Merge pull request #22126 from owen-mc/js/convert-qlref-inline-expectations

JS: Convert qlref tests to inline expectations

Author: owen-mc

javascript/ql/test/experimental/Security/CWE-094-dataURL/CodeInjection.qlref

@@ -1 +1,2 @@
-experimental/Security/CWE-094-dataURL/CodeInjection.ql
+query: experimental/Security/CWE-094-dataURL/CodeInjection.ql
+postprocess: utils/test/InlineExpectationsTestQuery.ql

javascript/ql/test/experimental/Security/CWE-094-dataURL/test.js

@@ -2,21 +2,21 @@ const { Worker } = require('node:worker_threads');
 var app = require('express')();
 
 app.post('/path', async function (req, res) {
-    const payload = req.query.queryParameter // like:  payload = 'data:text/javascript,console.log("hello!");//'
+    const payload = req.query.queryParameter // $ Source // like:  payload = 'data:text/javascript,console.log("hello!");//'
     let payloadURL = new URL(payload + sth) // NOT OK
-    new Worker(payloadURL);
+    new Worker(payloadURL); // $ Alert
 
     payloadURL = new URL(payload + sth) // NOT OK
-    new Worker(payloadURL);
+    new Worker(payloadURL); // $ Alert
 
     payloadURL = new URL(sth + payload) // OK
     new Worker(payloadURL);
 });
 
 app.post('/path2', async function (req, res) {
-    const payload = req.query.queryParameter // like:  payload = 'data:text/javascript,console.log("hello!");//'
-    await import(payload) // NOT OK
-    await import(payload + sth) // NOT OK
+    const payload = req.query.queryParameter // $ Source // like:  payload = 'data:text/javascript,console.log("hello!");//'
+    await import(payload) // $ Alert // NOT OK
+    await import(payload + sth) // $ Alert // NOT OK
     await import(sth + payload) // OK
 });
 

javascript/ql/test/experimental/Security/CWE-099/EnvValueAndKeyInjection/EnvValueAndKeyInjection.qlref

@@ -1 +1,2 @@
-experimental/Security/CWE-099/EnvValueAndKeyInjection.ql
+query: experimental/Security/CWE-099/EnvValueAndKeyInjection.ql
+postprocess: utils/test/InlineExpectationsTestQuery.ql

javascript/ql/test/experimental/Security/CWE-099/EnvValueAndKeyInjection/test.js

@@ -2,9 +2,9 @@ const http = require('node:http');
 
 
 http.createServer((req, res) => {
-  const { EnvValue, EnvKey } = req.body;
-  process.env[EnvKey] = EnvValue; // NOT OK
-  process.env[EnvKey] = EnvValue; // NOT OK
+  const { EnvValue, EnvKey } = req.body; // $ Source
+  process.env[EnvKey] = EnvValue; // $ Alert // NOT OK
+  process.env[EnvKey] = EnvValue; // $ Alert // NOT OK
 
   res.end('env has been injected!');
 });

javascript/ql/test/experimental/Security/CWE-099/EnvValueInjection/EnvValueInjection.qlref

@@ -1 +1,2 @@
-experimental/Security/CWE-099/EnvValueInjection.ql
+query: experimental/Security/CWE-099/EnvValueInjection.ql
+postprocess: utils/test/InlineExpectationsTestQuery.ql

javascript/ql/test/experimental/Security/CWE-099/EnvValueInjection/test.js

@@ -1,10 +1,10 @@
 const http = require('node:http');
 
 http.createServer((req, res) => {
-  const { EnvValue } = req.body;
-  process.env["A_Critical_Env"] = EnvValue; // NOT OK
-  process.env[AKey] = EnvValue; // NOT OK
-  process.env.AKey = EnvValue; // NOT OK
+  const { EnvValue } = req.body; // $ Source
+  process.env["A_Critical_Env"] = EnvValue; // $ Alert // NOT OK
+  process.env[AKey] = EnvValue; // $ Alert // NOT OK
+  process.env.AKey = EnvValue; // $ Alert // NOT OK
 
   res.end('env has been injected!');
 });

javascript/ql/test/experimental/Security/CWE-347/localsource/JsonWebToken.js

@@ -10,18 +10,18 @@ function aJWT() {
 }
 
 (function () {
-    const UserToken = aJwt()
+    const UserToken = aJwt() // $ Alert
 
     // BAD: no signature verification
-    jwtJsonwebtoken.decode(UserToken) // NOT OK
+    jwtJsonwebtoken.decode(UserToken) // $ Sink // NOT OK
 })();
 
 (function () {
-    const UserToken = aJwt()
+    const UserToken = aJwt() // $ Alert
 
     // BAD: no signature verification
-    jwtJsonwebtoken.decode(UserToken) // NOT OK
-    jwtJsonwebtoken.verify(UserToken, getSecret(), { algorithms: ["HS256", "none"] }) // NOT OK
+    jwtJsonwebtoken.decode(UserToken) // $ Sink // NOT OK
+    jwtJsonwebtoken.verify(UserToken, getSecret(), { algorithms: ["HS256", "none"] }) // $ Sink // NOT OK
 })();
 
 (function () {

javascript/ql/test/experimental/Security/CWE-347/localsource/decodeJwtWithoutVerificationLocalSource.qlref

@@ -1 +1,2 @@
-experimental/Security/CWE-347/decodeJwtWithoutVerificationLocalSource.ql
+query: experimental/Security/CWE-347/decodeJwtWithoutVerificationLocalSource.ql
+postprocess: utils/test/InlineExpectationsTestQuery.ql

javascript/ql/test/experimental/Security/CWE-347/localsource/jose.js

@@ -9,10 +9,10 @@ function aJWT() {
 }
 
 (function () {
-    const UserToken = aJwt()
+    const UserToken = aJwt() // $ Alert
 
     // no signature verification
-    jose.decodeJwt(UserToken) // NOT OK
+    jose.decodeJwt(UserToken) // $ Sink // NOT OK
 })();
 
 (async function () {

javascript/ql/test/experimental/Security/CWE-347/localsource/jwtDecode.js

@@ -10,9 +10,9 @@ function aJWT() {
 }
 
 (function () {
-    const UserToken = aJwt()
+    const UserToken = aJwt() // $ Alert
 
     // jwt-decode
     // no signature verification
-    jwt_decode(UserToken) // NOT OK
+    jwt_decode(UserToken) // $ Sink // NOT OK
 })();