Thanks to visit codestin.com
Credit goes to github.com

Skip to content

Commit 50a77ea

Browse files
asger-semmleasger-semmle
committed
JS: update test expectations
1 parent ee74613 commit 50a77ea

13 files changed

Lines changed: 82 additions & 45 deletions

File tree

‎javascript/ql/test/query-tests/Security/CWE-022/TaintedPath/TaintedPath.expected‎

Lines changed: 36 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -17,14 +17,6 @@ nodes
1717
| TaintedPath.js:19:33:19:36 | path |
1818
| TaintedPath.js:23:33:23:36 | path |
1919
| TaintedPath.js:27:33:27:36 | path |
20-
| TaintedPath.js:30:7:30:24 | path |
21-
| TaintedPath.js:34:3:34:3 | path |
22-
| TaintedPath.js:34:7:34:24 | path |
23-
| TaintedPath.js:34:29:34:46 | path |
24-
| TaintedPath.js:38:3:38:3 | path |
25-
| TaintedPath.js:38:7:38:24 | path |
26-
| TaintedPath.js:38:29:38:46 | path |
27-
| TaintedPath.js:39:5:39:5 | path |
2820
| TaintedPath.js:39:31:39:34 | path |
2921
| TaintedPath.js:45:3:45:44 | path |
3022
| TaintedPath.js:45:10:45:33 | url.par ... , true) |
@@ -112,18 +104,54 @@ edges
112104
| TaintedPath.js:9:7:9:48 | path | TaintedPath.js:23:33:23:36 | path |
113105
| TaintedPath.js:9:7:9:48 | path | TaintedPath.js:27:33:27:36 | path |
114106
| TaintedPath.js:9:7:9:48 | path | TaintedPath.js:30:7:30:24 | path |
107+
| TaintedPath.js:9:7:9:48 | path | TaintedPath.js:34:3:34:3 | path |
108+
| TaintedPath.js:9:7:9:48 | path | TaintedPath.js:34:7:34:24 | path |
109+
| TaintedPath.js:9:7:9:48 | path | TaintedPath.js:34:29:34:46 | path |
110+
| TaintedPath.js:9:7:9:48 | path | TaintedPath.js:38:3:38:3 | path |
111+
| TaintedPath.js:9:7:9:48 | path | TaintedPath.js:38:7:38:24 | path |
112+
| TaintedPath.js:9:7:9:48 | path | TaintedPath.js:38:29:38:46 | path |
113+
| TaintedPath.js:9:7:9:48 | path | TaintedPath.js:39:5:39:5 | path |
114+
| TaintedPath.js:9:7:9:48 | path | TaintedPath.js:39:31:39:34 | path |
115115
| TaintedPath.js:9:14:9:37 | url.par ... , true) | TaintedPath.js:9:14:9:43 | url.par ... ).query |
116116
| TaintedPath.js:9:14:9:43 | url.par ... ).query | TaintedPath.js:9:14:9:48 | url.par ... ry.path |
117117
| TaintedPath.js:9:14:9:48 | url.par ... ry.path | TaintedPath.js:9:7:9:48 | path |
118118
| TaintedPath.js:9:24:9:30 | req.url | TaintedPath.js:9:14:9:37 | url.par ... , true) |
119119
| TaintedPath.js:15:45:15:48 | path | TaintedPath.js:15:29:15:48 | "/home/user/" + path |
120120
| TaintedPath.js:30:7:30:24 | path | TaintedPath.js:34:3:34:3 | path |
121+
| TaintedPath.js:30:7:30:24 | path | TaintedPath.js:34:7:34:24 | path |
122+
| TaintedPath.js:30:7:30:24 | path | TaintedPath.js:34:29:34:46 | path |
123+
