Added tests and modeling of database-access-result · github/codeql@5b31350 · GitHub
Skip to content

Commit 5b31350

Browse files
NapalysNapalys
committed
Added tests and modeling of database-access-result
1 parent 93d9ae7 commit 5b31350

7 files changed

Lines changed: 168 additions & 1 deletion

File tree

‎javascript/ql/lib/change-notes/2025-07-28-dynamodb.md‎

Lines changed: 1 addition & 1 deletion

‎javascript/ql/lib/ext/athena.model.yml‎

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -19,3 +19,11 @@ extensions:
1919
data:
2020
- ["AthenaClientV3", "@aws-sdk/client-athena", "Member[AthenaClient]"]
2121
- ["AthenaClientV2", "aws-sdk", "Member[Athena]"]
22+
23+
- addsTo:
24+
pack: codeql/javascript-all
25+
extensible: sourceModel
26+
data:
27+
- ["AthenaClientV3", "ReturnValue.Member[send].ReturnValue.Awaited", "database-access-result"]
28+
- ["AthenaClientV2", "ReturnValue.Member[getQueryResults].ReturnValue.Member[promise].ReturnValue.Awaited", "database-access-result"]
29+
- ["AthenaClientV2", "ReturnValue.Member[getQueryResults].Argument[1].Parameter[1]", "database-access-result"]

‎javascript/ql/lib/ext/client-s3.model.yml‎

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -18,3 +18,11 @@ extensions:
1818
data:
1919
- ["S3ClientV3", "@aws-sdk/client-s3", "Member[S3Client]"]
2020
- ["S3ClientV2", "aws-sdk", "Member[S3]"]
21+
22+
- addsTo:
23+
pack: codeql/javascript-all
24+
extensible: sourceModel
25+
data:
26+
- ["S3ClientV3", "ReturnValue.Member[send].ReturnValue.Awaited", "database-access-result"]
27+
- ["S3ClientV2", "ReturnValue.Member[getObject].ReturnValue.Member[promise].ReturnValue.Awaited", "database-access-result"]
28+
- ["S3ClientV2", "ReturnValue.Member[getObject].Argument[1].Parameter[1]", "database-access-result"]

‎javascript/ql/lib/ext/dynamodb.model.yml‎

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -20,3 +20,11 @@ extensions:
2020
data:
2121
- ["DynamoDBClientV3", "@aws-sdk/client-dynamodb", "Member[DynamoDBClient,DynamoDB]"]
2222
- ["DynamoDBClientV2", "aws-sdk", "Member[DynamoDB]"]
23+
24+
- addsTo:
25+
pack: codeql/javascript-all
26+
extensible: sourceModel
27+
data:
28+
- ["DynamoDBClientV3", "ReturnValue.Member[send].ReturnValue.Awaited", "database-access-result"]
29+
- ["DynamoDBClientV2", "ReturnValue.Member[executeStatement,batchExecuteStatement].ReturnValue.Member[promise].ReturnValue.Awaited", "database-access-result"]
30+
- ["DynamoDBClientV2", "ReturnValue.Member[executeStatement,batchExecuteStatement].Argument[1].Parameter[1]", "database-access-result"]

‎javascript/ql/lib/ext/rds-client.model.yml‎

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -21,3 +21,11 @@ extensions:
2121
data:
2222
- ["RDSDataClientV3", "@aws-sdk/client-rds-data", "Member[RDSDataClient]"]
2323
- ["RDSDataClientV2", "aws-sdk", "Member[RDSDataService]"]
24+
25+
- addsTo:
26+
pack: codeql/javascript-all
27+
extensible: sourceModel
28+
data:
29+
- ["RDSDataClientV3", "ReturnValue.Member[send].ReturnValue.Awaited", "database-access-result"]
30+
- ["RDSDataClientV2", "ReturnValue.Member[executeStatement,batchExecuteStatement].ReturnValue.Member[promise].ReturnValue.Awaited", "database-access-result"]
31+
- ["RDSDataClientV2", "ReturnValue.Member[executeStatement,batchExecuteStatement].Argument[1].Parameter[1]", "database-access-result"]

