Skip to content

Commit 1d1cf0e

Browse files
geoffw0geoffw0
committed
JS: Effect on tests.
1 parent dd2ca0d commit 1d1cf0e

File tree

4 files changed

+35
-13
lines changed

4 files changed

+35
-13
lines changed

‎javascript/ql/test/library-tests/TaintTracking/BasicTaintTracking.expected‎

Lines changed: 28 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -1,15 +1,9 @@
11
legacyDataFlowDifference
2-
| arrays-init.js:2:16:2:23 | source() | arrays-init.js:27:8:27:13 | arr[0] | only flow with OLD data flow library |
3-
| arrays-init.js:2:16:2:23 | source() | arrays-init.js:33:8:33:13 | arr[0] | only flow with OLD data flow library |
4-
| arrays-init.js:2:16:2:23 | source() | arrays-init.js:35:8:35:13 | arr[2] | only flow with OLD data flow library |
5-
| arrays-init.js:2:16:2:23 | source() | arrays-init.js:36:8:36:13 | arr[3] | only flow with OLD data flow library |
6-
| arrays-init.js:2:16:2:23 | source() | arrays-init.js:37:8:37:13 | arr[4] | only flow with OLD data flow library |
72
| bound-function.js:27:8:27:15 | source() | bound-function.js:30:10:30:10 | y | only flow with OLD data flow library |
83
| call-apply.js:27:14:27:21 | source() | call-apply.js:24:8:24:11 | arg1 | only flow with NEW data flow library |
94
| call-apply.js:27:14:27:21 | source() | call-apply.js:32:6:32:35 | foo1.ap ... e, ""]) | only flow with NEW data flow library |
5+
| call-apply.js:27:14:27:21 | source() | call-apply.js:33:6:33:35 | foo2.ap ... e, ""]) | only flow with NEW data flow library |
106
| call-apply.js:27:14:27:21 | source() | call-apply.js:34:6:34:29 | foo1_ap ... e, ""]) | only flow with NEW data flow library |
11-
| call-apply.js:27:14:27:21 | source() | call-apply.js:41:6:41:28 | foo1_ca ... ource]) | only flow with OLD data flow library |
12-
| call-apply.js:27:14:27:21 | source() | call-apply.js:59:10:59:21 | arguments[1] | only flow with OLD data flow library |
137
| call-apply.js:45:8:45:15 | source() | call-apply.js:55:6:55:13 | foo(obj) | only flow with NEW data flow library |
148
| callbacks.js:37:17:37:24 | source() | callbacks.js:38:35:38:35 | x | only flow with NEW data flow library |
159
| callbacks.js:37:17:37:24 | source() | callbacks.js:41:10:41:10 | x | only flow with NEW data flow library |
@@ -32,14 +26,28 @@ legacyDataFlowDifference
3226
| object-bypass-sanitizer.js:35:29:35:36 | source() | object-bypass-sanitizer.js:28:10:28:30 | sanitiz ... bj).foo | only flow with OLD data flow library |
3327
| promise.js:12:20:12:27 | source() | promise.js:13:8:13:23 | resolver.promise | only flow with OLD data flow library |
3428
| sanitizer-guards.js:57:11:57:18 | source() | sanitizer-guards.js:64:8:64:8 | x | only flow with NEW data flow library |
29+
| spread.js:4:15:4:22 | source() | spread.js:17:8:17:8 | x | only flow with NEW data flow library |
3530
| spread.js:4:15:4:22 | source() | spread.js:18:8:18:8 | y | only flow with NEW data flow library |
31+
| spread.js:4:15:4:22 | source() | spread.js:19:8:19:8 | z | only flow with NEW data flow library |
32+
| spread.js:4:15:4:22 | source() | spread.js:23:8:23:8 | x | only flow with NEW data flow library |
3633
| spread.js:4:15:4:22 | source() | spread.js:24:8:24:8 | y | only flow with NEW data flow library |
34+
| spread.js:4:15:4:22 | source() | spread.js:25:8:25:8 | z | only flow with NEW data flow library |
3735
| tst.js:2:13:2:20 | source() | tst.js:17:10:17:10 | a | only flow with OLD data flow library |
3836
| use-use-after-implicit-read.js:7:17:7:24 | source() | use-use-after-implicit-read.js:15:10:15:10 | x | only flow with NEW data flow library |
37+
| use-use-after-implicit-read.js:7:17:7:24 | source() | use-use-after-implicit-read.js:16:10:16:10 | y | only flow with NEW data flow library |
3938
consistencyIssue
39+
| arrays-init.js:27 | did not expect an alert, but found an alert for LegacyConfig | OK | Consistency |
40+
| arrays-init.js:33 | did not expect an alert, but found an alert for LegacyConfig | OK | Consistency |
41+
| arrays-init.js:35 | did not expect an alert, but found an alert for LegacyConfig | OK | Consistency |
42+
| arrays-init.js:36 | did not expect an alert, but found an alert for LegacyConfig | OK | Consistency |
43+
| arrays-init.js:37 | did not expect an alert, but found an alert for LegacyConfig | OK | Consistency |
44+
| call-apply.js:33 | did not expect an alert, but found an alert | OK | Consistency |
45+
| call-apply.js:41 | did not expect an alert, but found an alert for LegacyConfig | OK | Consistency |
