Skip to content

Commit c2b65b1

Browse files
asgerfasgerf
committed
JS: Port IncompleteUrlSubstringSanitization test
1 parent 6b4be13 commit c2b65b1

File tree

3 files changed

+37
-31
lines changed

3 files changed

+37
-31
lines changed

‎javascript/ql/test/query-tests/Security/CWE-020/IncompleteUrlSubstringSanitization/IncompleteUrlSubstringSanitization.expected

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,3 +1,4 @@
1+
problems
12
| tst-IncompleteUrlSubstringSanitization.js:4:5:4:34 | x.index ... !== -1 | '$@' can be anywhere in the URL, and arbitrary hosts may come before or after it. | tst-IncompleteUrlSubstringSanitization.js:4:15:4:26 | "secure.com" | secure.com |
23
| tst-IncompleteUrlSubstringSanitization.js:5:5:5:34 | x.index ... !== -1 | '$@' can be anywhere in the URL, and arbitrary hosts may come before or after it. | tst-IncompleteUrlSubstringSanitization.js:5:15:5:26 | "secure.net" | secure.net |
34
| tst-IncompleteUrlSubstringSanitization.js:6:5:6:35 | x.index ... !== -1 | '$@' can be anywhere in the URL, and arbitrary hosts may come before or after it. | tst-IncompleteUrlSubstringSanitization.js:6:15:6:27 | ".secure.com" | .secure.com |
@@ -23,3 +24,7 @@
2324
| tst-IncompleteUrlSubstringSanitization.js:73:5:73:48 | x.index ... ") >= 0 | '$@' can be anywhere in the URL, and arbitrary hosts may come before or after it. | tst-IncompleteUrlSubstringSanitization.js:73:15:73:42 | "https: ... oo/bar" | https://secure.com/foo/bar |
2425
| tst-IncompleteUrlSubstringSanitization.js:74:5:74:40 | x.index ... ") >= 0 | '$@' can be anywhere in the URL, and arbitrary hosts may come before or after it. | tst-IncompleteUrlSubstringSanitization.js:74:15:74:34 | "https://secure.com" | https://secure.com |
2526
| tst-IncompleteUrlSubstringSanitization.js:75:5:75:52 | x.index ... ") >= 0 | '$@' can be anywhere in the URL, and arbitrary hosts may come before or after it. | tst-IncompleteUrlSubstringSanitization.js:75:15:75:46 | "https: ... ar-baz" | https://secure.com/foo/bar-baz |
27+
testFailures
28+
| tst-IncompleteUrlSubstringSanitization.js:62:2:62:31 | '$@' can be anywhere in the URL, and arbitrary hosts may come before or after it. | Unexpected result: Alert |
29+
| tst-IncompleteUrlSubstringSanitization.js:63:4:63:33 | '$@' can be anywhere in the URL, and arbitrary hosts may come before or after it. | Unexpected result: Alert |
30+
| tst-IncompleteUrlSubstringSanitization.js:64:3:64:26 | '$@' can be anywhere in the URL, and arbitrary hosts may come before or after it. | Unexpected result: Alert |

‎javascript/ql/test/query-tests/Security/CWE-020/IncompleteUrlSubstringSanitization/IncompleteUrlSubstringSanitization.qlref

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1 +1,2 @@
1-
Security/CWE-020/IncompleteUrlSubstringSanitization.ql
1+
query: Security/CWE-020/IncompleteUrlSubstringSanitization.ql
2+
postprocess: utils/test/InlineExpectationsTestQuery.ql

‎javascript/ql/test/query-tests/Security/CWE-020/IncompleteUrlSubstringSanitization/tst-IncompleteUrlSubstringSanitization.js

Lines changed: 30 additions & 30 deletions
Original file line numberDiff line numberDiff line change
@@ -1,23 +1,23 @@
11
(function(x){
2-
x.indexOf("internal") !== -1; // NOT OK, but not flagged
3-
x.indexOf("localhost") !== -1; // NOT OK, but not flagged
4-
x.indexOf("secure.com") !== -1; // NOT OK
5-
x.indexOf("secure.net") !== -1; // NOT OK
6-
x.indexOf(".secure.com") !== -1; // NOT OK
7-
x.indexOf("sub.secure.") !== -1; // NOT OK, but not flagged
8-
x.indexOf(".sub.secure.") !== -1; // NOT OK, but not flagged
2+
x.indexOf("internal") !== -1; // $ MISSING: Alert
3+
x.indexOf("localhost") !== -1; // $ MISSING: Alert
4+
x.indexOf("secure.com") !== -1; // $ Alert
5+
x.indexOf("secure.net") !== -1; // $ Alert
6+
x.indexOf(".secure.com") !== -1; // $ Alert
7+
x.indexOf("sub.secure.") !== -1; // $ MISSING: Alert
8+
x.indexOf(".sub.secure.") !== -1; // $ MISSING: Alert
99

