Skip to content

Commit f923b24

Browse files
asgerfasgerf
committed
JS: Fix test
1 parent d1df251 commit f923b24

File tree

2 files changed

+122
-1
lines changed

2 files changed

+122
-1
lines changed

‎javascript/ql/test/query-tests/Security/CWE-400/PrototypePollutionUtility.expected

Lines changed: 107 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1042,6 +1042,54 @@ nodes
10421042
| PrototypePollutionUtility/tests.js:461:24:461:28 | value |
10431043
| PrototypePollutionUtility/tests.js:461:24:461:28 | value |
10441044
| PrototypePollutionUtility/tests.js:461:24:461:28 | value |
1045+
| PrototypePollutionUtility/tests.js:467:26:467:28 | dst |
1046+
| PrototypePollutionUtility/tests.js:467:31:467:33 | src |
1047+
| PrototypePollutionUtility/tests.js:467:31:467:33 | src |
1048+
| PrototypePollutionUtility/tests.js:468:14:468:16 | key |
1049+
| PrototypePollutionUtility/tests.js:468:14:468:16 | key |
1050+
| PrototypePollutionUtility/tests.js:471:29:471:31 | dst |
1051+
| PrototypePollutionUtility/tests.js:471:29:471:36 | dst[key] |
1052+
| PrototypePollutionUtility/tests.js:471:29:471:36 | dst[key] |
1053+
| PrototypePollutionUtility/tests.js:471:33:471:35 | key |
1054+
| PrototypePollutionUtility/tests.js:471:39:471:41 | src |
1055+
| PrototypePollutionUtility/tests.js:471:39:471:46 | src[key] |
1056+
| PrototypePollutionUtility/tests.js:471:39:471:46 | src[key] |
1057+
| PrototypePollutionUtility/tests.js:471:39:471:46 | src[key] |
1058+
| PrototypePollutionUtility/tests.js:471:39:471:46 | src[key] |
1059+
| PrototypePollutionUtility/tests.js:471:43:471:45 | key |
1060+
| PrototypePollutionUtility/tests.js:473:13:473:15 | dst |
1061+
| PrototypePollutionUtility/tests.js:473:13:473:15 | dst |
1062+
| PrototypePollutionUtility/tests.js:473:17:473:19 | key |
1063+
| PrototypePollutionUtility/tests.js:473:17:473:19 | key |
1064+
| PrototypePollutionUtility/tests.js:473:24:473:26 | src |
1065+
| PrototypePollutionUtility/tests.js:473:24:473:26 | src |
1066+
| PrototypePollutionUtility/tests.js:473:24:473:31 | src[key] |
1067+
| PrototypePollutionUtility/tests.js:473:24:473:31 | src[key] |
1068+
| PrototypePollutionUtility/tests.js:473:24:473:31 | src[key] |
1069+
| PrototypePollutionUtility/tests.js:473:24:473:31 | src[key] |
1070+
| PrototypePollutionUtility/tests.js:473:24:473:31 | src[key] |
1071+
| PrototypePollutionUtility/tests.js:473:24:473:31 | src[key] |
1072+
| PrototypePollutionUtility/tests.js:473:28:473:30 | key |
1073+
| PrototypePollutionUtility/tests.js:478:32:478:34 | src |
1074+
| PrototypePollutionUtility/tests.js:479:14:479:16 | key |
1075+
| PrototypePollutionUtility/tests.js:479:14:479:16 | key |
1076+
| PrototypePollutionUtility/tests.js:482:13:482:28 | value |
1077+
| PrototypePollutionUtility/tests.js:482:13:482:28 | value |
1078+
| PrototypePollutionUtility/tests.js:482:13:482:28 | value |
1079+
| PrototypePollutionUtility/tests.js:482:21:482:23 | src |
1080+
| PrototypePollutionUtility/tests.js:482:21:482:28 | src[key] |
1081+
| PrototypePollutionUtility/tests.js:482:21:482:28 | src[key] |
1082+
| PrototypePollutionUtility/tests.js:482:21:482:28 | src[key] |
1083+
| PrototypePollutionUtility/tests.js:482:21:482:28 | src[key] |
1084+
| PrototypePollutionUtility/tests.js:482:25:482:27 | key |
1085+
| PrototypePollutionUtility/tests.js:484:38:484:42 | value |
1086+
| PrototypePollutionUtility/tests.js:484:38:484:42 | value |
1087+
| PrototypePollutionUtility/tests.js:486:17:486:19 | key |
1088+
| PrototypePollutionUtility/tests.js:486:17:486:19 | key |
1089+
| PrototypePollutionUtility/tests.js:486:24:486:28 | value |
1090+
| PrototypePollutionUtility/tests.js:486:24:486:28 | value |
1091+
| PrototypePollutionUtility/tests.js:486:24:486:28 | value |
1092+
