Skip to content

Commit eca98b4

Browse files
erik-krogherik-krogh
committed
basic support for util.promisify for NodeJSFileSystemAccess
1 parent ea0f6a3 commit eca98b4

File tree

3 files changed

+208
-1
lines changed

3 files changed

+208
-1
lines changed

‎javascript/ql/src/semmle/javascript/frameworks/NodeJSLib.qll

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -459,7 +459,7 @@ module NodeJSLib {
459459
private class NodeJSFileSystemAccess extends FileSystemAccess, DataFlow::CallNode {
460460
string methodName;
461461

462-
NodeJSFileSystemAccess() { this = fsModuleMember(methodName).getACall() }
462+
NodeJSFileSystemAccess() { this = maybePromisified(fsModuleMember(methodName)).getACall() }
463463

464464
/**
465465
* Gets the name of the called method.

‎javascript/ql/test/query-tests/Security/CWE-022/TaintedPath/TaintedPath.expected

Lines changed: 199 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -2082,6 +2082,92 @@ nodes
20822082
| other-fs-libraries.js:24:35:24:38 | path |
20832083
| other-fs-libraries.js:24:35:24:38 | path |
20842084
| other-fs-libraries.js:24:35:24:38 | path |
2085+
| other-fs-libraries.js:38:7:38:48 | path |
2086+
| other-fs-libraries.js:38:7:38:48 | path |
2087+
| other-fs-libraries.js:38:7:38:48 | path |
2088+
| other-fs-libraries.js:38:7:38:48 | path |
2089+
| other-fs-libraries.js:38:7:38:48 | path |
2090+
| other-fs-libraries.js:38:7:38:48 | path |
2091+
| other-fs-libraries.js:38:7:38:48 | path |
2092+
| other-fs-libraries.js:38:7:38:48 | path |
2093+
| other-fs-libraries.js:38:7:38:48 | path |
2094+
| other-fs-libraries.js:38:7:38:48 | path |
2095+
| other-fs-libraries.js:38:7:38:48 | path |
2096+
| other-fs-libraries.js:38:7:38:48 | path |
2097+
| other-fs-libraries.js:38:7:38:48 | path |
2098+
| other-fs-libraries.js:38:7:38:48 | path |
2099+
| other-fs-libraries.js:38:7:38:48 | path |
2100+
| other-fs-libraries.js:38:7:38:48 | path |
2101+
| other-fs-libraries.js:38:14:38:37 | url.par ... , true) |
2102+
| other-fs-libraries.js:38:14:38:37 | url.par ... , true) |
2103+
| other-fs-libraries.js:38:14:38:37 | url.par ... , true) |
2104+
| other-fs-libraries.js:38:14:38:37 | url.par ... , true) |
2105+
| other-fs-libraries.js:38:14:38:37 | url.par ... , true) |
2106+
| other-fs-libraries.js:38:14:38:37 | url.par ... , true) |
2107+
| other-fs-libraries.js:38:14:38:37 | url.par ... , true) |
2108+
| other-fs-libraries.js:38:14:38:37 | url.par ... , true) |
2109+
| other-fs-libraries.js:38:14:38:37 | url.par ... , true) |
2110+
| other-fs-libraries.js:38:14:38:37 | url.par ... , true) |
2111+
| other-fs-libraries.js:38:14:38:37 | url.par ... , true) |
2112+
| other-fs-libraries.js:38:14:38:37 | url.par ... , true) |
2113+
| other-fs-libraries.js:38:14:38:37 | url.par ... , true) |
2114+
| other-fs-libraries.js:38:14:38:37 | url.par ... , true) |
2115+
| other-fs-libraries.js:38:14:38:37 | url.par ... , true) |
2116+
| other-fs-libraries.js:38:14:38:37 | url.par ... , true) |
2117+
| other-fs-libraries.js:38:14:38:43 | url.par ... ).query |
2118+
| other-fs-libraries.js:38:14:38:43 | url.par ... ).query |
