Add SPURIOUS and MISSING tags

Author: owen-mc

javascript/ql/test/experimental/Security/CWE-918/check-middleware.js

@@ -6,7 +6,7 @@ const express = require('express');
 const app = express();
 
 app.get('/check-with-axios', validationMiddleware, req => {
-  axios.get("test.com/" + req.query.tainted); // $ Alert // OK is sanitized by the middleware - False Positive
+  axios.get("test.com/" + req.query.tainted); // $ SPURIOUS: Alert // OK is sanitized by the middleware - False Positive
 });
 
 

javascript/ql/test/experimental/Security/CWE-918/check-regex.js

@@ -13,14 +13,14 @@ app.get('/check-with-axios', req => {
     axios.get("test.com/" + req.query.tainted); // OK
   }
   if (req.query.tainted.match(/^.*$/)) { // anything
-    axios.get("test.com/" + req.query.tainted); // $ Alert // SSRF - False Negative
+    axios.get("test.com/" + req.query.tainted); // $ Alert // SSRF
   }
 
   const baseURL = "test.com/"
-  if (isValidPath(req.params.tainted) ) {
+  if (isValidPath(req.params.tainted)) {
     axios.get(baseURL + req.params.tainted); // OK
   }
-  if (!isValidPath(req.params.tainted) ) {
+  if (!isValidPath(req.params.tainted)) {
     axios.get(baseURL + req.params.tainted); // $ Alert // SSRF
   } else {
     axios.get(baseURL + req.params.tainted); // OK
@@ -30,15 +30,15 @@ app.get('/check-with-axios', req => {
   if (!req.query.tainted.match(/^[/\.%]+$/)) {
     axios.get("test.com/" + req.query.tainted); // $ Alert // SSRF
   }
-  if (!isInBlacklist(req.params.tainted) ) {
+  if (!isInBlacklist(req.params.tainted)) {
     axios.get(baseURL + req.params.tainted); // $ Alert // SSRF
   }
 
   if (!isValidPath(req.params.tainted)) {
     return;
   }
 
-  axios.get("test.com/" + req.query.tainted); // $ Alert // OK - False Positive
+  axios.get("test.com/" + req.query.tainted); // $ SPURIOUS: Alert // OK - False Positive
 
   if (req.query.tainted.matchAll(/^[0-9a-z]+$/g)) { // letters and numbers
     axios.get("test.com/" + req.query.tainted); // OK
@@ -48,20 +48,20 @@ app.get('/check-with-axios', req => {
   }
 });
 
-const isValidPath = path =>  path.match(/^[0-9a-z]+$/);
+const isValidPath = path => path.match(/^[0-9a-z]+$/);
 
-const isInBlackList = path =>  path.match(/^[/\.%]+$/);
+const isInBlackList = path => path.match(/^[/\.%]+$/);
 
 app.get('/check-with-axios', req => {
   const baseURL = "test.com/"
-  if (isValidPathMatchAll(req.params.tainted) ) {
+  if (isValidPathMatchAll(req.params.tainted)) {
     axios.get(baseURL + req.params.tainted); // OK
   }
-  if (!isValidPathMatchAll(req.params.tainted) ) {
+  if (!isValidPathMatchAll(req.params.tainted)) {
     axios.get(baseURL + req.params.tainted); // $ Alert // NOT OK - SSRF
   } else {
     axios.get(baseURL + req.params.tainted); // OK
   }
 });
 
-const isValidPathMatchAll = path =>  path.matchAll(/^[0-9a-z]+$/g);
+const isValidPathMatchAll = path => path.matchAll(/^[0-9a-z]+$/g);

javascript/ql/test/experimental/Security/CWE-918/check-validator.js

@@ -47,7 +47,7 @@ app.get("/check-with-axios", req => {
     axios.get("test.com/" + req.query.tainted); // OK
   }
   if (validHexa(req.query.tainted)) {
-    axios.get("test.com/" + req.query.tainted); // $ Alert // OK. False Positive
+    axios.get("test.com/" + req.query.tainted); // $ SPURIOUS: Alert // OK. False Positive
   }
 
   // with simple assignation
@@ -56,16 +56,16 @@ app.get("/check-with-axios", req => {
     axios.get("test.com/" + numberURL); // OK
   }
   if (validNumber(numberURL)) {
-    axios.get("test.com/" + req.query.tainted); // $ Alert // OK. False Positive
+    axios.get("test.com/" + req.query.tainted); // $ SPURIOUS: Alert // OK. False Positive
   }
   if (validNumber(req.query.tainted)) {
-    axios.get("test.com/" + numberURL); // $ Alert // OK. False Positive
+    axios.get("test.com/" + numberURL); // $ SPURIOUS: Alert // OK. False Positive
   }
 
-  if (validHexadecimal(req.query.tainted) || validHexaColor(req.query.tainted) || 
-      validDecimal(req.query.tainted) || validFloat(req.query.tainted) || validInt(req.query.tainted) || 
-      validNumber(req.query.tainted) || validOctal(req.query.tainted)) {
-    axios.get("test.com/" + req.query.tainted); // $ Alert // OK. False Positive
+  if (validHexadecimal(req.query.tainted) || validHexaColor(req.query.tainted) ||
+    validDecimal(req.query.tainted) || validFloat(req.query.tainted) || validInt(req.query.tainted) ||
+    validNumber(req.query.tainted) || validOctal(req.query.tainted)) {
+    axios.get("test.com/" + req.query.tainted); // $ SPURIOUS: Alert // OK. False Positive
   }
 });
 
@@ -93,6 +93,6 @@ const validHexaColor = url => validator.isHexColor(url);
 const validUUID = url => validator.isUUID(url);
 
 // unsafe validators
-const wrongValidation = url => validator.isByteLength(url, {min:4,max:8});
+const wrongValidation = url => validator.isByteLength(url, { min: 4, max: 8 });
 
 const isAlphanumeric = url => true;

javascript/ql/test/query-tests/AngularJS/MissingExplicitInjection/missing-explicit-injection.js

@@ -21,7 +21,7 @@
         controller: notInjected7
     };
 
-    function injected8(name){} // OK - false negative: we do not track through properties
+    function injected8(name){} // $ MISSING: Alert // false negative: we do not track through properties
     var obj8 = {
         controller: injected8
     };