‎javascript/ql/test/query-tests/Security/CWE-079/DomBasedXss/XssWithAdditionalSources.expected‎

Lines changed: 56 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -32,6 +32,34 @@ nodes
3232
| angular-tempate-url.js:13:30:13:31 | ev | semmle.label | ev |
3333
| angular-tempate-url.js:14:26:14:27 | ev | semmle.label | ev |
3434
| angular-tempate-url.js:14:26:14:32 | ev.data | semmle.label | ev.data |
35+
| aws-db.js:15:31:15:37 | results | semmle.label | results |
36+
| aws-db.js:15:31:15:76 | results ... arValue | semmle.label | results ... arValue |
37+
| aws-db.js:20:31:20:38 | response | semmle.label | response |
38+
| aws-db.js:20:31:20:54 | respons ... tring() | semmle.label | respons ... tring() |
39+
| aws-db.js:24:31:24:39 | response2 | semmle.label | response2 |
40+
| aws-db.js:24:31:24:47 | response2.records | semmle.label | response2.records |
41+
| aws-db.js:28:31:28:39 | response3 | semmle.label | response3 |
42+
| aws-db.js:28:31:28:44 | response3.Item | semmle.label | response3.Item |
43+
| aws-db.js:43:31:43:37 | results | semmle.label | results |
44+
| aws-db.js:43:31:43:76 | results ... arValue | semmle.label | results ... arValue |
45+
| aws-db.js:46:35:46:38 | data | semmle.label | data |
46+
| aws-db.js:46:35:46:77 | data.Re ... arValue | semmle.label | data.Re ... arValue |
47+
| aws-db.js:51:31:51:38 | response | semmle.label | response |
48+
| aws-db.js:51:31:51:54 | respons ... tring() | semmle.label | respons ... tring() |
49+
| aws-db.js:54:35:54:38 | data | semmle.label | data |
50+
| aws-db.js:54:35:54:54 | data.Body.toString() | semmle.label | data.Body.toString() |
51+
| aws-db.js:59:31:59:39 | response1 | semmle.label | response1 |
52+
| aws-db.js:59:31:59:47 | response1.records | semmle.label | response1.records |
53+
| aws-db.js:62:35:62:38 | data | semmle.label | data |
54+
| aws-db.js:62:35:62:46 | data.records | semmle.label | data.records |
55+
| aws-db.js:66:31:66:39 | response2 | semmle.label | response2 |
56+
| aws-db.js:66:31:66:53 | respons ... Results | semmle.label | respons ... Results |
57+
| aws-db.js:69:35:69:38 | data | semmle.label | data |
58+
| aws-db.js:69:35:69:52 | data.updateResults | semmle.label | data.updateResults |
59+
| aws-db.js:74:35:74:38 | data | semmle.label | data |
60+
| aws-db.js:74:35:74:43 | data.Item | semmle.label | data.Item |
61+
| aws-db.js:77:35:77:38 | data | semmle.label | data |
62+
| aws-db.js:77:35:77:43 | data.Item | semmle.label | data.Item |
3563
| classnames.js:7:31:7:84 | `<span ... <span>` | semmle.label | `<span ... <span>` |
3664
| classnames.js:7:47:7:69 | classNa ... w.name) | semmle.label | classNa ... w.name) |
3765
| classnames.js:7:58:7:68 | window.name | semmle.label | window.name |
@@ -724,6 +752,20 @@ edges
724752
| angular-tempate-url.js:13:30:13:31 | ev | angular-tempate-url.js:14:26:14:27 | ev | provenance | |
725753
| angular-tempate-url.js:14:26:14:27 | ev | angular-tempate-url.js:14:26:14:32 | ev.data | provenance | |
726754
| angular-tempate-url.js:14:26:14:32 | ev.data | angular-tempate-url.js:9:26:9:45 | Cookie.get("unsafe") | provenance | |
755+
