Skip to content

Commit fa02651

Browse files
erik-krogherik-krogh
committed
add taint step through the strip-ansi library
1 parent fe76341 commit fa02651

File tree

4 files changed

+111
-87
lines changed

4 files changed

+111
-87
lines changed

‎javascript/change-notes/2021-06-22-colors.md‎

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -9,4 +9,5 @@ lgtm,codescanning
99
[cli-color](https://npmjs.com/package/cli-color),
1010
[slice-ansi](https://npmjs.com/package/slice-ansi),
1111
[kleur](https://npmjs.com/package/kleur),
12-
[chalk](https://npmjs.com/package/chalk)
12+
[chalk](https://npmjs.com/package/chalk),
13+
[strip-ansi](https://npmjs.com/package/strip-ansi)

‎javascript/ql/src/semmle/javascript/frameworks/Logging.qll‎

Lines changed: 12 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -320,3 +320,15 @@ class ChalkStep extends TaintTracking::SharedTaintStep {
320320
)
321321
}
322322
}
323+
324+
/**
325+
* A step through the [`strip-ansi`](https://npmjs.org/package/strip-ansi) library.
326+
*/
327+
class StripAnsiStep extends TaintTracking::SharedTaintStep {
328+
override predicate stringManipulationStep(DataFlow::Node pred, DataFlow::Node succ) {
329+
exists(API::CallNode call | call = API::moduleImport("strip-ansi").getACall() |
330+
pred = call.getArgument(0) and
331+
succ = call
332+
)
333+
}
334+
}

