Skip to content

Commit b89e70b

Browse files
NapalysNapalys
committed
Added test cases for aws sources
1 parent 801a34f commit b89e70b

File tree

2 files changed

+214
-0
lines changed

2 files changed

+214
-0
lines changed

‎javascript/ql/test/query-tests/Security/CWE-079/DomBasedXss/XssWithAdditionalSources.expected‎

Lines changed: 96 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -60,6 +60,54 @@ nodes
6060
| aws-db.js:74:35:74:43 | data.Item | semmle.label | data.Item |
6161
| aws-db.js:77:35:77:38 | data | semmle.label | data |
6262
| aws-db.js:77:35:77:43 | data.Item | semmle.label | data.Item |
63+
| aws.js:14:31:14:36 | result | semmle.label | result |
64+
| aws.js:14:31:14:44 | result.comment | semmle.label | result.comment |
65+
| aws.js:18:31:18:37 | result2 | semmle.label | result2 |
66+
| aws.js:18:31:18:45 | result2.comment | semmle.label | result2.comment |
67+
| aws.js:22:31:22:37 | result3 | semmle.label | result3 |
68+
| aws.js:22:31:22:45 | result3.comment | semmle.label | result3.comment |
69+
| aws.js:26:31:26:37 | result4 | semmle.label | result4 |
70+
| aws.js:26:31:26:45 | result4.comment | semmle.label | result4.comment |
71+
| aws.js:34:31:34:34 | data | semmle.label | data |
72+
| aws.js:34:31:34:42 | data.comment | semmle.label | data.comment |
73+
| aws.js:37:35:37:38 | data | semmle.label | data |
74+
| aws.js:37:35:37:46 | data.comment | semmle.label | data.comment |
75+
| aws.js:47:31:47:34 | data | semmle.label | data |
76+
| aws.js:47:31:47:42 | data.comment | semmle.label | data.comment |
77+
| aws.js:50:35:50:38 | data | semmle.label | data |
78+
| aws.js:50:35:50:46 | data.comment | semmle.label | data.comment |
79+
| aws.js:59:31:59:34 | data | semmle.label | data |
80+
| aws.js:59:31:59:42 | data.comment | semmle.label | data.comment |
81+
| aws.js:62:35:62:38 | data | semmle.label | data |
82+
| aws.js:62:35:62:46 | data.comment | semmle.label | data.comment |
83+
| aws.js:66:31:66:35 | data2 | semmle.label | data2 |
84+
| aws.js:66:31:66:43 | data2.comment | semmle.label | data2.comment |
85+
| aws.js:69:35:69:38 | data | semmle.label | data |
86+
| aws.js:69:35:69:46 | data.comment | semmle.label | data.comment |
87+
| aws.js:78:31:78:34 | data | semmle.label | data |
88+
| aws.js:78:31:78:42 | data.comment | semmle.label | data.comment |
89+
| aws.js:81:35:81:38 | data | semmle.label | data |
90+
| aws.js:81:35:81:46 | data.comment | semmle.label | data.comment |
91+
| aws.js:85:31:85:35 | data2 | semmle.label | data2 |
92+
| aws.js:85:31:85:43 | data2.comment | semmle.label | data2.comment |
93+
| aws.js:88:35:88:38 | data | semmle.label | data |
94+
| aws.js:88:35:88:46 | data.comment | semmle.label | data.comment |
95+
| aws.js:92:31:92:35 | data3 | semmle.label | data3 |
96+
| aws.js:92:31:92:43 | data3.comment | semmle.label | data3.comment |
97+
| aws.js:95:35:95:38 | data | semmle.label | data |
98+
| aws.js:95:35:95:46 | data.comment | semmle.label | data.comment |
99+
| aws.js:99:31:99:35 | data4 | semmle.label | data4 |
100+
| aws.js:99:31:99:43 | data4.comment | semmle.label | data4.comment |
101+
| aws.js:102:35:102:38 | data | semmle.label | data |
102+
| aws.js:102:35:102:46 | data.comment | semmle.label | data.comment |
103+
| aws.js:106:31:106:35 | data5 | semmle.label | data5 |
