Skip to content

Commit c175081

Browse files
committed
Added test cases for fastify.addHook
1 parent f1a3293 commit c175081

File tree

3 files changed

+125
-0
lines changed

3 files changed

+125
-0
lines changed

javascript/ql/test/query-tests/Security/CWE-094/CodeInjection/CodeInjection.expected

Lines changed: 13 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -27,6 +27,10 @@
2727
| express.js:20:34:20:38 | taint | express.js:19:17:19:35 | req.param("wobble") | express.js:20:34:20:38 | taint | This code execution depends on a $@. | express.js:19:17:19:35 | req.param("wobble") | user-provided value |
2828
| express.js:36:15:36:19 | taint | express.js:27:17:27:35 | req.param("wobble") | express.js:36:15:36:19 | taint | This code execution depends on a $@. | express.js:27:17:27:35 | req.param("wobble") | user-provided value |
2929
| express.js:43:10:43:12 | msg | express.js:42:30:42:32 | msg | express.js:43:10:43:12 | msg | This code execution depends on a $@. | express.js:42:30:42:32 | msg | user-provided value |
30+
| fastify.js:58:44:58:52 | userInput | fastify.js:57:21:57:33 | request.query | fastify.js:58:44:58:52 | userInput | This code execution depends on a $@. | fastify.js:57:21:57:33 | request.query | user-provided value |
31+
| fastify.js:58:44:58:52 | userInput | fastify.js:57:21:57:39 | request.query.input | fastify.js:58:44:58:52 | userInput | This code execution depends on a $@. | fastify.js:57:21:57:39 | request.query.input | user-provided value |
32+
| fastify.js:59:23:59:31 | userInput | fastify.js:57:21:57:33 | request.query | fastify.js:59:23:59:31 | userInput | This code execution depends on a $@. | fastify.js:57:21:57:33 | request.query | user-provided value |
33+
| fastify.js:59:23:59:31 | userInput | fastify.js:57:21:57:39 | request.query.input | fastify.js:59:23:59:31 | userInput | This code execution depends on a $@. | fastify.js:57:21:57:39 | request.query.input | user-provided value |
3034
| module.js:9:16:9:29 | req.query.code | module.js:9:16:9:29 | req.query.code | module.js:9:16:9:29 | req.query.code | This code execution depends on a $@. | module.js:9:16:9:29 | req.query.code | user-provided value |
3135
| module.js:11:17:11:30 | req.query.code | module.js:11:17:11:30 | req.query.code | module.js:11:17:11:30 | req.query.code | This code execution depends on a $@. | module.js:11:17:11:30 | req.query.code | user-provided value |
3236
| react-native.js:8:32:8:38 | tainted | react-native.js:7:17:7:33 | req.param("code") | react-native.js:8:32:8:38 | tainted | This code execution depends on a $@. | react-native.js:7:17:7:33 | req.param("code") | user-provided value |
@@ -75,6 +79,10 @@ edges
7579
| express.js:27:9:27:35 | taint | express.js:36:15:36:19 | taint | provenance | |
7680
| express.js:27:17:27:35 | req.param("wobble") | express.js:27:9:27:35 | taint | provenance | |
7781
| express.js:42:30:42:32 | msg | express.js:43:10:43:12 | msg | provenance | |
82+
| fastify.js:57:9:57:39 | userInput | fastify.js:58:44:58:52 | userInput | provenance | |
83+
| fastify.js:57:9:57:39 | userInput | fastify.js:59:23:59:31 | userInput | provenance | |
84+
| fastify.js:57:21:57:33 | request.query | fastify.js:57:9:57:39 | userInput | provenance | |
85+
| fastify.js:57:21:57:39 | request.query.input | fastify.js:57:9:57:39 | userInput | provenance | |
7886
| react-native.js:7:7:7:33 | tainted | react-native.js:8:32:8:38 | tainted | provenance | |
7987
| react-native.js:7:7:7:33 | tainted | react-native.js:10:23:10:29 | tainted | provenance | |
8088
| react-native.js:7:17:7:33 | req.param("code") | react-native.js:7:7:7:33 | tainted | provenance | |
@@ -144,6 +152,11 @@ nodes
144152
| express.js:36:15:36:19 | taint | semmle.label | taint |
145153
| express.js:42:30:42:32 | msg | semmle.label | msg |
146154
| express.js:43:10:43:12 | msg | semmle.label | msg |
155+
| fastify.js:57:9:57:39 | userInput | semmle.label | userInput |
156+
| fastify.js:57:21:57:33 | request.query | semmle.label | request.query |
157+
| fastify.js:57:21:57:39 | request.query.input | semmle.label | request.query.input |
158+
| fastify.js:58:44:58:52 | userInput | semmle.label | userInput |
159+
| fastify.js:59:23:59:31 | userInput | semmle.label | userInput |
147160
| module.js:9:16:9:29 | req.query.code | semmle.label | req.query.code |
148161
| module.js:11:17:11:30 | req.query.code | semmle.label | req.query.code |
149162
| react-native.js:7:7:7:33 | tainted | semmle.label | tainted |