‎javascript/ql/test/query-tests/Security/CWE-117/LogInjection.expected‎

Lines changed: 95 additions & 86 deletions
Original file line numberDiff line numberDiff line change
@@ -22,45 +22,49 @@ nodes
2222
| logInjectionBad.js:30:23:30:49 | `[ERROR ... rror}"` |
2323
| logInjectionBad.js:30:23:30:49 | `[ERROR ... rror}"` |
2424
| logInjectionBad.js:30:42:30:46 | error |
25-
| logInjectionBad.js:45:9:45:36 | q |
26-
| logInjectionBad.js:45:13:45:36 | url.par ... , true) |
27-
| logInjectionBad.js:45:23:45:29 | req.url |
28-
| logInjectionBad.js:45:23:45:29 | req.url |
29-
| logInjectionBad.js:46:9:46:35 | username |
30-
| logInjectionBad.js:46:20:46:20 | q |
31-
| logInjectionBad.js:46:20:46:26 | q.query |
32-
| logInjectionBad.js:46:20:46:35 | q.query.username |
33-
| logInjectionBad.js:48:18:48:54 | ansiCol ... ername) |
34-
| logInjectionBad.js:48:18:48:54 | ansiCol ... ername) |
35-
| logInjectionBad.js:48:46:48:53 | username |
36-
| logInjectionBad.js:49:18:49:47 | colors. ... ername) |
37-
| logInjectionBad.js:49:18:49:47 | colors. ... ername) |
38-
| logInjectionBad.js:49:39:49:46 | username |
39-
| logInjectionBad.js:50:18:50:61 | wrapAns ... e), 20) |
40-
| logInjectionBad.js:50:18:50:61 | wrapAns ... e), 20) |
41-
| logInjectionBad.js:50:27:50:56 | colors. ... ername) |
42-
| logInjectionBad.js:50:48:50:55 | username |
43-
| logInjectionBad.js:51:17:51:47 | underli ... name))) |
44-
| logInjectionBad.js:51:17:51:47 | underli ... name))) |
45-
| logInjectionBad.js:51:27:51:46 | bold(blue(username)) |
46-
| logInjectionBad.js:51:32:51:45 | blue(username) |
47-
| logInjectionBad.js:51:37:51:44 | username |
48-
| logInjectionBad.js:52:17:52:76 | highlig ... true}) |
49-
| logInjectionBad.js:52:17:52:76 | highlig ... true}) |
50-
| logInjectionBad.js:52:27:52:34 | username |
51-
| logInjectionBad.js:53:17:53:51 | clc.red ... ername) |
52-
| logInjectionBad.js:53:17:53:51 | clc.red ... ername) |
53-
| logInjectionBad.js:53:43:53:50 | username |
54-
| logInjectionBad.js:54:17:54:65 | sliceAn ... 20, 30) |
55-
| logInjectionBad.js:54:17:54:65 | sliceAn ... 20, 30) |
56-
| logInjectionBad.js:54:27:54:56 | colors. ... ername) |
57-
| logInjectionBad.js:54:48:54:55 | username |
58-
| logInjectionBad.js:55:17:55:55 | kleur.b ... ername) |
59-
| logInjectionBad.js:55:17:55:55 | kleur.b ... ername) |
60-
| logInjectionBad.js:55:47:55:54 | username |
61-
| logInjectionBad.js:56:17:56:48 | chalk.u ... ername) |
62-
| logInjectionBad.js:56:17:56:48 | chalk.u ... ername) |
63-
| logInjectionBad.js:56:40:56:47 | username |
25+
| logInjectionBad.js:46:9:46:36 | q |
26+
| logInjectionBad.js:46:13:46:36 | url.par ... , true) |
27+
| logInjectionBad.js:46:23:46:29 | req.url |
28+
| logInjectionBad.js:46:23:46:29 | req.url |
29+
| logInjectionBad.js:47:9:47:35 | username |
30+
| logInjectionBad.js:47:20:47:20 | q |
31+
| logInjectionBad.js:47:20:47:26 | q.query |
32+
| logInjectionBad.js:47:20:47:35 | q.query.username |
33+
| logInjectionBad.js:49:18:49:54 | ansiCol ... ername) |
34+
| logInjectionBad.js:49:18:49:54 | ansiCol ... ername) |
35+
| logInjectionBad.js:49:46:49:53 | username |
36+
| logInjectionBad.js:50:18:50:47 | colors. ... ername) |
37+
| logInjectionBad.js:50:18:50:47 | colors. ... ername) |
38+
| logInjectionBad.js:50:39:50:46 | username |
39+
| logInjectionBad.js:51:18:51:61 | wrapAns ... e), 20) |
40+
| logInjectionBad.js:51:18:51:61 | wrapAns ... e), 20) |