2119+
| other-fs-libraries.js:38:14:38:43 | url.par ... ).query |
2120+
| other-fs-libraries.js:38:14:38:43 | url.par ... ).query |
2121+
| other-fs-libraries.js:38:14:38:43 | url.par ... ).query |
2122+
| other-fs-libraries.js:38:14:38:43 | url.par ... ).query |
2123+
| other-fs-libraries.js:38:14:38:43 | url.par ... ).query |
2124+
| other-fs-libraries.js:38:14:38:43 | url.par ... ).query |
2125+
| other-fs-libraries.js:38:14:38:43 | url.par ... ).query |
2126+
| other-fs-libraries.js:38:14:38:43 | url.par ... ).query |
2127+
| other-fs-libraries.js:38:14:38:43 | url.par ... ).query |
2128+
| other-fs-libraries.js:38:14:38:43 | url.par ... ).query |
2129+
| other-fs-libraries.js:38:14:38:43 | url.par ... ).query |
2130+
| other-fs-libraries.js:38:14:38:43 | url.par ... ).query |
2131+
| other-fs-libraries.js:38:14:38:43 | url.par ... ).query |
2132+
| other-fs-libraries.js:38:14:38:43 | url.par ... ).query |
2133+
| other-fs-libraries.js:38:14:38:48 | url.par ... ry.path |
2134+
| other-fs-libraries.js:38:14:38:48 | url.par ... ry.path |
2135+
| other-fs-libraries.js:38:14:38:48 | url.par ... ry.path |
2136+
| other-fs-libraries.js:38:14:38:48 | url.par ... ry.path |
2137+
| other-fs-libraries.js:38:14:38:48 | url.par ... ry.path |
2138+
| other-fs-libraries.js:38:14:38:48 | url.par ... ry.path |
2139+
| other-fs-libraries.js:38:14:38:48 | url.par ... ry.path |
2140+
| other-fs-libraries.js:38:14:38:48 | url.par ... ry.path |
2141+
| other-fs-libraries.js:38:14:38:48 | url.par ... ry.path |
2142+
| other-fs-libraries.js:38:14:38:48 | url.par ... ry.path |
2143+
| other-fs-libraries.js:38:14:38:48 | url.par ... ry.path |
2144+
| other-fs-libraries.js:38:14:38:48 | url.par ... ry.path |
2145+
| other-fs-libraries.js:38:14:38:48 | url.par ... ry.path |
2146+
| other-fs-libraries.js:38:14:38:48 | url.par ... ry.path |
2147+
| other-fs-libraries.js:38:14:38:48 | url.par ... ry.path |
2148+
| other-fs-libraries.js:38:14:38:48 | url.par ... ry.path |
2149+
| other-fs-libraries.js:38:24:38:30 | req.url |
2150+
| other-fs-libraries.js:38:24:38:30 | req.url |
2151+
| other-fs-libraries.js:38:24:38:30 | req.url |
2152+
| other-fs-libraries.js:38:24:38:30 | req.url |
2153+
| other-fs-libraries.js:38:24:38:30 | req.url |
2154+
| other-fs-libraries.js:40:35:40:38 | path |
2155+
| other-fs-libraries.js:40:35:40:38 | path |
2156+
| other-fs-libraries.js:40:35:40:38 | path |
2157+
| other-fs-libraries.js:40:35:40:38 | path |
2158+
| other-fs-libraries.js:40:35:40:38 | path |
2159+
| other-fs-libraries.js:40:35:40:38 | path |
2160+
| other-fs-libraries.js:40:35:40:38 | path |
2161+
| other-fs-libraries.js:40:35:40:38 | path |
2162+
| other-fs-libraries.js:40:35:40:38 | path |
2163+
| other-fs-libraries.js:40:35:40:38 | path |
2164+
| other-fs-libraries.js:40:35:40:38 | path |
2165+
| other-fs-libraries.js:40:35:40:38 | path |
2166+
| other-fs-libraries.js:40:35:40:38 | path |
2167+
| other-fs-libraries.js:40:35:40:38 | path |
2168+
| other-fs-libraries.js:40:35:40:38 | path |
2169+
| other-fs-libraries.js:40:35:40:38 | path |
2170+