javascript/ql/test/query-tests/Security/CWE-094/CodeInjection/HeuristicSourceCodeInjection.expected

Lines changed: 9 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -11,6 +11,10 @@ edges
1111
| express.js:27:9:27:35 | taint | express.js:36:15:36:19 | taint | provenance | |
1212
| express.js:27:17:27:35 | req.param("wobble") | express.js:27:9:27:35 | taint | provenance | |
1313
| express.js:42:30:42:32 | msg | express.js:43:10:43:12 | msg | provenance | |
14+
| fastify.js:57:9:57:39 | userInput | fastify.js:58:44:58:52 | userInput | provenance | |
15+
| fastify.js:57:9:57:39 | userInput | fastify.js:59:23:59:31 | userInput | provenance | |
16+
| fastify.js:57:21:57:33 | request.query | fastify.js:57:9:57:39 | userInput | provenance | |
17+
| fastify.js:57:21:57:39 | request.query.input | fastify.js:57:9:57:39 | userInput | provenance | |
1418
| react-native.js:7:7:7:33 | tainted | react-native.js:8:32:8:38 | tainted | provenance | |
1519
| react-native.js:7:7:7:33 | tainted | react-native.js:10:23:10:29 | tainted | provenance | |
1620
| react-native.js:7:17:7:33 | req.param("code") | react-native.js:7:7:7:33 | tainted | provenance | |
@@ -82,6 +86,11 @@ nodes
8286
| express.js:36:15:36:19 | taint | semmle.label | taint |
8387
| express.js:42:30:42:32 | msg | semmle.label | msg |
8488
| express.js:43:10:43:12 | msg | semmle.label | msg |
89+
| fastify.js:57:9:57:39 | userInput | semmle.label | userInput |
90+
| fastify.js:57:21:57:33 | request.query | semmle.label | request.query |
91+
| fastify.js:57:21:57:39 | request.query.input | semmle.label | request.query.input |
92+
| fastify.js:58:44:58:52 | userInput | semmle.label | userInput |
93+
| fastify.js:59:23:59:31 | userInput | semmle.label | userInput |
8594
| module.js:9:16:9:29 | req.query.code | semmle.label | req.query.code |
8695
| module.js:11:17:11:30 | req.query.code | semmle.label | req.query.code |
8796
| react-native.js:7:7:7:33 | tainted | semmle.label | tainted |
Lines changed: 103 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,103 @@
1+
const fastify = require('fastify')({ logger: true });
2+
3+
fastify.addHook('onRequest', async (request, reply) => {
4+
const userInput = request.query.onRequest; // $ MISSING: Source[js/code-injection]
5+
if (userInput) request.evalResult = eval(userInput); // $ MISSING: Alert[js/code-injection]
6+
});
7+
8+
fastify.addHook('onSend', async (request, reply, payload) => {
9+
const userInput = request.query.onSend; // $ MISSING: Source[js/code-injection]
10+
if (userInput) request.evalResult = eval(userInput); // $ MISSING: Alert[js/code-injection]
11+
return JSON.stringify({ ...JSON.parse(payload), onSend: request.evalResult });
12+
});
13+
14+
fastify.addHook('preParsing', async (request, reply, payload) => {
15+
const userInput = request.query.preParsing; // $ MISSING: Source[js/code-injection]
16+
if (userInput) request.evalResult = eval(userInput); // $ MISSING: Alert[js/code-injection]
17+
return payload;
18+
});
19+
20+
fastify.addHook('preValidation', async (request, reply) => {
21+
const userInput = request.query.preValidation; // $ MISSING: Source[js/code-injection]
22+
if (userInput) request.evalResult = eval(userInput); // $ MISSING: Alert[js/code-injection]
23+
});
24+
25+
fastify.addHook('preHandler', async (request, reply) => {
26+