104+
| aws.js:106:31:106:43 | data5.comment | semmle.label | data5.comment |
105+
| aws.js:109:35:109:38 | data | semmle.label | data |
106+
| aws.js:109:35:109:46 | data.comment | semmle.label | data.comment |
107+
| aws.js:113:31:113:35 | data6 | semmle.label | data6 |
108+
| aws.js:113:31:113:43 | data6.comment | semmle.label | data6.comment |
109+
| aws.js:116:35:116:38 | data | semmle.label | data |
110+
| aws.js:116:35:116:46 | data.comment | semmle.label | data.comment |
63111
| classnames.js:7:31:7:84 | `<span ... <span>` | semmle.label | `<span ... <span>` |
64112
| classnames.js:7:47:7:69 | classNa ... w.name) | semmle.label | classNa ... w.name) |
65113
| classnames.js:7:58:7:68 | window.name | semmle.label | window.name |
@@ -766,6 +814,30 @@ edges
766814
| aws-db.js:69:35:69:38 | data | aws-db.js:69:35:69:52 | data.updateResults | provenance | |
767815
| aws-db.js:74:35:74:38 | data | aws-db.js:74:35:74:43 | data.Item | provenance | |
768816
| aws-db.js:77:35:77:38 | data | aws-db.js:77:35:77:43 | data.Item | provenance | |
817+
| aws.js:14:31:14:36 | result | aws.js:14:31:14:44 | result.comment | provenance | |
818+
| aws.js:18:31:18:37 | result2 | aws.js:18:31:18:45 | result2.comment | provenance | |
819+
| aws.js:22:31:22:37 | result3 | aws.js:22:31:22:45 | result3.comment | provenance | |
820+
| aws.js:26:31:26:37 | result4 | aws.js:26:31:26:45 | result4.comment | provenance | |
821+
| aws.js:34:31:34:34 | data | aws.js:34:31:34:42 | data.comment | provenance | |
822+
| aws.js:37:35:37:38 | data | aws.js:37:35:37:46 | data.comment | provenance | |
823+
| aws.js:47:31:47:34 | data | aws.js:47:31:47:42 | data.comment | provenance | |
824+
| aws.js:50:35:50:38 | data | aws.js:50:35:50:46 | data.comment | provenance | |
825+
| aws.js:59:31:59:34 | data | aws.js:59:31:59:42 | data.comment | provenance | |
826+
| aws.js:62:35:62:38 | data | aws.js:62:35:62:46 | data.comment | provenance | |
827+
| aws.js:66:31:66:35 | data2 | aws.js:66:31:66:43 | data2.comment | provenance | |
828+
| aws.js:69:35:69:38 | data | aws.js:69:35:69:46 | data.comment | provenance | |
829+
| aws.js:78:31:78:34 | data | aws.js:78:31:78:42 | data.comment | provenance | |
830+
| aws.js:81:35:81:38 | data | aws.js:81:35:81:46 | data.comment | provenance | |
831+
| aws.js:85:31:85:35 | data2 | aws.js:85:31:85:43 | data2.comment | provenance | |
832+
| aws.js:88:35:88:38 | data | aws.js:88:35:88:46 | data.comment | provenance | |
833+
| aws.js:92:31:92:35 | data3 | aws.js:92:31:92:43 | data3.comment | provenance | |
834+
| aws.js:95:35:95:38 | data | aws.js:95:35:95:46 | data.comment | provenance | |
835+
| aws.js:99:31:99:35 | data4 | aws.js:99:31:99:43 | data4.comment | provenance | |
836+
| aws.js:102:35:102:38 | data | aws.js:102:35:102:46 | data.comment | provenance | |
837+
| aws.js:106:31:106:35 | data5 | aws.js:106:31:106:43 | data5.comment | provenance | |
838+
| aws.js:109:35:109:38 | data | aws.js:109:35:109:46 | data.comment | provenance | |
839+
| aws.js:113:31:113:35 | data6 | aws.js:113:31:113:43 | data6.comment | provenance | |
840+
| aws.js:116:35:116:38 | data | aws.js:116:35:116:46 | data.comment | provenance | |
769841
| classnames.js:7:47:7:69 | classNa ... w.name) | classnames.js:7:31:7:84 | `<span ... <span>` | provenance | |
770842
