Skip to content

Commit 0280221

Browse files
asgerfasgerf
committed
JS: Add variant of test that passes
1 parent a7e337a commit 0280221

2 files changed

Lines changed: 63 additions & 15 deletions

File tree

‎javascript/ql/test/query-tests/Security/CWE-400/PrototypePollutionUtility.expected‎

Lines changed: 48 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -861,6 +861,28 @@ nodes
861861
| PrototypePollutionUtility/tests.js:357:31:357:41 | source[key] |
862862
| PrototypePollutionUtility/tests.js:357:31:357:41 | source[key] |
863863
| PrototypePollutionUtility/tests.js:357:38:357:40 | key |
864+
| PrototypePollutionUtility/tests.js:364:49:364:54 | source |
865+
| PrototypePollutionUtility/tests.js:366:18:366:20 | key |
866+
| PrototypePollutionUtility/tests.js:366:18:366:20 | key |
867+
| PrototypePollutionUtility/tests.js:371:24:371:26 | key |
868+
| PrototypePollutionUtility/tests.js:371:24:371:26 | key |
869+
| PrototypePollutionUtility/tests.js:371:31:371:95 | mergePl ... ptions) |
870+
| PrototypePollutionUtility/tests.js:371:31:371:95 | mergePl ... ptions) |
871+
| PrototypePollutionUtility/tests.js:371:62:371:72 | target[key] |
872+
| PrototypePollutionUtility/tests.js:371:69:371:71 | key |
873+
| PrototypePollutionUtility/tests.js:371:75:371:80 | source |
874+
| PrototypePollutionUtility/tests.js:371:75:371:85 | source[key] |
875+
| PrototypePollutionUtility/tests.js:371:75:371:85 | source[key] |
876+
| PrototypePollutionUtility/tests.js:371:75:371:85 | source[key] |
877+
| PrototypePollutionUtility/tests.js:373:24:373:26 | key |
878+
| PrototypePollutionUtility/tests.js:373:24:373:26 | key |
879+
| PrototypePollutionUtility/tests.js:373:31:373:36 | source |
880+
| PrototypePollutionUtility/tests.js:373:31:373:41 | source[key] |
881+
| PrototypePollutionUtility/tests.js:373:31:373:41 | source[key] |
882+
| PrototypePollutionUtility/tests.js:373:31:373:41 | source[key] |
883+
| PrototypePollutionUtility/tests.js:373:31:373:41 | source[key] |
884+
| PrototypePollutionUtility/tests.js:373:31:373:41 | source[key] |
885+
| PrototypePollutionUtility/tests.js:373:38:373:40 | key |
864886
| PrototypePollutionUtility/tests.js:381:14:381:16 | key |
865887
| PrototypePollutionUtility/tests.js:381:14:381:16 | key |
866888
| PrototypePollutionUtility/tests.js:381:14:381:16 | key |
@@ -2346,6 +2368,32 @@ edges
23462368
| PrototypePollutionUtility/tests.js:357:31:357:41 | source[key] | PrototypePollutionUtility/tests.js:357:31:357:41 | source[key] |
23472369
| PrototypePollutionUtility/tests.js:357:38:357:40 | key | PrototypePollutionUtility/tests.js:357:31:357:41 | source[key] |
23482370
| PrototypePollutionUtility/tests.js:357:38:357:40 | key | PrototypePollutionUtility/tests.js:357:31:357:41 | source[key] |
2371+
| PrototypePollutionUtility/tests.js:364:49:364:54 | source | PrototypePollutionUtility/tests.js:371:75:371:80 | source |
2372+
| PrototypePollutionUtility/tests.js:364:49:364:54 | source | PrototypePollutionUtility/tests.js:373:31:373:36 | source |
2373+
| PrototypePollutionUtility/tests.js:366:18:366:20 | key | PrototypePollutionUtility/tests.js:371:24:371:26 | key |
2374+
| PrototypePollutionUtility/tests.js:366:18:366:20 | key | PrototypePollutionUtility/tests.js:371:24:371:26 | key |
2375+
| PrototypePollutionUtility/tests.js:366:18:366:20 | key | PrototypePollutionUtility/tests.js:371:24:371:26 | key |
2376+
| PrototypePollutionUtility/tests.js:366:18:366:20 | key | PrototypePollutionUtility/tests.js:371:24:371:26 | key |
2377+
| PrototypePollutionUtility/tests.js:366:18:366:20 | key | PrototypePollutionUtility/tests.js:371:69:371:71 | key |
2378+
| PrototypePollutionUtility/tests.js:366:18:366:20 | key | PrototypePollutionUtility/tests.js:371:69:371:71 | key |
