Skip to content

Commit 14faff4

Browse files
author
Alvaro Muñoz
committed
fix restify tests
1 parent e1f05e9 commit 14faff4

File tree

3 files changed

+63
-55
lines changed

3 files changed

+63
-55
lines changed

‎javascript/ql/test/library-tests/frameworks/Restify2/src/index.js‎

Lines changed: 17 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -123,9 +123,18 @@ function xss(req, res, next) { // test: handler
123123
res.send('hello ' + req.query.name); // test: source, stackTraceExposureSink, xssSink, xss
124124
next();
125125
}
126-
server["get"]('/xss', xss); // test: setup
127126

128-
function xss2(req, res, next) { // test: handler
127+
function xss2(req, res, next) { // test: candidateHandler
128+
next()
129+
}
130+
131+
function xss3(req, res, next) { // test: handler
132+
res.header("Content-Type", "text/html"); // test: headerDefinition
133+
res.send('hello ' + req.header("foo")); // test: source, stackTraceExposureSink, xssSink, !xss
134+
next();
135+
}
136+
137+
function xss4(req, res, next) { // test: handler
129138
var body = req.params.name; // test: source
130139
res.writeHead(200, {
131140
'Content-Length': Buffer.byteLength(body),
@@ -135,19 +144,16 @@ function xss2(req, res, next) { // test: handler
135144
res.end();
136145
next();
137146
}
147+
148+
server["get"]('/xss', xss); // test: setup
138149
["get", "head"].forEach(method => {
139150
server[method]('/xss2', xss2);
140151
});
141-
142-
function xss3(req, res, next) { // test: handler
143-
res.header("Content-Type", "text/html"); // test: headerDefinition
144-
res.send('hello ' + req.header("foo")); // test: source, stackTraceExposureSink, xssSink, !xss
145-
next();
146-
}
147152
server["get"]('/xss3', xss3); // test: setup
153+
server["get"]('/xss4', xss4); // test: setup
148154

149155

150-
function sendV2(req, res, next) { // test: candidateHandler
156+
server.get('/testv2', function(req, res, next) { // test: handler
151157
res.set({
152158
"Content-Type": "text/html",
153159
"access-control-allow-origin": "*", // test: corsMiconfigurationSink
@@ -162,7 +168,8 @@ function sendV2(req, res, next) { // test: candidateHandler
162168
clients.createJsonClient(req.params.uri); // test: source, ssrfSink
163169

164170
next();
165-
}
171+
})
172+
166173
server.get('/hello2/:name', restify.plugins.conditionalHandler([ // test: setup
167174
{ version: ['2.0.0', '2.1.0', '2.2.0'], handler: sendV2 }
168175
]));

