Skip to content

Commit 0902ca0

Browse files
NapalysNapalys
committed
JS: address copilot suggestions
1 parent 8c34546 commit 0902ca0

File tree

2 files changed

+40
-44
lines changed

2 files changed

+40
-44
lines changed

‎javascript/ql/test/query-tests/Security/CWE-078/CommandInjection/CommandInjection.expected‎

Lines changed: 37 additions & 40 deletions
Original file line numberDiff line numberDiff line change
@@ -33,25 +33,24 @@
3333
| execa.js:23:17:23:19 | cmd | execa.js:6:25:6:31 | req.url | execa.js:23:17:23:19 | cmd | This command line depends on a $@. | execa.js:6:25:6:31 | req.url | user-provided value |
3434
| execa.js:24:17:24:19 | cmd | execa.js:6:25:6:31 | req.url | execa.js:24:17:24:19 | cmd | This command line depends on a $@. | execa.js:6:25:6:31 | req.url | user-provided value |
3535
| execa.js:25:17:25:19 | cmd | execa.js:6:25:6:31 | req.url | execa.js:25:17:25:19 | cmd | This command line depends on a $@. | execa.js:6:25:6:31 | req.url | user-provided value |
36-
| execa.js:26:17:26:19 | cmd | execa.js:6:25:6:31 | req.url | execa.js:26:17:26:19 | cmd | This command line depends on a $@. | execa.js:6:25:6:31 | req.url | user-provided value |
36+
| execa.js:27:15:27:17 | cmd | execa.js:6:25:6:31 | req.url | execa.js:27:15:27:17 | cmd | This command line depends on a $@. | execa.js:6:25:6:31 | req.url | user-provided value |
3737
| execa.js:28:15:28:17 | cmd | execa.js:6:25:6:31 | req.url | execa.js:28:15:28:17 | cmd | This command line depends on a $@. | execa.js:6:25:6:31 | req.url | user-provided value |
38-
| execa.js:29:15:29:17 | cmd | execa.js:6:25:6:31 | req.url | execa.js:29:15:29:17 | cmd | This command line depends on a $@. | execa.js:6:25:6:31 | req.url | user-provided value |
38+
| execa.js:30:24:30:47 | cmd + a ... + arg3 | execa.js:6:25:6:31 | req.url | execa.js:30:24:30:47 | cmd + a ... + arg3 | This command line depends on a $@. | execa.js:6:25:6:31 | req.url | user-provided value |
39+
| execa.js:30:24:30:47 | cmd + a ... + arg3 | execa.js:7:26:7:32 | req.url | execa.js:30:24:30:47 | cmd + a ... + arg3 | This command line depends on a $@. | execa.js:7:26:7:32 | req.url | user-provided value |
40+
| execa.js:30:24:30:47 | cmd + a ... + arg3 | execa.js:8:26:8:32 | req.url | execa.js:30:24:30:47 | cmd + a ... + arg3 | This command line depends on a $@. | execa.js:8:26:8:32 | req.url | user-provided value |
41+
| execa.js:30:24:30:47 | cmd + a ... + arg3 | execa.js:9:26:9:32 | req.url | execa.js:30:24:30:47 | cmd + a ... + arg3 | This command line depends on a $@. | execa.js:9:26:9:32 | req.url | user-provided value |
3942
| execa.js:31:24:31:47 | cmd + a ... + arg3 | execa.js:6:25:6:31 | req.url | execa.js:31:24:31:47 | cmd + a ... + arg3 | This command line depends on a $@. | execa.js:6:25:6:31 | req.url | user-provided value |
4043
| execa.js:31:24:31:47 | cmd + a ... + arg3 | execa.js:7:26:7:32 | req.url | execa.js:31:24:31:47 | cmd + a ... + arg3 | This command line depends on a $@. | execa.js:7:26:7:32 | req.url | user-provided value |
4144
| execa.js:31:24:31:47 | cmd + a ... + arg3 | execa.js:8:26:8:32 | req.url | execa.js:31:24:31:47 | cmd + a ... + arg3 | This command line depends on a $@. | execa.js:8:26:8:32 | req.url | user-provided value |
