Skip to content

Commit a83508a

Browse files
asgerfasgerf
committed
JS: Port IncompleteHostNameRegExt test
1 parent ce8912d commit a83508a

File tree

3 files changed

+41
-32
lines changed

3 files changed

+41
-32
lines changed

‎javascript/ql/test/query-tests/Security/CWE-020/IncompleteHostnameRegExp/IncompleteHostnameRegExp.expected

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,3 +1,4 @@
1+
problems
12
| tst-IncompleteHostnameRegExp.js:3:3:3:28 | ^http:\\/\\/test.example.com | This regular expression has an unescaped '.' before 'example.com', so it might match more hosts than expected. | tst-IncompleteHostnameRegExp.js:3:2:3:29 | /^http: ... le.com/ | here |
23
| tst-IncompleteHostnameRegExp.js:5:3:5:28 | ^http:\\/\\/test.example.net | This regular expression has an unescaped '.' before 'example.net', so it might match more hosts than expected. | tst-IncompleteHostnameRegExp.js:5:2:5:29 | /^http: ... le.net/ | here |
34
| tst-IncompleteHostnameRegExp.js:6:3:6:42 | ^http:\\/\\/test.(example-a\|example-b).com | This regular expression has an unescaped '.' before '(example-a\|example-b).com', so it might match more hosts than expected. | tst-IncompleteHostnameRegExp.js:6:2:6:43 | /^http: ... b).com/ | here |
@@ -26,3 +27,10 @@
2627
| tst-IncompleteHostnameRegExp.js:55:14:55:38 | ^http://test.example.com | This regular expression has an unescaped '.' before 'example.com', so it might match more hosts than expected. | tst-IncompleteHostnameRegExp.js:55:13:55:39 | '^http: ... le.com' | here |
2728
| tst-IncompleteHostnameRegExp.js:59:5:59:20 | foo.example\\.com | This regular expression has an unescaped '.' before 'example\\.com', so it might match more hosts than expected. | tst-IncompleteHostnameRegExp.js:59:2:59:32 | /^(foo. ... ever)$/ | here |
2829
| tst-IncompleteHostnameRegExp.js:61:18:61:41 | ^http://test.example.com | This regular expression has an unescaped '.' before 'example.com', so it might match more hosts than expected. | tst-IncompleteHostnameRegExp.js:61:17:61:42 | "^http: ... le.com" | here |
30+
testFailures
31+
| tst-IncompleteHostnameRegExp.js:9:45:9:54 | // $ Alert | Missing result: Alert |
32+
| tst-IncompleteHostnameRegExp.js:10:3:10:36 | This regular expression has an unescaped '.' before 'example.com', so it might match more hosts than expected. | Unexpected result: Alert |
33+
| tst-IncompleteHostnameRegExp.js:17:35:17:44 | // $ Alert | Missing result: Alert |
34+
| tst-IncompleteHostnameRegExp.js:36:43:36:52 | // $ Alert | Missing result: Alert |
35+
| tst-IncompleteHostnameRegExp.js:42:69:42:78 | // $ Alert | Missing result: Alert |
36+
| tst-IncompleteHostnameRegExp.js:59:5:59:20 | This regular expression has an unescaped '.' before 'example\\.com', so it might match more hosts than expected. | Unexpected result: Alert |

‎javascript/ql/test/query-tests/Security/CWE-020/IncompleteHostnameRegExp/IncompleteHostnameRegExp.qlref

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1 +1,2 @@
1-
Security/CWE-020/IncompleteHostnameRegExp.ql
1+
query: Security/CWE-020/IncompleteHostnameRegExp.ql
2+
postprocess: utils/test/InlineExpectationsTestQuery.ql

‎javascript/ql/test/query-tests/Security/CWE-020/IncompleteHostnameRegExp/tst-IncompleteHostnameRegExp.js

Lines changed: 31 additions & 31 deletions
Original file line numberDiff line numberDiff line change
@@ -1,62 +1,62 @@
11
(function() {
2-
/^http:\/\/example.com/; // OK
3-
/^http:\/\/test.example.com/; // NOT OK
4-
/^http:\/\/test\\.example.com/; // OK
5-
/^http:\/\/test.example.net/; // NOT OK
6-
/^http:\/\/test.(example-a|example-b).com/; // NOT OK
7-
/^http:\/\/(.+).example.com\//; // NOT OK
8-
/^http:\/\/(\\.+)\\.example.com/; // OK
9-
/^http:\/\/(?:.+)\\.test\\.example.com\//; // NOT OK
10-
/^http:\/\/test.example.com\/(?:.*)/; // OK
11-
new RegExp("^http://test.example.com"); // NOT OK
12-
if (s.match("^http://test.example.com")) {} // NOT OK
2+
/^http:\/\/example.com/;
3+
/^http:\/\/test.example.com/; // $ Alert
4+
/^http:\/\/test\\.example.com/;
5+
/^http:\/\/test.example.net/; // $ Alert
6+
/^http:\/\/test.(example-a|example-b).com/; // $ Alert
7+
/^http:\/\/(.+).example.com\//; // $ Alert
8+
/^http:\/\/(\\.+)\\.example.com/;
9+
/^http:\/\/(?:.+)\\.test\\.example.com\//; // $ Alert
10+
/^http:\/\/test.example.com\/(?:.*)/;
11+
new RegExp("^http://test.example.com"); // $ Alert
12+
if (s.match("^http://test.example.com")) {} // $ Alert
1313