‎javascript/ql/test/library-tests/frameworks/Restify2/tests.expected‎

Lines changed: 46 additions & 44 deletions
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
11
passingPositiveTests
2-
| PASSED | candidateHandler | src/index.js:150:35:150:59 | // test ... Handler |
3-
| PASSED | candidateHandler | src/index.js:173:42:173:66 | // test ... Handler |
4-
| PASSED | corsMiconfigurationSink | src/index.js:153:41:153:72 | // test ... ionSink |
2+
| PASSED | candidateHandler | src/index.js:127:33:127:57 | // test ... Handler |
3+
| PASSED | candidateHandler | src/index.js:180:42:180:66 | // test ... Handler |
4+
| PASSED | corsMiconfigurationSink | src/index.js:159:41:159:72 | // test ... ionSink |
55
| PASSED | handler | src/index.js:32:39:32:54 | // test: handler |
66
| PASSED | handler | src/index.js:41:39:41:54 | // test: handler |
77
| PASSED | handler | src/index.js:44:35:44:50 | // test: handler |
@@ -18,17 +18,18 @@ passingPositiveTests
1818
| PASSED | handler | src/index.js:111:31:111:46 | // test: handler |
1919
| PASSED | handler | src/index.js:115:30:115:45 | // test: handler |
2020
| PASSED | handler | src/index.js:121:32:121:47 | // test: handler |
21-
| PASSED | handler | src/index.js:128:33:128:48 | // test: handler |
22-
| PASSED | handler | src/index.js:142:33:142:48 | // test: handler |
23-
| PASSED | handler | src/index.js:183:65:183:87 | // test ... handler |
24-
| PASSED | handler | src/index.js:187:63:187:85 | // test ... handler |
25-
| PASSED | handler | src/index.js:190:55:190:77 | // test ... handler |
26-
| PASSED | handler | src/index.js:192:39:192:61 | // test ... handler |
27-
| PASSED | handler | src/index.js:194:49:194:71 | // test ... handler |
28-
| PASSED | handler | src/index.js:198:65:198:87 | // test ... handler |
21+
| PASSED | handler | src/index.js:131:33:131:48 | // test: handler |
22+
| PASSED | handler | src/index.js:137:33:137:48 | // test: handler |
23+
| PASSED | handler | src/index.js:156:50:156:65 | // test: handler |
24+
| PASSED | handler | src/index.js:190:65:190:87 | // test ... handler |
25+
| PASSED | handler | src/index.js:194:63:194:85 | // test ... handler |
26+
| PASSED | handler | src/index.js:197:55:197:77 | // test ... handler |
27+
| PASSED | handler | src/index.js:199:39:199:61 | // test ... handler |
28+
| PASSED | handler | src/index.js:201:49:201:71 | // test ... handler |
29+
| PASSED | handler | src/index.js:205:65:205:87 | // test ... handler |
2930
| PASSED | headerDefinition | src/index.js:104:46:104:70 | // test ... inition |
3031
| PASSED | headerDefinition | src/index.js:122:44:122:68 | // test ... inition |
31-
| PASSED | headerDefinition | src/index.js:143:44:143:68 | // test ... inition |
32+
| PASSED | headerDefinition | src/index.js:132:44:132:68 | // test ... inition |
3233
| PASSED | redirectSink | src/index.js:78:32:78:60 | // test ... ectSink |
3334
| PASSED | redirectSink | src/index.js:87:45:87:73 | // test ... ectSink |
3435
| PASSED | redirectSink | src/index.js:88:40:88:68 | // test ... ectSink |
@@ -40,16 +41,17 @@ passingPositiveTests
4041
| PASSED | setup | src/index.js:93:44:93:66 | // test ... handler |
4142
| PASSED | setup | src/index.js:98:20:98:33 | // test: setup |
4243
| PASSED | setup | src/index.js:110:21:110:34 | // test: setup |
43-
| PASSED | setup | src/index.js:126:29:126:42 | // test: setup |
44-
| PASSED | setup | src/index.js:147:31:147:44 | // test: setup |
45-
| PASSED | setup | src/index.js:166:66:166:79 | // test: setup |
46-
| PASSED | setup | src/index.js:170:66:170:78 | //test: setup |