41+
| logInjectionBad.js:51:27:51:56 | colors. ... ername) |
42+
| logInjectionBad.js:51:48:51:55 | username |
43+
| logInjectionBad.js:52:17:52:47 | underli ... name))) |
44+
| logInjectionBad.js:52:17:52:47 | underli ... name))) |
45+
| logInjectionBad.js:52:27:52:46 | bold(blue(username)) |
46+
| logInjectionBad.js:52:32:52:45 | blue(username) |
47+
| logInjectionBad.js:52:37:52:44 | username |
48+
| logInjectionBad.js:53:17:53:76 | highlig ... true}) |
49+
| logInjectionBad.js:53:17:53:76 | highlig ... true}) |
50+
| logInjectionBad.js:53:27:53:34 | username |
51+
| logInjectionBad.js:54:17:54:51 | clc.red ... ername) |
52+
| logInjectionBad.js:54:17:54:51 | clc.red ... ername) |
53+
| logInjectionBad.js:54:43:54:50 | username |
54+
| logInjectionBad.js:55:17:55:65 | sliceAn ... 20, 30) |
55+
| logInjectionBad.js:55:17:55:65 | sliceAn ... 20, 30) |
56+
| logInjectionBad.js:55:27:55:56 | colors. ... ername) |
57+
| logInjectionBad.js:55:48:55:55 | username |
58+
| logInjectionBad.js:56:17:56:55 | kleur.b ... ername) |
59+
| logInjectionBad.js:56:17:56:55 | kleur.b ... ername) |
60+
| logInjectionBad.js:56:47:56:54 | username |
61+
| logInjectionBad.js:57:17:57:48 | chalk.u ... ername) |
62+
| logInjectionBad.js:57:17:57:48 | chalk.u ... ername) |
63+
| logInjectionBad.js:57:40:57:47 | username |
64+
| logInjectionBad.js:58:17:58:59 | stripAn ... rname)) |
65+
| logInjectionBad.js:58:17:58:59 | stripAn ... rname)) |
66+
| logInjectionBad.js:58:27:58:58 | chalk.u ... ername) |
67+
| logInjectionBad.js:58:50:58:57 | username |
6468
edges
6569
| logInjectionBad.js:19:9:19:36 | q | logInjectionBad.js:20:20:20:20 | q |
6670
| logInjectionBad.js:19:13:19:36 | url.par ... , true) | logInjectionBad.js:19:9:19:36 | q |
@@ -84,56 +88,61 @@ edges
8488
| logInjectionBad.js:29:14:29:18 | error | logInjectionBad.js:30:42:30:46 | error |
8589
| logInjectionBad.js:30:42:30:46 | error | logInjectionBad.js:30:23:30:49 | `[ERROR ... rror}"` |
8690
| logInjectionBad.js:30:42:30:46 | error | logInjectionBad.js:30:23:30:49 | `[ERROR ... rror}"` |
87-
| logInjectionBad.js:45:9:45:36 | q | logInjectionBad.js:46:20:46:20 | q |
88-
| logInjectionBad.js:45:13:45:36 | url.par ... , true) | logInjectionBad.js:45:9:45:36 | q |
89-
| logInjectionBad.js:45:23:45:29 | req.url | logInjectionBad.js:45:13:45:36 | url.par ... , true) |
90-
| logInjectionBad.js:45:23:45:29 | req.url | logInjectionBad.js:45:13:45:36 | url.par ... , true) |
91-
| logInjectionBad.js:46:9:46:35 | username | logInjectionBad.js:48:46:48:53 | username |
92-
| logInjectionBad.js:46:9:46:35 | username | logInjectionBad.js:49:39:49:46 | username |
93-
| logInjectionBad.js:46:9:46:35 | username | logInjectionBad.js:50:48:50:55 | username |
94-
| logInjectionBad.js:46:9:46:35 | username | logInjectionBad.js:51:37:51:44 | username |
95-
| logInjectionBad.js:46:9:46:35 | username | logInjectionBad.js:52:27:52:34 | username |
96-
| logInjectionBad.js:46:9:46:35 | username | logInjectionBad.js:53:43:53:50 | username |
97-
| logInjectionBad.js:46:9:46:35 | username | logInjectionBad.js:54:48:54:55 | username |
98-
| logInjectionBad.js:46:9:46:35 | username | logInjectionBad.js:55:47:55:54 | username |
99-
| logInjectionBad.js:46:9:46:35 | username | logInjectionBad.js:56:40:56:47 | username |
100-
| logInjectionBad.js:46:20:46:20 | q | logInjectionBad.js:46:20:46:26 | q.query |
101-
