Skip to content

Commit 06bc0f6

Browse files
asgerfasgerf
committed
JS: Add test for fs/promises
1 parent 965ca16 commit 06bc0f6

File tree

3 files changed

+214
-0
lines changed

3 files changed

+214
-0
lines changed

‎javascript/ql/test/query-tests/Security/CWE-022/TaintedPath/TaintedPath.expected

Lines changed: 199 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -2813,6 +2813,92 @@ nodes
28132813
| other-fs-libraries.js:72:15:72:18 | path |
28142814
| other-fs-libraries.js:72:15:72:18 | path |
28152815
| other-fs-libraries.js:72:15:72:18 | path |
2816+
| other-fs-libraries.js:77:7:77:48 | path |
2817+
| other-fs-libraries.js:77:7:77:48 | path |
2818+
| other-fs-libraries.js:77:7:77:48 | path |
2819+
| other-fs-libraries.js:77:7:77:48 | path |
2820+
| other-fs-libraries.js:77:7:77:48 | path |
2821+
| other-fs-libraries.js:77:7:77:48 | path |
2822+
| other-fs-libraries.js:77:7:77:48 | path |
2823+
| other-fs-libraries.js:77:7:77:48 | path |
2824+
| other-fs-libraries.js:77:7:77:48 | path |
2825+
| other-fs-libraries.js:77:7:77:48 | path |
2826+
| other-fs-libraries.js:77:7:77:48 | path |
2827+
| other-fs-libraries.js:77:7:77:48 | path |
2828+
| other-fs-libraries.js:77:7:77:48 | path |
2829+
| other-fs-libraries.js:77:7:77:48 | path |
2830+
| other-fs-libraries.js:77:7:77:48 | path |
2831+
| other-fs-libraries.js:77:7:77:48 | path |
2832+
| other-fs-libraries.js:77:14:77:37 | url.par ... , true) |
2833+
| other-fs-libraries.js:77:14:77:37 | url.par ... , true) |
2834+
| other-fs-libraries.js:77:14:77:37 | url.par ... , true) |
2835+
| other-fs-libraries.js:77:14:77:37 | url.par ... , true) |
2836+
| other-fs-libraries.js:77:14:77:37 | url.par ... , true) |
2837+
| other-fs-libraries.js:77:14:77:37 | url.par ... , true) |
2838+
| other-fs-libraries.js:77:14:77:37 | url.par ... , true) |
2839+
| other-fs-libraries.js:77:14:77:37 | url.par ... , true) |
2840+
| other-fs-libraries.js:77:14:77:37 | url.par ... , true) |
2841+
| other-fs-libraries.js:77:14:77:37 | url.par ... , true) |
2842+
| other-fs-libraries.js:77:14:77:37 | url.par ... , true) |
2843+
| other-fs-libraries.js:77:14:77:37 | url.par ... , true) |
2844+
| other-fs-libraries.js:77:14:77:37 | url.par ... , true) |
2845+
| other-fs-libraries.js:77:14:77:37 | url.par ... , true) |
2846+
| other-fs-libraries.js:77:14:77:37 | url.par ... , true) |
2847+
| other-fs-libraries.js:77:14:77:37 | url.par ... , true) |
2848+
| other-fs-libraries.js:77:14:77:43 | url.par ... ).query |
2849+
| other-fs-libraries.js:77:14:77:43 | url.par ... ).query |
2850+
| other-fs-libraries.js:77:14:77:43 | url.par ... ).query |
2851+
| other-fs-libraries.js:77:14:77:43 | url.par ... ).query |
2852+
| other-fs-libraries.js:77:14:77:43 | url.par ... ).query |
2853+
| other-fs-libraries.js:77:14:77:43 | url.par ... ).query |
2854+
| other-fs-libraries.js:77:14:77:43 | url.par ... ).query |
2855+
| other-fs-libraries.js:77:14:77:43 | url.par ... ).query |
2856+
| other-fs-libraries.js:77:14:77:43 | url.par ... ).query |
2857+
