Skip to content

Commit d28a6e6

Browse files
NapalysNapalys
committed
Added new test cases for regexp injection with enviromental variable threat model enabled
1 parent 8583257 commit d28a6e6

File tree

4 files changed

+64
-0
lines changed

4 files changed

+64
-0
lines changed

‎javascript/ql/test/query-tests/Security/CWE-730/Threat-models-enabled/RegExpInjection.expected

Lines changed: 34 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,34 @@
1+
#select
2+
| RegExpInjection.js:6:14:6:48 | `^${pro ... r.app$` | RegExpInjection.js:6:18:6:28 | process.env | RegExpInjection.js:6:14:6:48 | `^${pro ... r.app$` | This regular expression is constructed from a $@. | RegExpInjection.js:6:18:6:28 | process.env | environment variable |
3+
| RegExpInjection.js:8:14:8:40 | `^${pro ... }/bin$` | RegExpInjection.js:8:18:8:28 | process.env | RegExpInjection.js:8:14:8:40 | `^${pro ... }/bin$` | This regular expression is constructed from a $@. | RegExpInjection.js:8:18:8:28 | process.env | environment variable |
4+
| RegExpInjection.js:11:14:11:19 | envVar | RegExpInjection.js:10:16:10:26 | process.env | RegExpInjection.js:11:14:11:19 | envVar | This regular expression is constructed from a $@. | RegExpInjection.js:10:16:10:26 | process.env | environment variable |
5+
| RegExpInjection.js:14:14:14:47 | `^${pro ... r.app$` | RegExpInjection.js:14:18:14:29 | process.argv | RegExpInjection.js:14:14:14:47 | `^${pro ... r.app$` | This regular expression is constructed from a $@. | RegExpInjection.js:14:18:14:29 | process.argv | command-line argument |
6+
| RegExpInjection.js:17:14:17:17 | argv | RegExpInjection.js:16:14:16:25 | process.argv | RegExpInjection.js:17:14:17:17 | argv | This regular expression is constructed from a $@. | RegExpInjection.js:16:14:16:25 | process.argv | command-line argument |
7+
| RegExpInjection.js:21:14:21:22 | userInput | RegExpInjection.js:20:19:20:36 | req.param("input") | RegExpInjection.js:21:14:21:22 | userInput | This regular expression is constructed from a $@. | RegExpInjection.js:20:19:20:36 | req.param("input") | user-provided value |
8+
edges
9+
| RegExpInjection.js:6:18:6:28 | process.env | RegExpInjection.js:6:14:6:48 | `^${pro ... r.app$` | provenance | |
10+
| RegExpInjection.js:8:18:8:28 | process.env | RegExpInjection.js:8:14:8:40 | `^${pro ... }/bin$` | provenance | |
11+
| RegExpInjection.js:10:7:10:35 | envVar | RegExpInjection.js:11:14:11:19 | envVar | provenance | |
12+
| RegExpInjection.js:10:16:10:26 | process.env | RegExpInjection.js:10:7:10:35 | envVar | provenance | |
13+
| RegExpInjection.js:14:18:14:29 | process.argv | RegExpInjection.js:14:14:14:47 | `^${pro ... r.app$` | provenance | |
14+
| RegExpInjection.js:16:7:16:28 | argv | RegExpInjection.js:17:14:17:17 | argv | provenance | |
15+
| RegExpInjection.js:16:14:16:25 | process.argv | RegExpInjection.js:16:7:16:28 | argv | provenance | |
16+
| RegExpInjection.js:20:7:20:36 | userInput | RegExpInjection.js:21:14:21:22 | userInput | provenance | |
17+
| RegExpInjection.js:20:19:20:36 | req.param("input") | RegExpInjection.js:20:7:20:36 | userInput | provenance | |
18+
nodes
19+
| RegExpInjection.js:6:14:6:48 | `^${pro ... r.app$` | semmle.label | `^${pro ... r.app$` |
20+
| RegExpInjection.js:6:18:6:28 | process.env | semmle.label | process.env |
21+
| RegExpInjection.js:8:14:8:40 | `^${pro ... }/bin$` | semmle.label | `^${pro ... }/bin$` |
22+
| RegExpInjection.js:8:18:8:28 | process.env | semmle.label | process.env |
23+
| RegExpInjection.js:10:7:10:35 | envVar | semmle.label | envVar |
24+
| RegExpInjection.js:10:16:10:26 | process.env | semmle.label | process.env |
25+
| RegExpInjection.js:11:14:11:19 | envVar | semmle.label | envVar |
26+
| RegExpInjection.js:14:14:14:47 | `^${pro ... r.app$` | semmle.label | `^${pro ... r.app$` |
27+
| RegExpInjection.js:14:18:14:29 | process.argv | semmle.label | process.argv |
28+
| RegExpInjection.js:16:7:16:28 | argv | semmle.label | argv |
29+
| RegExpInjection.js:16:14:16:25 | process.argv | semmle.label | process.argv |
30+
| RegExpInjection.js:17:14:17:17 | argv | semmle.label | argv |
31+
| RegExpInjection.js:20:7:20:36 | userInput | semmle.label | userInput |
32+
| RegExpInjection.js:20:19:20:36 | req.param("input") | semmle.label | req.param("input") |
33+
| RegExpInjection.js:21:14:21:22 | userInput | semmle.label | userInput |
34+
subpaths

‎javascript/ql/test/query-tests/Security/CWE-730/Threat-models-enabled/RegExpInjection.ext.yml

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,6 @@
1+
extensions:
2+
- addsTo:
3+
pack: codeql/threat-models
4+
extensible: threatModelConfiguration
5+
data:
6+
- ["environment", true, 0]

‎javascript/ql/test/query-tests/Security/CWE-730/Threat-models-enabled/RegExpInjection.js

Lines changed: 22 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,22 @@
1+
var express = require('express');
2+
var app = express();
3+
4+
app.get('/test-environment', function(req, res) {
5+
// Environment variables should be detected when "environment" threat model is enabled
6+
new RegExp(`^${process.env.HOME}/Foo/bar.app$`); // $ Alert[js/regex-injection]
7+
8+
new RegExp(`^${process.env.PATH}/bin$`); // $ Alert[js/regex-injection]
9+
10+
var envVar = process.env.NODE_ENV; // $ Source[js/regex-injection]
11+
new RegExp(envVar); // $ Alert[js/regex-injection]
12+
13+
// Command line arguments should still be detected
14+
new RegExp(`^${process.argv[1]}/Foo/bar.app$`); // $ Alert[js/regex-injection]
15+
16+
var argv = process.argv[2]; // $ Source[js/regex-injection]
17+
new RegExp(argv); // $ Alert[js/regex-injection]
18+
19+
// Regular user input should still be detected
20+
var userInput = req.param("input"); // $ Source[js/regex-injection]
21+
new RegExp(userInput); // $ Alert[js/regex-injection]
22+
});

‎javascript/ql/test/query-tests/Security/CWE-730/Threat-models-enabled/RegExpInjection.qlref

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,2 @@
1+
query: Security/CWE-730/RegExpInjection.ql
2+
postprocess: utils/test/InlineExpectationsTestQuery.ql

0 commit comments

Comments
 (0)