Skip to content

Commit a4fe728

Browse files
committed
Added matchAll test which is not marked as vulnurability by CodeQL
1 parent 514375d commit a4fe728

File tree

1 file changed

+7
-1
lines changed

1 file changed

+7
-1
lines changed

javascript/ql/test/query-tests/Security/CWE-117/logInjectionBad.js

Lines changed: 7 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -116,4 +116,10 @@ const server4 = http.createServer((req, res) => {
116116
});
117117
server.start();
118118
}
119-
});
119+
});
120+
121+
const serverMatchAll = http.createServer((req, res) => {
122+
let username = url.parse(req.url, true).query.username;
123+
let otherStr = username.matchAll(/.*/g)[0]; // BAD - this is suppose to be cought by Taint Tracking, works for match but not matchAll
124+
console.log(otherStr);
125+
});

0 commit comments

Comments
 (0)