46+
| call-apply.js:59 | did not expect an alert, but found an alert for LegacyConfig | OK | Consistency |
4047
| nested-props.js:20 | expected an alert, but found none | NOT OK - but not found | Consistency |
4148
| stringification-read-steps.js:17 | expected an alert, but found none | NOT OK | Consistency |
4249
| stringification-read-steps.js:25 | expected an alert, but found none | NOT OK | Consistency |
50+
| use-use-after-implicit-read.js:16 | did not expect an alert, but found an alert | OK | Consistency |
4351
flow
4452
| access-path-sanitizer.js:2:18:2:25 | source() | access-path-sanitizer.js:4:8:4:12 | obj.x |
4553
| addexpr.js:4:10:4:17 | source() | addexpr.js:7:8:7:8 | x |
@@ -59,8 +67,13 @@ flow
5967
| array-mutation.js:75:28:75:35 | source() | array-mutation.js:76:8:76:8 | r |
6068
| arrays-init.js:2:16:2:23 | source() | arrays-init.js:17:8:17:13 | arr[1] |
6169
| arrays-init.js:2:16:2:23 | source() | arrays-init.js:22:8:22:13 | arr[6] |
70+
| arrays-init.js:2:16:2:23 | source() | arrays-init.js:27:8:27:13 | arr[0] |
6271
| arrays-init.js:2:16:2:23 | source() | arrays-init.js:28:8:28:13 | arr[1] |
72+
| arrays-init.js:2:16:2:23 | source() | arrays-init.js:33:8:33:13 | arr[0] |
6373
| arrays-init.js:2:16:2:23 | source() | arrays-init.js:34:8:34:13 | arr[1] |
74+
| arrays-init.js:2:16:2:23 | source() | arrays-init.js:35:8:35:13 | arr[2] |
75+
| arrays-init.js:2:16:2:23 | source() | arrays-init.js:36:8:36:13 | arr[3] |
76+
| arrays-init.js:2:16:2:23 | source() | arrays-init.js:37:8:37:13 | arr[4] |
6477
| arrays-init.js:2:16:2:23 | source() | arrays-init.js:38:8:38:13 | arr[5] |
6578
| arrays-init.js:2:16:2:23 | source() | arrays-init.js:43:10:43:15 | arr[i] |
6679
| arrays-init.js:2:16:2:23 | source() | arrays-init.js:55:10:55:15 | arr[i] |
@@ -83,8 +96,11 @@ flow
8396
| call-apply.js:27:14:27:21 | source() | call-apply.js:24:8:24:11 | arg1 |
8497
| call-apply.js:27:14:27:21 | source() | call-apply.js:29:6:29:32 | foo1.ca ... ce, "") |
8598
| call-apply.js:27:14:27:21 | source() | call-apply.js:32:6:32:35 | foo1.ap ... e, ""]) |
99+
| call-apply.js:27:14:27:21 | source() | call-apply.js:33:6:33:35 | foo2.ap ... e, ""]) |
86100
| call-apply.js:27:14:27:21 | source() | call-apply.js:34:6:34:29 | foo1_ap ... e, ""]) |
87101
| call-apply.js:27:14:27:21 | source() | call-apply.js:40:6:40:28 | foo1_ca ... e, ""]) |
102+
| call-apply.js:27:14:27:21 | source() | call-apply.js:41:6:41:28 | foo1_ca ... ource]) |
103+
| call-apply.js:27:14:27:21 | source() | call-apply.js:59:10:59:21 | arguments[1] |
88104
| call-apply.js:27:14:27:21 | source() | call-apply.js:62:10:62:21 | arguments[0] |
89105
| call-apply.js:45:8:45:15 | source() | call-apply.js:55:6:55:13 | foo(obj) |
90106
| call-apply.js:81:17:81:24 | source() | call-apply.js:78:8:78:11 | this |
@@ -263,8 +279,12 @@ flow
263279
| spread.js:4:15:4:22 | source() | spread.js:7:8:7:43 | { f: 'h ... orld' } |
264280
| spread.js:4:15:4:22 | source() | spread.js:9:8:9:19 | [ ...taint ] |
265281
| spread.js:4:15:4:22 | source() | spread.js:10:8:10:28 | [ 1, 2, ... nt, 3 ] |
282+
| spread.js:4:15:4:22 | source() | spread.js:17:8:17:8 | x |
266283
| spread.js:4:15:4:22 | source() | spread.js:18:8:18:8 | y |
284+
| spread.js:4:15:4:22 | source() | spread.js:19:8:19:8 | z |
285+
| spread.js:4:15:4:22 | source() | spread.js:23:8:23:8 | x |
267286
| spread.js:4:15:4:22 | source() | spread.js:24:8:24:8 | y |
287+
| spread.js:4:15:4:22 | source() | spread.js:25:8:25:8 | z |
268288
| static-capture-groups.js:2:17:2:24 | source() | static-capture-groups.js:5:14:5:22 | RegExp.$1 |
269289
| static-capture-groups.js:2:17:2:24 | source() | static-capture-groups.js:15:14:15:22 | RegExp.$1 |
270290
| static-capture-groups.js:2:17:2:24 | source() | static-capture-groups.js:17:14:17:22 | RegExp.$1 |
@@ -326,6 +346,7 @@ flow
326346
| tst.js:93:22:93:29 | source() | tst.js:97:14:97:26 | map.get(true) |
327347
| use-use-after-implicit-read.js:7:17:7:24 | source() | use-use-after-implicit-read.js:8:10:8:17 | captured |
328348
| use-use-after-implicit-read.js:7:17:7:24 | source() | use-use-after-implicit-read.js:15:10:15:10 | x |
349+
| use-use-after-implicit-read.js:7:17:7:24 | source() | use-use-after-implicit-read.js:16:10:16:10 | y |
329350
| xml.js:5:18:5:25 | source() | xml.js:8:14:8:17 | text |
330351
| xml.js:12:17:12:24 | source() | xml.js:13:14:13:19 | result |
331352
| xml.js:23:18:23:25 | source() | xml.js:20:14:20:17 | attr |

