Skip to content

Commit e8d10b9

Browse files
asgerfasgerf
committed
JS: Tests for template file resolution
1 parent 28fe8da commit e8d10b9

6 files changed

Lines changed: 100 additions & 0 deletions

File tree

‎javascript/ql/test/library-tests/frameworks/Templating/Xss.expected‎

Lines changed: 40 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -31,6 +31,25 @@ nodes
3131
| app.js:55:37:55:72 | req.que ... JsonRaw |
3232
| app.js:59:38:59:74 | req.que ... ringRaw |
3333
| app.js:59:38:59:74 | req.que ... ringRaw |
34+
| projectA/src/index.js:7:16:7:30 | req.query.sinkA |
35+
| projectA/src/index.js:7:16:7:30 | req.query.sinkA |
36+
| projectA/src/index.js:12:16:12:30 | req.query.sinkA |
37+
| projectA/src/index.js:12:16:12:30 | req.query.sinkA |
38+
| projectA/src/index.js:17:16:17:30 | req.query.sinkA |
39+
| projectA/src/index.js:17:16:17:30 | req.query.sinkA |
40+
| projectA/src/index.js:32:16:32:30 | req.query.sinkA |
41+
| projectA/src/index.js:32:16:32:30 | req.query.sinkA |
42+
| projectA/src/index.js:37:16:37:30 | req.query.sinkA |
43+
| projectA/src/index.js:37:16:37:30 | req.query.sinkA |
44+
| projectA/views/main.ejs:2:1:2:12 | <%- sinkA %> |
45+
| projectA/views/main.ejs:2:1:2:12 | <%- sinkA %> |
46+
| projectA/views/main.ejs:2:5:2:9 | sinkA |
47+
| projectA/views/subfolder/index.ejs:2:1:2:12 | <%- sinkA %> |
48+
| projectA/views/subfolder/index.ejs:2:1:2:12 | <%- sinkA %> |
49+
| projectA/views/subfolder/index.ejs:2:5:2:9 | sinkA |
50+
| projectA/views/subfolder/other.ejs:2:1:2:12 | <%- sinkA %> |
51+
| projectA/views/subfolder/other.ejs:2:1:2:12 | <%- sinkA %> |
52+
| projectA/views/subfolder/other.ejs:2:5:2:9 | sinkA |
3453
| views/ejs_sinks.ejs:4:9:4:22 | <%- rawHtml %> |
3554
| views/ejs_sinks.ejs:4:9:4:22 | <%- rawHtml %> |
3655
| views/ejs_sinks.ejs:4:13:4:19 | rawHtml |
@@ -117,6 +136,22 @@ edges
117136
| app.js:59:38:59:74 | req.que ... ringRaw | views/njk_sinks.njk:23:42:23:68 | dataInE ... ringRaw |
118137
| app.js:59:38:59:74 | req.que ... ringRaw | views/njk_sinks.njk:23:42:23:68 | dataInE ... ringRaw |
119138
| app.js:59:38:59:74 | req.que ... ringRaw | views/njk_sinks.njk:23:42:23:68 | dataInE ... ringRaw |
139+
| projectA/src/index.js:7:16:7:30 | req.query.sinkA | projectA/views/main.ejs:2:5:2:9 | sinkA |
140+
| projectA/src/index.js:7:16:7:30 | req.query.sinkA | projectA/views/main.ejs:2:5:2:9 | sinkA |
141+
| projectA/src/index.js:12:16:12:30 | req.query.sinkA | projectA/views/main.ejs:2:5:2:9 | sinkA |
142+
| projectA/src/index.js:12:16:12:30 | req.query.sinkA | projectA/views/main.ejs:2:5:2:9 | sinkA |
143+
| projectA/src/index.js:17:16:17:30 | req.query.sinkA | projectA/views/subfolder/index.ejs:2:5:2:9 | sinkA |
144+
| projectA/src/index.js:17:16:17:30 | req.query.sinkA | projectA/views/subfolder/index.ejs:2:5:2:9 | sinkA |
145+
| projectA/src/index.js:32:16:32:30 | req.query.sinkA | projectA/views/subfolder/other.ejs:2:5:2:9 | sinkA |
146+
| projectA/src/index.js:32:16:32:30 | req.query.sinkA | projectA/views/subfolder/other.ejs:2:5:2:9 | sinkA |
147+
| projectA/src/index.js:37:16:37:30 | req.query.sinkA | projectA/views/subfolder/other.ejs:2:5:2:9 | sinkA |
148+
| projectA/src/index.js:37:16:37:30 | req.query.sinkA | projectA/views/subfolder/other.ejs:2:5:2:9 | sinkA |
149+
| projectA/views/main.ejs:2:5:2:9 | sinkA | projectA/views/main.ejs:2:1:2:12 | <%- sinkA %> |
150+
| projectA/views/main.ejs:2:5:2:9 | sinkA | projectA/views/main.ejs:2:1:2:12 | <%- sinkA %> |