| logInjectionBad.js:46:20:46:26 | q.query | logInjectionBad.js:46:20:46:35 | q.query.username |
102-
| logInjectionBad.js:46:20:46:35 | q.query.username | logInjectionBad.js:46:9:46:35 | username |
103-
| logInjectionBad.js:48:46:48:53 | username | logInjectionBad.js:48:18:48:54 | ansiCol ... ername) |
104-
| logInjectionBad.js:48:46:48:53 | username | logInjectionBad.js:48:18:48:54 | ansiCol ... ername) |
105-
| logInjectionBad.js:49:39:49:46 | username | logInjectionBad.js:49:18:49:47 | colors. ... ername) |
106-
| logInjectionBad.js:49:39:49:46 | username | logInjectionBad.js:49:18:49:47 | colors. ... ername) |
107-
| logInjectionBad.js:50:27:50:56 | colors. ... ername) | logInjectionBad.js:50:18:50:61 | wrapAns ... e), 20) |
108-
| logInjectionBad.js:50:27:50:56 | colors. ... ername) | logInjectionBad.js:50:18:50:61 | wrapAns ... e), 20) |
109-
| logInjectionBad.js:50:48:50:55 | username | logInjectionBad.js:50:27:50:56 | colors. ... ername) |
110-
| logInjectionBad.js:51:27:51:46 | bold(blue(username)) | logInjectionBad.js:51:17:51:47 | underli ... name))) |
111-
| logInjectionBad.js:51:27:51:46 | bold(blue(username)) | logInjectionBad.js:51:17:51:47 | underli ... name))) |
112-
| logInjectionBad.js:51:32:51:45 | blue(username) | logInjectionBad.js:51:27:51:46 | bold(blue(username)) |
113-
| logInjectionBad.js:51:37:51:44 | username | logInjectionBad.js:51:32:51:45 | blue(username) |
114-
| logInjectionBad.js:52:27:52:34 | username | logInjectionBad.js:52:17:52:76 | highlig ... true}) |
115-
| logInjectionBad.js:52:27:52:34 | username | logInjectionBad.js:52:17:52:76 | highlig ... true}) |
116-
| logInjectionBad.js:53:43:53:50 | username | logInjectionBad.js:53:17:53:51 | clc.red ... ername) |
117-
| logInjectionBad.js:53:43:53:50 | username | logInjectionBad.js:53:17:53:51 | clc.red ... ername) |
118-
| logInjectionBad.js:54:27:54:56 | colors. ... ername) | logInjectionBad.js:54:17:54:65 | sliceAn ... 20, 30) |
119-
| logInjectionBad.js:54:27:54:56 | colors. ... ername) | logInjectionBad.js:54:17:54:65 | sliceAn ... 20, 30) |
120-
| logInjectionBad.js:54:48:54:55 | username | logInjectionBad.js:54:27:54:56 | colors. ... ername) |
121-
| logInjectionBad.js:55:47:55:54 | username | logInjectionBad.js:55:17:55:55 | kleur.b ... ername) |
122-
| logInjectionBad.js:55:47:55:54 | username | logInjectionBad.js:55:17:55:55 | kleur.b ... ername) |
123-
| logInjectionBad.js:56:40:56:47 | username | logInjectionBad.js:56:17:56:48 | chalk.u ... ername) |
124-
| logInjectionBad.js:56:40:56:47 | username | logInjectionBad.js:56:17:56:48 | chalk.u ... ername) |
91+
| logInjectionBad.js:46:9:46:36 | q | logInjectionBad.js:47:20:47:20 | q |
92+
| logInjectionBad.js:46:13:46:36 | url.par ... , true) | logInjectionBad.js:46:9:46:36 | q |
93+
| logInjectionBad.js:46:23:46:29 | req.url | logInjectionBad.js:46:13:46:36 | url.par ... , true) |
94+
| logInjectionBad.js:46:23:46:29 | req.url | logInjectionBad.js:46:13:46:36 | url.par ... , true) |
95+
| logInjectionBad.js:47:9:47:35 | username | logInjectionBad.js:49:46:49:53 | username |
96+
| logInjectionBad.js:47:9:47:35 | username | logInjectionBad.js:50:39:50:46 | username |
97+
| logInjectionBad.js:47:9:47:35 | username | logInjectionBad.js:51:48:51:55 | username |
98+
| logInjectionBad.js:47:9:47:35 | username | logInjectionBad.js:52:37:52:44 | username |
99+
| logInjectionBad.js:47:9:47:35 | username | logInjectionBad.js:53:27:53:34 | username |
100+