| TaintedPath.js:30:7:30:24 | path | TaintedPath.js:38:3:38:3 | path |
124+
| TaintedPath.js:30:7:30:24 | path | TaintedPath.js:38:7:38:24 | path |
125+
| TaintedPath.js:30:7:30:24 | path | TaintedPath.js:38:29:38:46 | path |
126+
| TaintedPath.js:30:7:30:24 | path | TaintedPath.js:39:5:39:5 | path |
127+
| TaintedPath.js:30:7:30:24 | path | TaintedPath.js:39:31:39:34 | path |
121128
| TaintedPath.js:34:3:34:3 | path | TaintedPath.js:34:7:34:24 | path |
129+
| TaintedPath.js:34:3:34:3 | path | TaintedPath.js:34:29:34:46 | path |
130+
| TaintedPath.js:34:3:34:3 | path | TaintedPath.js:38:3:38:3 | path |
131+
| TaintedPath.js:34:3:34:3 | path | TaintedPath.js:38:7:38:24 | path |
132+
| TaintedPath.js:34:3:34:3 | path | TaintedPath.js:38:29:38:46 | path |
133+
| TaintedPath.js:34:3:34:3 | path | TaintedPath.js:39:5:39:5 | path |
134+
| TaintedPath.js:34:3:34:3 | path | TaintedPath.js:39:31:39:34 | path |
122135
| TaintedPath.js:34:7:34:24 | path | TaintedPath.js:34:29:34:46 | path |
136+
| TaintedPath.js:34:7:34:24 | path | TaintedPath.js:38:3:38:3 | path |
137+
| TaintedPath.js:34:7:34:24 | path | TaintedPath.js:38:7:38:24 | path |
138+
| TaintedPath.js:34:7:34:24 | path | TaintedPath.js:38:29:38:46 | path |
139+
| TaintedPath.js:34:7:34:24 | path | TaintedPath.js:39:5:39:5 | path |
140+
| TaintedPath.js:34:7:34:24 | path | TaintedPath.js:39:31:39:34 | path |
123141
| TaintedPath.js:34:29:34:46 | path | TaintedPath.js:38:3:38:3 | path |
142+
| TaintedPath.js:34:29:34:46 | path | TaintedPath.js:38:7:38:24 | path |
143+
| TaintedPath.js:34:29:34:46 | path | TaintedPath.js:38:29:38:46 | path |
144+
| TaintedPath.js:34:29:34:46 | path | TaintedPath.js:39:5:39:5 | path |
145+
| TaintedPath.js:34:29:34:46 | path | TaintedPath.js:39:31:39:34 | path |
124146
| TaintedPath.js:38:3:38:3 | path | TaintedPath.js:38:7:38:24 | path |
147+
| TaintedPath.js:38:3:38:3 | path | TaintedPath.js:38:29:38:46 | path |
148+
| TaintedPath.js:38:3:38:3 | path | TaintedPath.js:39:5:39:5 | path |
149+
| TaintedPath.js:38:3:38:3 | path | TaintedPath.js:39:31:39:34 | path |
125150
| TaintedPath.js:38:7:38:24 | path | TaintedPath.js:38:29:38:46 | path |
151+
| TaintedPath.js:38:7:38:24 | path | TaintedPath.js:39:5:39:5 | path |
152+
| TaintedPath.js:38:7:38:24 | path | TaintedPath.js:39:31:39:34 | path |
126153
| TaintedPath.js:38:29:38:46 | path | TaintedPath.js:39:5:39:5 | path |
154+
| TaintedPath.js:38:29:38:46 | path | TaintedPath.js:39:31:39:34 | path |
127155
| TaintedPath.js:39:5:39:5 | path | TaintedPath.js:39:31:39:34 | path |
128156
| TaintedPath.js:45:3:45:44 | path | TaintedPath.js:47:49:47:52 | path |
129157
| TaintedPath.js:45:3:45:44 | path | TaintedPath.js:49:48:49:51 | path |