‎javascript/ql/test/library-tests/TaintedUrlSuffix/tst.js‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -8,12 +8,12 @@ function t1() {
88
sink(href.split('#')[0]); // could be 'tainted-url-suffix', but omitted due to FPs from URI-encoding
99
sink(href.split('#')[1]); // $ flow=taint
1010
sink(href.split('#').pop()); // $ flow=taint
11-
sink(href.split('#')[2]); // $ MISSING: flow=taint // currently the split() summary only propagates to index 1
11+
sink(href.split('#')[2]); // $ flow=taint // currently the split() summary only propagates to index 1
1212

1313
sink(href.split('?')[0]);
1414
sink(href.split('?')[1]); // $ flow=taint
1515
sink(href.split('?').pop()); // $ flow=taint
16-
sink(href.split('?')[2]); // $ MISSING: flow=taint
16+
sink(href.split('?')[2]); // $ flow=taint
1717

1818
sink(href.split(blah())[0]); // $ flow=tainted-url-suffix
1919
sink(href.split(blah())[1]); // $ flow=tainted-url-suffix

‎javascript/ql/test/library-tests/frameworks/AsyncPackage/AsyncTaintTracking.expected‎

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -1,10 +1,10 @@
11
legacyDataFlowDifference
2-
| each.js:11:9:11:16 | source() | each.js:13:12:13:15 | item | only flow with OLD data flow library |
3-
| map.js:10:13:10:20 | source() | map.js:12:14:12:17 | item | only flow with OLD data flow library |
4-
| map.js:26:13:26:20 | source() | map.js:28:27:28:32 | result | only flow with OLD data flow library |
5-
| sortBy.js:10:22:10:29 | source() | sortBy.js:12:27:12:32 | result | only flow with OLD data flow library |
62
#select
3+
| each.js:11:9:11:16 | source() | each.js:13:12:13:15 | item |
4+
| map.js:10:13:10:20 | source() | map.js:12:14:12:17 | item |
75
| map.js:20:19:20:26 | source() | map.js:23:27:23:32 | result |
6+
| map.js:26:13:26:20 | source() | map.js:28:27:28:32 | result |
7+
| sortBy.js:10:22:10:29 | source() | sortBy.js:12:27:12:32 | result |
88
| waterfall.js:8:30:8:37 | source() | waterfall.js:11:12:11:16 | taint |
99
| waterfall.js:8:30:8:37 | source() | waterfall.js:20:10:20:14 | taint |
1010
| waterfall.js:28:18:28:25 | source() | waterfall.js:39:10:39:12 | err |

‎javascript/ql/test/query-tests/Security/CWE-730/RegExpInjection.expected‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -31,6 +31,7 @@ edges
3131
| RegExpInjection.js:54:14:54:16 | key | RegExpInjection.js:54:14:54:27 | key.split(".") | provenance | |
3232
| RegExpInjection.js:54:14:54:16 | key | RegExpInjection.js:54:14:54:27 | key.split(".") [ArrayElement] | provenance | |
3333
| RegExpInjection.js:54:14:54:27 | key.split(".") | RegExpInjection.js:54:14:54:42 | key.spl ... x => x) | provenance | |
34+
| RegExpInjection.js:54:14:54:27 | key.split(".") [ArrayElement] | RegExpInjection.js:54:14:54:42 | key.spl ... x => x) | provenance | |
3435
| RegExpInjection.js:54:14:54:27 | key.split(".") [ArrayElement] | RegExpInjection.js:54:14:54:42 | key.spl ... x => x) [ArrayElement] | provenance | |
3536
| RegExpInjection.js:54:14:54:42 | key.spl ... x => x) | RegExpInjection.js:54:14:54:52 | key.spl ... in("-") | provenance | |
3637
| RegExpInjection.js:54:14:54:42 | key.spl ... x => x) [ArrayElement] | RegExpInjection.js:54:14:54:52 | key.spl ... in("-") | provenance | |

0 commit comments

Comments
 (0)