Skip to content

Commit fe90146

Browse files
asgerfasgerf
committed
JS: Add test for path.join with spread argument
1 parent 06bc0f6 commit fe90146

File tree

2 files changed

+53
-0
lines changed

2 files changed

+53
-0
lines changed

‎javascript/ql/test/query-tests/Security/CWE-022/TaintedPath/TaintedPath.expected

Lines changed: 48 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -2163,6 +2163,28 @@ nodes
21632163
| normalizedPaths.js:399:21:399:24 | path |
21642164
| normalizedPaths.js:399:21:399:24 | path |
21652165
| normalizedPaths.js:399:21:399:24 | path |
2166+
| normalizedPaths.js:407:19:407:67 | pathMod ... t('/')) |
2167+
| normalizedPaths.js:407:19:407:67 | pathMod ... t('/')) |
2168+
| normalizedPaths.js:407:19:407:67 | pathMod ... t('/')) |
2169+
| normalizedPaths.js:407:19:407:67 | pathMod ... t('/')) |
2170+
| normalizedPaths.js:407:45:407:55 | req.query.x |
2171+
| normalizedPaths.js:407:45:407:55 | req.query.x |
2172+
| normalizedPaths.js:407:45:407:55 | req.query.x |
2173+
| normalizedPaths.js:407:45:407:55 | req.query.x |
2174+
| normalizedPaths.js:407:45:407:66 | req.que ... it('/') |
2175+
| normalizedPaths.js:407:45:407:66 | req.que ... it('/') |
2176+
| normalizedPaths.js:407:45:407:66 | req.que ... it('/') |
2177+
| normalizedPaths.js:408:19:408:60 | pathMod ... t('/')) |
2178+
| normalizedPaths.js:408:19:408:60 | pathMod ... t('/')) |
2179+
| normalizedPaths.js:408:19:408:60 | pathMod ... t('/')) |
2180+
| normalizedPaths.js:408:19:408:60 | pathMod ... t('/')) |
2181+
| normalizedPaths.js:408:38:408:48 | req.query.x |
2182+
| normalizedPaths.js:408:38:408:48 | req.query.x |
2183+
| normalizedPaths.js:408:38:408:48 | req.query.x |
2184+
| normalizedPaths.js:408:38:408:48 | req.query.x |
2185+
| normalizedPaths.js:408:38:408:59 | req.que ... it('/') |
2186+
| normalizedPaths.js:408:38:408:59 | req.que ... it('/') |
2187+
| normalizedPaths.js:408:38:408:59 | req.que ... it('/') |
21662188
| other-fs-libraries.js:9:7:9:48 | path |
21672189
| other-fs-libraries.js:9:7:9:48 | path |
21682190
| other-fs-libraries.js:9:7:9:48 | path |
@@ -7350,6 +7372,30 @@ edges
73507372
| normalizedPaths.js:385:35:385:45 | req.query.x | normalizedPaths.js:385:14:385:46 | pathMod ... uery.x) |
73517373
| normalizedPaths.js:385:35:385:45 | req.query.x | normalizedPaths.js:385:14:385:46 | pathMod ... uery.x) |
73527374
| normalizedPaths.js:385:35:385:45 | req.query.x | normalizedPaths.js:385:14:385:46 | pathMod ... uery.x) |
7375+
| normalizedPaths.js:407:45:407:55 | req.query.x | normalizedPaths.js:407:45:407:66 | req.que ... it('/') |
7376+
| normalizedPaths.js:407:45:407:55 | req.query.x | normalizedPaths.js:407:45:407:66 | req.que ... it('/') |
7377+
| normalizedPaths.js:407:45:407:55 | req.query.x | normalizedPaths.js:407:45:407:66 | req.que ... it('/') |
7378+
| normalizedPaths.js:407:45:407:55 | req.query.x | normalizedPaths.js:407:45:407:66 | req.que ... it('/') |
7379+
| normalizedPaths.js:407:45:407:55 | req.query.x | normalizedPaths.js:407:45:407:66 | req.que ... it('/') |
7380+
| normalizedPaths.js:407:45:407:55 | req.query.x | normalizedPaths.js:407:45:407:66 | req.que ... it('/') |
7381+
| normalizedPaths.js:407:45:407:66 | req.que ... it('/') | normalizedPaths.js:407:19:407:67 | pathMod ... t('/')) |
7382+
| normalizedPaths.js:407:45:407:66 | req.que ... it('/') | normalizedPaths.js:407:19:407:67 | pathMod ... t('/')) |
7383+
| normalizedPaths.js:407:45:407:66 | req.que ... it('/') | normalizedPaths.js:407:19:407:67 | pathMod ... t('/')) |
7384+
| normalizedPaths.js:407:45:407:66 | req.que ... it('/') | normalizedPaths.js:407:19:407:67 | pathMod ... t('/')) |
7385+
| normalizedPaths.js:407:45:407:66 | req.que ... it('/') | normalizedPaths.js:407:19:407:67 | pathMod ... t('/')) |
7386+
| normalizedPaths.js:407:45:407:66 | req.que ... it('/') | normalizedPaths.js:407:19:407:67 | pathMod ... t('/')) |
7387+
| normalizedPaths.js:408:38:408:48 | req.query.x | normalizedPaths.js:408:38:408:59 | req.que ... it('/') |
7388+
| normalizedPaths.js:408:38:408:48 | req.query.x | normalizedPaths.js:408:38:408:59 | req.que ... it('/') |