47-
| PASSED | setup | src/index.js:183:65:183:87 | // test ... handler |
48-
| PASSED | setup | src/index.js:187:63:187:85 | // test ... handler |
49-
| PASSED | setup | src/index.js:190:55:190:77 | // test ... handler |
50-
| PASSED | setup | src/index.js:192:39:192:61 | // test ... handler |
51-
| PASSED | setup | src/index.js:194:49:194:71 | // test ... handler |
52-
| PASSED | setup | src/index.js:198:65:198:87 | // test ... handler |
44+
| PASSED | setup | src/index.js:148:29:148:42 | // test: setup |
45+
| PASSED | setup | src/index.js:152:31:152:44 | // test: setup |
46+
| PASSED | setup | src/index.js:153:31:153:44 | // test: setup |
47+
| PASSED | setup | src/index.js:173:66:173:79 | // test: setup |
48+
| PASSED | setup | src/index.js:177:66:177:78 | //test: setup |
49+
| PASSED | setup | src/index.js:190:65:190:87 | // test ... handler |
50+
| PASSED | setup | src/index.js:194:63:194:85 | // test ... handler |
51+
| PASSED | setup | src/index.js:197:55:197:77 | // test ... handler |
52+
| PASSED | setup | src/index.js:199:39:199:61 | // test ... handler |
53+
| PASSED | setup | src/index.js:201:49:201:71 | // test ... handler |
54+
| PASSED | setup | src/index.js:205:65:205:87 | // test ... handler |
5355
| PASSED | source | src/index.js:11:76:11:130 | // test ... k, !xss |
5456
| PASSED | source | src/index.js:24:76:24:128 | // test ... nk, xss |
5557
| PASSED | source | src/index.js:72:41:72:80 | // test ... reSink |
@@ -61,15 +63,15 @@ passingPositiveTests
6163
| PASSED | source | src/index.js:88:40:88:68 | // test ... ectSink |
6264
| PASSED | source | src/index.js:100:37:100:51 | // test: source |
6365
| PASSED | source | src/index.js:123:40:123:92 | // test ... nk, xss |
64-
| PASSED | source | src/index.js:129:31:129:45 | // test: source |
65-
| PASSED | source | src/index.js:144:43:144:96 | // test ... k, !xss |
66-
| PASSED | source | src/index.js:158:41:158:93 | // test ... nk, xss |
67-
| PASSED | source | src/index.js:160:26:160:50 | // test ... srfSink |
68-
| PASSED | source | src/index.js:162:45:162:69 | // test ... srfSink |
69-
| PASSED | source | src/index.js:196:28:196:58 | // test ... k, !xss |
70-
| PASSED | source | src/index.js:200:28:200:56 | // test ... nk, xss |
71-
| PASSED | ssrfSink | src/index.js:160:26:160:50 | // test ... srfSink |
72-
| PASSED | ssrfSink | src/index.js:162:45:162:69 | // test ... srfSink |
66+
| PASSED | source | src/index.js:133:43:133:96 | // test ... k, !xss |
67+
| PASSED | source | src/index.js:138:31:138:45 | // test: source |
68+
| PASSED | source | src/index.js:164:41:164:93 | // test ... nk, xss |
69+
| PASSED | source | src/index.js:166:26:166:50 | // test ... srfSink |
70+
| PASSED | source | src/index.js:168:45:168:69 | // test ... srfSink |
71+
| PASSED | source | src/index.js:203:28:203:58 | // test ... k, !xss |
72+
| PASSED | source | src/index.js:207:28:207:56 | // test ... nk, xss |
73+
| PASSED | ssrfSink | src/index.js:166:26:166:50 | // test ... srfSink |
74+
| PASSED | ssrfSink | src/index.js:168:45:168:69 | // test ... srfSink |
7375
| PASSED | stackTraceExposureSink | src/index.js:9:66:9:96 | // test ... ureSink |
7476
| PASSED | stackTraceExposureSink | src/index.js:11:76:11:130 | // test ... k, !xss |
7577
| PASSED | stackTraceExposureSink | src/index.js:22:66:22:105 | // test ... xssSink |
@@ -81,28 +83,28 @@ passingPositiveTests
8183
| PASSED | stackTraceExposureSink | src/index.js:105:29:105:73 | // test ... nk, xss |
8284
| PASSED | stackTraceExposureSink | src/index.js:116:29:116:59 | // test ... ureSink |
