Thanks to visit codestin.com
Credit goes to github.com

Skip to content

Commit 02c4a04

Browse files
erik-krogherik-krogh
committed
add tests for js/build-artifact-leak
1 parent 2f9124f commit 02c4a04

4 files changed

Lines changed: 102 additions & 2 deletions

File tree

‎javascript/ql/src/semmle/javascript/security/dataflow/CleartextLoggingCustomizations.qll‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -208,8 +208,8 @@ module CleartextLogging {
208208
stringify.getArgument(0) = read
209209
)
210210
|
211-
exists(write.getPropertyNameExpr()) and
212-
exists(read.getPropertyNameExpr()) and
211+
not exists(write.getPropertyName()) and
212+
not exists(read.getPropertyName()) and
213213
src = read.getBase() and
214214
trg = write.getBase().getALocalSource()
215215
)

‎javascript/ql/test/query-tests/Security/CWE-312/BuildArtifactLeak.expected‎

Lines changed: 57 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,57 @@
1+
nodes
2+
| build-leaks.js:4:39:6:1 | { // NO ... .env)\\n} |
3+
| build-leaks.js:4:39:6:1 | { // NO ... .env)\\n} |
4+
| build-leaks.js:5:20:5:46 | JSON.st ... ss.env) |
5+
| build-leaks.js:5:35:5:45 | process.env |
6+
| build-leaks.js:5:35:5:45 | process.env |
7+
| build-leaks.js:13:11:19:10 | raw |
8+
| build-leaks.js:13:17:19:10 | Object. ... }) |
9+
| build-leaks.js:14:18:14:20 | env |
10+
| build-leaks.js:15:24:15:34 | process.env |
11+
| build-leaks.js:15:24:15:34 | process.env |
12+
| build-leaks.js:16:20:16:22 | env |
13+
| build-leaks.js:21:11:26:5 | stringifed |
14+
| build-leaks.js:21:24:26:5 | {\\n ... )\\n } |
15+
| build-leaks.js:22:24:25:14 | Object. ... }, {}) |
16+
| build-leaks.js:22:49:22:51 | env |
17+
| build-leaks.js:23:39:23:41 | raw |
18+
| build-leaks.js:24:20:24:22 | env |
19+
| build-leaks.js:30:22:30:31 | stringifed |
20+
| build-leaks.js:34:26:34:57 | getEnv( ... ngified |
21+
| build-leaks.js:34:26:34:57 | getEnv( ... ngified |
22+
| build-leaks.js:40:9:40:60 | pw |
23+
| build-leaks.js:40:14:40:60 | url.par ... assword |
24+
| build-leaks.js:40:14:40:60 | url.par ... assword |
25+
| build-leaks.js:41:43:41:86 | { "proc ... y(pw) } |
26+
| build-leaks.js:41:43:41:86 | { "proc ... y(pw) } |
27+
| build-leaks.js:41:67:41:84 | JSON.stringify(pw) |
28+
| build-leaks.js:41:82:41:83 | pw |
29+
edges
30+
| build-leaks.js:5:20:5:46 | JSON.st ... ss.env) | build-leaks.js:4:39:6:1 | { // NO ... .env)\\n} |
31+
| build-leaks.js:5:20:5:46 | JSON.st ... ss.env) | build-leaks.js:4:39:6:1 | { // NO ... .env)\\n} |
32+
| build-leaks.js:5:35:5:45 | process.env | build-leaks.js:5:20:5:46 | JSON.st ... ss.env) |
33+
| build-leaks.js:5:35:5:45 | process.env | build-leaks.js:5:20:5:46 | JSON.st ... ss.env) |
34+
| build-leaks.js:13:11:19:10 | raw | build-leaks.js:23:39:23:41 | raw |
35+
| build-leaks.js:13:17:19:10 | Object. ... }) | build-leaks.js:13:11:19:10 | raw |
36+
| build-leaks.js:14:18:14:20 | env | build-leaks.js:16:20:16:22 | env |
37+
| build-leaks.js:15:24:15:34 | process.env | build-leaks.js:14:18:14:20 | env |
38+
| build-leaks.js:15:24:15:34 | process.env | build-leaks.js:14:18:14:20 | env |
39+
| build-leaks.js:16:20:16:22 | env | build-leaks.js:13:17:19:10 | Object. ... }) |
40+
| build-leaks.js:21:11:26:5 | stringifed | build-leaks.js:30:22:30:31 | stringifed |
41+
| build-leaks.js:21:24:26:5 | {\\n ... )\\n } | build-leaks.js:21:11:26:5 | stringifed |
42+
| build-leaks.js:22:24:25:14 | Object. ... }, {}) | build-leaks.js:21:24:26:5 | {\\n ... )\\n } |
43+
| build-leaks.js:22:49:22:51 | env | build-leaks.js:24:20:24:22 | env |
44+
| build-leaks.js:23:39:23:41 | raw | build-leaks.js:22:49:22:51 | env |
45+
| build-leaks.js:24:20:24:22 | env | build-leaks.js:22:24:25:14 | Object. ... }, {}) |
46+
| build-leaks.js:30:22:30:31 | stringifed | build-leaks.js:34:26:34:57 | getEnv( ... ngified |
47+
| build-leaks.js:30:22:30:31 | stringifed | build-leaks.js:34:26:34:57 | getEnv( ... ngified |
48+
| build-leaks.js:40:9:40:60 | pw | build-leaks.js:41:82:41:83 | pw |
49+
| build-leaks.js:40:14:40:60 | url.par ... assword | build-leaks.js:40:9:40:60 | pw |
50+
| build-leaks.js:40:14:40:60 | url.par ... assword | build-leaks.js:40:9:40:60 | pw |
51+
| build-leaks.js:41:67:41:84 | JSON.stringify(pw) | build-leaks.js:41:43:41:86 | { "proc ... y(pw) } |
52+
| build-leaks.js:41:67:41:84 | JSON.stringify(pw) | build-leaks.js:41:43:41:86 | { "proc ... y(pw) } |
53+
| build-leaks.js:41:82:41:83 | pw | build-leaks.js:41:67:41:84 | JSON.stringify(pw) |
54+
#select
55+
| build-leaks.js:4:39:6:1 | { // NO ... .env)\\n} | build-leaks.js:5:35:5:45 | process.env | build-leaks.js:4:39:6:1 | { // NO ... .env)\\n} | Sensitive data returned by $@ is stored in a build artifact here. | build-leaks.js:5:35:5:45 | process.env | process environment |
56+
| build-leaks.js:34:26:34:57 | getEnv( ... ngified | build-leaks.js:15:24:15:34 | process.env | build-leaks.js:34:26:34:57 | getEnv( ... ngified | Sensitive data returned by $@ is stored in a build artifact here. | build-leaks.js:15:24:15:34 | process.env | process environment |
57+
| build-leaks.js:41:43:41:86 | { "proc ... y(pw) } | build-leaks.js:40:14:40:60 | url.par ... assword | build-leaks.js:41:43:41:86 | { "proc ... y(pw) } | Sensitive data returned by $@ is stored in a build artifact here. | build-leaks.js:40:14:40:60 | url.par ... assword | an access to current_password |

