Skip to content

Commit b239bfa

Browse files
NapalysNapalys
committed
Added tests forIncompleteHostnameRegExp and normalizedPaths using matchAll
1 parent ccee34d commit b239bfa

File tree

4 files changed

+54
-0
lines changed

4 files changed

+54
-0
lines changed

‎javascript/ql/test/query-tests/Security/CWE-020/IncompleteHostnameRegExp/IncompleteHostnameRegExp.expected

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -25,3 +25,4 @@
2525
| tst-IncompleteHostnameRegExp.js:53:14:53:35 | test.example.com$ | This regular expression has an unescaped '.' before 'example.com', so it might match more hosts than expected. | tst-IncompleteHostnameRegExp.js:53:13:53:36 | 'test.' ... e.com$' | here |
2626
| tst-IncompleteHostnameRegExp.js:55:14:55:38 | ^http://test.example.com | This regular expression has an unescaped '.' before 'example.com', so it might match more hosts than expected. | tst-IncompleteHostnameRegExp.js:55:13:55:39 | '^http: ... le.com' | here |
2727
| tst-IncompleteHostnameRegExp.js:59:5:59:20 | foo.example\\.com | This regular expression has an unescaped '.' before 'example\\.com', so it might match more hosts than expected. | tst-IncompleteHostnameRegExp.js:59:2:59:32 | /^(foo. ... ever)$/ | here |
28+
| tst-IncompleteHostnameRegExp.js:61:18:61:41 | ^http://test.example.com | This regular expression has an unescaped '.' before 'example.com', so it might match more hosts than expected. | tst-IncompleteHostnameRegExp.js:61:17:61:42 | "^http: ... le.com" | here |

‎javascript/ql/test/query-tests/Security/CWE-020/IncompleteHostnameRegExp/tst-IncompleteHostnameRegExp.js

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -57,4 +57,6 @@
5757
/^http:\/\/(..|...)\.example\.com\/index\.html/; // OK, wildcards are intentional
5858
/^http:\/\/.\.example\.com\/index\.html/; // OK, the wildcard is intentional
5959
/^(foo.example\.com|whatever)$/; // kinda OK - one disjunction doesn't even look like a hostname
60+
61+
if (s.matchAll("^http://test.example.com")) {} // NOT OK
6062
});

‎javascript/ql/test/query-tests/Security/CWE-022/TaintedPath/TaintedPath.expected