151+
| projectA/views/subfolder/index.ejs:2:5:2:9 | sinkA | projectA/views/subfolder/index.ejs:2:1:2:12 | <%- sinkA %> |
152+
| projectA/views/subfolder/index.ejs:2:5:2:9 | sinkA | projectA/views/subfolder/index.ejs:2:1:2:12 | <%- sinkA %> |
153+
| projectA/views/subfolder/other.ejs:2:5:2:9 | sinkA | projectA/views/subfolder/other.ejs:2:1:2:12 | <%- sinkA %> |
154+
| projectA/views/subfolder/other.ejs:2:5:2:9 | sinkA | projectA/views/subfolder/other.ejs:2:1:2:12 | <%- sinkA %> |
120155
| views/ejs_sinks.ejs:4:13:4:19 | rawHtml | views/ejs_sinks.ejs:4:9:4:22 | <%- rawHtml %> |
121156
| views/ejs_sinks.ejs:4:13:4:19 | rawHtml | views/ejs_sinks.ejs:4:9:4:22 | <%- rawHtml %> |
122157
| views/ejs_sinks.ejs:7:13:7:30 | object.rawHtmlProp | views/ejs_sinks.ejs:7:9:7:33 | <%- object.rawHtmlProp %> |
@@ -140,6 +175,11 @@ edges
140175
| views/njk_sinks.njk:15:49:15:74 | dataInG ... JsonRaw | views/njk_sinks.njk:15:49:15:81 | dataInG ... \| json |
141176
| views/njk_sinks.njk:15:49:15:74 | dataInG ... JsonRaw | views/njk_sinks.njk:15:49:15:81 | dataInG ... \| json |
142177
#select
178+
| projectA/views/main.ejs:2:1:2:12 | <%- sinkA %> | projectA/src/index.js:7:16:7:30 | req.query.sinkA | projectA/views/main.ejs:2:1:2:12 | <%- sinkA %> | Cross-site scripting vulnerability due to $@. | projectA/src/index.js:7:16:7:30 | req.query.sinkA | user-provided value |
179+
| projectA/views/main.ejs:2:1:2:12 | <%- sinkA %> | projectA/src/index.js:12:16:12:30 | req.query.sinkA | projectA/views/main.ejs:2:1:2:12 | <%- sinkA %> | Cross-site scripting vulnerability due to $@. | projectA/src/index.js:12:16:12:30 | req.query.sinkA | user-provided value |
180+
| projectA/views/subfolder/index.ejs:2:1:2:12 | <%- sinkA %> | projectA/src/index.js:17:16:17:30 | req.query.sinkA | projectA/views/subfolder/index.ejs:2:1:2:12 | <%- sinkA %> | Cross-site scripting vulnerability due to $@. | projectA/src/index.js:17:16:17:30 | req.query.sinkA | user-provided value |
181+
| projectA/views/subfolder/other.ejs:2:1:2:12 | <%- sinkA %> | projectA/src/index.js:32:16:32:30 | req.query.sinkA | projectA/views/subfolder/other.ejs:2:1:2:12 | <%- sinkA %> | Cross-site scripting vulnerability due to $@. | projectA/src/index.js:32:16:32:30 | req.query.sinkA | user-provided value |
182+
| projectA/views/subfolder/other.ejs:2:1:2:12 | <%- sinkA %> | projectA/src/index.js:37:16:37:30 | req.query.sinkA | projectA/views/subfolder/other.ejs:2:1:2:12 | <%- sinkA %> | Cross-site scripting vulnerability due to $@. | projectA/src/index.js:37:16:37:30 | req.query.sinkA | user-provided value |
143183
| views/ejs_sinks.ejs:4:9:4:22 | <%- rawHtml %> | app.js:8:18:8:34 | req.query.rawHtml | views/ejs_sinks.ejs:4:9:4:22 | <%- rawHtml %> | Cross-site scripting vulnerability due to $@. | app.js:8:18:8:34 | req.query.rawHtml | user-provided value |
144184
| views/ejs_sinks.ejs:7:9:7:33 | <%- object.rawHtmlProp %> | app.js:11:26:11:46 | req.que ... tmlProp | views/ejs_sinks.ejs:7:9:7:33 | <%- object.rawHtmlProp %> | Cross-site scripting vulnerability due to $@. | app.js:11:26:11:46 | req.que ... tmlProp | user-provided value |
145185
| views/ejs_sinks.ejs:11:43:11:71 | <%- dataInStringLiteralRaw %> | app.js:14:33:14:64 | req.que ... eralRaw | views/ejs_sinks.ejs:11:43:11:71 | <%- dataInStringLiteralRaw %> | Cross-site scripting vulnerability due to $@. | app.js:14:33:14:64 | req.que ... eralRaw | user-provided value |