| logInjectionBad.js:47:9:47:35 | username | logInjectionBad.js:54:43:54:50 | username |
101+
| logInjectionBad.js:47:9:47:35 | username | logInjectionBad.js:55:48:55:55 | username |
102+
| logInjectionBad.js:47:9:47:35 | username | logInjectionBad.js:56:47:56:54 | username |
103+
| logInjectionBad.js:47:9:47:35 | username | logInjectionBad.js:57:40:57:47 | username |
104+
| logInjectionBad.js:47:9:47:35 | username | logInjectionBad.js:58:50:58:57 | username |
105+
| logInjectionBad.js:47:20:47:20 | q | logInjectionBad.js:47:20:47:26 | q.query |
106+
| logInjectionBad.js:47:20:47:26 | q.query | logInjectionBad.js:47:20:47:35 | q.query.username |
107+
| logInjectionBad.js:47:20:47:35 | q.query.username | logInjectionBad.js:47:9:47:35 | username |
108+
| logInjectionBad.js:49:46:49:53 | username | logInjectionBad.js:49:18:49:54 | ansiCol ... ername) |
109+
| logInjectionBad.js:49:46:49:53 | username | logInjectionBad.js:49:18:49:54 | ansiCol ... ername) |
110+
| logInjectionBad.js:50:39:50:46 | username | logInjectionBad.js:50:18:50:47 | colors. ... ername) |
111+
| logInjectionBad.js:50:39:50:46 | username | logInjectionBad.js:50:18:50:47 | colors. ... ername) |
112+
| logInjectionBad.js:51:27:51:56 | colors. ... ername) | logInjectionBad.js:51:18:51:61 | wrapAns ... e), 20) |
113+
| logInjectionBad.js:51:27:51:56 | colors. ... ername) | logInjectionBad.js:51:18:51:61 | wrapAns ... e), 20) |
114+
| logInjectionBad.js:51:48:51:55 | username | logInjectionBad.js:51:27:51:56 | colors. ... ername) |
115+
| logInjectionBad.js:52:27:52:46 | bold(blue(username)) | logInjectionBad.js:52:17:52:47 | underli ... name))) |
116+
| logInjectionBad.js:52:27:52:46 | bold(blue(username)) | logInjectionBad.js:52:17:52:47 | underli ... name))) |
117+
| logInjectionBad.js:52:32:52:45 | blue(username) | logInjectionBad.js:52:27:52:46 | bold(blue(username)) |
118+
| logInjectionBad.js:52:37:52:44 | username | logInjectionBad.js:52:32:52:45 | blue(username) |
119+
| logInjectionBad.js:53:27:53:34 | username | logInjectionBad.js:53:17:53:76 | highlig ... true}) |
120+
| logInjectionBad.js:53:27:53:34 | username | logInjectionBad.js:53:17:53:76 | highlig ... true}) |
121+
| logInjectionBad.js:54:43:54:50 | username | logInjectionBad.js:54:17:54:51 | clc.red ... ername) |
122+
| logInjectionBad.js:54:43:54:50 | username | logInjectionBad.js:54:17:54:51 | clc.red ... ername) |
123+
| logInjectionBad.js:55:27:55:56 | colors. ... ername) | logInjectionBad.js:55:17:55:65 | sliceAn ... 20, 30) |
124+
| logInjectionBad.js:55:27:55:56 | colors. ... ername) | logInjectionBad.js:55:17:55:65 | sliceAn ... 20, 30) |
125+
| logInjectionBad.js:55:48:55:55 | username | logInjectionBad.js:55:27:55:56 | colors. ... ername) |
126+
| logInjectionBad.js:56:47:56:54 | username | logInjectionBad.js:56:17:56:55 | kleur.b ... ername) |
127+
| logInjectionBad.js:56:47:56:54 | username | logInjectionBad.js:56:17:56:55 | kleur.b ... ername) |
128+
| logInjectionBad.js:57:40:57:47 | username | logInjectionBad.js:57:17:57:48 | chalk.u ... ername) |
129+
| logInjectionBad.js:57:40:57:47 | username | logInjectionBad.js:57:17:57:48 | chalk.u ... ername) |
130+
| logInjectionBad.js:58:27:58:58 | chalk.u ... ername) | logInjectionBad.js:58:17:58:59 | stripAn ... rname)) |
131+
| logInjectionBad.js:58:27:58:58 | chalk.u ... ername) | logInjectionBad.js:58:17:58:59 | stripAn ... rname)) |
132+