| other-fs-libraries.js:40:35:40:38 | path |
20852171
| tainted-require.js:7:19:7:37 | req.param("module") |
20862172
| tainted-require.js:7:19:7:37 | req.param("module") |
20872173
| tainted-require.js:7:19:7:37 | req.param("module") |
@@ -5673,6 +5759,118 @@ edges
56735759
| other-fs-libraries.js:9:24:9:30 | req.url | other-fs-libraries.js:9:14:9:37 | url.par ... , true) |
56745760
| other-fs-libraries.js:9:24:9:30 | req.url | other-fs-libraries.js:9:14:9:37 | url.par ... , true) |
56755761
| other-fs-libraries.js:9:24:9:30 | req.url | other-fs-libraries.js:9:14:9:37 | url.par ... , true) |
5762+
| other-fs-libraries.js:38:7:38:48 | path | other-fs-libraries.js:40:35:40:38 | path |
5763+
| other-fs-libraries.js:38:7:38:48 | path | other-fs-libraries.js:40:35:40:38 | path |
5764+
| other-fs-libraries.js:38:7:38:48 | path | other-fs-libraries.js:40:35:40:38 | path |
5765+
| other-fs-libraries.js:38:7:38:48 | path | other-fs-libraries.js:40:35:40:38 | path |
5766+
| other-fs-libraries.js:38:7:38:48 | path | other-fs-libraries.js:40:35:40:38 | path |
5767+
| other-fs-libraries.js:38:7:38:48 | path | other-fs-libraries.js:40:35:40:38 | path |
5768+
| other-fs-libraries.js:38:7:38:48 | path | other-fs-libraries.js:40:35:40:38 | path |
5769+
| other-fs-libraries.js:38:7:38:48 | path | other-fs-libraries.js:40:35:40:38 | path |
5770+
| other-fs-libraries.js:38:7:38:48 | path | other-fs-libraries.js:40:35:40:38 | path |
5771+
| other-fs-libraries.js:38:7:38:48 | path | other-fs-libraries.js:40:35:40:38 | path |
5772+
| other-fs-libraries.js:38:7:38:48 | path | other-fs-libraries.js:40:35:40:38 | path |
5773+
| other-fs-libraries.js:38:7:38:48 | path | other-fs-libraries.js:40:35:40:38 | path |
5774+
| other-fs-libraries.js:38:7:38:48 | path | other-fs-libraries.js:40:35:40:38 | path |
5775+
| other-fs-libraries.js:38:7:38:48 | path | other-fs-libraries.js:40:35:40:38 | path |
5776+
| other-fs-libraries.js:38:7:38:48 | path | other-fs-libraries.js:40:35:40:38 | path |
5777+
| other-fs-libraries.js:38:7:38:48 | path | other-fs-libraries.js:40:35:40:38 | path |
5778+
| other-fs-libraries.js:38:7:38:48 | path | other-fs-libraries.js:40:35:40:38 | path |
5779+
| other-fs-libraries.js:38:7:38:48 | path | other-fs-libraries.js:40:35:40:38 | path |
5780+
| other-fs-libraries.js:38:7:38:48 | path | other-fs-libraries.js:40:35:40:38 | path |
5781+
| other-fs-libraries.js:38:7:38:48 | path | other-fs-libraries.js:40:35:40:38 | path |
5782+
| other-fs-libraries.js:38:7:38:48 | path | other-fs-libraries.js:40:35:40:38 | path |
5783+
| other-fs-libraries.js:38:7:38:48 | path | other-fs-libraries.js:40:35:40:38 | path |
5784+
| other-fs-libraries.js:38:7:38:48 | path | other-fs-libraries.js:40:35:40:38 | path |
5785+
| other-fs-libraries.js:38:7:38:48 | path | other-fs-libraries.js:40:35:40:38 | path |
5786+
| other-fs-libraries.js:38:7:38:48 | path | other-fs-libraries.js:40:35:40:38 | path |
5787+
| other-fs-libraries.js:38:7:38:48 | path | other-fs-libraries.js:40:35:40:38 | path |
5788+
| other-fs-libraries.js:38:7:38:48 | path | other-fs-libraries.js:40:35:40:38 | path |