| other-fs-libraries.js:77:14:77:43 | url.par ... ).query |
2858+
| other-fs-libraries.js:77:14:77:43 | url.par ... ).query |
2859+
| other-fs-libraries.js:77:14:77:43 | url.par ... ).query |
2860+
| other-fs-libraries.js:77:14:77:43 | url.par ... ).query |
2861+
| other-fs-libraries.js:77:14:77:43 | url.par ... ).query |
2862+
| other-fs-libraries.js:77:14:77:43 | url.par ... ).query |
2863+
| other-fs-libraries.js:77:14:77:43 | url.par ... ).query |
2864+
| other-fs-libraries.js:77:14:77:48 | url.par ... ry.path |
2865+
| other-fs-libraries.js:77:14:77:48 | url.par ... ry.path |
2866+
| other-fs-libraries.js:77:14:77:48 | url.par ... ry.path |
2867+
| other-fs-libraries.js:77:14:77:48 | url.par ... ry.path |
2868+
| other-fs-libraries.js:77:14:77:48 | url.par ... ry.path |
2869+
| other-fs-libraries.js:77:14:77:48 | url.par ... ry.path |
2870+
| other-fs-libraries.js:77:14:77:48 | url.par ... ry.path |
2871+
| other-fs-libraries.js:77:14:77:48 | url.par ... ry.path |
2872+
| other-fs-libraries.js:77:14:77:48 | url.par ... ry.path |
2873+
| other-fs-libraries.js:77:14:77:48 | url.par ... ry.path |
2874+
| other-fs-libraries.js:77:14:77:48 | url.par ... ry.path |
2875+
| other-fs-libraries.js:77:14:77:48 | url.par ... ry.path |
2876+
| other-fs-libraries.js:77:14:77:48 | url.par ... ry.path |
2877+
| other-fs-libraries.js:77:14:77:48 | url.par ... ry.path |
2878+
| other-fs-libraries.js:77:14:77:48 | url.par ... ry.path |
2879+
| other-fs-libraries.js:77:14:77:48 | url.par ... ry.path |
2880+
| other-fs-libraries.js:77:24:77:30 | req.url |
2881+
| other-fs-libraries.js:77:24:77:30 | req.url |
2882+
| other-fs-libraries.js:77:24:77:30 | req.url |
2883+
| other-fs-libraries.js:77:24:77:30 | req.url |
2884+
| other-fs-libraries.js:77:24:77:30 | req.url |
2885+
| other-fs-libraries.js:79:16:79:19 | path |
2886+
| other-fs-libraries.js:79:16:79:19 | path |
2887+
| other-fs-libraries.js:79:16:79:19 | path |
2888+
| other-fs-libraries.js:79:16:79:19 | path |
2889+
| other-fs-libraries.js:79:16:79:19 | path |
2890+
| other-fs-libraries.js:79:16:79:19 | path |
2891+
| other-fs-libraries.js:79:16:79:19 | path |
2892+
| other-fs-libraries.js:79:16:79:19 | path |
2893+
| other-fs-libraries.js:79:16:79:19 | path |
2894+
| other-fs-libraries.js:79:16:79:19 | path |
2895+
| other-fs-libraries.js:79:16:79:19 | path |
2896+
| other-fs-libraries.js:79:16:79:19 | path |
2897+
| other-fs-libraries.js:79:16:79:19 | path |
2898+
| other-fs-libraries.js:79:16:79:19 | path |
2899+
| other-fs-libraries.js:79:16:79:19 | path |
2900+
| other-fs-libraries.js:79:16:79:19 | path |
2901+
| other-fs-libraries.js:79:16:79:19 | path |
28162902
| prettier.js:6:11:6:28 | p |
28172903
| prettier.js:6:11:6:28 | p |
28182904
| prettier.js:6:11:6:28 | p |
@@ -8288,6 +8374,118 @@ edges
82888374
| other-fs-libraries.js:68:24:68:30 | req.url | other-fs-libraries.js:68:14:68:37 | url.par ... , true) |
82898375
| other-fs-libraries.js:68:24:68:30 | req.url | other-fs-libraries.js:68:14:68:37 | url.par ... , true) |
