Skip to content

Commit 8acb024

Browse files
NapalysNapalys
committed
Added test cases for NextResponse and Response 
1 parent 63a3953 commit 8acb024

File tree

4 files changed

+83
-0
lines changed

4 files changed

+83
-0
lines changed

‎javascript/ql/test/query-tests/Security/CWE-079/ReflectedXss/ReflectedXss.expected

Lines changed: 17 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -27,6 +27,10 @@
2727
| ReflectedXssContentTypes.js:39:13:39:35 | "FOO: " ... rams.id | ReflectedXssContentTypes.js:39:23:39:35 | req.params.id | ReflectedXssContentTypes.js:39:13:39:35 | "FOO: " ... rams.id | Cross-site scripting vulnerability due to a $@. | ReflectedXssContentTypes.js:39:23:39:35 | req.params.id | user-provided value |
2828
| ReflectedXssContentTypes.js:70:12:70:34 | "FOO: " ... rams.id | ReflectedXssContentTypes.js:70:22:70:34 | req.params.id | ReflectedXssContentTypes.js:70:12:70:34 | "FOO: " ... rams.id | Cross-site scripting vulnerability due to a $@. | ReflectedXssContentTypes.js:70:22:70:34 | req.params.id | user-provided value |
2929
| ReflectedXssGood3.js:139:12:139:27 | escapeHtml3(url) | ReflectedXssGood3.js:135:15:135:27 | req.params.id | ReflectedXssGood3.js:139:12:139:27 | escapeHtml3(url) | Cross-site scripting vulnerability due to a $@. | ReflectedXssGood3.js:135:15:135:27 | req.params.id | user-provided value |
30+
| app/api/route.ts:5:18:5:21 | body | app/api/route.ts:2:24:2:33 | req.json() | app/api/route.ts:5:18:5:21 | body | Cross-site scripting vulnerability due to a $@. | app/api/route.ts:2:24:2:33 | req.json() | user-provided value |
31+
| app/api/route.ts:13:18:13:21 | body | app/api/route.ts:2:24:2:33 | req.json() | app/api/route.ts:13:18:13:21 | body | Cross-site scripting vulnerability due to a $@. | app/api/route.ts:2:24:2:33 | req.json() | user-provided value |
32+
| app/api/route.ts:25:18:25:21 | body | app/api/route.ts:2:24:2:33 | req.json() | app/api/route.ts:25:18:25:21 | body | Cross-site scripting vulnerability due to a $@. | app/api/route.ts:2:24:2:33 | req.json() | user-provided value |
33+
| app/api/route.ts:29:25:29:28 | body | app/api/route.ts:2:24:2:33 | req.json() | app/api/route.ts:29:25:29:28 | body | Cross-site scripting vulnerability due to a $@. | app/api/route.ts:2:24:2:33 | req.json() | user-provided value |
3034
| etherpad.js:11:12:11:19 | response | etherpad.js:9:16:9:30 | req.query.jsonp | etherpad.js:11:12:11:19 | response | Cross-site scripting vulnerability due to a $@. | etherpad.js:9:16:9:30 | req.query.jsonp | user-provided value |
3135
| formatting.js:6:14:6:47 | util.fo ... , evil) | formatting.js:4:16:4:29 | req.query.evil | formatting.js:6:14:6:47 | util.fo ... , evil) | Cross-site scripting vulnerability due to a $@. | formatting.js:4:16:4:29 | req.query.evil | user-provided value |
3236
| formatting.js:7:14:7:53 | require ... , evil) | formatting.js:4:16:4:29 | req.query.evil | formatting.js:7:14:7:53 | require ... , evil) | Cross-site scripting vulnerability due to a $@. | formatting.js:4:16:4:29 | req.query.evil | user-provided value |
@@ -128,6 +132,12 @@ edges
128132
| ReflectedXssGood3.js:135:15:135:27 | req.params.id | ReflectedXssGood3.js:135:9:135:27 | url | provenance | |
129133
| ReflectedXssGood3.js:139:24:139:26 | url | ReflectedXssGood3.js:68:22:68:26 | value | provenance | |
130134
| ReflectedXssGood3.js:139:24:139:26 | url | ReflectedXssGood3.js:139:12:139:27 | escapeHtml3(url) | provenance | |
135+
| app/api/route.ts:2:11:2:33 | body | app/api/route.ts:5:18:5:21 | body | provenance | |
136+
| app/api/route.ts:2:11:2:33 | body | app/api/route.ts:13:18:13:21 | body | provenance | |
137+
| app/api/route.ts:2:11:2:33 | body | app/api/route.ts:25:18:25:21 | body | provenance | |
138+
| app/api/route.ts:2:11:2:33 | body | app/api/route.ts:29:25:29:28 | body | provenance | |
139+
| app/api/route.ts:2:18:2:33 | await req.json() | app/api/route.ts:2:11:2:33 | body | provenance | |
140+
| app/api/route.ts:2:24:2:33 | req.json() | app/api/route.ts:2:18:2:33 | await req.json() | provenance | |
131141
| etherpad.js:9:5:9:53 | response | etherpad.js:11:12:11:19 | response | provenance | |
132142
| etherpad.js:9:16:9:30 | req.query.jsonp | etherpad.js:9:5:9:53 | response | provenance | |
133143
| formatting.js:4:9:4:29 | evil | formatting.js:6:43:6:46 | evil | provenance | |
@@ -309,6 +319,13 @@ nodes
309319
| ReflectedXssGood3.js:135:15:135:27 | req.params.id | semmle.label | req.params.id |
310320
| ReflectedXssGood3.js:139:12:139:27 | escapeHtml3(url) | semmle.label | escapeHtml3(url) |
311321
| ReflectedXssGood3.js:139:24:139:26 | url | semmle.label | url |
322+
| app/api/route.ts:2:11:2:33 | body | semmle.label | body |
323+
| app/api/route.ts:2:18:2:33 | await req.json() | semmle.label | await req.json() |
324+
| app/api/route.ts:2:24:2:33 | req.json() | semmle.label | req.json() |
325+
| app/api/route.ts:5:18:5:21 | body | semmle.label | body |
326+
| app/api/route.ts:13:18:13:21 | body | semmle.label | body |
327+
| app/api/route.ts:25:18:25:21 | body | semmle.label | body |
328+
| app/api/route.ts:29:25:29:28 | body | semmle.label | body |
312329
| etherpad.js:9:5:9:53 | response | semmle.label | response |
313330
| etherpad.js:9:16:9:30 | req.query.jsonp | semmle.label | req.query.jsonp |
314331
| etherpad.js:11:12:11:19 | response | semmle.label | response |

