Skip to content

Commit 5a49f6b

Browse files
am0o0am0o0
committed
fix tests
1 parent f5efddc commit 5a49f6b

File tree

27 files changed

+845
-860
lines changed

27 files changed

+845
-860
lines changed

‎javascript/ql/src/Security/CWE-400/DeepObjectResourceExhaustion.expected‎

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,8 @@
1+
nodes
2+
| examples/DeepObjectResourceExhaustion.js:9:29:9:36 | req.body |
3+
| examples/DeepObjectResourceExhaustion.js:9:29:9:36 | req.body |
4+
| examples/DeepObjectResourceExhaustion.js:9:29:9:36 | req.body |
5+
edges
6+
| examples/DeepObjectResourceExhaustion.js:9:29:9:36 | req.body | examples/DeepObjectResourceExhaustion.js:9:29:9:36 | req.body |
7+
#select
8+
| examples/DeepObjectResourceExhaustion.js:9:29:9:36 | req.body | examples/DeepObjectResourceExhaustion.js:9:29:9:36 | req.body | examples/DeepObjectResourceExhaustion.js:9:29:9:36 | req.body | Denial of service caused by processing $@ with $@. | examples/DeepObjectResourceExhaustion.js:9:29:9:36 | req.body | user input | examples/DeepObjectResourceExhaustion.js:4:21:4:35 | allErrors: true | allErrors: true |

‎javascript/ql/src/Security/CWE-400/RemotePropertyInjection.expected‎

Lines changed: 13 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1 +1,13 @@
1-
| examples/RemotePropertyInjection.js:8:8:8:11 | prop | A $@ is used as a property name to write to. | examples/RemotePropertyInjection.js:7:13:7:36 | req.que ... trolled | user-provided value |
1+
nodes
2+
| examples/RemotePropertyInjection.js:7:6:7:36 | prop |
3+
| examples/RemotePropertyInjection.js:7:13:7:36 | req.que ... trolled |
4+
| examples/RemotePropertyInjection.js:7:13:7:36 | req.que ... trolled |
5+
| examples/RemotePropertyInjection.js:8:8:8:11 | prop |
6+
| examples/RemotePropertyInjection.js:8:8:8:11 | prop |
7+
edges
8+
| examples/RemotePropertyInjection.js:7:6:7:36 | prop | examples/RemotePropertyInjection.js:8:8:8:11 | prop |
9+
| examples/RemotePropertyInjection.js:7:6:7:36 | prop | examples/RemotePropertyInjection.js:8:8:8:11 | prop |
10+
| examples/RemotePropertyInjection.js:7:13:7:36 | req.que ... trolled | examples/RemotePropertyInjection.js:7:6:7:36 | prop |
11+
| examples/RemotePropertyInjection.js:7:13:7:36 | req.que ... trolled | examples/RemotePropertyInjection.js:7:6:7:36 | prop |
12+
#select
13+
| examples/RemotePropertyInjection.js:8:8:8:11 | prop | examples/RemotePropertyInjection.js:7:13:7:36 | req.que ... trolled | examples/RemotePropertyInjection.js:8:8:8:11 | prop | A property name to write to depends on a $@. | examples/RemotePropertyInjection.js:7:13:7:36 | req.que ... trolled | user-provided value |

‎javascript/ql/src/experimental/Security/CWE-522-DecompressionBombs/DecompressionBombs.ql‎

Lines changed: 0 additions & 17 deletions
Original file line numberDiff line numberDiff line change
@@ -278,23 +278,6 @@ module DecompressionBomb {
278278
}
279279
}
280280

281-
module Brotli {
282-
/**
283-
* The decompression sinks of (brotli)[https://www.npmjs.com/package/brotli]
284-
*/
285-
class DecompressionBomb extends Range {
286-
DecompressionBomb() {
287-
this =
288-
[
289-
API::moduleImport("brotli").getMember("decompress"),
290-
API::moduleImport("brotli/decompress")
291-
]
292-
}
293-
294-
override DataFlow::Node sink() { result = this.getACall().getArgument(0) }
295-
}
296-
}
297-
298281
module Unzipper {
299282
/**
300283
* The decompression sinks of (unzipper)[https://www.npmjs.com/package/unzipper]

‎javascript/ql/src/experimental/Security/CWE-522-DecompressionBombs/RemoteFlowSources.qll‎

Lines changed: 0 additions & 3 deletions
This file was deleted.