82908376
| other-fs-libraries.js:68:24:68:30 | req.url | other-fs-libraries.js:68:14:68:37 | url.par ... , true) |
8377+
| other-fs-libraries.js:77:7:77:48 | path | other-fs-libraries.js:79:16:79:19 | path |
8378+
| other-fs-libraries.js:77:7:77:48 | path | other-fs-libraries.js:79:16:79:19 | path |
8379+
| other-fs-libraries.js:77:7:77:48 | path | other-fs-libraries.js:79:16:79:19 | path |
8380+
| other-fs-libraries.js:77:7:77:48 | path | other-fs-libraries.js:79:16:79:19 | path |
8381+
| other-fs-libraries.js:77:7:77:48 | path | other-fs-libraries.js:79:16:79:19 | path |
8382+
| other-fs-libraries.js:77:7:77:48 | path | other-fs-libraries.js:79:16:79:19 | path |
8383+
| other-fs-libraries.js:77:7:77:48 | path | other-fs-libraries.js:79:16:79:19 | path |
8384+
| other-fs-libraries.js:77:7:77:48 | path | other-fs-libraries.js:79:16:79:19 | path |
8385+
| other-fs-libraries.js:77:7:77:48 | path | other-fs-libraries.js:79:16:79:19 | path |
8386+
| other-fs-libraries.js:77:7:77:48 | path | other-fs-libraries.js:79:16:79:19 | path |
8387+
| other-fs-libraries.js:77:7:77:48 | path | other-fs-libraries.js:79:16:79:19 | path |
8388+
| other-fs-libraries.js:77:7:77:48 | path | other-fs-libraries.js:79:16:79:19 | path |
8389+
| other-fs-libraries.js:77:7:77:48 | path | other-fs-libraries.js:79:16:79:19 | path |
8390+
| other-fs-libraries.js:77:7:77:48 | path | other-fs-libraries.js:79:16:79:19 | path |
8391+
| other-fs-libraries.js:77:7:77:48 | path | other-fs-libraries.js:79:16:79:19 | path |
8392+
| other-fs-libraries.js:77:7:77:48 | path | other-fs-libraries.js:79:16:79:19 | path |
8393+
| other-fs-libraries.js:77:7:77:48 | path | other-fs-libraries.js:79:16:79:19 | path |
8394+
| other-fs-libraries.js:77:7:77:48 | path | other-fs-libraries.js:79:16:79:19 | path |
8395+
| other-fs-libraries.js:77:7:77:48 | path | other-fs-libraries.js:79:16:79:19 | path |
8396+
| other-fs-libraries.js:77:7:77:48 | path | other-fs-libraries.js:79:16:79:19 | path |
8397+
| other-fs-libraries.js:77:7:77:48 | path | other-fs-libraries.js:79:16:79:19 | path |
8398+
| other-fs-libraries.js:77:7:77:48 | path | other-fs-libraries.js:79:16:79:19 | path |
8399+
| other-fs-libraries.js:77:7:77:48 | path | other-fs-libraries.js:79:16:79:19 | path |
8400+
| other-fs-libraries.js:77:7:77:48 | path | other-fs-libraries.js:79:16:79:19 | path |
8401+
| other-fs-libraries.js:77:7:77:48 | path | other-fs-libraries.js:79:16:79:19 | path |
8402+
| other-fs-libraries.js:77:7:77:48 | path | other-fs-libraries.js:79:16:79:19 | path |
8403+
| other-fs-libraries.js:77:7:77:48 | path | other-fs-libraries.js:79:16:79:19 | path |
8404+
| other-fs-libraries.js:77:7:77:48 | path | other-fs-libraries.js:79:16:79:19 | path |
8405+
| other-fs-libraries.js:77:7:77:48 | path | other-fs-libraries.js:79:16:79:19 | path |
8406+
| other-fs-libraries.js:77:7:77:48 | path | other-fs-libraries.js:79:16:79:19 | path |
8407+
| other-fs-libraries.js:77:7:77:48 | path | other-fs-libraries.js:79:16:79:19 | path |
8408+