10-
x.indexOf("secure.com") === -1; // NOT OK
11-
x.indexOf("secure.com") === 0; // NOT OK
12-
x.indexOf("secure.com") >= 0; // NOT OK
10+
x.indexOf("secure.com") === -1; // $ Alert
11+
x.indexOf("secure.com") === 0; // $ Alert
12+
x.indexOf("secure.com") >= 0; // $ Alert
1313

14-
x.startsWith("https://secure.com"); // NOT OK
15-
x.endsWith("secure.com"); // NOT OK
14+
x.startsWith("https://secure.com"); // $ Alert
15+
x.endsWith("secure.com"); // $ Alert
1616
x.endsWith(".secure.com"); // OK
1717
x.startsWith("secure.com/"); // OK
1818
x.indexOf("secure.com/") === 0; // OK
1919

20-
x.includes("secure.com"); // NOT OK
20+
x.includes("secure.com"); // $ Alert
2121

2222
x.indexOf("#") !== -1; // OK
2323
x.indexOf(":") !== -1; // OK
@@ -29,11 +29,11 @@
2929
x.indexOf("some/path") !== -1; // OK
3030
x.indexOf("/index.html") !== -1; // OK
3131
x.indexOf(":template:") !== -1; // OK
32-
x.indexOf("https://secure.com") !== -1; // NOT OK
33-
x.indexOf("https://secure.com:443") !== -1; // NOT OK
34-
x.indexOf("https://secure.com/") !== -1; // NOT OK
32+
x.indexOf("https://secure.com") !== -1; // $ Alert
33+
x.indexOf("https://secure.com:443") !== -1; // $ Alert
34+
x.indexOf("https://secure.com/") !== -1; // $ Alert
3535

36-
x.indexOf(".cn") !== -1; // NOT OK, but not flagged
36+
x.indexOf(".cn") !== -1; // $ MISSING: Alert
3737
x.indexOf(".jpg") !== -1; // OK
3838
x.indexOf("index.html") !== -1; // OK
3939
x.indexOf("index.js") !== -1; // OK
@@ -43,34 +43,34 @@
4343
x.indexOf("secure=true") !== -1; // OK (query param)
4444
x.indexOf("&auth=") !== -1; // OK (query param)
4545

46-
x.indexOf(getCurrentDomain()) !== -1; // NOT OK, but not flagged
47-
x.indexOf(location.origin) !== -1; // NOT OK, but not flagged
46+
x.indexOf(getCurrentDomain()) !== -1; // $ MISSING: Alert
47+
x.indexOf(location.origin) !== -1; // $ MISSING: Alert
4848

4949
x.indexOf("tar.gz") + offset; // OK
5050
x.indexOf("tar.gz") - offset; // OK
5151

52-
x.indexOf("https://example.internal") !== -1; // NOT OK
52+
x.indexOf("https://example.internal") !== -1; // $ Alert
5353
x.indexOf("https://") !== -1; // OK
5454

55-
x.startsWith("https://example.internal"); // NOT OK
56-
x.indexOf('https://example.internal.org') !== 0; // NOT OK
57-
x.indexOf('https://example.internal.org') === 0; // NOT OK
58-
x.endsWith("internal.com"); // NOT OK
55+
x.startsWith("https://example.internal"); // $ Alert
56+
x.indexOf('https://example.internal.org') !== 0; // $ Alert
57+
x.indexOf('https://example.internal.org') === 0; // $ Alert
58+
x.endsWith("internal.com"); // $ Alert
5959
x.startsWith("https://example.internal:80"); // OK
6060

61-
x.indexOf("secure.com") !== -1; // NOT OK
61+
x.indexOf("secure.com") !== -1; // $ Alert
6262
x.indexOf("secure.com") === -1; // OK
6363
!(x.indexOf("secure.com") !== -1); // OK
6464
!x.includes("secure.com"); // OK
6565

66-
if(!x.includes("secure.com")) { // NOT OK
66+
if(!x.includes("secure.com")) { // $ Alert
6767

6868
} else {
6969
doSomeThingWithTrustedURL(x);
7070
}
71-
71+
7272
x.startsWith("https://secure.com/foo/bar"); // OK - a forward slash after the domain makes prefix checks safe.
73-
x.indexOf("https://secure.com/foo/bar") >= 0 // NOT OK - the url can be anywhere in the string.
74-
x.indexOf("https://secure.com") >= 0 // NOT OK
75-
x.indexOf("https://secure.com/foo/bar-baz") >= 0 // NOT OK - the url can be anywhere in the string.
73+
x.indexOf("https://secure.com/foo/bar") >= 0 // $ Alert - the url can be anywhere in the string.
74+
x.indexOf("https://secure.com") >= 0 // $ Alert
75+
x.indexOf("https://secure.com/foo/bar-baz") >= 0 // $ Alert - the url can be anywhere in the string.
7676
});

0 commit comments

Comments
 (0)