Skip to content

Commit

Permalink
JS: Effect on tests.
Browse files Browse the repository at this point in the history
  • Loading branch information
@geoffw0
geoffw0 committed Feb 17, 2025
1 parent dd2ca0d commit 1d1cf0e
Show file tree
Hide file tree
Showing 4 changed files with 35 additions and 13 deletions.
35 changes: 28 additions & 7 deletions javascript/ql/test/library-tests/TaintTracking/BasicTaintTracking.expected
View file
Original file line number Diff line number Diff line change
@@ -1,15 +1,9 @@
legacyDataFlowDifference
| arrays-init.js:2:16:2:23 | source() | arrays-init.js:27:8:27:13 | arr[0] | only flow with OLD data flow library |
| arrays-init.js:2:16:2:23 | source() | arrays-init.js:33:8:33:13 | arr[0] | only flow with OLD data flow library |
| arrays-init.js:2:16:2:23 | source() | arrays-init.js:35:8:35:13 | arr[2] | only flow with OLD data flow library |
| arrays-init.js:2:16:2:23 | source() | arrays-init.js:36:8:36:13 | arr[3] | only flow with OLD data flow library |
| arrays-init.js:2:16:2:23 | source() | arrays-init.js:37:8:37:13 | arr[4] | only flow with OLD data flow library |
| bound-function.js:27:8:27:15 | source() | bound-function.js:30:10:30:10 | y | only flow with OLD data flow library |
| call-apply.js:27:14:27:21 | source() | call-apply.js:24:8:24:11 | arg1 | only flow with NEW data flow library |
| call-apply.js:27:14:27:21 | source() | call-apply.js:32:6:32:35 | foo1.ap ... e, ""]) | only flow with NEW data flow library |
| call-apply.js:27:14:27:21 | source() | call-apply.js:33:6:33:35 | foo2.ap ... e, ""]) | only flow with NEW data flow library |
| call-apply.js:27:14:27:21 | source() | call-apply.js:34:6:34:29 | foo1_ap ... e, ""]) | only flow with NEW data flow library |
| call-apply.js:27:14:27:21 | source() | call-apply.js:41:6:41:28 | foo1_ca ... ource]) | only flow with OLD data flow library |
| call-apply.js:27:14:27:21 | source() | call-apply.js:59:10:59:21 | arguments[1] | only flow with OLD data flow library |
| call-apply.js:45:8:45:15 | source() | call-apply.js:55:6:55:13 | foo(obj) | only flow with NEW data flow library |
| callbacks.js:37:17:37:24 | source() | callbacks.js:38:35:38:35 | x | only flow with NEW data flow library |
| callbacks.js:37:17:37:24 | source() | callbacks.js:41:10:41:10 | x | only flow with NEW data flow library |
Expand All @@ -32,14 +26,28 @@ legacyDataFlowDifference
| object-bypass-sanitizer.js:35:29:35:36 | source() | object-bypass-sanitizer.js:28:10:28:30 | sanitiz ... bj).foo | only flow with OLD data flow library |
| promise.js:12:20:12:27 | source() | promise.js:13:8:13:23 | resolver.promise | only flow with OLD data flow library |
| sanitizer-guards.js:57:11:57:18 | source() | sanitizer-guards.js:64:8:64:8 | x | only flow with NEW data flow library |
| spread.js:4:15:4:22 | source() | spread.js:17:8:17:8 | x | only flow with NEW data flow library |
| spread.js:4:15:4:22 | source() | spread.js:18:8:18:8 | y | only flow with NEW data flow library |
| spread.js:4:15:4:22 | source() | spread.js:19:8:19:8 | z | only flow with NEW data flow library |
| spread.js:4:15:4:22 | source() | spread.js:23:8:23:8 | x | only flow with NEW data flow library |
| spread.js:4:15:4:22 | source() | spread.js:24:8:24:8 | y | only flow with NEW data flow library |
| spread.js:4:15:4:22 | source() | spread.js:25:8:25:8 | z | only flow with NEW data flow library |
| tst.js:2:13:2:20 | source() | tst.js:17:10:17:10 | a | only flow with OLD data flow library |
| use-use-after-implicit-read.js:7:17:7:24 | source() | use-use-after-implicit-read.js:15:10:15:10 | x | only flow with NEW data flow library |
| use-use-after-implicit-read.js:7:17:7:24 | source() | use-use-after-implicit-read.js:16:10:16:10 | y | only flow with NEW data flow library |
consistencyIssue
| arrays-init.js:27 | did not expect an alert, but found an alert for LegacyConfig | OK | Consistency |
| arrays-init.js:33 | did not expect an alert, but found an alert for LegacyConfig | OK | Consistency |
| arrays-init.js:35 | did not expect an alert, but found an alert for LegacyConfig | OK | Consistency |
| arrays-init.js:36 | did not expect an alert, but found an alert for LegacyConfig | OK | Consistency |
| arrays-init.js:37 | did not expect an alert, but found an alert for LegacyConfig | OK | Consistency |
| call-apply.js:33 | did not expect an alert, but found an alert | OK | Consistency |
| call-apply.js:41 | did not expect an alert, but found an alert for LegacyConfig | OK | Consistency |
| call-apply.js:59 | did not expect an alert, but found an alert for LegacyConfig | OK | Consistency |
| nested-props.js:20 | expected an alert, but found none | NOT OK - but not found | Consistency |