| other-fs-libraries.js:77:7:77:48 | path | other-fs-libraries.js:79:16:79:19 | path |
8409+
| other-fs-libraries.js:77:14:77:37 | url.par ... , true) | other-fs-libraries.js:77:14:77:43 | url.par ... ).query |
8410+
| other-fs-libraries.js:77:14:77:37 | url.par ... , true) | other-fs-libraries.js:77:14:77:43 | url.par ... ).query |
8411+
| other-fs-libraries.js:77:14:77:37 | url.par ... , true) | other-fs-libraries.js:77:14:77:43 | url.par ... ).query |
8412+
| other-fs-libraries.js:77:14:77:37 | url.par ... , true) | other-fs-libraries.js:77:14:77:43 | url.par ... ).query |
8413+
| other-fs-libraries.js:77:14:77:37 | url.par ... , true) | other-fs-libraries.js:77:14:77:43 | url.par ... ).query |
8414+
| other-fs-libraries.js:77:14:77:37 | url.par ... , true) | other-fs-libraries.js:77:14:77:43 | url.par ... ).query |
8415+
| other-fs-libraries.js:77:14:77:37 | url.par ... , true) | other-fs-libraries.js:77:14:77:43 | url.par ... ).query |
8416+
| other-fs-libraries.js:77:14:77:37 | url.par ... , true) | other-fs-libraries.js:77:14:77:43 | url.par ... ).query |
8417+
| other-fs-libraries.js:77:14:77:37 | url.par ... , true) | other-fs-libraries.js:77:14:77:43 | url.par ... ).query |
8418+
| other-fs-libraries.js:77:14:77:37 | url.par ... , true) | other-fs-libraries.js:77:14:77:43 | url.par ... ).query |
8419+
| other-fs-libraries.js:77:14:77:37 | url.par ... , true) | other-fs-libraries.js:77:14:77:43 | url.par ... ).query |
8420+
| other-fs-libraries.js:77:14:77:37 | url.par ... , true) | other-fs-libraries.js:77:14:77:43 | url.par ... ).query |
8421+
| other-fs-libraries.js:77:14:77:37 | url.par ... , true) | other-fs-libraries.js:77:14:77:43 | url.par ... ).query |
8422+
| other-fs-libraries.js:77:14:77:37 | url.par ... , true) | other-fs-libraries.js:77:14:77:43 | url.par ... ).query |
8423+
| other-fs-libraries.js:77:14:77:37 | url.par ... , true) | other-fs-libraries.js:77:14:77:43 | url.par ... ).query |
8424+
| other-fs-libraries.js:77:14:77:37 | url.par ... , true) | other-fs-libraries.js:77:14:77:43 | url.par ... ).query |
8425+
| other-fs-libraries.js:77:14:77:43 | url.par ... ).query | other-fs-libraries.js:77:14:77:48 | url.par ... ry.path |
8426+
| other-fs-libraries.js:77:14:77:43 | url.par ... ).query | other-fs-libraries.js:77:14:77:48 | url.par ... ry.path |
8427+
| other-fs-libraries.js:77:14:77:43 | url.par ... ).query | other-fs-libraries.js:77:14:77:48 | url.par ... ry.path |
8428+
| other-fs-libraries.js:77:14:77:43 | url.par ... ).query | other-fs-libraries.js:77:14:77:48 | url.par ... ry.path |
8429+
| other-fs-libraries.js:77:14:77:43 | url.par ... ).query | other-fs-libraries.js:77:14:77:48 | url.par ... ry.path |
8430+
| other-fs-libraries.js:77:14:77:43 | url.par ... ).query | other-fs-libraries.js:77:14:77:48 | url.par ... ry.path |
8431+
| other-fs-libraries.js:77:14:77:43 | url.par ... ).query | other-fs-libraries.js:77:14:77:48 | url.par ... ry.path |
8432+
| other-fs-libraries.js:77:14:77:43 | url.par ... ).query | other-fs-libraries.js:77:14:77:48 | url.par ... ry.path |