| aws-db.js:15:31:15:37 | results | aws-db.js:15:31:15:76 | results ... arValue | provenance | |
756+
| aws-db.js:20:31:20:38 | response | aws-db.js:20:31:20:54 | respons ... tring() | provenance | |
757+
| aws-db.js:24:31:24:39 | response2 | aws-db.js:24:31:24:47 | response2.records | provenance | |
758+
| aws-db.js:28:31:28:39 | response3 | aws-db.js:28:31:28:44 | response3.Item | provenance | |
759+
| aws-db.js:43:31:43:37 | results | aws-db.js:43:31:43:76 | results ... arValue | provenance | |
760+
| aws-db.js:46:35:46:38 | data | aws-db.js:46:35:46:77 | data.Re ... arValue | provenance | |
761+
| aws-db.js:51:31:51:38 | response | aws-db.js:51:31:51:54 | respons ... tring() | provenance | |
762+
| aws-db.js:54:35:54:38 | data | aws-db.js:54:35:54:54 | data.Body.toString() | provenance | |
763+
| aws-db.js:59:31:59:39 | response1 | aws-db.js:59:31:59:47 | response1.records | provenance | |
764+
| aws-db.js:62:35:62:38 | data | aws-db.js:62:35:62:46 | data.records | provenance | |
765+
| aws-db.js:66:31:66:39 | response2 | aws-db.js:66:31:66:53 | respons ... Results | provenance | |
766+
| aws-db.js:69:35:69:38 | data | aws-db.js:69:35:69:52 | data.updateResults | provenance | |
767+
| aws-db.js:74:35:74:38 | data | aws-db.js:74:35:74:43 | data.Item | provenance | |
768+
| aws-db.js:77:35:77:38 | data | aws-db.js:77:35:77:43 | data.Item | provenance | |
727769
| classnames.js:7:47:7:69 | classNa ... w.name) | classnames.js:7:31:7:84 | `<span ... <span>` | provenance | |
728770
| classnames.js:7:58:7:68 | window.name | classnames.js:7:47:7:69 | classNa ... w.name) | provenance | |
729771
| classnames.js:8:47:8:70 | classNa ... w.name) | classnames.js:8:31:8:85 | `<span ... <span>` | provenance | |
@@ -1319,6 +1361,20 @@ subpaths
13191361
| various-concat-obfuscations.js:21:17:21:46 | documen ... h.attrs | various-concat-obfuscations.js:17:24:17:28 | attrs | various-concat-obfuscations.js:18:10:18:105 | '<div a ... /div>') | various-concat-obfuscations.js:21:4:21:47 | indirec ... .attrs) |
13201362
| various-concat-obfuscations.js:21:17:21:46 | documen ... h.attrs | various-concat-obfuscations.js:17:24:17:28 | attrs | various-concat-obfuscations.js:18:10:18:105 | '<div a ... /div>') [ArrayElement] | various-concat-obfuscations.js:21:4:21:47 | indirec ... .attrs) |
13211363
#select
1364+
| aws-db.js:15:31:15:76 | results ... arValue | aws-db.js:15:31:15:37 | results | aws-db.js:15:31:15:76 | results ... arValue | Cross-site scripting vulnerability due to $@. | aws-db.js:15:31:15:37 | results | user-provided value |
1365+
| aws-db.js:20:31:20:54 | respons ... tring() | aws-db.js:20:31:20:38 | response | aws-db.js:20:31:20:54 | respons ... tring() | Cross-site scripting vulnerability due to $@. | aws-db.js:20:31:20:38 | response | user-provided value |
1366+
| aws-db.js:24:31:24:47 | response2.records | aws-db.js:24:31:24:39 | response2 | aws-db.js:24:31:24:47 | response2.records | Cross-site scripting vulnerability due to $@. | aws-db.js:24:31:24:39 | response2 | user-provided value |
1367+
| aws-db.js:28:31:28:44 | response3.Item | aws-db.js:28:31:28:39 | response3 | aws-db.js:28:31:28:44 | response3.Item | Cross-site scripting vulnerability due to $@. | aws-db.js:28:31:28:39 | response3 | user-provided value |