‎javascript/ql/test/library-tests/frameworks/Templating/projectA/src/index.js‎

Lines changed: 40 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,40 @@
1+
const express = require('express');
2+
3+
const app = express();
4+
5+
app.get('/fooA', (req, res) => {
6+
res.render('main', {
7+
sinkA: req.query.sinkA,
8+
sinkB: req.query.sinkB,
9+
});
10+
11+
res.render('main.ejs', {
12+
sinkA: req.query.sinkA,
13+
sinkB: req.query.sinkB,
14+
});
15+
16+
res.render('subfolder', {
17+
sinkA: req.query.sinkA,
18+
sinkB: req.query.sinkB,
19+
});
20+
21+
res.render('subfolder/index', {
22+
sinkA: req.query.sinkA,
23+
sinkB: req.query.sinkB,
24+
});
25+
26+
res.render('subfolder/index.ejs', {
27+
sinkA: req.query.sinkA,
28+
sinkB: req.query.sinkB,
29+
});
30+
31+
res.render('subfolder/other', {
32+
sinkA: req.query.sinkA,
33+
sinkB: req.query.sinkB,
34+
});
35+
36+
res.render('subfolder/other.ejs', {
37+
sinkA: req.query.sinkA,
38+
sinkB: req.query.sinkB,
39+
});
40+
});

‎javascript/ql/test/library-tests/frameworks/Templating/projectA/views/main.ejs‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,3 @@
1+
Project A
2+
<%- sinkA %>
3+
<%= sinkB %>

‎javascript/ql/test/library-tests/frameworks/Templating/projectA/views/subfolder/index.ejs‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,3 @@
1+
Subfolder/index
2+
<%- sinkA %>
3+
<%= sinkB %>

‎javascript/ql/test/library-tests/frameworks/Templating/projectA/views/subfolder/other.ejs‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,3 @@
1+
Subfolder/other
2+
<%- sinkA %>
3+
<%= sinkB %>

‎javascript/ql/test/library-tests/frameworks/Templating/test.expected‎

Lines changed: 11 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -2,6 +2,9 @@ getTemplateInstantiationSyntax
22
| consolidate.js:3:1:3:83 | consoli ... => {}) | ejs |
33
| consolidate.js:4:1:4:90 | consoli ... => {}) | mustache |
44
getLikelyTemplateSyntax
5+
| projectA/views/main.ejs:0:0:0:0 | projectA/views/main.ejs | ejs |
6+
| projectA/views/subfolder/index.ejs:0:0:0:0 | projectA/views/subfolder/index.ejs | ejs |
7+
| projectA/views/subfolder/other.ejs:0:0:0:0 | projectA/views/subfolder/other.ejs | ejs |
58
| views/ejs_sinks.ejs:0:0:0:0 | views/ejs_sinks.ejs | ejs |
69
| views/hbs_sinks.hbs:0:0:0:0 | views/hbs_sinks.hbs | mustache |
710
| views/instantiated_as_ejs.html:0:0:0:0 | views/instantiated_as_ejs.html | ejs |
@@ -13,7 +16,15 @@ getTargetFile
1316
| app.js:44:5:60:6 | res.ren ... \\n }) | views/njk_sinks.njk:0:0:0:0 | views/njk_sinks.njk |
1417
| consolidate.js:3:1:3:83 | consoli ... => {}) | views/instantiated_as_ejs.html:0:0:0:0 | views/instantiated_as_ejs.html |
1518
| consolidate.js:4:1:4:90 | consoli ... => {}) | views/instantiated_as_hbs.html:0:0:0:0 | views/instantiated_as_hbs.html |
19+
| projectA/src/index.js:6:5:9:6 | res.ren ... \\n }) | projectA/views/main.ejs:0:0:0:0 | projectA/views/main.ejs |
20+
| projectA/src/index.js:11:5:14:6 | res.ren ... \\n }) | projectA/views/main.ejs:0:0:0:0 | projectA/views/main.ejs |
21+
| projectA/src/index.js:16:5:19:6 | res.ren ... \\n }) | projectA/views/subfolder/index.ejs:0:0:0:0 | projectA/views/subfolder/index.ejs |
22+
| projectA/src/index.js:31:5:34:6 | res.ren ... \\n }) | projectA/views/subfolder/other.ejs:0:0:0:0 | projectA/views/subfolder/other.ejs |
23+
| projectA/src/index.js:36:5:39:6 | res.ren ... \\n }) | projectA/views/subfolder/other.ejs:0:0:0:0 | projectA/views/subfolder/other.ejs |
1624
xssSink
25+
| projectA/views/main.ejs:2:1:2:12 | <%- sinkA %> |
26+
| projectA/views/subfolder/index.ejs:2:1:2:12 | <%- sinkA %> |
27+
| projectA/views/subfolder/other.ejs:2:1:2:12 | <%- sinkA %> |
1728
| views/ejs_sinks.ejs:4:9:4:22 | <%- rawHtml %> |
1829
| views/ejs_sinks.ejs:5:9:5:31 | <%- rawHtmlSafeValue %> |
1930
| views/ejs_sinks.ejs:7:9:7:33 | <%- object.rawHtmlProp %> |

0 commit comments

Comments
 (0)