‎javascript/ql/test/query-tests/Security/CWE-078/CommandInjection.expected‎

Lines changed: 4 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -11,14 +11,12 @@ nodes
1111
| child_process-test.js:21:14:21:16 | cmd |
1212
| child_process-test.js:22:18:22:20 | cmd |
1313
| child_process-test.js:23:13:23:15 | cmd |
14-
| child_process-test.js:25:13:25:23 | "foo" + cmd |
1514
| child_process-test.js:25:13:25:31 | "foo" + cmd + "bar" |
1615
| child_process-test.js:25:21:25:23 | cmd |
1716
| child_process-test.js:36:7:36:20 | sh |
1817
| child_process-test.js:36:12:36:20 | 'cmd.exe' |
1918
| child_process-test.js:38:7:38:20 | sh |
2019
| child_process-test.js:38:12:38:20 | '/bin/sh' |
21-
| child_process-test.js:39:5:39:5 | sh |
2220
| child_process-test.js:39:14:39:15 | sh |
2321
| child_process-test.js:39:18:39:30 | [ flag, cmd ] |
2422
| child_process-test.js:39:26:39:28 | cmd |
@@ -39,7 +37,6 @@ nodes
3937
| child_process-test.js:56:12:56:14 | cmd |
4038
| child_process-test.js:56:17:56:20 | args |
4139
| execSeries.js:3:20:3:22 | arr |
42-
| execSeries.js:5:4:5:3 | arr |
4340
| execSeries.js:6:14:6:16 | arr |
4441
| execSeries.js:6:14:6:21 | arr[i++] |
4542
| execSeries.js:13:19:13:26 | commands |
@@ -71,9 +68,12 @@ edges
7168
| child_process-test.js:6:25:6:31 | req.url | child_process-test.js:6:15:6:38 | url.par ... , true) |
7269
| child_process-test.js:25:13:25:23 | "foo" + cmd | child_process-test.js:25:13:25:31 | "foo" + cmd + "bar" |
7370
| child_process-test.js:25:21:25:23 | cmd | child_process-test.js:25:13:25:23 | "foo" + cmd |
71+
| child_process-test.js:25:21:25:23 | cmd | child_process-test.js:25:13:25:31 | "foo" + cmd + "bar" |
7472
| child_process-test.js:36:7:36:20 | sh | child_process-test.js:39:5:39:5 | sh |
73+
| child_process-test.js:36:7:36:20 | sh | child_process-test.js:39:14:39:15 | sh |
7574
| child_process-test.js:36:12:36:20 | 'cmd.exe' | child_process-test.js:36:7:36:20 | sh |
7675
| child_process-test.js:38:7:38:20 | sh | child_process-test.js:39:5:39:5 | sh |
76+
| child_process-test.js:38:7:38:20 | sh | child_process-test.js:39:14:39:15 | sh |
7777
| child_process-test.js:38:12:38:20 | '/bin/sh' | child_process-test.js:38:7:38:20 | sh |
7878
| child_process-test.js:39:5:39:5 | sh | child_process-test.js:39:14:39:15 | sh |
7979
| child_process-test.js:41:9:41:17 | args | child_process-test.js:44:30:44:33 | args |
@@ -86,6 +86,7 @@ edges
8686
| child_process-test.js:55:14:55:16 | cmd | child_process-test.js:56:12:56:14 | cmd |
8787
| child_process-test.js:55:19:55:22 | args | child_process-test.js:56:17:56:20 | args |
8888
| execSeries.js:3:20:3:22 | arr | execSeries.js:5:4:5:3 | arr |
89+
| execSeries.js:3:20:3:22 | arr | execSeries.js:6:14:6:16 | arr |
8990
| execSeries.js:5:4:5:3 | arr | execSeries.js:6:14:6:16 | arr |
9091
| execSeries.js:6:14:6:16 | arr | execSeries.js:6:14:6:21 | arr[i++] |
9192
| execSeries.js:6:14:6:21 | arr[i++] | execSeries.js:14:24:14:30 | command |