4245
| execa.js:31:24:31:47 | cmd + a ... + arg3 | execa.js:9:26:9:32 | req.url | execa.js:31:24:31:47 | cmd + a ... + arg3 | This command line depends on a $@. | execa.js:9:26:9:32 | req.url | user-provided value |
43-
| execa.js:32:24:32:47 | cmd + a ... + arg3 | execa.js:6:25:6:31 | req.url | execa.js:32:24:32:47 | cmd + a ... + arg3 | This command line depends on a $@. | execa.js:6:25:6:31 | req.url | user-provided value |
44-
| execa.js:32:24:32:47 | cmd + a ... + arg3 | execa.js:7:26:7:32 | req.url | execa.js:32:24:32:47 | cmd + a ... + arg3 | This command line depends on a $@. | execa.js:7:26:7:32 | req.url | user-provided value |
45-
| execa.js:32:24:32:47 | cmd + a ... + arg3 | execa.js:8:26:8:32 | req.url | execa.js:32:24:32:47 | cmd + a ... + arg3 | This command line depends on a $@. | execa.js:8:26:8:32 | req.url | user-provided value |
46-
| execa.js:32:24:32:47 | cmd + a ... + arg3 | execa.js:9:26:9:32 | req.url | execa.js:32:24:32:47 | cmd + a ... + arg3 | This command line depends on a $@. | execa.js:9:26:9:32 | req.url | user-provided value |
46+
| execa.js:33:22:33:45 | cmd + a ... + arg3 | execa.js:6:25:6:31 | req.url | execa.js:33:22:33:45 | cmd + a ... + arg3 | This command line depends on a $@. | execa.js:6:25:6:31 | req.url | user-provided value |
47+
| execa.js:33:22:33:45 | cmd + a ... + arg3 | execa.js:7:26:7:32 | req.url | execa.js:33:22:33:45 | cmd + a ... + arg3 | This command line depends on a $@. | execa.js:7:26:7:32 | req.url | user-provided value |
48+
| execa.js:33:22:33:45 | cmd + a ... + arg3 | execa.js:8:26:8:32 | req.url | execa.js:33:22:33:45 | cmd + a ... + arg3 | This command line depends on a $@. | execa.js:8:26:8:32 | req.url | user-provided value |
49+
| execa.js:33:22:33:45 | cmd + a ... + arg3 | execa.js:9:26:9:32 | req.url | execa.js:33:22:33:45 | cmd + a ... + arg3 | This command line depends on a $@. | execa.js:9:26:9:32 | req.url | user-provided value |
4750
| execa.js:34:22:34:45 | cmd + a ... + arg3 | execa.js:6:25:6:31 | req.url | execa.js:34:22:34:45 | cmd + a ... + arg3 | This command line depends on a $@. | execa.js:6:25:6:31 | req.url | user-provided value |
4851
| execa.js:34:22:34:45 | cmd + a ... + arg3 | execa.js:7:26:7:32 | req.url | execa.js:34:22:34:45 | cmd + a ... + arg3 | This command line depends on a $@. | execa.js:7:26:7:32 | req.url | user-provided value |
4952
| execa.js:34:22:34:45 | cmd + a ... + arg3 | execa.js:8:26:8:32 | req.url | execa.js:34:22:34:45 | cmd + a ... + arg3 | This command line depends on a $@. | execa.js:8:26:8:32 | req.url | user-provided value |
5053
| execa.js:34:22:34:45 | cmd + a ... + arg3 | execa.js:9:26:9:32 | req.url | execa.js:34:22:34:45 | cmd + a ... + arg3 | This command line depends on a $@. | execa.js:9:26:9:32 | req.url | user-provided value |
51-
| execa.js:35:22:35:45 | cmd + a ... + arg3 | execa.js:6:25:6:31 | req.url | execa.js:35:22:35:45 | cmd + a ... + arg3 | This command line depends on a $@. | execa.js:6:25:6:31 | req.url | user-provided value |
52-
| execa.js:35:22:35:45 | cmd + a ... + arg3 | execa.js:7:26:7:32 | req.url | execa.js:35:22:35:45 | cmd + a ... + arg3 | This command line depends on a $@. | execa.js:7:26:7:32 | req.url | user-provided value |