1414
function id(e) { return e; }
15-
new RegExp(id(id(id("^http://test.example.com")))); // NOT OK
15+
new RegExp(id(id(id("^http://test.example.com")))); // $ Alert
1616

17-
new RegExp(`test.example.com$`); // NOT OK
17+
new RegExp(`test.example.com$`); // $ Alert
1818

19-
let hostname = '^test.example.com'; // NOT OK
19+
let hostname = '^test.example.com'; // $ Alert
2020
new RegExp(`${hostname}$`);
2121

22-
let domain = { hostname: 'test.example.com$' }; // NOT OK
22+
let domain = { hostname: 'test.example.com$' }; // $ Alert
2323
new RegExp(domain.hostname);
2424

2525
function convert1(domain) {
2626
return new RegExp(domain.hostname);
2727
}
28-
convert1({ hostname: 'test.example.com$' }); // NOT OK
28+
convert1({ hostname: 'test.example.com$' }); // $ Alert
2929

30-
let domains = [ { hostname: 'test.example.com$' } ]; // NOT OK
30+
let domains = [ { hostname: 'test.example.com$' } ]; // $ Alert
3131
function convert2(domain) {
3232
return new RegExp(domain.hostname);
3333
}
3434
domains.map(d => convert2(d));
3535

36-
/^(.+\.(?:example-a|example-b)\.com)\//; // NOT OK
37-
/^(https?:)?\/\/((service|www).)?example.com(?=$|\/)/; // NOT OK
38-
/^(http|https):\/\/www.example.com\/p\/f\//; // NOT OK
39-
/^(http:\/\/sub.example.com\/)/g; // NOT OK
40-
/^https?:\/\/api.example.com/; // NOT OK
41-
new RegExp('^http://localhost:8000|' + '^https?://.+\\.example\\.com/'); // NOT OK
42-
new RegExp('^http[s]?:\/\/?sub1\\.sub2\\.example\\.com\/f\/(.+)'); // NOT OK
43-
/^https:\/\/[a-z]*.example.com$/; // NOT OK
44-
RegExp('^protos?://(localhost|.+.example.net|.+.example-a.com|.+.example-b.com|.+.example.internal)'); // NOT OK
36+
/^(.+\.(?:example-a|example-b)\.com)\//; // $ Alert
37+
/^(https?:)?\/\/((service|www).)?example.com(?=$|\/)/; // $ Alert
38+
/^(http|https):\/\/www.example.com\/p\/f\//; // $ Alert
39+
/^(http:\/\/sub.example.com\/)/g; // $ Alert
40+
/^https?:\/\/api.example.com/; // $ Alert
41+
new RegExp('^http://localhost:8000|' + '^https?://.+\\.example\\.com/'); // $ Alert
42+
new RegExp('^http[s]?:\/\/?sub1\\.sub2\\.example\\.com\/f\/(.+)'); // $ Alert
43+
/^https:\/\/[a-z]*.example.com$/; // $ Alert
44+
RegExp('^protos?://(localhost|.+.example.net|.+.example-a.com|.+.example-b.com|.+.example.internal)'); // $ Alert
4545

4646
/^(example.dev|example.com)/; // OK
4747

48-
new RegExp('^http://localhost:8000|' + '^https?://.+.example\\.com/'); // NOT OK
48+
new RegExp('^http://localhost:8000|' + '^https?://.+.example\\.com/'); // $ Alert
4949

5050
var primary = 'example.com$';
51-
new RegExp('test.' + primary); // NOT OK, but not detected
51+
new RegExp('test.' + primary); // $ MISSING: Alert
5252

53-
new RegExp('test.' + 'example.com$'); // NOT OK
53+
new RegExp('test.' + 'example.com$'); // $ Alert
5454

55-
new RegExp('^http://test\.example.com'); // NOT OK
55+
new RegExp('^http://test\.example.com'); // $ Alert
5656

5757
/^http:\/\/(..|...)\.example\.com\/index\.html/; // OK, wildcards are intentional
5858
/^http:\/\/.\.example\.com\/index\.html/; // OK, the wildcard is intentional
5959
/^(foo.example\.com|whatever)$/; // kinda OK - one disjunction doesn't even look like a hostname
6060

61-
if (s.matchAll("^http://test.example.com")) {} // NOT OK
61+
if (s.matchAll("^http://test.example.com")) {} // $ Alert
6262
});

0 commit comments

Comments
 (0)