‎javascript/ql/test/query-tests/Security/CWE-079/ReflectedXss.expected‎

Lines changed: 4 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -3,10 +3,7 @@ nodes
33
| ReflectedXss.js:8:33:8:45 | req.params.id |
44
| etherpad.js:9:5:9:53 | response |
55
| etherpad.js:9:16:9:30 | req.query.jsonp |
6-
| etherpad.js:9:16:9:36 | req.que ... p + "(" |
7-
| etherpad.js:9:16:9:47 | req.que ... esponse |
86
| etherpad.js:9:16:9:53 | req.que ... e + ")" |
9-
| etherpad.js:11:3:11:3 | response |
107
| etherpad.js:11:12:11:19 | response |
118
| formatting.js:4:9:4:29 | evil |
129
| formatting.js:4:16:4:29 | req.query.evil |
@@ -45,8 +42,12 @@ nodes
4542
edges
4643
| ReflectedXss.js:8:33:8:45 | req.params.id | ReflectedXss.js:8:14:8:45 | "Unknow ... rams.id |
4744
| etherpad.js:9:5:9:53 | response | etherpad.js:11:3:11:3 | response |
45+
| etherpad.js:9:5:9:53 | response | etherpad.js:11:12:11:19 | response |
4846
| etherpad.js:9:16:9:30 | req.query.jsonp | etherpad.js:9:16:9:36 | req.que ... p + "(" |
47+
| etherpad.js:9:16:9:30 | req.query.jsonp | etherpad.js:9:16:9:47 | req.que ... esponse |
48+
| etherpad.js:9:16:9:30 | req.query.jsonp | etherpad.js:9:16:9:53 | req.que ... e + ")" |
4949
| etherpad.js:9:16:9:36 | req.que ... p + "(" | etherpad.js:9:16:9:47 | req.que ... esponse |
50+
| etherpad.js:9:16:9:36 | req.que ... p + "(" | etherpad.js:9:16:9:53 | req.que ... e + ")" |
5051
| etherpad.js:9:16:9:47 | req.que ... esponse | etherpad.js:9:16:9:53 | req.que ... e + ")" |
5152
| etherpad.js:9:16:9:53 | req.que ... e + ")" | etherpad.js:9:5:9:53 | response |
5253
| etherpad.js:11:3:11:3 | response | etherpad.js:11:12:11:19 | response |