53-
| execa.js:35:22:35:45 | cmd + a ... + arg3 | execa.js:8:26:8:32 | req.url | execa.js:35:22:35:45 | cmd + a ... + arg3 | This command line depends on a $@. | execa.js:8:26:8:32 | req.url | user-provided value |
54-
| execa.js:35:22:35:45 | cmd + a ... + arg3 | execa.js:9:26:9:32 | req.url | execa.js:35:22:35:45 | cmd + a ... + arg3 | This command line depends on a $@. | execa.js:9:26:9:32 | req.url | user-provided value |
5554
| form-parsers.js:9:8:9:39 | "touch ... nalname | form-parsers.js:9:19:9:26 | req.file | form-parsers.js:9:8:9:39 | "touch ... nalname | This command line depends on a $@. | form-parsers.js:9:19:9:26 | req.file | user-provided value |
5655
| form-parsers.js:14:10:14:37 | "touch ... nalname | form-parsers.js:13:3:13:11 | req.files | form-parsers.js:14:10:14:37 | "touch ... nalname | This command line depends on a $@. | form-parsers.js:13:3:13:11 | req.files | user-provided value |
5756
| form-parsers.js:25:10:25:28 | "touch " + filename | form-parsers.js:24:48:24:55 | filename | form-parsers.js:25:10:25:28 | "touch " + filename | This command line depends on a $@. | form-parsers.js:24:48:24:55 | filename | user-provided value |
@@ -149,49 +148,48 @@ edges
149148
| execa.js:6:9:6:54 | cmd | execa.js:23:17:23:19 | cmd | provenance | |
150149
| execa.js:6:9:6:54 | cmd | execa.js:24:17:24:19 | cmd | provenance | |
151150
| execa.js:6:9:6:54 | cmd | execa.js:25:17:25:19 | cmd | provenance | |
152-
| execa.js:6:9:6:54 | cmd | execa.js:26:17:26:19 | cmd | provenance | |
151+
| execa.js:6:9:6:54 | cmd | execa.js:27:15:27:17 | cmd | provenance | |
153152
| execa.js:6:9:6:54 | cmd | execa.js:28:15:28:17 | cmd | provenance | |
154-
| execa.js:6:9:6:54 | cmd | execa.js:29:15:29:17 | cmd | provenance | |
153+
| execa.js:6:9:6:54 | cmd | execa.js:30:24:30:26 | cmd | provenance | |
155154
| execa.js:6:9:6:54 | cmd | execa.js:31:24:31:26 | cmd | provenance | |
156-
| execa.js:6:9:6:54 | cmd | execa.js:32:24:32:26 | cmd | provenance | |
155+
| execa.js:6:9:6:54 | cmd | execa.js:33:22:33:24 | cmd | provenance | |
157156
| execa.js:6:9:6:54 | cmd | execa.js:34:22:34:24 | cmd | provenance | |
158-
| execa.js:6:9:6:54 | cmd | execa.js:35:22:35:24 | cmd | provenance | |
159157
| execa.js:6:15:6:38 | url.par ... , true) | execa.js:6:9:6:54 | cmd | provenance | |
160158
| execa.js:6:25:6:31 | req.url | execa.js:6:15:6:38 | url.par ... , true) | provenance | |
159+
| execa.js:7:9:7:53 | arg1 | execa.js:30:30:30:33 | arg1 | provenance | |
161160
| execa.js:7:9:7:53 | arg1 | execa.js:31:30:31:33 | arg1 | provenance | |
162-
| execa.js:7:9:7:53 | arg1 | execa.js:32:30:32:33 | arg1 | provenance | |
161+
| execa.js:7:9:7:53 | arg1 | execa.js:33:28:33:31 | arg1 | provenance | |
163162
| execa.js:7:9:7:53 | arg1 | execa.js:34:28:34:31 | arg1 | provenance | |
164-
| execa.js:7:9:7:53 | arg1 | execa.js:35:28:35:31 | arg1 | provenance | |
165163
| execa.js:7:16:7:39 | url.par ... , true) | execa.js:7:9:7:53 | arg1 | provenance | |
166164
| execa.js:7:26:7:32 | req.url | execa.js:7:16:7:39 | url.par ... , true) | provenance | |
165+
| execa.js:8:9:8:53 | arg2 | execa.js:30:37:30:40 | arg2 | provenance | |
167166
| execa.js:8:9:8:53 | arg2 | execa.js:31:37:31:40 | arg2 | provenance | |