5789+
| other-fs-libraries.js:38:7:38:48 | path | other-fs-libraries.js:40:35:40:38 | path |
5790+
| other-fs-libraries.js:38:7:38:48 | path | other-fs-libraries.js:40:35:40:38 | path |
5791+
| other-fs-libraries.js:38:7:38:48 | path | other-fs-libraries.js:40:35:40:38 | path |
5792+
| other-fs-libraries.js:38:7:38:48 | path | other-fs-libraries.js:40:35:40:38 | path |
5793+
| other-fs-libraries.js:38:7:38:48 | path | other-fs-libraries.js:40:35:40:38 | path |
5794+
| other-fs-libraries.js:38:14:38:37 | url.par ... , true) | other-fs-libraries.js:38:14:38:43 | url.par ... ).query |
5795+
| other-fs-libraries.js:38:14:38:37 | url.par ... , true) | other-fs-libraries.js:38:14:38:43 | url.par ... ).query |
5796+
| other-fs-libraries.js:38:14:38:37 | url.par ... , true) | other-fs-libraries.js:38:14:38:43 | url.par ... ).query |
5797+
| other-fs-libraries.js:38:14:38:37 | url.par ... , true) | other-fs-libraries.js:38:14:38:43 | url.par ... ).query |
5798+
| other-fs-libraries.js:38:14:38:37 | url.par ... , true) | other-fs-libraries.js:38:14:38:43 | url.par ... ).query |
5799+
| other-fs-libraries.js:38:14:38:37 | url.par ... , true) | other-fs-libraries.js:38:14:38:43 | url.par ... ).query |
5800+
| other-fs-libraries.js:38:14:38:37 | url.par ... , true) | other-fs-libraries.js:38:14:38:43 | url.par ... ).query |
5801+
| other-fs-libraries.js:38:14:38:37 | url.par ... , true) | other-fs-libraries.js:38:14:38:43 | url.par ... ).query |
5802+
| other-fs-libraries.js:38:14:38:37 | url.par ... , true) | other-fs-libraries.js:38:14:38:43 | url.par ... ).query |
5803+
| other-fs-libraries.js:38:14:38:37 | url.par ... , true) | other-fs-libraries.js:38:14:38:43 | url.par ... ).query |
5804+
| other-fs-libraries.js:38:14:38:37 | url.par ... , true) | other-fs-libraries.js:38:14:38:43 | url.par ... ).query |
5805+
| other-fs-libraries.js:38:14:38:37 | url.par ... , true) | other-fs-libraries.js:38:14:38:43 | url.par ... ).query |
5806+
| other-fs-libraries.js:38:14:38:37 | url.par ... , true) | other-fs-libraries.js:38:14:38:43 | url.par ... ).query |
5807+
| other-fs-libraries.js:38:14:38:37 | url.par ... , true) | other-fs-libraries.js:38:14:38:43 | url.par ... ).query |
5808+
| other-fs-libraries.js:38:14:38:37 | url.par ... , true) | other-fs-libraries.js:38:14:38:43 | url.par ... ).query |
5809+
| other-fs-libraries.js:38:14:38:37 | url.par ... , true) | other-fs-libraries.js:38:14:38:43 | url.par ... ).query |
5810+
| other-fs-libraries.js:38:14:38:43 | url.par ... ).query | other-fs-libraries.js:38:14:38:48 | url.par ... ry.path |
5811+
| other-fs-libraries.js:38:14:38:43 | url.par ... ).query | other-fs-libraries.js:38:14:38:48 | url.par ... ry.path |
5812+
| other-fs-libraries.js:38:14:38:43 | url.par ... ).query | other-fs-libraries.js:38:14:38:48 | url.par ... ry.path |
5813+
| other-fs-libraries.js:38:14:38:43 | url.par ... ).query | other-fs-libraries.js:38:14:38:48 | url.par ... ry.path |
5814+
| other-fs-libraries.js:38:14:38:43 | url.par ... ).query | other-fs-libraries.js:38:14:38:48 | url.par ... ry.path |
5815+