| PrototypePollutionUtility/tests.js:486:24:486:28 | value |
10451093
| examples/PrototypePollutionUtility.js:1:16:1:18 | dst |
10461094
| examples/PrototypePollutionUtility.js:1:16:1:18 | dst |
10471095
| examples/PrototypePollutionUtility.js:1:21:1:23 | src |
@@ -2457,6 +2505,64 @@ edges
24572505
| PrototypePollutionUtility/tests.js:459:41:459:48 | dst[key] | PrototypePollutionUtility/tests.js:456:38:456:40 | dst |
24582506
| PrototypePollutionUtility/tests.js:459:45:459:47 | key | PrototypePollutionUtility/tests.js:459:41:459:48 | dst[key] |
24592507
| PrototypePollutionUtility/tests.js:459:45:459:47 | key | PrototypePollutionUtility/tests.js:459:41:459:48 | dst[key] |
2508+
| PrototypePollutionUtility/tests.js:467:26:467:28 | dst | PrototypePollutionUtility/tests.js:471:29:471:31 | dst |
2509+
| PrototypePollutionUtility/tests.js:467:26:467:28 | dst | PrototypePollutionUtility/tests.js:473:13:473:15 | dst |
2510+
| PrototypePollutionUtility/tests.js:467:26:467:28 | dst | PrototypePollutionUtility/tests.js:473:13:473:15 | dst |
2511+
| PrototypePollutionUtility/tests.js:467:31:467:33 | src | PrototypePollutionUtility/tests.js:471:39:471:41 | src |
2512+
| PrototypePollutionUtility/tests.js:467:31:467:33 | src | PrototypePollutionUtility/tests.js:473:24:473:26 | src |
2513+
| PrototypePollutionUtility/tests.js:467:31:467:33 | src | PrototypePollutionUtility/tests.js:473:24:473:26 | src |
2514+
| PrototypePollutionUtility/tests.js:468:14:468:16 | key | PrototypePollutionUtility/tests.js:471:33:471:35 | key |
2515+
| PrototypePollutionUtility/tests.js:468:14:468:16 | key | PrototypePollutionUtility/tests.js:471:33:471:35 | key |
2516+
| PrototypePollutionUtility/tests.js:468:14:468:16 | key | PrototypePollutionUtility/tests.js:471:43:471:45 | key |
2517+
| PrototypePollutionUtility/tests.js:468:14:468:16 | key | PrototypePollutionUtility/tests.js:471:43:471:45 | key |
2518+
| PrototypePollutionUtility/tests.js:468:14:468:16 | key | PrototypePollutionUtility/tests.js:473:17:473:19 | key |
2519+
| PrototypePollutionUtility/tests.js:468:14:468:16 | key | PrototypePollutionUtility/tests.js:473:17:473:19 | key |
2520+
| PrototypePollutionUtility/tests.js:468:14:468:16 | key | PrototypePollutionUtility/tests.js:473:17:473:19 | key |
2521+
| PrototypePollutionUtility/tests.js:468:14:468:16 | key | PrototypePollutionUtility/tests.js:473:17:473:19 | key |
2522+
| PrototypePollutionUtility/tests.js:468:14:468:16 | key | PrototypePollutionUtility/tests.js:473:28:473:30 | key |
2523+
| PrototypePollutionUtility/tests.js:468:14:468:16 | key | PrototypePollutionUtility/tests.js:473:28:473:30 | key |
2524+
| PrototypePollutionUtility/tests.js:471:29:471:31 | dst | PrototypePollutionUtility/tests.js:471:29:471:36 | dst[key] |
2525+
| PrototypePollutionUtility/tests.js:471:29:471:36 | dst[key] | PrototypePollutionUtility/tests.js:467:26:467:28 | dst |
2526+
| PrototypePollutionUtility/tests.js:471:29:471:36 | dst[key] | PrototypePollutionUtility/tests.js:467:26:467:28 | dst |
2527+
| PrototypePollutionUtility/tests.js:471:33:471:35 | key | PrototypePollutionUtility/tests.js:471:29:471:36 | dst[key] |
2528+
| PrototypePollutionUtility/tests.js:471:39:471:41 | src | PrototypePollutionUtility/tests.js:471:39:471:46 | src[key] |
2529+
| PrototypePollutionUtility/tests.js:471:39:471:46 | src[key] | PrototypePollutionUtility/tests.js:467:31:467:33 | src |
2530+
| PrototypePollutionUtility/tests.js:471:39:471:46 | src[key] | PrototypePollutionUtility/tests.js:467:31:467:33 | src |
2531+
| PrototypePollutionUtility/tests.js:471:39:471:46 | src[key] | PrototypePollutionUtility/tests.js:467:31:467:33 | src |
2532+
| PrototypePollutionUtility/tests.js:471:39:471:46 | src[key] | PrototypePollutionUtility/tests.js:467:31:467:33 | src |