168-
| execa.js:8:9:8:53 | arg2 | execa.js:32:37:32:40 | arg2 | provenance | |
167+
| execa.js:8:9:8:53 | arg2 | execa.js:33:35:33:38 | arg2 | provenance | |
169168
| execa.js:8:9:8:53 | arg2 | execa.js:34:35:34:38 | arg2 | provenance | |
170-
| execa.js:8:9:8:53 | arg2 | execa.js:35:35:35:38 | arg2 | provenance | |
171169
| execa.js:8:16:8:39 | url.par ... , true) | execa.js:8:9:8:53 | arg2 | provenance | |
172170
| execa.js:8:26:8:32 | req.url | execa.js:8:16:8:39 | url.par ... , true) | provenance | |
171+
| execa.js:9:9:9:53 | arg3 | execa.js:30:44:30:47 | arg3 | provenance | |
173172
| execa.js:9:9:9:53 | arg3 | execa.js:31:44:31:47 | arg3 | provenance | |
174-
| execa.js:9:9:9:53 | arg3 | execa.js:32:44:32:47 | arg3 | provenance | |
173+
| execa.js:9:9:9:53 | arg3 | execa.js:33:42:33:45 | arg3 | provenance | |
175174
| execa.js:9:9:9:53 | arg3 | execa.js:34:42:34:45 | arg3 | provenance | |
176-
| execa.js:9:9:9:53 | arg3 | execa.js:35:42:35:45 | arg3 | provenance | |
177175
| execa.js:9:16:9:39 | url.par ... , true) | execa.js:9:9:9:53 | arg3 | provenance | |
178176
| execa.js:9:26:9:32 | req.url | execa.js:9:16:9:39 | url.par ... , true) | provenance | |
177+
| execa.js:30:24:30:26 | cmd | execa.js:30:24:30:47 | cmd + a ... + arg3 | provenance | |
178+
| execa.js:30:30:30:33 | arg1 | execa.js:30:24:30:47 | cmd + a ... + arg3 | provenance | |
179+
| execa.js:30:37:30:40 | arg2 | execa.js:30:24:30:47 | cmd + a ... + arg3 | provenance | |
180+
| execa.js:30:44:30:47 | arg3 | execa.js:30:24:30:47 | cmd + a ... + arg3 | provenance | |
179181
| execa.js:31:24:31:26 | cmd | execa.js:31:24:31:47 | cmd + a ... + arg3 | provenance | |
180182
| execa.js:31:30:31:33 | arg1 | execa.js:31:24:31:47 | cmd + a ... + arg3 | provenance | |
181183
| execa.js:31:37:31:40 | arg2 | execa.js:31:24:31:47 | cmd + a ... + arg3 | provenance | |
182184
| execa.js:31:44:31:47 | arg3 | execa.js:31:24:31:47 | cmd + a ... + arg3 | provenance | |
183-
| execa.js:32:24:32:26 | cmd | execa.js:32:24:32:47 | cmd + a ... + arg3 | provenance | |
184-
| execa.js:32:30:32:33 | arg1 | execa.js:32:24:32:47 | cmd + a ... + arg3 | provenance | |
185-
| execa.js:32:37:32:40 | arg2 | execa.js:32:24:32:47 | cmd + a ... + arg3 | provenance | |
186-
| execa.js:32:44:32:47 | arg3 | execa.js:32:24:32:47 | cmd + a ... + arg3 | provenance | |
185+
| execa.js:33:22:33:24 | cmd | execa.js:33:22:33:45 | cmd + a ... + arg3 | provenance | |
186+
| execa.js:33:28:33:31 | arg1 | execa.js:33:22:33:45 | cmd + a ... + arg3 | provenance | |
187+
| execa.js:33:35:33:38 | arg2 | execa.js:33:22:33:45 | cmd + a ... + arg3 | provenance | |
188+
| execa.js:33:42:33:45 | arg3 | execa.js:33:22:33:45 | cmd + a ... + arg3 | provenance | |
187189
| execa.js:34:22:34:24 | cmd | execa.js:34:22:34:45 | cmd + a ... + arg3 | provenance | |
188190
| execa.js:34:28:34:31 | arg1 | execa.js:34:22:34:45 | cmd + a ... + arg3 | provenance | |
189191
| execa.js:34:35:34:38 | arg2 | execa.js:34:22:34:45 | cmd + a ... + arg3 | provenance | |
190192
| execa.js:34:42:34:45 | arg3 | execa.js:34:22:34:45 | cmd + a ... + arg3 | provenance | |
191-
| execa.js:35:22:35:24 | cmd | execa.js:35:22:35:45 | cmd + a ... + arg3 | provenance | |