8385
| PASSED | stackTraceExposureSink | src/index.js:123:40:123:92 | // test ... nk, xss |
84-
| PASSED | stackTraceExposureSink | src/index.js:134:20:134:64 | // test ... nk, xss |
85-
| PASSED | stackTraceExposureSink | src/index.js:144:43:144:96 | // test ... k, !xss |
86-
| PASSED | stackTraceExposureSink | src/index.js:158:41:158:93 | // test ... nk, xss |
86+
| PASSED | stackTraceExposureSink | src/index.js:133:43:133:96 | // test ... k, !xss |
87+
| PASSED | stackTraceExposureSink | src/index.js:143:20:143:64 | // test ... nk, xss |
88+
| PASSED | stackTraceExposureSink | src/index.js:164:41:164:93 | // test ... nk, xss |
8789
| PASSED | xss | src/index.js:24:76:24:128 | // test ... nk, xss |
8890
| PASSED | xss | src/index.js:105:29:105:73 | // test ... nk, xss |
8991
| PASSED | xss | src/index.js:123:40:123:92 | // test ... nk, xss |
90-
| PASSED | xss | src/index.js:134:20:134:64 | // test ... nk, xss |
91-
| PASSED | xss | src/index.js:158:41:158:93 | // test ... nk, xss |
92-
| PASSED | xss | src/index.js:200:28:200:56 | // test ... nk, xss |
92+
| PASSED | xss | src/index.js:143:20:143:64 | // test ... nk, xss |
93+
| PASSED | xss | src/index.js:164:41:164:93 | // test ... nk, xss |
94+
| PASSED | xss | src/index.js:207:28:207:56 | // test ... nk, xss |
9395
| PASSED | xssSink | src/index.js:22:66:22:105 | // test ... xssSink |
9496
| PASSED | xssSink | src/index.js:24:76:24:128 | // test ... nk, xss |
9597
| PASSED | xssSink | src/index.js:105:29:105:73 | // test ... nk, xss |
9698
| PASSED | xssSink | src/index.js:123:40:123:92 | // test ... nk, xss |
97-
| PASSED | xssSink | src/index.js:134:20:134:64 | // test ... nk, xss |
98-
| PASSED | xssSink | src/index.js:144:43:144:96 | // test ... k, !xss |
99-
| PASSED | xssSink | src/index.js:158:41:158:93 | // test ... nk, xss |
100-
| PASSED | xssSink | src/index.js:200:28:200:56 | // test ... nk, xss |
99+
| PASSED | xssSink | src/index.js:133:43:133:96 | // test ... k, !xss |
100+
| PASSED | xssSink | src/index.js:143:20:143:64 | // test ... nk, xss |
101+
| PASSED | xssSink | src/index.js:164:41:164:93 | // test ... nk, xss |
102+
| PASSED | xssSink | src/index.js:207:28:207:56 | // test ... nk, xss |
101103
failingPositiveTests
102104
passingNegativeTests
103105
| PASSED | !xss | src/index.js:11:76:11:130 | // test ... k, !xss |
104-
| PASSED | !xss | src/index.js:144:43:144:96 | // test ... k, !xss |
105-
| PASSED | !xss | src/index.js:196:28:196:58 | // test ... k, !xss |
106+
| PASSED | !xss | src/index.js:133:43:133:96 | // test ... k, !xss |
107+
| PASSED | !xss | src/index.js:203:28:203:58 | // test ... k, !xss |
106108
| PASSED | !xssSink | src/index.js:11:76:11:130 | // test ... k, !xss |
107-
| PASSED | !xssSink | src/index.js:196:28:196:58 | // test ... k, !xss |
109+
| PASSED | !xssSink | src/index.js:203:28:203:58 | // test ... k, !xss |
108110
failingNegativeTests

‎javascript/ql/test/library-tests/frameworks/Restify2/tests.ql‎

Lines changed: 0 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -6,7 +6,6 @@ import semmle.javascript.security.dataflow.ServerSideUrlRedirectCustomizations
66
import semmle.javascript.security.dataflow.RequestForgeryCustomizations
77
import semmle.javascript.security.dataflow.ReflectedXssCustomizations
88
import semmle.javascript.security.dataflow.ReflectedXssQuery as XssConfig
9-
import semmle.javascript.heuristics.AdditionalRouteHandlers
109

1110
class InlineTest extends LineComment {
1211
string tests;

0 commit comments

Comments
 (0)