| logInjectionBad.js:58:50:58:57 | username | logInjectionBad.js:58:27:58:58 | chalk.u ... ername) |
125133
#select
126134
| logInjectionBad.js:22:18:22:43 | `[INFO] ... rname}` | logInjectionBad.js:19:23:19:29 | req.url | logInjectionBad.js:22:18:22:43 | `[INFO] ... rname}` | $@ flows to log entry. | logInjectionBad.js:19:23:19:29 | req.url | User-provided value |
127135
| logInjectionBad.js:23:37:23:44 | username | logInjectionBad.js:19:23:19:29 | req.url | logInjectionBad.js:23:37:23:44 | username | $@ flows to log entry. | logInjectionBad.js:19:23:19:29 | req.url | User-provided value |
128136
| logInjectionBad.js:24:35:24:42 | username | logInjectionBad.js:19:23:19:29 | req.url | logInjectionBad.js:24:35:24:42 | username | $@ flows to log entry. | logInjectionBad.js:19:23:19:29 | req.url | User-provided value |
129137
| logInjectionBad.js:25:36:25:43 | username | logInjectionBad.js:19:23:19:29 | req.url | logInjectionBad.js:25:36:25:43 | username | $@ flows to log entry. | logInjectionBad.js:19:23:19:29 | req.url | User-provided value |
130138
| logInjectionBad.js:30:23:30:49 | `[ERROR ... rror}"` | logInjectionBad.js:19:23:19:29 | req.url | logInjectionBad.js:30:23:30:49 | `[ERROR ... rror}"` | $@ flows to log entry. | logInjectionBad.js:19:23:19:29 | req.url | User-provided value |
131-
| logInjectionBad.js:48:18:48:54 | ansiCol ... ername) | logInjectionBad.js:45:23:45:29 | req.url | logInjectionBad.js:48:18:48:54 | ansiCol ... ername) | $@ flows to log entry. | logInjectionBad.js:45:23:45:29 | req.url | User-provided value |
132-
| logInjectionBad.js:49:18:49:47 | colors. ... ername) | logInjectionBad.js:45:23:45:29 | req.url | logInjectionBad.js:49:18:49:47 | colors. ... ername) | $@ flows to log entry. | logInjectionBad.js:45:23:45:29 | req.url | User-provided value |
133-
| logInjectionBad.js:50:18:50:61 | wrapAns ... e), 20) | logInjectionBad.js:45:23:45:29 | req.url | logInjectionBad.js:50:18:50:61 | wrapAns ... e), 20) | $@ flows to log entry. | logInjectionBad.js:45:23:45:29 | req.url | User-provided value |
134-
| logInjectionBad.js:51:17:51:47 | underli ... name))) | logInjectionBad.js:45:23:45:29 | req.url | logInjectionBad.js:51:17:51:47 | underli ... name))) | $@ flows to log entry. | logInjectionBad.js:45:23:45:29 | req.url | User-provided value |
135-
| logInjectionBad.js:52:17:52:76 | highlig ... true}) | logInjectionBad.js:45:23:45:29 | req.url | logInjectionBad.js:52:17:52:76 | highlig ... true}) | $@ flows to log entry. | logInjectionBad.js:45:23:45:29 | req.url | User-provided value |
136-
| logInjectionBad.js:53:17:53:51 | clc.red ... ername) | logInjectionBad.js:45:23:45:29 | req.url | logInjectionBad.js:53:17:53:51 | clc.red ... ername) | $@ flows to log entry. | logInjectionBad.js:45:23:45:29 | req.url | User-provided value |
137-
| logInjectionBad.js:54:17:54:65 | sliceAn ... 20, 30) | logInjectionBad.js:45:23:45:29 | req.url | logInjectionBad.js:54:17:54:65 | sliceAn ... 20, 30) | $@ flows to log entry. | logInjectionBad.js:45:23:45:29 | req.url | User-provided value |
138-
| logInjectionBad.js:55:17:55:55 | kleur.b ... ername) | logInjectionBad.js:45:23:45:29 | req.url | logInjectionBad.js:55:17:55:55 | kleur.b ... ername) | $@ flows to log entry. | logInjectionBad.js:45:23:45:29 | req.url | User-provided value |
139-
| logInjectionBad.js:56:17:56:48 | chalk.u ... ername) | logInjectionBad.js:45:23:45:29 | req.url | logInjectionBad.js:56:17:56:48 | chalk.u ... ername) | $@ flows to log entry. | logInjectionBad.js:45:23:45:29 | req.url | User-provided value |