| other-fs-libraries.js:38:14:38:43 | url.par ... ).query | other-fs-libraries.js:38:14:38:48 | url.par ... ry.path |
5816+
| other-fs-libraries.js:38:14:38:43 | url.par ... ).query | other-fs-libraries.js:38:14:38:48 | url.par ... ry.path |
5817+
| other-fs-libraries.js:38:14:38:43 | url.par ... ).query | other-fs-libraries.js:38:14:38:48 | url.par ... ry.path |
5818+
| other-fs-libraries.js:38:14:38:43 | url.par ... ).query | other-fs-libraries.js:38:14:38:48 | url.par ... ry.path |
5819+
| other-fs-libraries.js:38:14:38:43 | url.par ... ).query | other-fs-libraries.js:38:14:38:48 | url.par ... ry.path |
5820+
| other-fs-libraries.js:38:14:38:43 | url.par ... ).query | other-fs-libraries.js:38:14:38:48 | url.par ... ry.path |
5821+
| other-fs-libraries.js:38:14:38:43 | url.par ... ).query | other-fs-libraries.js:38:14:38:48 | url.par ... ry.path |
5822+
| other-fs-libraries.js:38:14:38:43 | url.par ... ).query | other-fs-libraries.js:38:14:38:48 | url.par ... ry.path |
5823+
| other-fs-libraries.js:38:14:38:43 | url.par ... ).query | other-fs-libraries.js:38:14:38:48 | url.par ... ry.path |
5824+
| other-fs-libraries.js:38:14:38:43 | url.par ... ).query | other-fs-libraries.js:38:14:38:48 | url.par ... ry.path |
5825+
| other-fs-libraries.js:38:14:38:43 | url.par ... ).query | other-fs-libraries.js:38:14:38:48 | url.par ... ry.path |
5826+
| other-fs-libraries.js:38:14:38:48 | url.par ... ry.path | other-fs-libraries.js:38:7:38:48 | path |
5827+
| other-fs-libraries.js:38:14:38:48 | url.par ... ry.path | other-fs-libraries.js:38:7:38:48 | path |
5828+
| other-fs-libraries.js:38:14:38:48 | url.par ... ry.path | other-fs-libraries.js:38:7:38:48 | path |
5829+
| other-fs-libraries.js:38:14:38:48 | url.par ... ry.path | other-fs-libraries.js:38:7:38:48 | path |
5830+
| other-fs-libraries.js:38:14:38:48 | url.par ... ry.path | other-fs-libraries.js:38:7:38:48 | path |
5831+
| other-fs-libraries.js:38:14:38:48 | url.par ... ry.path | other-fs-libraries.js:38:7:38:48 | path |
5832+
| other-fs-libraries.js:38:14:38:48 | url.par ... ry.path | other-fs-libraries.js:38:7:38:48 | path |
5833+
| other-fs-libraries.js:38:14:38:48 | url.par ... ry.path | other-fs-libraries.js:38:7:38:48 | path |
5834+
| other-fs-libraries.js:38:14:38:48 | url.par ... ry.path | other-fs-libraries.js:38:7:38:48 | path |
5835+
| other-fs-libraries.js:38:14:38:48 | url.par ... ry.path | other-fs-libraries.js:38:7:38:48 | path |
5836+
| other-fs-libraries.js:38:14:38:48 | url.par ... ry.path | other-fs-libraries.js:38:7:38:48 | path |
5837+
| other-fs-libraries.js:38:14:38:48 | url.par ... ry.path | other-fs-libraries.js:38:7:38:48 | path |
5838+
| other-fs-libraries.js:38:14:38:48 | url.par ... ry.path | other-fs-libraries.js:38:7:38:48 | path |
5839+
| other-fs-libraries.js:38:14:38:48 | url.par ... ry.path | other-fs-libraries.js:38:7:38:48 | path |
5840+
| other-fs-libraries.js:38:14:38:48 | url.par ... ry.path | other-fs-libraries.js:38:7:38:48 | path |
5841+
| other-fs-libraries.js:38:14:38:48 | url.par ... ry.path | other-fs-libraries.js:38:7:38:48 | path |
5842+