8433+
| other-fs-libraries.js:77:14:77:43 | url.par ... ).query | other-fs-libraries.js:77:14:77:48 | url.par ... ry.path |
8434+
| other-fs-libraries.js:77:14:77:43 | url.par ... ).query | other-fs-libraries.js:77:14:77:48 | url.par ... ry.path |
8435+
| other-fs-libraries.js:77:14:77:43 | url.par ... ).query | other-fs-libraries.js:77:14:77:48 | url.par ... ry.path |
8436+
| other-fs-libraries.js:77:14:77:43 | url.par ... ).query | other-fs-libraries.js:77:14:77:48 | url.par ... ry.path |
8437+
| other-fs-libraries.js:77:14:77:43 | url.par ... ).query | other-fs-libraries.js:77:14:77:48 | url.par ... ry.path |
8438+
| other-fs-libraries.js:77:14:77:43 | url.par ... ).query | other-fs-libraries.js:77:14:77:48 | url.par ... ry.path |
8439+
| other-fs-libraries.js:77:14:77:43 | url.par ... ).query | other-fs-libraries.js:77:14:77:48 | url.par ... ry.path |
8440+
| other-fs-libraries.js:77:14:77:43 | url.par ... ).query | other-fs-libraries.js:77:14:77:48 | url.par ... ry.path |
8441+
| other-fs-libraries.js:77:14:77:48 | url.par ... ry.path | other-fs-libraries.js:77:7:77:48 | path |
8442+
| other-fs-libraries.js:77:14:77:48 | url.par ... ry.path | other-fs-libraries.js:77:7:77:48 | path |
8443+
| other-fs-libraries.js:77:14:77:48 | url.par ... ry.path | other-fs-libraries.js:77:7:77:48 | path |
8444+
| other-fs-libraries.js:77:14:77:48 | url.par ... ry.path | other-fs-libraries.js:77:7:77:48 | path |
8445+
| other-fs-libraries.js:77:14:77:48 | url.par ... ry.path | other-fs-libraries.js:77:7:77:48 | path |
8446+
| other-fs-libraries.js:77:14:77:48 | url.par ... ry.path | other-fs-libraries.js:77:7:77:48 | path |
8447+
| other-fs-libraries.js:77:14:77:48 | url.par ... ry.path | other-fs-libraries.js:77:7:77:48 | path |
8448+
| other-fs-libraries.js:77:14:77:48 | url.par ... ry.path | other-fs-libraries.js:77:7:77:48 | path |
8449+
| other-fs-libraries.js:77:14:77:48 | url.par ... ry.path | other-fs-libraries.js:77:7:77:48 | path |
8450+
| other-fs-libraries.js:77:14:77:48 | url.par ... ry.path | other-fs-libraries.js:77:7:77:48 | path |
8451+
| other-fs-libraries.js:77:14:77:48 | url.par ... ry.path | other-fs-libraries.js:77:7:77:48 | path |
8452+
| other-fs-libraries.js:77:14:77:48 | url.par ... ry.path | other-fs-libraries.js:77:7:77:48 | path |
8453+
| other-fs-libraries.js:77:14:77:48 | url.par ... ry.path | other-fs-libraries.js:77:7:77:48 | path |
8454+
| other-fs-libraries.js:77:14:77:48 | url.par ... ry.path | other-fs-libraries.js:77:7:77:48 | path |
8455+
| other-fs-libraries.js:77:14:77:48 | url.par ... ry.path | other-fs-libraries.js:77:7:77:48 | path |
8456+
| other-fs-libraries.js:77:14:77:48 | url.par ... ry.path | other-fs-libraries.js:77:7:77:48 | path |
8457+
| other-fs-libraries.js:77:24:77:30 | req.url | other-fs-libraries.js:77:14:77:37 | url.par ... , true) |
8458+
| other-fs-libraries.js:77:24:77:30 | req.url | other-fs-libraries.js:77:14:77:37 | url.par ... , true) |
8459+