‎javascript/ql/test/query-tests/Security/CWE-079/Xss.expected‎

Lines changed: 8 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -6,7 +6,6 @@ nodes
66
| jquery.js:2:17:2:33 | document.location |
77
| jquery.js:2:17:2:40 | documen ... .search |
88
| jquery.js:4:5:4:11 | tainted |
9-
| jquery.js:7:5:7:26 | "<div i ... tainted |
109
| jquery.js:7:5:7:34 | "<div i ... + "\\">" |
1110
| jquery.js:7:20:7:26 | tainted |
1211
| jquery.js:8:18:8:34 | "XSS: " + tainted |
@@ -54,12 +53,10 @@ nodes
5453
| tst.js:2:16:2:32 | document.location |
5554
| tst.js:2:16:2:39 | documen ... .search |
5655
| tst.js:5:18:5:23 | target |
57-
| tst.js:8:18:8:114 | "<OPTIO ... t=")+8) |
5856
| tst.js:8:18:8:126 | "<OPTIO ... PTION>" |
5957
| tst.js:8:37:8:53 | document.location |
6058
| tst.js:8:37:8:58 | documen ... on.href |
6159
| tst.js:8:37:8:114 | documen ... t=")+8) |
62-
| tst.js:12:5:12:33 | '<div s ... target |
6360
| tst.js:12:5:12:42 | '<div s ... 'px">' |
6461
| tst.js:12:28:12:33 | target |
6562
| tst.js:19:25:19:41 | document.location |
@@ -100,7 +97,6 @@ nodes
10097
| tst.js:73:3:73:19 | document.location |
10198
| tst.js:73:3:73:26 | documen ... .search |
10299
| tst.js:73:46:73:46 | x |
103-
| tst.js:74:7:74:7 | x |
104100
| tst.js:76:20:76:20 | x |
105101
| tst.js:80:49:80:65 | document.location |
106102
| tst.js:80:49:80:72 | documen ... .search |
@@ -147,9 +143,7 @@ nodes
147143
| tst.js:194:19:194:42 | documen ... .search |
148144
| tst.js:196:67:196:73 | tainted |
149145
| tst.js:197:67:197:73 | tainted |
150-
| tst.js:200:20:200:19 | tainted |
151146
| tst.js:201:35:201:41 | tainted |
152-
| tst.js:203:27:203:26 | tainted |
153147
| tst.js:203:46:203:52 | tainted |
154148
| tst.js:204:38:204:44 | tainted |
155149
| tst.js:205:35:205:41 | tainted |
@@ -196,6 +190,7 @@ edges
196190
| jquery.js:2:17:2:40 | documen ... .search | jquery.js:2:7:2:40 | tainted |
197191
| jquery.js:7:5:7:26 | "<div i ... tainted | jquery.js:7:5:7:34 | "<div i ... + "\\">" |
198192
| jquery.js:7:20:7:26 | tainted | jquery.js:7:5:7:26 | "<div i ... tainted |
193+
| jquery.js:7:20:7:26 | tainted | jquery.js:7:5:7:34 | "<div i ... + "\\">" |
199194
| jquery.js:8:28:8:34 | tainted | jquery.js:8:18:8:34 | "XSS: " + tainted |
200195
| nodemailer.js:13:50:13:66 | req.query.message | nodemailer.js:13:11:13:69 | `Hi, yo ... sage}.` |
201196
| react-native.js:7:7:7:33 | tainted | react-native.js:8:18:8:24 | tainted |
@@ -232,8 +227,10 @@ edges
232227
| tst.js:8:37:8:53 | document.location | tst.js:8:37:8:58 | documen ... on.href |
233228
| tst.js:8:37:8:58 | documen ... on.href | tst.js:8:37:8:114 | documen ... t=")+8) |
234229
| tst.js:8:37:8:114 | documen ... t=")+8) | tst.js:8:18:8:114 | "<OPTIO ... t=")+8) |
230+
| tst.js:8:37:8:114 | documen ... t=")+8) | tst.js:8:18:8:126 | "<OPTIO ... PTION>" |
235231
| tst.js:12:5:12:33 | '<div s ... target | tst.js:12:5:12:42 | '<div s ... 'px">' |
236232
| tst.js:12:28:12:33 | target | tst.js:12:5:12:33 | '<div s ... target |
233+
| tst.js:12:28:12:33 | target | tst.js:12:5:12:42 | '<div s ... 'px">' |
237234
| tst.js:19:25:19:41 | document.location | tst.js:20:18:20:35 | params.get('name') |
238235
| tst.js:23:42:23:47 | target | tst.js:23:42:23:60 | target.substring(1) |
239236
| tst.js:23:42:23:60 | target.substring(1) | tst.js:24:18:24:41 | searchP ... 'name') |
@@ -263,6 +260,7 @@ edges
263260
| tst.js:73:3:73:19 | document.location | tst.js:73:3:73:26 | documen ... .search |
264261
| tst.js:73:3:73:26 | documen ... .search | tst.js:73:1:73:27 | [,docum ... search] |
265262
| tst.js:73:46:73:46 | x | tst.js:74:7:74:7 | x |
263+
| tst.js:73:46:73:46 | x | tst.js:76:20:76:20 | x |
266264
| tst.js:74:7:74:7 | x | tst.js:76:20:76:20 | x |
267265
| tst.js:80:49:80:65 | document.location | tst.js:80:49:80:72 | documen ... .search |
268266
| tst.js:84:26:84:42 | document.location | tst.js:84:26:84:49 | documen ... .search |
@@ -294,7 +292,11 @@ edges
294292
| tst.js:194:9:194:42 | tainted | tst.js:196:67:196:73 | tainted |
295293
| tst.js:194:9:194:42 | tainted | tst.js:197:67:197:73 | tainted |
296294
| tst.js:194:9:194:42 | tainted | tst.js:200:20:200:19 | tainted |
295+
| tst.js:194:9:194:42 | tainted | tst.js:201:35:201:41 | tainted |
297296
| tst.js:194:9:194:42 | tainted | tst.js:203:27:203:26 | tainted |
297+
| tst.js:194:9:194:42 | tainted | tst.js:203:46:203:52 | tainted |
298+
| tst.js:194:9:194:42 | tainted | tst.js:204:38:204:44 | tainted |
299+
| tst.js:194:9:194:42 | tainted | tst.js:205:35:205:41 | tainted |
298300
| tst.js:194:9:194:42 | tainted | tst.js:233:35:233:41 | tainted |
299301
| tst.js:194:9:194:42 | tainted | tst.js:235:20:235:26 | tainted |
300302
| tst.js:194:9:194:42 | tainted | tst.js:237:23:237:29 | tainted |