‎javascript/ql/test/query-tests/Security/CWE-079/ReflectedXss/ReflectedXssWithCustomSanitizer.expected

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -26,6 +26,10 @@
2626
| ReflectedXssContentTypes.js:39:13:39:35 | "FOO: " ... rams.id | Cross-site scripting vulnerability due to $@. | ReflectedXssContentTypes.js:39:23:39:35 | req.params.id | user-provided value |
2727
| ReflectedXssContentTypes.js:70:12:70:34 | "FOO: " ... rams.id | Cross-site scripting vulnerability due to $@. | ReflectedXssContentTypes.js:70:22:70:34 | req.params.id | user-provided value |
2828
| ReflectedXssGood3.js:139:12:139:27 | escapeHtml3(url) | Cross-site scripting vulnerability due to $@. | ReflectedXssGood3.js:135:15:135:27 | req.params.id | user-provided value |
29+
| app/api/route.ts:5:18:5:21 | body | Cross-site scripting vulnerability due to $@. | app/api/route.ts:2:24:2:33 | req.json() | user-provided value |
30+
| app/api/route.ts:13:18:13:21 | body | Cross-site scripting vulnerability due to $@. | app/api/route.ts:2:24:2:33 | req.json() | user-provided value |
31+
| app/api/route.ts:25:18:25:21 | body | Cross-site scripting vulnerability due to $@. | app/api/route.ts:2:24:2:33 | req.json() | user-provided value |
32+
| app/api/route.ts:29:25:29:28 | body | Cross-site scripting vulnerability due to $@. | app/api/route.ts:2:24:2:33 | req.json() | user-provided value |
2933
| formatting.js:6:14:6:47 | util.fo ... , evil) | Cross-site scripting vulnerability due to $@. | formatting.js:4:16:4:29 | req.query.evil | user-provided value |
3034
| formatting.js:7:14:7:53 | require ... , evil) | Cross-site scripting vulnerability due to $@. | formatting.js:4:16:4:29 | req.query.evil | user-provided value |
3135
| live-server.js:6:13:6:50 | `<html> ... /html>` | Cross-site scripting vulnerability due to $@. | live-server.js:4:21:4:27 | req.url | user-provided value |