| other-fs-libraries.js:77:24:77:30 | req.url | other-fs-libraries.js:77:14:77:37 | url.par ... , true) |
8460+
| other-fs-libraries.js:77:24:77:30 | req.url | other-fs-libraries.js:77:14:77:37 | url.par ... , true) |
8461+
| other-fs-libraries.js:77:24:77:30 | req.url | other-fs-libraries.js:77:14:77:37 | url.par ... , true) |
8462+
| other-fs-libraries.js:77:24:77:30 | req.url | other-fs-libraries.js:77:14:77:37 | url.par ... , true) |
8463+
| other-fs-libraries.js:77:24:77:30 | req.url | other-fs-libraries.js:77:14:77:37 | url.par ... , true) |
8464+
| other-fs-libraries.js:77:24:77:30 | req.url | other-fs-libraries.js:77:14:77:37 | url.par ... , true) |
8465+
| other-fs-libraries.js:77:24:77:30 | req.url | other-fs-libraries.js:77:14:77:37 | url.par ... , true) |
8466+
| other-fs-libraries.js:77:24:77:30 | req.url | other-fs-libraries.js:77:14:77:37 | url.par ... , true) |
8467+
| other-fs-libraries.js:77:24:77:30 | req.url | other-fs-libraries.js:77:14:77:37 | url.par ... , true) |
8468+
| other-fs-libraries.js:77:24:77:30 | req.url | other-fs-libraries.js:77:14:77:37 | url.par ... , true) |
8469+
| other-fs-libraries.js:77:24:77:30 | req.url | other-fs-libraries.js:77:14:77:37 | url.par ... , true) |
8470+
| other-fs-libraries.js:77:24:77:30 | req.url | other-fs-libraries.js:77:14:77:37 | url.par ... , true) |
8471+
| other-fs-libraries.js:77:24:77:30 | req.url | other-fs-libraries.js:77:14:77:37 | url.par ... , true) |
8472+
| other-fs-libraries.js:77:24:77:30 | req.url | other-fs-libraries.js:77:14:77:37 | url.par ... , true) |
8473+
| other-fs-libraries.js:77:24:77:30 | req.url | other-fs-libraries.js:77:14:77:37 | url.par ... , true) |
8474+
| other-fs-libraries.js:77:24:77:30 | req.url | other-fs-libraries.js:77:14:77:37 | url.par ... , true) |
8475+
| other-fs-libraries.js:77:24:77:30 | req.url | other-fs-libraries.js:77:14:77:37 | url.par ... , true) |
8476+
| other-fs-libraries.js:77:24:77:30 | req.url | other-fs-libraries.js:77:14:77:37 | url.par ... , true) |
8477+
| other-fs-libraries.js:77:24:77:30 | req.url | other-fs-libraries.js:77:14:77:37 | url.par ... , true) |
8478+
| other-fs-libraries.js:77:24:77:30 | req.url | other-fs-libraries.js:77:14:77:37 | url.par ... , true) |
8479+
| other-fs-libraries.js:77:24:77:30 | req.url | other-fs-libraries.js:77:14:77:37 | url.par ... , true) |
8480+
| other-fs-libraries.js:77:24:77:30 | req.url | other-fs-libraries.js:77:14:77:37 | url.par ... , true) |
8481+
| other-fs-libraries.js:77:24:77:30 | req.url | other-fs-libraries.js:77:14:77:37 | url.par ... , true) |
8482+
| other-fs-libraries.js:77:24:77:30 | req.url | other-fs-libraries.js:77:14:77:37 | url.par ... , true) |
8483+
| other-fs-libraries.js:77:24:77:30 | req.url | other-fs-libraries.js:77:14:77:37 | url.par ... , true) |
8484+
| other-fs-libraries.js:77:24:77:30 | req.url | other-fs-libraries.js:77:14:77:37 | url.par ... , true) |
8485+
| other-fs-libraries.js:77:24:77:30 | req.url | other-fs-libraries.js:77:14:77:37 | url.par ... , true) |
8486+