| other-fs-libraries.js:38:24:38:30 | req.url | other-fs-libraries.js:38:14:38:37 | url.par ... , true) |
5843+
| other-fs-libraries.js:38:24:38:30 | req.url | other-fs-libraries.js:38:14:38:37 | url.par ... , true) |
5844+
| other-fs-libraries.js:38:24:38:30 | req.url | other-fs-libraries.js:38:14:38:37 | url.par ... , true) |
5845+
| other-fs-libraries.js:38:24:38:30 | req.url | other-fs-libraries.js:38:14:38:37 | url.par ... , true) |
5846+
| other-fs-libraries.js:38:24:38:30 | req.url | other-fs-libraries.js:38:14:38:37 | url.par ... , true) |
5847+
| other-fs-libraries.js:38:24:38:30 | req.url | other-fs-libraries.js:38:14:38:37 | url.par ... , true) |
5848+
| other-fs-libraries.js:38:24:38:30 | req.url | other-fs-libraries.js:38:14:38:37 | url.par ... , true) |
5849+
| other-fs-libraries.js:38:24:38:30 | req.url | other-fs-libraries.js:38:14:38:37 | url.par ... , true) |
5850+
| other-fs-libraries.js:38:24:38:30 | req.url | other-fs-libraries.js:38:14:38:37 | url.par ... , true) |
5851+
| other-fs-libraries.js:38:24:38:30 | req.url | other-fs-libraries.js:38:14:38:37 | url.par ... , true) |
5852+
| other-fs-libraries.js:38:24:38:30 | req.url | other-fs-libraries.js:38:14:38:37 | url.par ... , true) |
5853+
| other-fs-libraries.js:38:24:38:30 | req.url | other-fs-libraries.js:38:14:38:37 | url.par ... , true) |
5854+
| other-fs-libraries.js:38:24:38:30 | req.url | other-fs-libraries.js:38:14:38:37 | url.par ... , true) |
5855+
| other-fs-libraries.js:38:24:38:30 | req.url | other-fs-libraries.js:38:14:38:37 | url.par ... , true) |
5856+
| other-fs-libraries.js:38:24:38:30 | req.url | other-fs-libraries.js:38:14:38:37 | url.par ... , true) |
5857+
| other-fs-libraries.js:38:24:38:30 | req.url | other-fs-libraries.js:38:14:38:37 | url.par ... , true) |
5858+
| other-fs-libraries.js:38:24:38:30 | req.url | other-fs-libraries.js:38:14:38:37 | url.par ... , true) |
5859+
| other-fs-libraries.js:38:24:38:30 | req.url | other-fs-libraries.js:38:14:38:37 | url.par ... , true) |
5860+
| other-fs-libraries.js:38:24:38:30 | req.url | other-fs-libraries.js:38:14:38:37 | url.par ... , true) |
5861+
| other-fs-libraries.js:38:24:38:30 | req.url | other-fs-libraries.js:38:14:38:37 | url.par ... , true) |
5862+
| other-fs-libraries.js:38:24:38:30 | req.url | other-fs-libraries.js:38:14:38:37 | url.par ... , true) |
5863+
| other-fs-libraries.js:38:24:38:30 | req.url | other-fs-libraries.js:38:14:38:37 | url.par ... , true) |
5864+
| other-fs-libraries.js:38:24:38:30 | req.url | other-fs-libraries.js:38:14:38:37 | url.par ... , true) |
5865+
| other-fs-libraries.js:38:24:38:30 | req.url | other-fs-libraries.js:38:14:38:37 | url.par ... , true) |
5866+
| other-fs-libraries.js:38:24:38:30 | req.url | other-fs-libraries.js:38:14:38:37 | url.par ... , true) |
5867+
| other-fs-libraries.js:38:24:38:30 | req.url | other-fs-libraries.js:38:14:38:37 | url.par ... , true) |
5868+
| other-fs-libraries.js:38:24:38:30 | req.url | other-fs-libraries.js:38:14:38:37 | url.par ... , true) |
5869+
| other-fs-libraries.js:38:24:38:30 | req.url | other-fs-libraries.js:38:14:38:37 | url.par ... , true) |