7389+
| normalizedPaths.js:408:38:408:48 | req.query.x | normalizedPaths.js:408:38:408:59 | req.que ... it('/') |
7390+
| normalizedPaths.js:408:38:408:48 | req.query.x | normalizedPaths.js:408:38:408:59 | req.que ... it('/') |
7391+
| normalizedPaths.js:408:38:408:48 | req.query.x | normalizedPaths.js:408:38:408:59 | req.que ... it('/') |
7392+
| normalizedPaths.js:408:38:408:48 | req.query.x | normalizedPaths.js:408:38:408:59 | req.que ... it('/') |
7393+
| normalizedPaths.js:408:38:408:59 | req.que ... it('/') | normalizedPaths.js:408:19:408:60 | pathMod ... t('/')) |
7394+
| normalizedPaths.js:408:38:408:59 | req.que ... it('/') | normalizedPaths.js:408:19:408:60 | pathMod ... t('/')) |
7395+
| normalizedPaths.js:408:38:408:59 | req.que ... it('/') | normalizedPaths.js:408:19:408:60 | pathMod ... t('/')) |
7396+
| normalizedPaths.js:408:38:408:59 | req.que ... it('/') | normalizedPaths.js:408:19:408:60 | pathMod ... t('/')) |
7397+
| normalizedPaths.js:408:38:408:59 | req.que ... it('/') | normalizedPaths.js:408:19:408:60 | pathMod ... t('/')) |
7398+
| normalizedPaths.js:408:38:408:59 | req.que ... it('/') | normalizedPaths.js:408:19:408:60 | pathMod ... t('/')) |
73537399
| other-fs-libraries.js:9:7:9:48 | path | other-fs-libraries.js:11:19:11:22 | path |
73547400
| other-fs-libraries.js:9:7:9:48 | path | other-fs-libraries.js:11:19:11:22 | path |
73557401
| other-fs-libraries.js:9:7:9:48 | path | other-fs-libraries.js:11:19:11:22 | path |
@@ -10363,6 +10409,8 @@ edges
1036310409
| normalizedPaths.js:381:19:381:29 | slash(path) | normalizedPaths.js:377:14:377:27 | req.query.path | normalizedPaths.js:381:19:381:29 | slash(path) | This path depends on a $@. | normalizedPaths.js:377:14:377:27 | req.query.path | user-provided value |
1036410410
| normalizedPaths.js:388:19:388:22 | path | normalizedPaths.js:385:35:385:45 | req.query.x | normalizedPaths.js:388:19:388:22 | path | This path depends on a $@. | normalizedPaths.js:385:35:385:45 | req.query.x | user-provided value |
1036510411
| normalizedPaths.js:399:21:399:24 | path | normalizedPaths.js:385:35:385:45 | req.query.x | normalizedPaths.js:399:21:399:24 | path | This path depends on a $@. | normalizedPaths.js:385:35:385:45 | req.query.x | user-provided value |
10412+
| normalizedPaths.js:407:19:407:67 | pathMod ... t('/')) | normalizedPaths.js:407:45:407:55 | req.query.x | normalizedPaths.js:407:19:407:67 | pathMod ... t('/')) | This path depends on a $@. | normalizedPaths.js:407:45:407:55 | req.query.x | user-provided value |
10413+
| normalizedPaths.js:408:19:408:60 | pathMod ... t('/')) | normalizedPaths.js:408:38:408:48 | req.query.x | normalizedPaths.js:408:19:408:60 | pathMod ... t('/')) | This path depends on a $@. | normalizedPaths.js:408:38:408:48 | req.query.x | user-provided value |
1036610414
| other-fs-libraries.js:11:19:11:22 | path | other-fs-libraries.js:9:24:9:30 | req.url | other-fs-libraries.js:11:19:11:22 | path | This path depends on a $@. | other-fs-libraries.js:9:24:9:30 | req.url | user-provided value |
1036710415
| other-fs-libraries.js:12:27:12:30 | path | other-fs-libraries.js:9:24:9:30 | req.url | other-fs-libraries.js:12:27:12:30 | path | This path depends on a $@. | other-fs-libraries.js:9:24:9:30 | req.url | user-provided value |
1036810416
| other-fs-libraries.js:13:24:13:27 | path | other-fs-libraries.js:9:24:9:30 | req.url | other-fs-libraries.js:13:24:13:27 | path | This path depends on a $@. | other-fs-libraries.js:9:24:9:30 | req.url | user-provided value |

‎javascript/ql/test/query-tests/Security/CWE-022/TaintedPath/normalizedPaths.js

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -402,3 +402,8 @@ app.get('/dotdot-regexp', (req, res) => {
402402
fs.readFileSync(path); // OK
403403
}
404404
});
405+
406+
app.get('/join-spread', (req, res) => {
407+
fs.readFileSync(pathModule.join('foo', ...req.query.x.split('/'))); // NOT OK
408+
fs.readFileSync(pathModule.join(...req.query.x.split('/'))); // NOT OK
409+
});

0 commit comments

Comments
 (0)