Skip to content

Commit 62194f5

Browse files
NapalysNapalys
committed
JS: add test cases RegExp with unknown flags
1 parent e673348 commit 62194f5

File tree

2 files changed

+40
-0
lines changed

2 files changed

+40
-0
lines changed

‎javascript/ql/test/query-tests/Security/CWE-730/RegExpInjection.expected

Lines changed: 27 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -64,6 +64,19 @@ nodes
6464
| RegExpInjection.js:93:20:93:31 | process.argv |
6565
| RegExpInjection.js:93:20:93:31 | process.argv |
6666
| RegExpInjection.js:93:20:93:34 | process.argv[1] |
67+
| RegExpInjection.js:97:7:97:32 | input |
68+
| RegExpInjection.js:97:15:97:32 | req.param("input") |
69+
| RegExpInjection.js:97:15:97:32 | req.param("input") |
70+
| RegExpInjection.js:99:7:99:106 | sanitized |
71+
| RegExpInjection.js:99:19:99:23 | input |
72+
| RegExpInjection.js:99:19:99:106 | input.r ... "\\\\$&") |
73+
| RegExpInjection.js:100:14:100:22 | sanitized |
74+
| RegExpInjection.js:100:14:100:22 | sanitized |
75+
| RegExpInjection.js:105:7:105:122 | sanitized |
76+
| RegExpInjection.js:105:19:105:23 | input |
77+
| RegExpInjection.js:105:19:105:122 | input.r ... "\\\\$&") |
78+
| RegExpInjection.js:106:14:106:22 | sanitized |
79+
| RegExpInjection.js:106:14:106:22 | sanitized |
6780
| tst.js:5:9:5:29 | data |
6881
| tst.js:5:16:5:29 | req.query.data |
6982
| tst.js:5:16:5:29 | req.query.data |
@@ -133,6 +146,18 @@ edges
133146
| RegExpInjection.js:93:20:93:31 | process.argv | RegExpInjection.js:93:20:93:34 | process.argv[1] |
134147
| RegExpInjection.js:93:20:93:34 | process.argv[1] | RegExpInjection.js:93:16:93:49 | `^${pro ... r.app$` |
135148
| RegExpInjection.js:93:20:93:34 | process.argv[1] | RegExpInjection.js:93:16:93:49 | `^${pro ... r.app$` |
149+
| RegExpInjection.js:97:7:97:32 | input | RegExpInjection.js:99:19:99:23 | input |
150+
| RegExpInjection.js:97:7:97:32 | input | RegExpInjection.js:105:19:105:23 | input |
151+
| RegExpInjection.js:97:15:97:32 | req.param("input") | RegExpInjection.js:97:7:97:32 | input |
152+
| RegExpInjection.js:97:15:97:32 | req.param("input") | RegExpInjection.js:97:7:97:32 | input |
153+
| RegExpInjection.js:99:7:99:106 | sanitized | RegExpInjection.js:100:14:100:22 | sanitized |
154+
| RegExpInjection.js:99:7:99:106 | sanitized | RegExpInjection.js:100:14:100:22 | sanitized |
155+
| RegExpInjection.js:99:19:99:23 | input | RegExpInjection.js:99:19:99:106 | input.r ... "\\\\$&") |
156+
| RegExpInjection.js:99:19:99:106 | input.r ... "\\\\$&") | RegExpInjection.js:99:7:99:106 | sanitized |
157+
| RegExpInjection.js:105:7:105:122 | sanitized | RegExpInjection.js:106:14:106:22 | sanitized |
158+
| RegExpInjection.js:105:7:105:122 | sanitized | RegExpInjection.js:106:14:106:22 | sanitized |
159+
| RegExpInjection.js:105:19:105:23 | input | RegExpInjection.js:105:19:105:122 | input.r ... "\\\\$&") |
160+
| RegExpInjection.js:105:19:105:122 | input.r ... "\\\\$&") | RegExpInjection.js:105:7:105:122 | sanitized |
136161
| tst.js:5:9:5:29 | data | tst.js:6:21:6:24 | data |
137162
| tst.js:5:16:5:29 | req.query.data | tst.js:5:9:5:29 | data |
138163
| tst.js:5:16:5:29 | req.query.data | tst.js:5:9:5:29 | data |
@@ -157,4 +182,6 @@ edges
157182
| RegExpInjection.js:87:14:87:55 | "^.*\\.( ... + ")$" | RegExpInjection.js:82:15:82:32 | req.param("input") | RegExpInjection.js:87:14:87:55 | "^.*\\.( ... + ")$" | This regular expression is constructed from a $@. | RegExpInjection.js:82:15:82:32 | req.param("input") | user-provided value |
158183
| RegExpInjection.js:91:16:91:50 | `^${pro ... r.app$` | RegExpInjection.js:91:20:91:30 | process.env | RegExpInjection.js:91:16:91:50 | `^${pro ... r.app$` | This regular expression is constructed from a $@. | RegExpInjection.js:91:20:91:30 | process.env | environment variable |
159184
| RegExpInjection.js:93:16:93:49 | `^${pro ... r.app$` | RegExpInjection.js:93:20:93:31 | process.argv | RegExpInjection.js:93:16:93:49 | `^${pro ... r.app$` | This regular expression is constructed from a $@. | RegExpInjection.js:93:20:93:31 | process.argv | command-line argument |
185+
| RegExpInjection.js:100:14:100:22 | sanitized | RegExpInjection.js:97:15:97:32 | req.param("input") | RegExpInjection.js:100:14:100:22 | sanitized | This regular expression is constructed from a $@. | RegExpInjection.js:97:15:97:32 | req.param("input") | user-provided value |
186+
| RegExpInjection.js:106:14:106:22 | sanitized | RegExpInjection.js:97:15:97:32 | req.param("input") | RegExpInjection.js:106:14:106:22 | sanitized | This regular expression is constructed from a $@. | RegExpInjection.js:97:15:97:32 | req.param("input") | user-provided value |
160187
| tst.js:6:16:6:35 | "^"+ data.name + "$" | tst.js:5:16:5:29 | req.query.data | tst.js:6:16:6:35 | "^"+ data.name + "$" | This regular expression is constructed from a $@. | tst.js:5:16:5:29 | req.query.data | user-provided value |

‎javascript/ql/test/query-tests/Security/CWE-730/RegExpInjection.js

Lines changed: 13 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -92,3 +92,16 @@ app.get("argv", function(req, res) {
9292

9393
new RegExp(`^${process.argv[1]}/Foo/bar.app$`); // NOT OK
9494
});
95+
96+
app.get("argv", function(req, res) {
97+
var input = req.param("input");
98+
99+
var sanitized = input.replace(new RegExp("[\\-\\[\\]\\/\\{\\}\\(\\)\\*\\+\\?\\.\\\\\\^\\$\\|]"), "\\$&");
100+
new RegExp(sanitized); // NOT OK
101+
102+
var sanitized = input.replace(new RegExp("[\\-\\[\\]\\/\\{\\}\\(\\)\\*\\+\\?\\.\\\\\\^\\$\\|]", "g"), "\\$&");
103+
new RegExp(sanitized); // OK
104+
105+
var sanitized = input.replace(new RegExp("[\\-\\[\\]\\/\\{\\}\\(\\)\\*\\+\\?\\.\\\\\\^\\$\\|]", unknownFlags()), "\\$&");
106+
new RegExp(sanitized); // OK -- Currently flagged, but most likely should not be.
107+
});

0 commit comments

Comments
 (0)