| stringification-read-steps.js:17 | expected an alert, but found none | NOT OK | Consistency |
| stringification-read-steps.js:25 | expected an alert, but found none | NOT OK | Consistency |
| use-use-after-implicit-read.js:16 | did not expect an alert, but found an alert | OK | Consistency |
flow
| access-path-sanitizer.js:2:18:2:25 | source() | access-path-sanitizer.js:4:8:4:12 | obj.x |
| addexpr.js:4:10:4:17 | source() | addexpr.js:7:8:7:8 | x |
Expand All @@ -59,8 +67,13 @@ flow
| array-mutation.js:75:28:75:35 | source() | array-mutation.js:76:8:76:8 | r |
| arrays-init.js:2:16:2:23 | source() | arrays-init.js:17:8:17:13 | arr[1] |
| arrays-init.js:2:16:2:23 | source() | arrays-init.js:22:8:22:13 | arr[6] |
| arrays-init.js:2:16:2:23 | source() | arrays-init.js:27:8:27:13 | arr[0] |
| arrays-init.js:2:16:2:23 | source() | arrays-init.js:28:8:28:13 | arr[1] |
| arrays-init.js:2:16:2:23 | source() | arrays-init.js:33:8:33:13 | arr[0] |
| arrays-init.js:2:16:2:23 | source() | arrays-init.js:34:8:34:13 | arr[1] |
| arrays-init.js:2:16:2:23 | source() | arrays-init.js:35:8:35:13 | arr[2] |
| arrays-init.js:2:16:2:23 | source() | arrays-init.js:36:8:36:13 | arr[3] |
| arrays-init.js:2:16:2:23 | source() | arrays-init.js:37:8:37:13 | arr[4] |
| arrays-init.js:2:16:2:23 | source() | arrays-init.js:38:8:38:13 | arr[5] |
| arrays-init.js:2:16:2:23 | source() | arrays-init.js:43:10:43:15 | arr[i] |
| arrays-init.js:2:16:2:23 | source() | arrays-init.js:55:10:55:15 | arr[i] |
Expand All @@ -83,8 +96,11 @@ flow
| call-apply.js:27:14:27:21 | source() | call-apply.js:24:8:24:11 | arg1 |
| call-apply.js:27:14:27:21 | source() | call-apply.js:29:6:29:32 | foo1.ca ... ce, "") |
| call-apply.js:27:14:27:21 | source() | call-apply.js:32:6:32:35 | foo1.ap ... e, ""]) |
| call-apply.js:27:14:27:21 | source() | call-apply.js:33:6:33:35 | foo2.ap ... e, ""]) |
| call-apply.js:27:14:27:21 | source() | call-apply.js:34:6:34:29 | foo1_ap ... e, ""]) |
| call-apply.js:27:14:27:21 | source() | call-apply.js:40:6:40:28 | foo1_ca ... e, ""]) |
| call-apply.js:27:14:27:21 | source() | call-apply.js:41:6:41:28 | foo1_ca ... ource]) |
| call-apply.js:27:14:27:21 | source() | call-apply.js:59:10:59:21 | arguments[1] |
| call-apply.js:27:14:27:21 | source() | call-apply.js:62:10:62:21 | arguments[0] |
| call-apply.js:45:8:45:15 | source() | call-apply.js:55:6:55:13 | foo(obj) |
| call-apply.js:81:17:81:24 | source() | call-apply.js:78:8:78:11 | this |
Expand Down Expand Up @@ -263,8 +279,12 @@ flow
| spread.js:4:15:4:22 | source() | spread.js:7:8:7:43 | { f: 'h ... orld' } |
| spread.js:4:15:4:22 | source() | spread.js:9:8:9:19 | [ ...taint ] |
| spread.js:4:15:4:22 | source() | spread.js:10:8:10:28 | [ 1, 2, ... nt, 3 ] |
| spread.js:4:15:4:22 | source() | spread.js:17:8:17:8 | x |
| spread.js:4:15:4:22 | source() | spread.js:18:8:18:8 | y |
| spread.js:4:15:4:22 | source() | spread.js:19:8:19:8 | z |
| spread.js:4:15:4:22 | source() | spread.js:23:8:23:8 | x |
| spread.js:4:15:4:22 | source() | spread.js:24:8:24:8 | y |
| spread.js:4:15:4:22 | source() | spread.js:25:8:25:8 | z |
| static-capture-groups.js:2:17:2:24 | source() | static-capture-groups.js:5:14:5:22 | RegExp.$1 |
| static-capture-groups.js:2:17:2:24 | source() | static-capture-groups.js:15:14:15:22 | RegExp.$1 |
| static-capture-groups.js:2:17:2:24 | source() | static-capture-groups.js:17:14:17:22 | RegExp.$1 |
Expand Down Expand Up @@ -326,6 +346,7 @@ flow
| tst.js:93:22:93:29 | source() | tst.js:97:14:97:26 | map.get(true) |
| use-use-after-implicit-read.js:7:17:7:24 | source() | use-use-after-implicit-read.js:8:10:8:17 | captured |
| use-use-after-implicit-read.js:7:17:7:24 | source() | use-use-after-implicit-read.js:15:10:15:10 | x |
| use-use-after-implicit-read.js:7:17:7:24 | source() | use-use-after-implicit-read.js:16:10:16:10 | y |
| xml.js:5:18:5:25 | source() | xml.js:8:14:8:17 | text |
| xml.js:12:17:12:24 | source() | xml.js:13:14:13:19 | result |
| xml.js:23:18:23:25 | source() | xml.js:20:14:20:17 | attr |
Expand Down
4 changes: 2 additions & 2 deletions javascript/ql/test/library-tests/TaintedUrlSuffix/tst.js
View file
Original file line number Diff line number Diff line change
Expand Up @@ -8,12 +8,12 @@ function t1() {
sink(href.split('#')[0]); // could be 'tainted-url-suffix', but omitted due to FPs from URI-encoding
sink(href.split('#')[1]); // $ flow=taint
sink(href.split('#').pop()); // $ flow=taint
sink(href.split('#')[2]); // $ MISSING: flow=taint // currently the split() summary only propagates to index 1
sink(href.split('#')[2]); // $ flow=taint // currently the split() summary only propagates to index 1