139+
| logInjectionBad.js:49:18:49:54 | ansiCol ... ername) | logInjectionBad.js:46:23:46:29 | req.url | logInjectionBad.js:49:18:49:54 | ansiCol ... ername) | $@ flows to log entry. | logInjectionBad.js:46:23:46:29 | req.url | User-provided value |
140+
| logInjectionBad.js:50:18:50:47 | colors. ... ername) | logInjectionBad.js:46:23:46:29 | req.url | logInjectionBad.js:50:18:50:47 | colors. ... ername) | $@ flows to log entry. | logInjectionBad.js:46:23:46:29 | req.url | User-provided value |
141+
| logInjectionBad.js:51:18:51:61 | wrapAns ... e), 20) | logInjectionBad.js:46:23:46:29 | req.url | logInjectionBad.js:51:18:51:61 | wrapAns ... e), 20) | $@ flows to log entry. | logInjectionBad.js:46:23:46:29 | req.url | User-provided value |
142+
| logInjectionBad.js:52:17:52:47 | underli ... name))) | logInjectionBad.js:46:23:46:29 | req.url | logInjectionBad.js:52:17:52:47 | underli ... name))) | $@ flows to log entry. | logInjectionBad.js:46:23:46:29 | req.url | User-provided value |
143+
| logInjectionBad.js:53:17:53:76 | highlig ... true}) | logInjectionBad.js:46:23:46:29 | req.url | logInjectionBad.js:53:17:53:76 | highlig ... true}) | $@ flows to log entry. | logInjectionBad.js:46:23:46:29 | req.url | User-provided value |
144+
| logInjectionBad.js:54:17:54:51 | clc.red ... ername) | logInjectionBad.js:46:23:46:29 | req.url | logInjectionBad.js:54:17:54:51 | clc.red ... ername) | $@ flows to log entry. | logInjectionBad.js:46:23:46:29 | req.url | User-provided value |
145+
| logInjectionBad.js:55:17:55:65 | sliceAn ... 20, 30) | logInjectionBad.js:46:23:46:29 | req.url | logInjectionBad.js:55:17:55:65 | sliceAn ... 20, 30) | $@ flows to log entry. | logInjectionBad.js:46:23:46:29 | req.url | User-provided value |
146+
| logInjectionBad.js:56:17:56:55 | kleur.b ... ername) | logInjectionBad.js:46:23:46:29 | req.url | logInjectionBad.js:56:17:56:55 | kleur.b ... ername) | $@ flows to log entry. | logInjectionBad.js:46:23:46:29 | req.url | User-provided value |
147+
| logInjectionBad.js:57:17:57:48 | chalk.u ... ername) | logInjectionBad.js:46:23:46:29 | req.url | logInjectionBad.js:57:17:57:48 | chalk.u ... ername) | $@ flows to log entry. | logInjectionBad.js:46:23:46:29 | req.url | User-provided value |
148+
| logInjectionBad.js:58:17:58:59 | stripAn ... rname)) | logInjectionBad.js:46:23:46:29 | req.url | logInjectionBad.js:58:17:58:59 | stripAn ... rname)) | $@ flows to log entry. | logInjectionBad.js:46:23:46:29 | req.url | User-provided value |

‎javascript/ql/test/query-tests/Security/CWE-117/logInjectionBad.js‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -40,6 +40,7 @@ var clc = require("cli-color");
4040
import sliceAnsi from 'slice-ansi';
4141
import kleur from 'kleur';
4242
const chalk = require('chalk');
43+
import stripAnsi from 'strip-ansi';
4344

4445
const server2 = http.createServer((req, res) => {
4546
let q = url.parse(req.url, true);
@@ -54,4 +55,5 @@ const server2 = http.createServer((req, res) => {
5455
console.log(sliceAnsi(colors.red.underline(username), 20, 30)); // NOT OK
5556
console.log(kleur.blue().bold().underline(username)); // NOT OK
5657
console.log(chalk.underline.bgBlue(username)); // NOT OK
58+
console.log(stripAnsi(chalk.underline.bgBlue(username))); // NOT OK
5759
});

0 commit comments

Comments
 (0)