| other-fs-libraries.js:77:24:77:30 | req.url | other-fs-libraries.js:77:14:77:37 | url.par ... , true) |
8487+
| other-fs-libraries.js:77:24:77:30 | req.url | other-fs-libraries.js:77:14:77:37 | url.par ... , true) |
8488+
| other-fs-libraries.js:77:24:77:30 | req.url | other-fs-libraries.js:77:14:77:37 | url.par ... , true) |
82918489
| prettier.js:6:11:6:28 | p | prettier.js:7:28:7:28 | p |
82928490
| prettier.js:6:11:6:28 | p | prettier.js:7:28:7:28 | p |
82938491
| prettier.js:6:11:6:28 | p | prettier.js:7:28:7:28 | p |
@@ -10187,6 +10385,7 @@ edges
1018710385
| other-fs-libraries.js:70:19:70:22 | path | other-fs-libraries.js:68:24:68:30 | req.url | other-fs-libraries.js:70:19:70:22 | path | This path depends on a $@. | other-fs-libraries.js:68:24:68:30 | req.url | user-provided value |
1018810386
| other-fs-libraries.js:71:10:71:13 | path | other-fs-libraries.js:68:24:68:30 | req.url | other-fs-libraries.js:71:10:71:13 | path | This path depends on a $@. | other-fs-libraries.js:68:24:68:30 | req.url | user-provided value |
1018910387
| other-fs-libraries.js:72:15:72:18 | path | other-fs-libraries.js:68:24:68:30 | req.url | other-fs-libraries.js:72:15:72:18 | path | This path depends on a $@. | other-fs-libraries.js:68:24:68:30 | req.url | user-provided value |
10388+
| other-fs-libraries.js:79:16:79:19 | path | other-fs-libraries.js:77:24:77:30 | req.url | other-fs-libraries.js:79:16:79:19 | path | This path depends on a $@. | other-fs-libraries.js:77:24:77:30 | req.url | user-provided value |
1019010389
| prettier.js:7:28:7:28 | p | prettier.js:6:13:6:13 | p | prettier.js:7:28:7:28 | p | This path depends on a $@. | prettier.js:6:13:6:13 | p | user-provided value |
1019110390
| prettier.js:11:44:11:44 | p | prettier.js:6:13:6:13 | p | prettier.js:11:44:11:44 | p | This path depends on a $@. | prettier.js:6:13:6:13 | p | user-provided value |
1019210391
| pupeteer.js:9:28:9:34 | tainted | pupeteer.js:5:28:5:53 | parseTo ... t).name | pupeteer.js:9:28:9:34 | tainted | This path depends on a $@. | pupeteer.js:5:28:5:53 | parseTo ... t).name | user-provided value |

‎javascript/ql/test/query-tests/Security/CWE-022/TaintedPath/fs.js

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -45,4 +45,12 @@ var fs = {};
4545
*/
4646
fs.readFileSync = function(filename, encoding) {};
4747

48+
/**
49+
* @param {string} filename
50+
* @param {string} encoding
51+
* @param {(function(NodeJS.ErrnoException, string): void)} callback
52+
* @return {void}
53+
*/
54+
fs.readFile = function(filename, encoding, callback) {};
55+
4856
module.exports = fs;

‎javascript/ql/test/query-tests/Security/CWE-022/TaintedPath/other-fs-libraries.js

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -71,3 +71,10 @@ http.createServer(function(req, res) {
7171
mkdirp(path); // NOT OK
7272
mkdirp.sync(path); // NOT OK
7373
});
74+
75+
const fsp = require("fs/promises");
76+
http.createServer(function(req, res) {
77+
var path = url.parse(req.url, true).query.path;
78+
79+
fsp.readFile(path); // NOT OK
80+
});

0 commit comments

Comments
 (0)