2533+
| PrototypePollutionUtility/tests.js:471:39:471:46 | src[key] | PrototypePollutionUtility/tests.js:467:31:467:33 | src |
2534+
| PrototypePollutionUtility/tests.js:471:43:471:45 | key | PrototypePollutionUtility/tests.js:471:39:471:46 | src[key] |
2535+
| PrototypePollutionUtility/tests.js:473:24:473:26 | src | PrototypePollutionUtility/tests.js:473:24:473:31 | src[key] |
2536+
| PrototypePollutionUtility/tests.js:473:24:473:26 | src | PrototypePollutionUtility/tests.js:473:24:473:31 | src[key] |
2537+
| PrototypePollutionUtility/tests.js:473:24:473:26 | src | PrototypePollutionUtility/tests.js:473:24:473:31 | src[key] |
2538+
| PrototypePollutionUtility/tests.js:473:24:473:26 | src | PrototypePollutionUtility/tests.js:473:24:473:31 | src[key] |
2539+
| PrototypePollutionUtility/tests.js:473:24:473:31 | src[key] | PrototypePollutionUtility/tests.js:473:24:473:31 | src[key] |
2540+
| PrototypePollutionUtility/tests.js:473:28:473:30 | key | PrototypePollutionUtility/tests.js:473:24:473:31 | src[key] |
2541+
| PrototypePollutionUtility/tests.js:473:28:473:30 | key | PrototypePollutionUtility/tests.js:473:24:473:31 | src[key] |
2542+
| PrototypePollutionUtility/tests.js:478:32:478:34 | src | PrototypePollutionUtility/tests.js:482:21:482:23 | src |
2543+
| PrototypePollutionUtility/tests.js:479:14:479:16 | key | PrototypePollutionUtility/tests.js:482:25:482:27 | key |
2544+
| PrototypePollutionUtility/tests.js:479:14:479:16 | key | PrototypePollutionUtility/tests.js:482:25:482:27 | key |
2545+
| PrototypePollutionUtility/tests.js:479:14:479:16 | key | PrototypePollutionUtility/tests.js:486:17:486:19 | key |
2546+
| PrototypePollutionUtility/tests.js:479:14:479:16 | key | PrototypePollutionUtility/tests.js:486:17:486:19 | key |
2547+
| PrototypePollutionUtility/tests.js:479:14:479:16 | key | PrototypePollutionUtility/tests.js:486:17:486:19 | key |
2548+
| PrototypePollutionUtility/tests.js:479:14:479:16 | key | PrototypePollutionUtility/tests.js:486:17:486:19 | key |
2549+
| PrototypePollutionUtility/tests.js:482:13:482:28 | value | PrototypePollutionUtility/tests.js:484:38:484:42 | value |
2550+
| PrototypePollutionUtility/tests.js:482:13:482:28 | value | PrototypePollutionUtility/tests.js:484:38:484:42 | value |
2551+
| PrototypePollutionUtility/tests.js:482:13:482:28 | value | PrototypePollutionUtility/tests.js:486:24:486:28 | value |
2552+
| PrototypePollutionUtility/tests.js:482:13:482:28 | value | PrototypePollutionUtility/tests.js:486:24:486:28 | value |
2553+
| PrototypePollutionUtility/tests.js:482:13:482:28 | value | PrototypePollutionUtility/tests.js:486:24:486:28 | value |
2554+
| PrototypePollutionUtility/tests.js:482:13:482:28 | value | PrototypePollutionUtility/tests.js:486:24:486:28 | value |
2555+
| PrototypePollutionUtility/tests.js:482:13:482:28 | value | PrototypePollutionUtility/tests.js:486:24:486:28 | value |
2556+
| PrototypePollutionUtility/tests.js:482:13:482:28 | value | PrototypePollutionUtility/tests.js:486:24:486:28 | value |
2557+
| PrototypePollutionUtility/tests.js:482:21:482:23 | src | PrototypePollutionUtility/tests.js:482:21:482:28 | src[key] |
2558+
| PrototypePollutionUtility/tests.js:482:21:482:28 | src[key] | PrototypePollutionUtility/tests.js:482:13:482:28 | value |
2559+
| PrototypePollutionUtility/tests.js:482:21:482:28 | src[key] | PrototypePollutionUtility/tests.js:482:13:482:28 | value |
2560+
| PrototypePollutionUtility/tests.js:482:21:482:28 | src[key] | PrototypePollutionUtility/tests.js:482:13:482:28 | value |
2561+
| PrototypePollutionUtility/tests.js:482:21:482:28 | src[key] | PrototypePollutionUtility/tests.js:482:13:482:28 | value |
2562+
| PrototypePollutionUtility/tests.js:482:21:482:28 | src[key] | PrototypePollutionUtility/tests.js:482:13:482:28 | value |