| classnames.js:7:58:7:68 | window.name | classnames.js:7:47:7:69 | classNa ... w.name) | provenance | |
771843
| classnames.js:8:47:8:70 | classNa ... w.name) | classnames.js:8:31:8:85 | `<span ... <span>` | provenance | |
@@ -1375,6 +1447,30 @@ subpaths
13751447
| aws-db.js:69:35:69:52 | data.updateResults | aws-db.js:69:35:69:38 | data | aws-db.js:69:35:69:52 | data.updateResults | Cross-site scripting vulnerability due to $@. | aws-db.js:69:35:69:38 | data | user-provided value |
13761448
| aws-db.js:74:35:74:43 | data.Item | aws-db.js:74:35:74:38 | data | aws-db.js:74:35:74:43 | data.Item | Cross-site scripting vulnerability due to $@. | aws-db.js:74:35:74:38 | data | user-provided value |
13771449
| aws-db.js:77:35:77:43 | data.Item | aws-db.js:77:35:77:38 | data | aws-db.js:77:35:77:43 | data.Item | Cross-site scripting vulnerability due to $@. | aws-db.js:77:35:77:38 | data | user-provided value |
1450+
| aws.js:14:31:14:44 | result.comment | aws.js:14:31:14:36 | result | aws.js:14:31:14:44 | result.comment | Cross-site scripting vulnerability due to $@. | aws.js:14:31:14:36 | result | user-provided value |
1451+
| aws.js:18:31:18:45 | result2.comment | aws.js:18:31:18:37 | result2 | aws.js:18:31:18:45 | result2.comment | Cross-site scripting vulnerability due to $@. | aws.js:18:31:18:37 | result2 | user-provided value |
1452+
| aws.js:22:31:22:45 | result3.comment | aws.js:22:31:22:37 | result3 | aws.js:22:31:22:45 | result3.comment | Cross-site scripting vulnerability due to $@. | aws.js:22:31:22:37 | result3 | user-provided value |
1453+
| aws.js:26:31:26:45 | result4.comment | aws.js:26:31:26:37 | result4 | aws.js:26:31:26:45 | result4.comment | Cross-site scripting vulnerability due to $@. | aws.js:26:31:26:37 | result4 | user-provided value |
1454+
| aws.js:34:31:34:42 | data.comment | aws.js:34:31:34:34 | data | aws.js:34:31:34:42 | data.comment | Cross-site scripting vulnerability due to $@. | aws.js:34:31:34:34 | data | user-provided value |
1455+
| aws.js:37:35:37:46 | data.comment | aws.js:37:35:37:38 | data | aws.js:37:35:37:46 | data.comment | Cross-site scripting vulnerability due to $@. | aws.js:37:35:37:38 | data | user-provided value |
1456+
| aws.js:47:31:47:42 | data.comment | aws.js:47:31:47:34 | data | aws.js:47:31:47:42 | data.comment | Cross-site scripting vulnerability due to $@. | aws.js:47:31:47:34 | data | user-provided value |
1457+
| aws.js:50:35:50:46 | data.comment | aws.js:50:35:50:38 | data | aws.js:50:35:50:46 | data.comment | Cross-site scripting vulnerability due to $@. | aws.js:50:35:50:38 | data | user-provided value |
1458+
| aws.js:59:31:59:42 | data.comment | aws.js:59:31:59:34 | data | aws.js:59:31:59:42 | data.comment | Cross-site scripting vulnerability due to $@. | aws.js:59:31:59:34 | data | user-provided value |
1459+
| aws.js:62:35:62:46 | data.comment | aws.js:62:35:62:38 | data | aws.js:62:35:62:46 | data.comment | Cross-site scripting vulnerability due to $@. | aws.js:62:35:62:38 | data | user-provided value |
1460+
| aws.js:66:31:66:43 | data2.comment | aws.js:66:31:66:35 | data2 | aws.js:66:31:66:43 | data2.comment | Cross-site scripting vulnerability due to $@. | aws.js:66:31:66:35 | data2 | user-provided value |
1461+