sink(href.split('?')[0]);
sink(href.split('?')[1]); // $ flow=taint
sink(href.split('?').pop()); // $ flow=taint
sink(href.split('?')[2]); // $ MISSING: flow=taint
sink(href.split('?')[2]); // $ flow=taint

sink(href.split(blah())[0]); // $ flow=tainted-url-suffix
sink(href.split(blah())[1]); // $ flow=tainted-url-suffix
Expand Down
8 changes: 4 additions & 4 deletions javascript/ql/test/library-tests/frameworks/AsyncPackage/AsyncTaintTracking.expected
View file
Original file line number Diff line number Diff line change
@@ -1,10 +1,10 @@
legacyDataFlowDifference
| each.js:11:9:11:16 | source() | each.js:13:12:13:15 | item | only flow with OLD data flow library |
| map.js:10:13:10:20 | source() | map.js:12:14:12:17 | item | only flow with OLD data flow library |
| map.js:26:13:26:20 | source() | map.js:28:27:28:32 | result | only flow with OLD data flow library |
| sortBy.js:10:22:10:29 | source() | sortBy.js:12:27:12:32 | result | only flow with OLD data flow library |
#select
| each.js:11:9:11:16 | source() | each.js:13:12:13:15 | item |
| map.js:10:13:10:20 | source() | map.js:12:14:12:17 | item |
| map.js:20:19:20:26 | source() | map.js:23:27:23:32 | result |
| map.js:26:13:26:20 | source() | map.js:28:27:28:32 | result |
| sortBy.js:10:22:10:29 | source() | sortBy.js:12:27:12:32 | result |
| waterfall.js:8:30:8:37 | source() | waterfall.js:11:12:11:16 | taint |
| waterfall.js:8:30:8:37 | source() | waterfall.js:20:10:20:14 | taint |
| waterfall.js:28:18:28:25 | source() | waterfall.js:39:10:39:12 | err |
Expand Down
1 change: 1 addition & 0 deletions javascript/ql/test/query-tests/Security/CWE-730/RegExpInjection.expected
View file
Original file line number Diff line number Diff line change
Expand Up @@ -31,6 +31,7 @@ edges
| RegExpInjection.js:54:14:54:16 | key | RegExpInjection.js:54:14:54:27 | key.split(".") | provenance | |
| RegExpInjection.js:54:14:54:16 | key | RegExpInjection.js:54:14:54:27 | key.split(".") [ArrayElement] | provenance | |
| RegExpInjection.js:54:14:54:27 | key.split(".") | RegExpInjection.js:54:14:54:42 | key.spl ... x => x) | provenance | |
| RegExpInjection.js:54:14:54:27 | key.split(".") [ArrayElement] | RegExpInjection.js:54:14:54:42 | key.spl ... x => x) | provenance | |
| RegExpInjection.js:54:14:54:27 | key.split(".") [ArrayElement] | RegExpInjection.js:54:14:54:42 | key.spl ... x => x) [ArrayElement] | provenance | |
| RegExpInjection.js:54:14:54:42 | key.spl ... x => x) | RegExpInjection.js:54:14:54:52 | key.spl ... in("-") | provenance | |
| RegExpInjection.js:54:14:54:42 | key.spl ... x => x) [ArrayElement] | RegExpInjection.js:54:14:54:52 | key.spl ... in("-") | provenance | |
Expand Down

0 comments on commit 1d1cf0e

Please sign in to comment.