2563+
| PrototypePollutionUtility/tests.js:482:25:482:27 | key | PrototypePollutionUtility/tests.js:482:21:482:28 | src[key] |
2564+
| PrototypePollutionUtility/tests.js:484:38:484:42 | value | PrototypePollutionUtility/tests.js:478:32:478:34 | src |
2565+
| PrototypePollutionUtility/tests.js:484:38:484:42 | value | PrototypePollutionUtility/tests.js:478:32:478:34 | src |
24602566
| examples/PrototypePollutionUtility.js:1:16:1:18 | dst | examples/PrototypePollutionUtility.js:5:19:5:21 | dst |
24612567
| examples/PrototypePollutionUtility.js:1:16:1:18 | dst | examples/PrototypePollutionUtility.js:5:19:5:21 | dst |
24622568
| examples/PrototypePollutionUtility.js:1:16:1:18 | dst | examples/PrototypePollutionUtility.js:7:13:7:15 | dst |
@@ -2583,4 +2689,5 @@ edges
25832689
| PrototypePollutionUtility/tests.js:450:30:450:32 | dst | PrototypePollutionUtility/tests.js:444:25:444:27 | key | PrototypePollutionUtility/tests.js:450:30:450:32 | dst | Properties are copied from $@ to $@ without guarding against prototype pollution. | PrototypePollutionUtility/tests.js:444:12:444:14 | src | src | PrototypePollutionUtility/tests.js:450:30:450:32 | dst | dst |
25842690
| PrototypePollutionUtility/tests.js:451:30:451:32 | dst | PrototypePollutionUtility/tests.js:444:25:444:27 | key | PrototypePollutionUtility/tests.js:451:30:451:32 | dst | Properties are copied from $@ to $@ without guarding against prototype pollution. | PrototypePollutionUtility/tests.js:444:12:444:14 | src | src | PrototypePollutionUtility/tests.js:451:30:451:32 | dst | dst |
25852691
| PrototypePollutionUtility/tests.js:461:13:461:15 | dst | PrototypePollutionUtility/tests.js:457:25:457:27 | key | PrototypePollutionUtility/tests.js:461:13:461:15 | dst | Properties are copied from $@ to $@ without guarding against prototype pollution. | PrototypePollutionUtility/tests.js:457:12:457:14 | src | src | PrototypePollutionUtility/tests.js:461:13:461:15 | dst | dst |
2692+
| PrototypePollutionUtility/tests.js:473:13:473:15 | dst | PrototypePollutionUtility/tests.js:468:14:468:16 | key | PrototypePollutionUtility/tests.js:473:13:473:15 | dst | Properties are copied from $@ to $@ without guarding against prototype pollution. | PrototypePollutionUtility/tests.js:468:21:468:23 | src | src | PrototypePollutionUtility/tests.js:473:13:473:15 | dst | dst |
25862693
| examples/PrototypePollutionUtility.js:7:13:7:15 | dst | examples/PrototypePollutionUtility.js:2:14:2:16 | key | examples/PrototypePollutionUtility.js:7:13:7:15 | dst | Properties are copied from $@ to $@ without guarding against prototype pollution. | examples/PrototypePollutionUtility.js:2:21:2:23 | src | src | examples/PrototypePollutionUtility.js:7:13:7:15 | dst | dst |

‎javascript/ql/test/query-tests/Security/CWE-400/PrototypePollutionUtility/tests.js

Lines changed: 15 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -466,10 +466,24 @@ function copyUsingUnderscoreOrLodash(dst, src) {
466466
let isPlainObject = require('is-plain-object');
467467
function copyPlainObject(dst, src) {
468468
for (let key in src) {
469+
if (key === '__proto__') continue;
469470
if (dst[key] && isPlainObject(src)) {
470471
copyPlainObject(dst[key], src[key]);
471472
} else {
472-
dst[key] = src[key]; // OK
473+
dst[key] = src[key]; // OK - but flagged anyway
474+
}
475+
}
476+
}
477+
478+
function copyPlainObject2(dst, src) {
479+
for (let key in src) {
480+
if (key === '__proto__') continue;
481+
let target = dst[key];
482+
let value = src[key];
483+
if (isPlainObject(target) && isPlainObject(value)) {
484+
copyPlainObject2(target, value);
485+
} else {
486+
dst[key] = value; // OK
473487
}
474488
}
475489
}

0 commit comments

Comments
 (0)