| aws.js:69:35:69:46 | data.comment | aws.js:69:35:69:38 | data | aws.js:69:35:69:46 | data.comment | Cross-site scripting vulnerability due to $@. | aws.js:69:35:69:38 | data | user-provided value |
1462+
| aws.js:78:31:78:42 | data.comment | aws.js:78:31:78:34 | data | aws.js:78:31:78:42 | data.comment | Cross-site scripting vulnerability due to $@. | aws.js:78:31:78:34 | data | user-provided value |
1463+
| aws.js:81:35:81:46 | data.comment | aws.js:81:35:81:38 | data | aws.js:81:35:81:46 | data.comment | Cross-site scripting vulnerability due to $@. | aws.js:81:35:81:38 | data | user-provided value |
1464+
| aws.js:85:31:85:43 | data2.comment | aws.js:85:31:85:35 | data2 | aws.js:85:31:85:43 | data2.comment | Cross-site scripting vulnerability due to $@. | aws.js:85:31:85:35 | data2 | user-provided value |
1465+
| aws.js:88:35:88:46 | data.comment | aws.js:88:35:88:38 | data | aws.js:88:35:88:46 | data.comment | Cross-site scripting vulnerability due to $@. | aws.js:88:35:88:38 | data | user-provided value |
1466+
| aws.js:92:31:92:43 | data3.comment | aws.js:92:31:92:35 | data3 | aws.js:92:31:92:43 | data3.comment | Cross-site scripting vulnerability due to $@. | aws.js:92:31:92:35 | data3 | user-provided value |
1467+
| aws.js:95:35:95:46 | data.comment | aws.js:95:35:95:38 | data | aws.js:95:35:95:46 | data.comment | Cross-site scripting vulnerability due to $@. | aws.js:95:35:95:38 | data | user-provided value |
1468+
| aws.js:99:31:99:43 | data4.comment | aws.js:99:31:99:35 | data4 | aws.js:99:31:99:43 | data4.comment | Cross-site scripting vulnerability due to $@. | aws.js:99:31:99:35 | data4 | user-provided value |
1469+
| aws.js:102:35:102:46 | data.comment | aws.js:102:35:102:38 | data | aws.js:102:35:102:46 | data.comment | Cross-site scripting vulnerability due to $@. | aws.js:102:35:102:38 | data | user-provided value |
1470+
| aws.js:106:31:106:43 | data5.comment | aws.js:106:31:106:35 | data5 | aws.js:106:31:106:43 | data5.comment | Cross-site scripting vulnerability due to $@. | aws.js:106:31:106:35 | data5 | user-provided value |
1471+
| aws.js:109:35:109:46 | data.comment | aws.js:109:35:109:38 | data | aws.js:109:35:109:46 | data.comment | Cross-site scripting vulnerability due to $@. | aws.js:109:35:109:38 | data | user-provided value |
1472+
| aws.js:113:31:113:43 | data6.comment | aws.js:113:31:113:35 | data6 | aws.js:113:31:113:43 | data6.comment | Cross-site scripting vulnerability due to $@. | aws.js:113:31:113:35 | data6 | user-provided value |
1473+
| aws.js:116:35:116:46 | data.comment | aws.js:116:35:116:38 | data | aws.js:116:35:116:46 | data.comment | Cross-site scripting vulnerability due to $@. | aws.js:116:35:116:38 | data | user-provided value |
13781474
| hana.js:11:37:11:51 | rows[0].comment | hana.js:11:37:11:40 | rows | hana.js:11:37:11:51 | rows[0].comment | Cross-site scripting vulnerability due to $@. | hana.js:11:37:11:40 | rows | user-provided value |
13791475
| hana.js:16:37:16:51 | rows[0].comment | hana.js:16:37:16:40 | rows | hana.js:16:37:16:51 | rows[0].comment | Cross-site scripting vulnerability due to $@. | hana.js:16:37:16:40 | rows | user-provided value |
13801476
| hana.js:19:37:19:51 | rows[0].comment | hana.js:19:37:19:40 | rows | hana.js:19:37:19:51 | rows[0].comment | Cross-site scripting vulnerability due to $@. | hana.js:19:37:19:40 | rows | user-provided value |