‎javascript/ql/test/query-tests/Security/CWE-089/SqlInjection.expected‎

Lines changed: 8 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -3,24 +3,20 @@ nodes
33
| mongodb.js:12:19:12:20 | {} |
44
| mongodb.js:13:19:13:26 | req.body |
55
| mongodb.js:13:19:13:32 | req.body.title |
6-
| mongodb.js:14:59:14:58 | query |
76
| mongodb.js:18:16:18:20 | query |
87
| mongodb.js:26:11:26:32 | title |
98
| mongodb.js:26:19:26:26 | req.body |
109
| mongodb.js:26:19:26:32 | req.body.title |
11-
| mongodb.js:27:11:27:35 | title |
1210
| mongodb.js:32:18:32:45 | { title ... itle) } |
1311
| mongodb.js:32:27:32:43 | JSON.parse(title) |
1412
| mongodb.js:32:38:32:42 | title |
1513
| mongodb.js:48:11:48:20 | query |
1614
| mongodb.js:48:19:48:20 | {} |
1715
| mongodb.js:49:19:49:33 | req.query.title |
18-
| mongodb.js:50:59:50:58 | query |
1916
| mongodb.js:54:16:54:20 | query |
2017
| mongodb_bodySafe.js:23:11:23:20 | query |
2118
| mongodb_bodySafe.js:23:19:23:20 | {} |
2219
| mongodb_bodySafe.js:24:19:24:33 | req.query.title |
23-
| mongodb_bodySafe.js:25:59:25:58 | query |
2420
| mongodb_bodySafe.js:29:16:29:20 | query |
2521
| mongoose.js:20:11:20:20 | query |
2622
| mongoose.js:20:19:20:20 | {} |
@@ -48,22 +44,19 @@ nodes
4844
| socketio.js:10:25:10:30 | handle |
4945
| socketio.js:11:12:11:53 | `INSERT ... andle}` |
5046
| socketio.js:11:46:11:51 | handle |
51-
| tst2.js:9:27:9:78 | "select ... rams.id |
5247
| tst2.js:9:27:9:84 | "select ... d + "'" |
5348
| tst2.js:9:66:9:78 | req.params.id |
5449
| tst3.js:8:7:9:55 | query1 |
55-
| tst3.js:8:16:9:34 | "SELECT ... ategory |
5650
| tst3.js:8:16:9:55 | "SELECT ... PRICE" |
5751
| tst3.js:9:16:9:34 | req.params.category |
5852
| tst3.js:10:14:10:19 | query1 |
59-
| tst4.js:8:10:8:60 | 'SELECT ... rams.id |
6053
| tst4.js:8:10:8:66 | 'SELECT ... d + '"' |
6154
| tst4.js:8:46:8:60 | $routeParams.id |
62-
| tst.js:10:10:10:58 | 'SELECT ... rams.id |
6355
| tst.js:10:10:10:64 | 'SELECT ... d + '"' |
6456
| tst.js:10:46:10:58 | req.params.id |
6557
edges
6658
| mongodb.js:12:11:12:20 | query | mongodb.js:14:59:14:58 | query |
59+
| mongodb.js:12:11:12:20 | query | mongodb.js:18:16:18:20 | query |
6760
| mongodb.js:12:19:12:20 | {} | mongodb.js:12:11:12:20 | query |
6861
| mongodb.js:13:19:13:26 | req.body | mongodb.js:13:19:13:32 | req.body.title |
6962
| mongodb.js:13:19:13:32 | req.body.title | mongodb.js:12:11:12:20 | query |
@@ -72,19 +65,22 @@ edges
7265
| mongodb.js:13:19:13:32 | req.body.title | mongodb.js:18:16:18:20 | query |
7366
| mongodb.js:14:59:14:58 | query | mongodb.js:18:16:18:20 | query |
7467
| mongodb.js:26:11:26:32 | title | mongodb.js:27:11:27:35 | title |
68+
| mongodb.js:26:11:26:32 | title | mongodb.js:32:38:32:42 | title |
7569
| mongodb.js:26:19:26:26 | req.body | mongodb.js:26:19:26:32 | req.body.title |
7670
| mongodb.js:26:19:26:32 | req.body.title | mongodb.js:26:11:26:32 | title |
7771
| mongodb.js:27:11:27:35 | title | mongodb.js:32:38:32:42 | title |
7872
