Merge pull request #19354 from michaelnebel/csharp/matchlinenumbersonsinks

Shared: Match line information on Alert and Sink locations.

Author: michaelnebel

javascript/ql/test/query-tests/Security/CWE-078/CommandInjection/child_process-test.js

@@ -36,7 +36,7 @@ var server = http.createServer(function(req, res) {
       sh = 'cmd.exe', flag = '/c';
     else
       sh = '/bin/sh', flag = '-c';
-    cp.spawn(sh, [ flag, cmd ]); // $ Alert Sink
+    cp.spawn(sh, [ flag, cmd ]); // $ Alert
 
     let args = [];
     args[0] = "-c";
@@ -53,8 +53,8 @@ var server = http.createServer(function(req, res) {
     args[1] = cmd; // $ Sink
     cp.execFile(`/bin` + "/bash", args); // $ Alert
 
-    cp.spawn('cmd.exe', ['/C', 'foo'].concat(["bar", cmd])); // $ Alert Sink
-    cp.spawn('cmd.exe', ['/C', 'foo'].concat(cmd)); // $ Alert Sink
+    cp.spawn('cmd.exe', ['/C', 'foo'].concat(["bar", cmd])); // $ Alert
+    cp.spawn('cmd.exe', ['/C', 'foo'].concat(cmd)); // $ Alert
 
     let myArgs = [];
     myArgs.push(`-` + "c");

javascript/ql/test/query-tests/Security/CWE-078/CommandInjection/exec-sh.js

@@ -12,7 +12,7 @@ function getShell() {
 
 function execSh(command, options) {
     var shell = getShell()
-    return cp.spawn(shell.cmd, [shell.arg, command], options) // $ Alert Sink
+    return cp.spawn(shell.cmd, [shell.arg, command], options) // $ Alert
 }
 
 http.createServer(function (req, res) {

javascript/ql/test/query-tests/Security/CWE-078/CommandInjection/exec-sh2.js

@@ -7,7 +7,7 @@ function getShell() {
 }
 
 function execSh(command, options) {
-    return cp.spawn(getShell(), ["-c", command], options) // $ Alert Sink
+    return cp.spawn(getShell(), ["-c", command], options) // $ Alert
 };
 
 http.createServer(function (req, res) {

javascript/ql/test/query-tests/Security/CWE-078/UnsafeShellCommandConstruction/lib/isImported.js

@@ -3,5 +3,5 @@
 const cp = require("child_process");
 
 module.exports.thisMethodIsImported = function (name) { // $ Source
-	cp.exec("rm -rf " + name); // $ Alert Sink
-}
+	cp.exec("rm -rf " + name); // $ Alert
+}