‎javascript/ql/test/query-tests/Security/CWE-312/BuildArtifactLeak.qlref‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1 @@
1+
Security/CWE-312/BuildArtifactLeak.ql

‎javascript/ql/test/query-tests/Security/CWE-312/build-leaks.js‎

Lines changed: 42 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,42 @@
1+
const webpack = require("webpack");
2+
3+
4+
var plugin = new webpack.DefinePlugin({ // NOT OK
5+
"process.env": JSON.stringify(process.env)
6+
});
7+
8+
// OK
9+
new webpack.DefinePlugin({ 'process.env': JSON.stringify({ DEBUG: process.env.DEBUG }) })
10+
11+
12+
function getEnv(env) {
13+
const raw = Object.keys(process.env)
14+
.reduce((env, key) => {
15+
env[key] = process.env[key]
16+
return env
17+
}, {
18+
NODE_ENV: process.env.NODE_ENV || env || 'development'
19+
})
20+
21+
const stringifed = {
22+
'process.env': Object.keys(raw).reduce((env, key) => {
23+
env[key] = JSON.stringify(raw[key])
24+
return env
25+
}, {})
26+
}
27+
28+
return {
29+
raw: raw,
30+
stringified: stringifed
31+
}
32+
}
33+
34+
new webpack.DefinePlugin(getEnv('production').stringified); // NOT OK
35+
36+
var https = require('https');
37+
var url = require('url');
38+
39+
var server = https.createServer(function (req, res) {
40+
let pw = url.parse(req.url, true).query.current_password;
41+
var plugin = new webpack.DefinePlugin({ "process.env.secret": JSON.stringify(pw) }); // NOT OK
42+
});

0 commit comments

Comments
 (0)