const userInput = request.query.preHandler; // $ MISSING: Source[js/code-injection]
27+
if (userInput) request.evalResult = eval(userInput); // $ MISSING: Alert[js/code-injection]
28+
});
29+
30+
fastify.addHook('preSerialization', async (request, reply, payload) => {
31+
const userInput = request.query.preSerialization; // $ MISSING: Source[js/code-injection]
32+
if (userInput) request.evalResult = eval(userInput); // $ MISSING: Alert[js/code-injection]
33+
return payload;
34+
});
35+
36+
fastify.addHook('onResponse', async (request, reply) => {
37+
const userInput = request.query.onResponse; // $ MISSING: Source[js/code-injection]
38+
if (userInput) request.evalResult = eval(userInput); // $ MISSING: Alert[js/code-injection]
39+
});
40+
41+
fastify.addHook('onError', async (request, reply, error) => {
42+
const userInput = request.query.onError; // $ MISSING: Source[js/code-injection]
43+
if (userInput) request.evalResult = eval(userInput); // $ MISSING: Alert[js/code-injection]
44+
});
45+
46+
fastify.addHook('onTimeout', async (request, reply) => {
47+
const userInput = request.query.onTimeout; // $ MISSING: Source[js/code-injection]
48+
if (userInput) request.evalResult = eval(userInput); // $ MISSING: Alert[js/code-injection]
49+
});
50+
51+
fastify.addHook('onRequestAbort', (request, done) => {
52+
const userInput = request.query.onRequestAbort; // $ MISSING: Source[js/code-injection]
53+
if (userInput) request.evalResult = eval(userInput); // $ MISSING: Alert[js/code-injection]
54+
});
55+
56+
fastify.get('/dangerous', async (request, reply) => {
57+
const userInput = request.query.input; // $ Source[js/code-injection]
58+
if (userInput) request.evalResult = eval(userInput); // $ Alert[js/code-injection]
59+
const result = eval(userInput); // $ Alert[js/code-injection]
60+
return { result };
61+
});
62+
63+
64+
// Store user input in request object
65+
fastify.addHook('preHandler', async (request, reply) => {
66+
request.storedCode = request.query.storedCode;
67+
});
68+
fastify.get('/flow-through-request', async (request, reply) => {
69+
// Use the stored code from previous hook
70+
if (request.storedCode) {
71+
const evaluatedResult = eval(request.storedCode); // $ MISSING: Alert[js/code-injection]
72+
return { result: evaluatedResult };
73+
}
74+
return { result: null };
75+
});
76+
77+
// Store user input in reply object
78+
fastify.addHook('onRequest', async (request, reply) => {
79+
reply.userCode = request.query.replyCode;
80+
});
81+
fastify.get('/flow-through-reply', async (request, reply) => {
82+
// Use the code stored in reply object
83+
if (reply.userCode) {
84+
const replyResult = eval(reply.userCode); // $ MISSING: Alert[js/code-injection]
85+
return { result: replyResult };
86+
}
87+
return { result: null };
88+
});
89+
90+
91+
// Store user input in reply object
92+
fastify.addHook('onRequest', async (request, reply) => {
93+
reply.locals = reply.locals || {};
94+
reply.locals.nestedCode = request.query.replyCode;
95+
});
96+
fastify.get('/flow-through-reply', async (request, reply) => {
97+
// Use the code stored in reply object
98+
if (reply.locals && reply.locals.nestedCode) {
99+
const replyResult = eval(reply.locals.nestedCode); // $ MISSING: Alert[js/code-injection]
100+
return { result: replyResult };
101+
}
102+
return { result: null };
103+
});

0 commit comments

Comments
 (0)