‎javascript/ql/test/library-tests/InterProceduralFlow/tests.expected‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -104,6 +104,10 @@ taintTracking
104104
| esLib.js:3:21:3:29 | "tainted" | esClient.js:8:13:8:21 | es.source |
105105
| esLib.js:3:21:3:29 | "tainted" | esClient.js:11:13:11:17 | esFoo |
106106
| esLib.js:3:21:3:29 | "tainted" | nodeJsClient.js:5:13:5:21 | es.source |
107+
| global-forin1.js:2:14:2:26 | [ "tainted" ] | global-forin1.js:1:13:1:13 | p |
108+
| global-forin1.js:2:14:2:26 | [ "tainted" ] | global-forin1.js:4:15:4:15 | p |
109+
| global-forin1.js:2:14:2:26 | [ "tainted" ] | global-forin1.js:7:13:7:13 | p |
110+
| global-forin1.js:2:14:2:26 | [ "tainted" ] | global-forin2.js:1:13:1:13 | p |
107111
| global.js:1:15:1:24 | "tainted1" | global.js:9:13:9:22 | g(source1) |
108112
| global.js:1:15:1:24 | "tainted1" | global.js:17:13:17:27 | window.location |
109113
| global.js:2:15:2:24 | "tainted2" | global.js:10:13:10:22 | g(source2) |

‎javascript/ql/test/query-tests/Security/CWE-079/DomBasedXss/ConsistencyDomBasedXss.expected‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1 @@
1+
| query-tests/Security/CWE-079/DomBasedXss/tst.js:296 | did not expect an alert, but found an alert for HtmlInjection | OK | |

‎javascript/ql/test/query-tests/Security/CWE-079/DomBasedXss/Xss.expected‎

Lines changed: 25 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -969,6 +969,18 @@ nodes
969969
| tst.js:288:59:288:65 | tainted |
970970
| tst.js:288:59:288:65 | tainted |
971971
| tst.js:288:59:288:65 | tainted |
972+
| tst.js:293:9:293:16 | obj |
973+
| tst.js:293:9:293:16 | obj |
974+
| tst.js:293:15:293:16 | {} |
975+
| tst.js:293:15:293:16 | {} |
976+
| tst.js:294:26:294:36 | window.name |
977+
| tst.js:294:26:294:36 | window.name |
978+
| tst.js:294:26:294:36 | window.name |
979+
| tst.js:295:19:295:21 | obj |
980+
| tst.js:295:19:295:21 | obj |
981+
| tst.js:296:9:296:9 | p |
982+
| tst.js:296:9:296:9 | p |
983+
| tst.js:296:9:296:9 | p |
972984
| tst.js:301:9:301:16 | location |
973985
| tst.js:301:9:301:16 | location |
974986
| tst.js:302:10:302:10 | e |
@@ -2139,6 +2151,18 @@ edges
21392151
| tst.js:285:19:285:29 | window.name | tst.js:285:9:285:29 | tainted |
21402152
| tst.js:285:19:285:29 | window.name | tst.js:285:9:285:29 | tainted |
21412153
| tst.js:285:19:285:29 | window.name | tst.js:285:9:285:29 | tainted |
2154+
| tst.js:293:9:293:16 | obj | tst.js:295:19:295:21 | obj |
2155+
| tst.js:293:9:293:16 | obj | tst.js:295:19:295:21 | obj |
2156+
| tst.js:293:15:293:16 | {} | tst.js:293:9:293:16 | obj |
2157+
| tst.js:293:15:293:16 | {} | tst.js:293:9:293:16 | obj |
2158+
| tst.js:294:26:294:36 | window.name | tst.js:293:15:293:16 | {} |
2159+
| tst.js:294:26:294:36 | window.name | tst.js:293:15:293:16 | {} |
2160+
| tst.js:294:26:294:36 | window.name | tst.js:293:15:293:16 | {} |
2161+
| tst.js:294:26:294:36 | window.name | tst.js:293:15:293:16 | {} |
2162+
| tst.js:295:19:295:21 | obj | tst.js:296:9:296:9 | p |
2163+
| tst.js:295:19:295:21 | obj | tst.js:296:9:296:9 | p |
2164+
| tst.js:295:19:295:21 | obj | tst.js:296:9:296:9 | p |
2165+
| tst.js:295:19:295:21 | obj | tst.js:296:9:296:9 | p |
21422166
| tst.js:301:9:301:16 | location | tst.js:302:10:302:10 | e |
21432167
| tst.js:301:9:301:16 | location | tst.js:302:10:302:10 | e |
21442168
| tst.js:302:10:302:10 | e | tst.js:303:20:303:20 | e |
@@ -2545,6 +2569,7 @@ edges
25452569
| tst.js:264:11:264:21 | window.name | tst.js:264:11:264:21 | window.name | tst.js:264:11:264:21 | window.name | Cross-site scripting vulnerability due to $@. | tst.js:264:11:264:21 | window.name | user-provided value |
25462570
| tst.js:280:22:280:29 | location | tst.js:280:22:280:29 | location | tst.js:280:22:280:29 | location | Cross-site scripting vulnerability due to $@. | tst.js:280:22:280:29 | location | user-provided value |
25472571
| tst.js:288:59:288:65 | tainted | tst.js:285:19:285:29 | window.name | tst.js:288:59:288:65 | tainted | Cross-site scripting vulnerability due to $@. | tst.js:285:19:285:29 | window.name | user-provided value |
2572+
| tst.js:296:9:296:9 | p | tst.js:294:26:294:36 | window.name | tst.js:296:9:296:9 | p | Cross-site scripting vulnerability due to $@. | tst.js:294:26:294:36 | window.name | user-provided value |
25482573
| tst.js:303:20:303:20 | e | tst.js:301:9:301:16 | location | tst.js:303:20:303:20 | e | Cross-site scripting vulnerability due to $@. | tst.js:301:9:301:16 | location | user-provided value |
25492574
| tst.js:311:20:311:20 | e | tst.js:308:10:308:17 | location | tst.js:311:20:311:20 | e | Cross-site scripting vulnerability due to $@. | tst.js:308:10:308:17 | location | user-provided value |
25502575
| tst.js:316:35:316:42 | location | tst.js:316:35:316:42 | location | tst.js:316:35:316:42 | location | Cross-site scripting vulnerability due to $@. | tst.js:316:35:316:42 | location | user-provided value |