1368+
| aws-db.js:43:31:43:76 | results ... arValue | aws-db.js:43:31:43:37 | results | aws-db.js:43:31:43:76 | results ... arValue | Cross-site scripting vulnerability due to $@. | aws-db.js:43:31:43:37 | results | user-provided value |
1369+
| aws-db.js:46:35:46:77 | data.Re ... arValue | aws-db.js:46:35:46:38 | data | aws-db.js:46:35:46:77 | data.Re ... arValue | Cross-site scripting vulnerability due to $@. | aws-db.js:46:35:46:38 | data | user-provided value |
1370+
| aws-db.js:51:31:51:54 | respons ... tring() | aws-db.js:51:31:51:38 | response | aws-db.js:51:31:51:54 | respons ... tring() | Cross-site scripting vulnerability due to $@. | aws-db.js:51:31:51:38 | response | user-provided value |
1371+
| aws-db.js:54:35:54:54 | data.Body.toString() | aws-db.js:54:35:54:38 | data | aws-db.js:54:35:54:54 | data.Body.toString() | Cross-site scripting vulnerability due to $@. | aws-db.js:54:35:54:38 | data | user-provided value |
1372+
| aws-db.js:59:31:59:47 | response1.records | aws-db.js:59:31:59:39 | response1 | aws-db.js:59:31:59:47 | response1.records | Cross-site scripting vulnerability due to $@. | aws-db.js:59:31:59:39 | response1 | user-provided value |
1373+
| aws-db.js:62:35:62:46 | data.records | aws-db.js:62:35:62:38 | data | aws-db.js:62:35:62:46 | data.records | Cross-site scripting vulnerability due to $@. | aws-db.js:62:35:62:38 | data | user-provided value |
1374+
| aws-db.js:66:31:66:53 | respons ... Results | aws-db.js:66:31:66:39 | response2 | aws-db.js:66:31:66:53 | respons ... Results | Cross-site scripting vulnerability due to $@. | aws-db.js:66:31:66:39 | response2 | user-provided value |
1375+
| aws-db.js:69:35:69:52 | data.updateResults | aws-db.js:69:35:69:38 | data | aws-db.js:69:35:69:52 | data.updateResults | Cross-site scripting vulnerability due to $@. | aws-db.js:69:35:69:38 | data | user-provided value |
1376+
| aws-db.js:74:35:74:43 | data.Item | aws-db.js:74:35:74:38 | data | aws-db.js:74:35:74:43 | data.Item | Cross-site scripting vulnerability due to $@. | aws-db.js:74:35:74:38 | data | user-provided value |
1377+
| aws-db.js:77:35:77:43 | data.Item | aws-db.js:77:35:77:38 | data | aws-db.js:77:35:77:43 | data.Item | Cross-site scripting vulnerability due to $@. | aws-db.js:77:35:77:38 | data | user-provided value |
13221378
| hana.js:11:37:11:51 | rows[0].comment | hana.js:11:37:11:40 | rows | hana.js:11:37:11:51 | rows[0].comment | Cross-site scripting vulnerability due to $@. | hana.js:11:37:11:40 | rows | user-provided value |
13231379
| hana.js:16:37:16:51 | rows[0].comment | hana.js:16:37:16:40 | rows | hana.js:16:37:16:51 | rows[0].comment | Cross-site scripting vulnerability due to $@. | hana.js:16:37:16:40 | rows | user-provided value |
13241380
| hana.js:19:37:19:51 | rows[0].comment | hana.js:19:37:19:40 | rows | hana.js:19:37:19:51 | rows[0].comment | Cross-site scripting vulnerability due to $@. | hana.js:19:37:19:40 | rows | user-provided value |

‎javascript/ql/test/query-tests/Security/CWE-079/DomBasedXss/aws-db.js‎

Lines changed: 79 additions & 0 deletions

0 commit comments

Comments
 (0)