| mongodb.js:32:27:32:43 | JSON.parse(title) | mongodb.js:32:18:32:45 | { title ... itle) } |
7973
| mongodb.js:32:38:32:42 | title | mongodb.js:32:27:32:43 | JSON.parse(title) |
8074
| mongodb.js:48:11:48:20 | query | mongodb.js:50:59:50:58 | query |
75+
| mongodb.js:48:11:48:20 | query | mongodb.js:54:16:54:20 | query |
8176
| mongodb.js:48:19:48:20 | {} | mongodb.js:48:11:48:20 | query |
8277
| mongodb.js:49:19:49:33 | req.query.title | mongodb.js:48:11:48:20 | query |
8378
| mongodb.js:49:19:49:33 | req.query.title | mongodb.js:48:19:48:20 | {} |
8479
| mongodb.js:49:19:49:33 | req.query.title | mongodb.js:50:59:50:58 | query |
8580
| mongodb.js:49:19:49:33 | req.query.title | mongodb.js:54:16:54:20 | query |
8681
| mongodb.js:50:59:50:58 | query | mongodb.js:54:16:54:20 | query |
8782
| mongodb_bodySafe.js:23:11:23:20 | query | mongodb_bodySafe.js:25:59:25:58 | query |
83+
| mongodb_bodySafe.js:23:11:23:20 | query | mongodb_bodySafe.js:29:16:29:20 | query |
8884
| mongodb_bodySafe.js:23:19:23:20 | {} | mongodb_bodySafe.js:23:11:23:20 | query |
8985
| mongodb_bodySafe.js:24:19:24:33 | req.query.title | mongodb_bodySafe.js:23:11:23:20 | query |
9086
| mongodb_bodySafe.js:24:19:24:33 | req.query.title | mongodb_bodySafe.js:23:19:23:20 | {} |
@@ -132,14 +128,18 @@ edges
132128
| socketio.js:11:46:11:51 | handle | socketio.js:11:12:11:53 | `INSERT ... andle}` |
133129
| tst2.js:9:27:9:78 | "select ... rams.id | tst2.js:9:27:9:84 | "select ... d + "'" |
134130
| tst2.js:9:66:9:78 | req.params.id | tst2.js:9:27:9:78 | "select ... rams.id |
131+
| tst2.js:9:66:9:78 | req.params.id | tst2.js:9:27:9:84 | "select ... d + "'" |
135132
| tst3.js:8:7:9:55 | query1 | tst3.js:10:14:10:19 | query1 |
136133
| tst3.js:8:16:9:34 | "SELECT ... ategory | tst3.js:8:16:9:55 | "SELECT ... PRICE" |
137134
| tst3.js:8:16:9:55 | "SELECT ... PRICE" | tst3.js:8:7:9:55 | query1 |
138135
| tst3.js:9:16:9:34 | req.params.category | tst3.js:8:16:9:34 | "SELECT ... ategory |
136+
| tst3.js:9:16:9:34 | req.params.category | tst3.js:8:16:9:55 | "SELECT ... PRICE" |
139137
| tst4.js:8:10:8:60 | 'SELECT ... rams.id | tst4.js:8:10:8:66 | 'SELECT ... d + '"' |
140138
| tst4.js:8:46:8:60 | $routeParams.id | tst4.js:8:10:8:60 | 'SELECT ... rams.id |
139+
| tst4.js:8:46:8:60 | $routeParams.id | tst4.js:8:10:8:66 | 'SELECT ... d + '"' |
141140
| tst.js:10:10:10:58 | 'SELECT ... rams.id | tst.js:10:10:10:64 | 'SELECT ... d + '"' |
142141
| tst.js:10:46:10:58 | req.params.id | tst.js:10:10:10:58 | 'SELECT ... rams.id |
142+
| tst.js:10:46:10:58 | req.params.id | tst.js:10:10:10:64 | 'SELECT ... d + '"' |
143143
#select
144144
| mongodb.js:18:16:18:20 | query | mongodb.js:13:19:13:26 | req.body | mongodb.js:18:16:18:20 | query | This query depends on $@. | mongodb.js:13:19:13:26 | req.body | a user-provided value |
145145
| mongodb.js:32:18:32:45 | { title ... itle) } | mongodb.js:26:19:26:26 | req.body | mongodb.js:32:18:32:45 | { title ... itle) } | This query depends on $@. | mongodb.js:26:19:26:26 | req.body | a user-provided value |