Lines changed: 29 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -2237,6 +2237,19 @@ nodes
22372237
| normalizedPaths.js:408:38:408:59 | req.que ... it('/') |
22382238
| normalizedPaths.js:408:38:408:59 | req.que ... it('/') |
22392239
| normalizedPaths.js:408:38:408:59 | req.que ... it('/') |
2240+
| normalizedPaths.js:412:7:412:46 | path |
2241+
| normalizedPaths.js:412:7:412:46 | path |
2242+
| normalizedPaths.js:412:14:412:46 | pathMod ... uery.x) |
2243+
| normalizedPaths.js:412:14:412:46 | pathMod ... uery.x) |
2244+
| normalizedPaths.js:412:35:412:45 | req.query.x |
2245+
| normalizedPaths.js:412:35:412:45 | req.query.x |
2246+
| normalizedPaths.js:412:35:412:45 | req.query.x |
2247+
| normalizedPaths.js:415:19:415:22 | path |
2248+
| normalizedPaths.js:415:19:415:22 | path |
2249+
| normalizedPaths.js:415:19:415:22 | path |
2250+
| normalizedPaths.js:426:21:426:24 | path |
2251+
| normalizedPaths.js:426:21:426:24 | path |
2252+
| normalizedPaths.js:426:21:426:24 | path |
22402253
| other-fs-libraries.js:9:7:9:48 | path |
22412254
| other-fs-libraries.js:9:7:9:48 | path |
22422255
| other-fs-libraries.js:9:7:9:48 | path |
@@ -7524,6 +7537,20 @@ edges
75247537
| normalizedPaths.js:408:38:408:59 | req.que ... it('/') | normalizedPaths.js:408:19:408:60 | pathMod ... t('/')) |
75257538
| normalizedPaths.js:408:38:408:59 | req.que ... it('/') | normalizedPaths.js:408:19:408:60 | pathMod ... t('/')) |
75267539
| normalizedPaths.js:408:38:408:59 | req.que ... it('/') | normalizedPaths.js:408:19:408:60 | pathMod ... t('/')) |
7540+
| normalizedPaths.js:412:7:412:46 | path | normalizedPaths.js:415:19:415:22 | path |
7541+
| normalizedPaths.js:412:7:412:46 | path | normalizedPaths.js:415:19:415:22 | path |
7542+
| normalizedPaths.js:412:7:412:46 | path | normalizedPaths.js:415:19:415:22 | path |
7543+
| normalizedPaths.js:412:7:412:46 | path | normalizedPaths.js:415:19:415:22 | path |
7544+
| normalizedPaths.js:412:7:412:46 | path | normalizedPaths.js:426:21:426:24 | path |
7545+
| normalizedPaths.js:412:7:412:46 | path | normalizedPaths.js:426:21:426:24 | path |
7546+
| normalizedPaths.js:412:7:412:46 | path | normalizedPaths.js:426:21:426:24 | path |
7547+
| normalizedPaths.js:412:7:412:46 | path | normalizedPaths.js:426:21:426:24 | path |
7548+
| normalizedPaths.js:412:14:412:46 | pathMod ... uery.x) | normalizedPaths.js:412:7:412:46 | path |
7549+
| normalizedPaths.js:412:14:412:46 | pathMod ... uery.x) | normalizedPaths.js:412:7:412:46 | path |
7550+
| normalizedPaths.js:412:35:412:45 | req.query.x | normalizedPaths.js:412:14:412:46 | pathMod ... uery.x) |
7551+
| normalizedPaths.js:412:35:412:45 | req.query.x | normalizedPaths.js:412:14:412:46 | pathMod ... uery.x) |
7552+
| normalizedPaths.js:412:35:412:45 | req.query.x | normalizedPaths.js:412:14:412:46 | pathMod ... uery.x) |
7553+
| normalizedPaths.js:412:35:412:45 | req.query.x | normalizedPaths.js:412:14:412:46 | pathMod ... uery.x) |
75277554
| other-fs-libraries.js:9:7:9:48 | path | other-fs-libraries.js:11:19:11:22 | path |
75287555
| other-fs-libraries.js:9:7:9:48 | path | other-fs-libraries.js:11:19:11:22 | path |
75297556
| other-fs-libraries.js:9:7:9:48 | path | other-fs-libraries.js:11:19:11:22 | path |
@@ -10539,6 +10566,8 @@ edges
1053910566
| normalizedPaths.js:399:21:399:24 | path | normalizedPaths.js:385:35:385:45 | req.query.x | normalizedPaths.js:399:21:399:24 | path | This path depends on a $@. | normalizedPaths.js:385:35:385:45 | req.query.x | user-provided value |
1054010567
| normalizedPaths.js:407:19:407:67 | pathMod ... t('/')) | normalizedPaths.js:407:45:407:55 | req.query.x | normalizedPaths.js:407:19:407:67 | pathMod ... t('/')) | This path depends on a $@. | normalizedPaths.js:407:45:407:55 | req.query.x | user-provided value |
1054110568
| normalizedPaths.js:408:19:408:60 | pathMod ... t('/')) | normalizedPaths.js:408:38:408:48 | req.query.x | normalizedPaths.js:408:19:408:60 | pathMod ... t('/')) | This path depends on a $@. | normalizedPaths.js:408:38:408:48 | req.query.x | user-provided value |
10569+
| normalizedPaths.js:415:19:415:22 | path | normalizedPaths.js:412:35:412:45 | req.query.x | normalizedPaths.js:415:19:415:22 | path | This path depends on a $@. | normalizedPaths.js:412:35:412:45 | req.query.x | user-provided value |
10570+
| normalizedPaths.js:426:21:426:24 | path | normalizedPaths.js:412:35:412:45 | req.query.x | normalizedPaths.js:426:21:426:24 | path | This path depends on a $@. | normalizedPaths.js:412:35:412:45 | req.query.x | user-provided value |
1054210571
| other-fs-libraries.js:11:19:11:22 | path | other-fs-libraries.js:9:24:9:30 | req.url | other-fs-libraries.js:11:19:11:22 | path | This path depends on a $@. | other-fs-libraries.js:9:24:9:30 | req.url | user-provided value |
1054310572
| other-fs-libraries.js:12:27:12:30 | path | other-fs-libraries.js:9:24:9:30 | req.url | other-fs-libraries.js:12:27:12:30 | path | This path depends on a $@. | other-fs-libraries.js:9:24:9:30 | req.url | user-provided value |
1054410573
| other-fs-libraries.js:13:24:13:27 | path | other-fs-libraries.js:9:24:9:30 | req.url | other-fs-libraries.js:13:24:13:27 | path | This path depends on a $@. | other-fs-libraries.js:9:24:9:30 | req.url | user-provided value |

‎javascript/ql/test/query-tests/Security/CWE-022/TaintedPath/normalizedPaths.js

Lines changed: 22 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -407,3 +407,25 @@ app.get('/join-spread', (req, res) => {
407407
fs.readFileSync(pathModule.join('foo', ...req.query.x.split('/'))); // NOT OK
408408
fs.readFileSync(pathModule.join(...req.query.x.split('/'))); // NOT OK
409409
});
410+
411+
app.get('/dotdot-matchAll-regexp', (req, res) => {
412+
let path = pathModule.normalize(req.query.x);
413+
if (pathModule.isAbsolute(path))
414+
return;
415+
fs.readFileSync(path); // NOT OK
416+
if (!path.matchAll(/\./)) {
417+
fs.readFileSync(path); // OK
418+
}
419+
if (!path.matchAll(/\.\./)) {
420+
fs.readFileSync(path); // OK
421+
}
422+
if (!path.matchAll(/\.\.\//)) {
423+
fs.readFileSync(path); // OK
424+
}
425+
if (!path.matchAll(/\.\.\/foo/)) {
426+
fs.readFileSync(path); // NOT OK
427+
}
428+
if (!path.matchAll(/(\.\.\/|\.\.\\)/)) {
429+
fs.readFileSync(path); // OK
430+
}
431+
});

0 commit comments

Comments
 (0)