192-
| execa.js:35:28:35:31 | arg1 | execa.js:35:22:35:45 | cmd + a ... + arg3 | provenance | |
193-
| execa.js:35:35:35:38 | arg2 | execa.js:35:22:35:45 | cmd + a ... + arg3 | provenance | |
194-
| execa.js:35:42:35:45 | arg3 | execa.js:35:22:35:45 | cmd + a ... + arg3 | provenance | |
195193
| form-parsers.js:9:19:9:26 | req.file | form-parsers.js:9:8:9:39 | "touch ... nalname | provenance | |
196194
| form-parsers.js:13:3:13:11 | req.files | form-parsers.js:13:21:13:24 | file | provenance | |
197195
| form-parsers.js:13:21:13:24 | file | form-parsers.js:14:21:14:24 | file | provenance | |
@@ -317,29 +315,28 @@ nodes
317315
| execa.js:23:17:23:19 | cmd | semmle.label | cmd |
318316
| execa.js:24:17:24:19 | cmd | semmle.label | cmd |
319317
| execa.js:25:17:25:19 | cmd | semmle.label | cmd |
320-
| execa.js:26:17:26:19 | cmd | semmle.label | cmd |
318+
| execa.js:27:15:27:17 | cmd | semmle.label | cmd |
321319
| execa.js:28:15:28:17 | cmd | semmle.label | cmd |
322-
| execa.js:29:15:29:17 | cmd | semmle.label | cmd |
320+
| execa.js:30:24:30:26 | cmd | semmle.label | cmd |
321+
| execa.js:30:24:30:47 | cmd + a ... + arg3 | semmle.label | cmd + a ... + arg3 |
322+
| execa.js:30:30:30:33 | arg1 | semmle.label | arg1 |
323+
| execa.js:30:37:30:40 | arg2 | semmle.label | arg2 |
324+
| execa.js:30:44:30:47 | arg3 | semmle.label | arg3 |
323325
| execa.js:31:24:31:26 | cmd | semmle.label | cmd |
324326
| execa.js:31:24:31:47 | cmd + a ... + arg3 | semmle.label | cmd + a ... + arg3 |
325327
| execa.js:31:30:31:33 | arg1 | semmle.label | arg1 |
326328
| execa.js:31:37:31:40 | arg2 | semmle.label | arg2 |
327329
| execa.js:31:44:31:47 | arg3 | semmle.label | arg3 |
328-
| execa.js:32:24:32:26 | cmd | semmle.label | cmd |
329-
| execa.js:32:24:32:47 | cmd + a ... + arg3 | semmle.label | cmd + a ... + arg3 |
330-
| execa.js:32:30:32:33 | arg1 | semmle.label | arg1 |
331-
| execa.js:32:37:32:40 | arg2 | semmle.label | arg2 |
332-
| execa.js:32:44:32:47 | arg3 | semmle.label | arg3 |
330+
| execa.js:33:22:33:24 | cmd | semmle.label | cmd |
331+
| execa.js:33:22:33:45 | cmd + a ... + arg3 | semmle.label | cmd + a ... + arg3 |
332+
| execa.js:33:28:33:31 | arg1 | semmle.label | arg1 |
333+
| execa.js:33:35:33:38 | arg2 | semmle.label | arg2 |
334+
| execa.js:33:42:33:45 | arg3 | semmle.label | arg3 |
333335
| execa.js:34:22:34:24 | cmd | semmle.label | cmd |
334336
| execa.js:34:22:34:45 | cmd + a ... + arg3 | semmle.label | cmd + a ... + arg3 |
335337
| execa.js:34:28:34:31 | arg1 | semmle.label | arg1 |
336338
| execa.js:34:35:34:38 | arg2 | semmle.label | arg2 |
337339
| execa.js:34:42:34:45 | arg3 | semmle.label | arg3 |
338-
| execa.js:35:22:35:24 | cmd | semmle.label | cmd |
339-
| execa.js:35:22:35:45 | cmd + a ... + arg3 | semmle.label | cmd + a ... + arg3 |
340-
| execa.js:35:28:35:31 | arg1 | semmle.label | arg1 |
341-
| execa.js:35:35:35:38 | arg2 | semmle.label | arg2 |
342-
| execa.js:35:42:35:45 | arg3 | semmle.label | arg3 |
343340
| form-parsers.js:9:8:9:39 | "touch ... nalname | semmle.label | "touch ... nalname |
344341
| form-parsers.js:9:19:9:26 | req.file | semmle.label | req.file |
345342
| form-parsers.js:13:3:13:11 | req.files | semmle.label | req.files |