‎javascript/ql/test/query-tests/Security/CWE-079/DomBasedXss/XssWithAdditionalSources.expected‎

Lines changed: 24 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -981,6 +981,18 @@ nodes
981981
| tst.js:288:59:288:65 | tainted |
982982
| tst.js:288:59:288:65 | tainted |
983983
| tst.js:288:59:288:65 | tainted |
984+
| tst.js:293:9:293:16 | obj |
985+
| tst.js:293:9:293:16 | obj |
986+
| tst.js:293:15:293:16 | {} |
987+
| tst.js:293:15:293:16 | {} |
988+
| tst.js:294:26:294:36 | window.name |
989+
| tst.js:294:26:294:36 | window.name |
990+
| tst.js:294:26:294:36 | window.name |
991+
| tst.js:295:19:295:21 | obj |
992+
| tst.js:295:19:295:21 | obj |
993+
| tst.js:296:9:296:9 | p |
994+
| tst.js:296:9:296:9 | p |
995+
| tst.js:296:9:296:9 | p |
984996
| tst.js:301:9:301:16 | location |
985997
| tst.js:301:9:301:16 | location |
986998
| tst.js:302:10:302:10 | e |
@@ -2201,6 +2213,18 @@ edges
22012213
| tst.js:285:19:285:29 | window.name | tst.js:285:9:285:29 | tainted |
22022214
| tst.js:285:19:285:29 | window.name | tst.js:285:9:285:29 | tainted |
22032215
| tst.js:285:19:285:29 | window.name | tst.js:285:9:285:29 | tainted |
2216+
| tst.js:293:9:293:16 | obj | tst.js:295:19:295:21 | obj |
2217+
| tst.js:293:9:293:16 | obj | tst.js:295:19:295:21 | obj |
2218+
| tst.js:293:15:293:16 | {} | tst.js:293:9:293:16 | obj |
2219+
| tst.js:293:15:293:16 | {} | tst.js:293:9:293:16 | obj |
2220+
| tst.js:294:26:294:36 | window.name | tst.js:293:15:293:16 | {} |
2221+
| tst.js:294:26:294:36 | window.name | tst.js:293:15:293:16 | {} |
2222+
| tst.js:294:26:294:36 | window.name | tst.js:293:15:293:16 | {} |
2223+
| tst.js:294:26:294:36 | window.name | tst.js:293:15:293:16 | {} |
2224+
| tst.js:295:19:295:21 | obj | tst.js:296:9:296:9 | p |
2225+
| tst.js:295:19:295:21 | obj | tst.js:296:9:296:9 | p |
2226+
| tst.js:295:19:295:21 | obj | tst.js:296:9:296:9 | p |
2227+
| tst.js:295:19:295:21 | obj | tst.js:296:9:296:9 | p |
22042228
| tst.js:301:9:301:16 | location | tst.js:302:10:302:10 | e |
22052229
| tst.js:301:9:301:16 | location | tst.js:302:10:302:10 | e |
22062230
| tst.js:302:10:302:10 | e | tst.js:303:20:303:20 | e |

0 commit comments

Comments
 (0)