‎javascript/ql/test/query-tests/Security/CWE-079/DomBasedXss/aws.js‎

Lines changed: 118 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,118 @@
1+
const AWS = require('aws-sdk');
2+
const { AthenaClient } = require('@aws-sdk/client-athena');
3+
const { S3Client } = require('@aws-sdk/client-s3');
4+
const { RDSDataClient } = require('@aws-sdk/client-rds-data');
5+
const { DynamoDBClient } = require('@aws-sdk/client-dynamodb');
6+
const express = require('express');
7+
8+
const app = express();
9+
10+
// AWS V3 Common tests
11+
app.post('/aws-v3-common', async (req, res) => {
12+
const athenaClient = new AthenaClient({});
13+
const result = await athenaClient.send({});
14+
document.body.innerHTML = result.comment; // $ Alert[js/xss-additional-sources-dom-test]
15+
16+
const s3Client = new S3Client({});
17+
const result2 = await s3Client.send({});
18+
document.body.innerHTML = result2.comment; // $ Alert[js/xss-additional-sources-dom-test]
19+
20+
const rdsDataClient = new RDSDataClient({});
21+
const result3 = await rdsDataClient.send({});
22+
document.body.innerHTML = result3.comment; // $ Alert[js/xss-additional-sources-dom-test]
23+
24+
const dynamoClient = new DynamoDBClient({});
25+
const result4 = await dynamoClient.send({});
26+
document.body.innerHTML = result4.comment; // $ Alert[js/xss-additional-sources-dom-test]
27+
});
28+
29+
// Athena Client V2 tests
30+
app.post('/athena-v2', async (req, res) => {
31+
const athena = new AWS.Athena();
32+
33+
const data = await athena.getQueryResults({}).promise();
34+
document.body.innerHTML = data.comment; // $ Alert[js/xss-additional-sources-dom-test]
35+
36+
athena.getQueryResults({}, function(err, data) {
37+
document.body.innerHTML = data.comment; // $ Alert[js/xss-additional-sources-dom-test]
38+
});
39+
});
40+
41+
// S3 Client V2 tests
42+
app.post('/s3-v2', async (req, res) => {
43+
const s3 = new AWS.S3();
44+
45+
46+
const data = await s3.getObject({}).promise();
47+
document.body.innerHTML = data.comment; // $ Alert[js/xss-additional-sources-dom-test]
48+
49+
s3.getObject({}, function(err, data) {
50+
document.body.innerHTML = data.comment; // $ Alert[js/xss-additional-sources-dom-test]
51+
});
52+
});
53+
54+
// RDS Data Client V2 tests
55+
app.post('/rds-data-v2', async (req, res) => {
56+
const rdsData = new AWS.RDSDataService();
57+
58+
const data = await rdsData.executeStatement({}).promise();
59+
document.body.innerHTML = data.comment; // $ Alert[js/xss-additional-sources-dom-test]
60+
61+
rdsData.executeStatement({}, function(err, data) {
62+
document.body.innerHTML = data.comment; // $ Alert[js/xss-additional-sources-dom-test]
63+
});
64+
65+
const data2 = await rdsData.batchExecuteStatement({}).promise();
66+
document.body.innerHTML = data2.comment; // $ Alert[js/xss-additional-sources-dom-test]
67+
68+
rdsData.batchExecuteStatement({}, function(err, data) {
69+
document.body.innerHTML = data.comment; // $ Alert[js/xss-additional-sources-dom-test]
70+
});
71+
});
72+
73+
// DynamoDB Client V2 tests
74+
app.post('/dynamodb-v2', async (req, res) => {
75+
const dynamodb = new AWS.DynamoDB();
76+
77+
const data = await dynamodb.executeStatement({}).promise();
78+
document.body.innerHTML = data.comment; // $ Alert[js/xss-additional-sources-dom-test]
79+
80+
dynamodb.executeStatement({}, function(err, data) {
81+
document.body.innerHTML = data.comment; // $ Alert[js/xss-additional-sources-dom-test]
82+
});
83+
84+
const data2 = await dynamodb.batchExecuteStatement({}).promise();
85+
document.body.innerHTML = data2.comment; // $ Alert[js/xss-additional-sources-dom-test]
86+
87+
dynamodb.batchExecuteStatement({}, function(err, data) {
88+
document.body.innerHTML = data.comment; // $ Alert[js/xss-additional-sources-dom-test]
89+
});
90+
91+
const data3 = await dynamodb.query({}).promise();
92+
document.body.innerHTML = data3.comment; // $ Alert[js/xss-additional-sources-dom-test]
93+
94+
dynamodb.query({}, function(err, data) {
95+
document.body.innerHTML = data.comment; // $ Alert[js/xss-additional-sources-dom-test]
96+
});
97+
98+
const data4 = await dynamodb.scan({}).promise();
99+
document.body.innerHTML = data4.comment; // $ Alert[js/xss-additional-sources-dom-test]
100+
101+
dynamodb.scan({}, function(err, data) {
102+
document.body.innerHTML = data.comment; // $ Alert[js/xss-additional-sources-dom-test]
103+
});
104+
105+
const data5 = await dynamodb.getItem({}).promise();
106+
document.body.innerHTML = data5.comment; // $ Alert[js/xss-additional-sources-dom-test]
107+
108+
dynamodb.getItem({}, function(err, data) {
109+
document.body.innerHTML = data.comment; // $ Alert[js/xss-additional-sources-dom-test]
110+
});
111+
112+
const data6 = await dynamodb.batchGetItem({}).promise();
113+
document.body.innerHTML = data6.comment; // $ Alert[js/xss-additional-sources-dom-test]
114+
115+
dynamodb.batchGetItem({}, function(err, data) {
116+
document.body.innerHTML = data.comment; // $ Alert[js/xss-additional-sources-dom-test]
117+
});
118+
});

0 commit comments

Comments
 (0)