‎javascript/ql/test/query-tests/Security/CWE-078/CommandInjection/execa.js‎

Lines changed: 3 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -16,13 +16,12 @@ http.createServer(async function (req, res) {
1616

1717
$.sync`${cmd} ${arg1} ${arg2} ${arg3}`; // $Alert
1818
$.sync`ssh ${arg1} ${arg2} ${arg3}`; // safely escapes variables, preventing shell injection.
19-
await $({ shell: true })`${cmd} ${arg1} ${arg2} ${arg3}` // $Alert
20-
await $({ shell: false })`${cmd} ${arg1} ${arg2} ${arg3}` // $Alert
21-
await $({ shell: false })`ssh ${arg1} ${arg2} ${arg3}` // safely escapes variables, preventing shell injection.
19+
await $({ shell: true })`${cmd} ${arg1} ${arg2} ${arg3}`; // $Alert
20+
await $({ shell: false })`${cmd} ${arg1} ${arg2} ${arg3}`; // $Alert
21+
await $({ shell: false })`ssh ${arg1} ${arg2} ${arg3}`; // safely escapes variables, preventing shell injection.
2222

2323
await execa(cmd, [arg1, arg2, arg3]); // $Alert
2424
await execa(cmd, { shell: true }); // $Alert
25-
await execa(cmd, { shell: true }); // $Alert
2625
await execa(cmd, [arg1, arg2, arg3], { shell: true }); // $Alert
2726

2827
execaSync(cmd, [arg1, arg2, arg3]); // $Alert

0 commit comments

Comments
 (0)