5870+
| other-fs-libraries.js:38:24:38:30 | req.url | other-fs-libraries.js:38:14:38:37 | url.par ... , true) |
5871+
| other-fs-libraries.js:38:24:38:30 | req.url | other-fs-libraries.js:38:14:38:37 | url.par ... , true) |
5872+
| other-fs-libraries.js:38:24:38:30 | req.url | other-fs-libraries.js:38:14:38:37 | url.par ... , true) |
5873+
| other-fs-libraries.js:38:24:38:30 | req.url | other-fs-libraries.js:38:14:38:37 | url.par ... , true) |
56765874
| tainted-require.js:7:19:7:37 | req.param("module") | tainted-require.js:7:19:7:37 | req.param("module") |
56775875
| tainted-sendFile.js:8:16:8:33 | req.param("gimme") | tainted-sendFile.js:8:16:8:33 | req.param("gimme") |
56785876
| tainted-sendFile.js:10:16:10:33 | req.param("gimme") | tainted-sendFile.js:10:16:10:33 | req.param("gimme") |
@@ -6572,6 +6770,7 @@ edges
65726770
| other-fs-libraries.js:17:35:17:38 | path | other-fs-libraries.js:9:24:9:30 | req.url | other-fs-libraries.js:17:35:17:38 | path | This path depends on $@. | other-fs-libraries.js:9:24:9:30 | req.url | a user-provided value |
65736771
| other-fs-libraries.js:19:56:19:59 | path | other-fs-libraries.js:9:24:9:30 | req.url | other-fs-libraries.js:19:56:19:59 | path | This path depends on $@. | other-fs-libraries.js:9:24:9:30 | req.url | a user-provided value |
65746772
| other-fs-libraries.js:24:35:24:38 | path | other-fs-libraries.js:9:24:9:30 | req.url | other-fs-libraries.js:24:35:24:38 | path | This path depends on $@. | other-fs-libraries.js:9:24:9:30 | req.url | a user-provided value |
6773+
| other-fs-libraries.js:40:35:40:38 | path | other-fs-libraries.js:38:24:38:30 | req.url | other-fs-libraries.js:40:35:40:38 | path | This path depends on $@. | other-fs-libraries.js:38:24:38:30 | req.url | a user-provided value |
65756774
| tainted-require.js:7:19:7:37 | req.param("module") | tainted-require.js:7:19:7:37 | req.param("module") | tainted-require.js:7:19:7:37 | req.param("module") | This path depends on $@. | tainted-require.js:7:19:7:37 | req.param("module") | a user-provided value |
65766775
| tainted-sendFile.js:8:16:8:33 | req.param("gimme") | tainted-sendFile.js:8:16:8:33 | req.param("gimme") | tainted-sendFile.js:8:16:8:33 | req.param("gimme") | This path depends on $@. | tainted-sendFile.js:8:16:8:33 | req.param("gimme") | a user-provided value |
65776776
| tainted-sendFile.js:10:16:10:33 | req.param("gimme") | tainted-sendFile.js:10:16:10:33 | req.param("gimme") | tainted-sendFile.js:10:16:10:33 | req.param("gimme") | This path depends on $@. | tainted-sendFile.js:10:16:10:33 | req.param("gimme") | a user-provided value |

‎javascript/ql/test/query-tests/Security/CWE-022/TaintedPath/other-fs-libraries.js

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -31,3 +31,11 @@ function getFsModule(special) {
3131
return require("original-fs");
3232
}
3333
}
34+
35+
var util = require("util");
36+
37+
http.createServer(function(req, res) {
38+
var path = url.parse(req.url, true).query.path;
39+
40+
util.promisify(fs.readFileSync)(path); // NOT OK
41+
});

0 commit comments

Comments
 (0)