‎javascript/ql/test/query-tests/Security/CWE-079/ReflectedXss/app/api/route.ts

Lines changed: 30 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,30 @@
1+
export async function POST(req: Request) {
2+
const body = await req.json(); // $ Source
3+
4+
new Response(body, {headers: { 'Content-Type': 'application/json' }});
5+
new Response(body, {headers: { 'Content-Type': 'text/html' }}); // $ Alert
6+
7+
const headers2 = new Headers(req.headers);
8+
headers2.append('Content-Type', 'application/json');
9+
new Response(body, { headers: headers2 });
10+
11+
const headers3 = new Headers(req.headers);
12+
headers3.append('Content-Type', 'text/html');
13+
new Response(body, { headers: headers3 }); // $ Alert
14+
15+
const headers4 = new Headers({
16+
...Object.fromEntries(req.headers),
17+
'Content-Type': 'application/json'
18+
});
19+
new Response(body, { headers: headers4 });
20+
21+
const headers5 = new Headers({
22+
...Object.fromEntries(req.headers),
23+
'Content-Type': 'text/html'
24+
});
25+
new Response(body, { headers: headers5 }); // $ Alert
26+
27+
const headers = new Headers(req.headers);
28+
headers.set('Content-Type', 'text/html');
29+
return new Response(body, { headers }); // $ Alert
30+
}

‎javascript/ql/test/query-tests/Security/CWE-079/ReflectedXss/app/api/routeNextRequest.ts

Lines changed: 32 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,32 @@
1+
import { NextRequest, NextResponse } from 'next/server';
2+
3+
export async function POST(req: NextRequest) {
4+
const body = await req.json(); // $ MISSING: Source
5+
6+
new NextResponse(body, {headers: { 'Content-Type': 'application/json' }});
7+
new NextResponse(body, {headers: { 'Content-Type': 'text/html' }}); // $ MISSING: Alert
8+
9+
const headers2 = new Headers(req.headers);
10+
headers2.append('Content-Type', 'application/json');
11+
new NextResponse(body, { headers: headers2 });
12+
13+
const headers3 = new Headers(req.headers);
14+
headers3.append('Content-Type', 'text/html');
15+
new NextResponse(body, { headers: headers3 }); // $ MISSING: Alert
16+
17+
const headers4 = new Headers({
18+
...Object.fromEntries(req.headers),
19+
'Content-Type': 'application/json'
20+
});
21+
new NextResponse(body, { headers: headers4 });
22+
23+
const headers5 = new Headers({
24+
...Object.fromEntries(req.headers),
25+
'Content-Type': 'text/html'
26+
});
27+
new NextResponse(body, { headers: headers5 }); // $ MISSING: Alert
28+
29+
const headers = new Headers(req.headers);
30+
headers.set('Content-Type', 'text/html');
31+
return new NextResponse(body, { headers }); // $ MISSING: Alert
32+
}

0 commit comments

Comments
 (0)