index.ejs:2:1:2:12 | <%- sinkA %> |
2735
| projectA/views/subfolder/other.ejs:2:1:2:12 | <%- sinkA %> |
36+
| projectB/views/main.ejs:3:1:3:12 | <%- sinkB %> |
37+
| projectB/views/subfolder/index.ejs:3:1:3:12 | <%- sinkB %> |
38+
| projectB/views/subfolder/other.ejs:3:1:3:12 | <%- sinkB %> |
2839
| views/ejs_sinks.ejs:4:9:4:22 | <%- rawHtml %> |
2940
| views/ejs_sinks.ejs:5:9:5:31 | <%- rawHtmlSafeValue %> |
3041
| views/ejs_sinks.ejs:7:9:7:33 | <%- object.rawHtmlProp %> |

0 commit comments

Comments
 (0)