‎javascript/ql/test/query-tests/Security/CWE-094/CodeInjection/CodeInjection.expected‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -29,13 +29,10 @@ nodes
2929
| angularjs.js:53:32:53:46 | location.search |
3030
| eslint-escope-build.js:20:22:20:22 | c |
3131
| eslint-escope-build.js:21:16:21:16 | c |
32-
| express.js:7:24:7:62 | "return ... obble") |
3332
| express.js:7:24:7:69 | "return ... + "];" |
3433
| express.js:7:44:7:62 | req.param("wobble") |
35-
| express.js:9:34:9:72 | "return ... obble") |
3634
| express.js:9:34:9:79 | "return ... + "];" |
3735
| express.js:9:54:9:72 | req.param("wobble") |
38-
| express.js:12:8:12:46 | "return ... obble") |
3936
| express.js:12:8:12:53 | "return ... + "];" |
4037
| express.js:12:28:12:46 | req.param("wobble") |
4138
| react-native.js:7:7:7:33 | tainted |
@@ -72,10 +69,13 @@ edges
7269
| eslint-escope-build.js:20:22:20:22 | c | eslint-escope-build.js:21:16:21:16 | c |
7370
| express.js:7:24:7:62 | "return ... obble") | express.js:7:24:7:69 | "return ... + "];" |
7471
| express.js:7:44:7:62 | req.param("wobble") | express.js:7:24:7:62 | "return ... obble") |
72+
| express.js:7:44:7:62 | req.param("wobble") | express.js:7:24:7:69 | "return ... + "];" |
7573
| express.js:9:34:9:72 | "return ... obble") | express.js:9:34:9:79 | "return ... + "];" |
7674
| express.js:9:54:9:72 | req.param("wobble") | express.js:9:34:9:72 | "return ... obble") |
75+
| express.js:9:54:9:72 | req.param("wobble") | express.js:9:34:9:79 | "return ... + "];" |
7776
| express.js:12:8:12:46 | "return ... obble") | express.js:12:8:12:53 | "return ... + "];" |
7877
| express.js:12:28:12:46 | req.param("wobble") | express.js:12:8:12:46 | "return ... obble") |
78+
| express.js:12:28:12:46 | req.param("wobble") | express.js:12:8:12:53 | "return ... + "];" |
7979
| react-native.js:7:7:7:33 | tainted | react-native.js:8:32:8:38 | tainted |
8080
| react-native.js:7:7:7:33 | tainted | react-native.js:10:23:10:29 | tainted |
8181
| react-native.js:7:17:7:33 | req.param("code") | react-native.js:7:7:7:33 | tainted |

0 commit comments

Comments
 (0)