2379+
| PrototypePollutionUtility/tests.js:366:18:366:20 | key | PrototypePollutionUtility/tests.js:373:24:373:26 | key |
2380+
| PrototypePollutionUtility/tests.js:366:18:366:20 | key | PrototypePollutionUtility/tests.js:373:24:373:26 | key |
2381+
| PrototypePollutionUtility/tests.js:366:18:366:20 | key | PrototypePollutionUtility/tests.js:373:24:373:26 | key |
2382+
| PrototypePollutionUtility/tests.js:366:18:366:20 | key | PrototypePollutionUtility/tests.js:373:24:373:26 | key |
2383+
| PrototypePollutionUtility/tests.js:366:18:366:20 | key | PrototypePollutionUtility/tests.js:373:38:373:40 | key |
2384+
| PrototypePollutionUtility/tests.js:366:18:366:20 | key | PrototypePollutionUtility/tests.js:373:38:373:40 | key |
2385+
| PrototypePollutionUtility/tests.js:371:62:371:72 | target[key] | PrototypePollutionUtility/tests.js:371:31:371:95 | mergePl ... ptions) |
2386+
| PrototypePollutionUtility/tests.js:371:62:371:72 | target[key] | PrototypePollutionUtility/tests.js:371:31:371:95 | mergePl ... ptions) |
2387+
| PrototypePollutionUtility/tests.js:371:69:371:71 | key | PrototypePollutionUtility/tests.js:371:62:371:72 | target[key] |
2388+
| PrototypePollutionUtility/tests.js:371:75:371:80 | source | PrototypePollutionUtility/tests.js:371:75:371:85 | source[key] |
2389+
| PrototypePollutionUtility/tests.js:371:75:371:85 | source[key] | PrototypePollutionUtility/tests.js:364:49:364:54 | source |
2390+
| PrototypePollutionUtility/tests.js:371:75:371:85 | source[key] | PrototypePollutionUtility/tests.js:364:49:364:54 | source |
2391+
| PrototypePollutionUtility/tests.js:371:75:371:85 | source[key] | PrototypePollutionUtility/tests.js:364:49:364:54 | source |
2392+
| PrototypePollutionUtility/tests.js:373:31:373:36 | source | PrototypePollutionUtility/tests.js:373:31:373:41 | source[key] |
2393+
| PrototypePollutionUtility/tests.js:373:31:373:36 | source | PrototypePollutionUtility/tests.js:373:31:373:41 | source[key] |
2394+
| PrototypePollutionUtility/tests.js:373:31:373:41 | source[key] | PrototypePollutionUtility/tests.js:373:31:373:41 | source[key] |
2395+
| PrototypePollutionUtility/tests.js:373:38:373:40 | key | PrototypePollutionUtility/tests.js:373:31:373:41 | source[key] |
2396+
| PrototypePollutionUtility/tests.js:373:38:373:40 | key | PrototypePollutionUtility/tests.js:373:31:373:41 | source[key] |
23492397
| PrototypePollutionUtility/tests.js:381:14:381:16 | key | PrototypePollutionUtility/tests.js:383:22:383:24 | key |
23502398
| PrototypePollutionUtility/tests.js:381:14:381:16 | key | PrototypePollutionUtility/tests.js:383:22:383:24 | key |
23512399
| PrototypePollutionUtility/tests.js:381:14:381:16 | key | PrototypePollutionUtility/tests.js:383:22:383:24 | key |

‎javascript/ql/test/query-tests/Security/CWE-400/PrototypePollutionUtility/tests.js‎

Lines changed: 15 additions & 15 deletions
Original file line numberDiff line numberDiff line change
@@ -361,21 +361,21 @@ function mergePlainObjectsOnly(target, source) {
361361
return target;
362362
}
363363

364-
365-
366-
367-
368-
369-
370-
371-
372-
373-
374-
375-
376-
377-
378-
364+
function mergePlainObjectsOnlyNoClosure(target, source) {
365+
if (isNonArrayObject(target) && isNonArrayObject(source)) {
366+
for (let key of Object.keys(source)) {
367+
if (key === '__proto__') {
368+
return;
369+
}
370+
if (isNonArrayObject(source[key]) && key in target) {
371+
target[key] = mergePlainObjectsOnlyNoClosure(target[key], source[key], options);
372+
} else {
373+
target[key] = source[key]; // OK
374+
}
375+
}
376+
}
377+
return target;
378+
}
379379

380380
function forEachProp(obj, callback) {
381381
for (let key in obj) {

0 commit comments

Comments
 (0)