Skip to content

Commit 4e365e2

Browse files
am0o0am0o0
committed
fix conflict
1 parent 20c087c commit 4e365e2

2 files changed

Lines changed: 33 additions & 110 deletions

File tree

‎javascript/ql/test/query-tests/Security/CWE-798/HardcodedCredentials.expected‎

Lines changed: 27 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -153,12 +153,12 @@ nodes
153153
| HardcodedCredentials.js:135:41:135:50 | "hgfedcba" |
154154
| HardcodedCredentials.js:135:41:135:50 | "hgfedcba" |
155155
| HardcodedCredentials.js:135:41:135:50 | "hgfedcba" |
156-
| HardcodedCredentials.js:160:38:160:48 | "change_me" |
157-
| HardcodedCredentials.js:160:38:160:48 | "change_me" |
158-
| HardcodedCredentials.js:160:38:160:48 | "change_me" |
159-
| HardcodedCredentials.js:161:41:161:51 | 'change_me' |
160-
| HardcodedCredentials.js:161:41:161:51 | 'change_me' |
161-
| HardcodedCredentials.js:161:41:161:51 | 'change_me' |
156+
| HardcodedCredentials.js:160:38:160:56 | "oiuneawrgiyubaegr" |
157+
| HardcodedCredentials.js:160:38:160:56 | "oiuneawrgiyubaegr" |
158+
| HardcodedCredentials.js:160:38:160:56 | "oiuneawrgiyubaegr" |
159+
| HardcodedCredentials.js:161:41:161:59 | 'oiuneawrgiyubaegr' |
160+
| HardcodedCredentials.js:161:41:161:59 | 'oiuneawrgiyubaegr' |
161+
| HardcodedCredentials.js:161:41:161:59 | 'oiuneawrgiyubaegr' |
162162
| HardcodedCredentials.js:164:35:164:45 | 'change_me' |
163163
| HardcodedCredentials.js:164:35:164:45 | 'change_me' |
164164
| HardcodedCredentials.js:164:35:164:45 | 'change_me' |
@@ -271,6 +271,18 @@ nodes
271271
| HardcodedCredentials.js:295:37:295:66 | `Basic ... 000001` |
272272
| HardcodedCredentials.js:295:37:295:66 | `Basic ... 000001` |
273273
| HardcodedCredentials.js:295:37:295:66 | `Basic ... 000001` |
274+
| HardcodedCredentials.js:299:44:299:52 | 'mytoken' |
275+
| HardcodedCredentials.js:299:44:299:52 | 'mytoken' |
276+
| HardcodedCredentials.js:299:44:299:52 | 'mytoken' |
277+
| HardcodedCredentials.js:300:44:300:56 | 'SampleToken' |
278+
| HardcodedCredentials.js:300:44:300:56 | 'SampleToken' |
279+
| HardcodedCredentials.js:300:44:300:56 | 'SampleToken' |
280+
| HardcodedCredentials.js:301:44:301:55 | 'MyPassword' |
281+
| HardcodedCredentials.js:301:44:301:55 | 'MyPassword' |
282+
| HardcodedCredentials.js:301:44:301:55 | 'MyPassword' |
283+
| HardcodedCredentials.js:302:44:302:69 | 'iubfew ... ybgera' |
284+
| HardcodedCredentials.js:302:44:302:69 | 'iubfew ... ybgera' |
285+
| HardcodedCredentials.js:302:44:302:69 | 'iubfew ... ybgera' |
274286
edges
275287
| HardcodedCredentials.js:5:15:5:22 | 'dbuser' | HardcodedCredentials.js:5:15:5:22 | 'dbuser' |
276288
| HardcodedCredentials.js:8:19:8:28 | 'hgfedcba' | HardcodedCredentials.js:8:19:8:28 | 'hgfedcba' |
@@ -326,8 +338,8 @@ edges
326338
| HardcodedCredentials.js:130:44:130:53 | 'hgfedcba' | HardcodedCredentials.js:130:44:130:53 | 'hgfedcba' |
327339
| HardcodedCredentials.js:131:52:131:61 | 'hgfedcba' | HardcodedCredentials.js:131:52:131:61 | 'hgfedcba' |
328340
| HardcodedCredentials.js:135:41:135:50 | "hgfedcba" | HardcodedCredentials.js:135:41:135:50 | "hgfedcba" |
329-
| HardcodedCredentials.js:160:38:160:48 | "change_me" | HardcodedCredentials.js:160:38:160:48 | "change_me" |
330-
| HardcodedCredentials.js:161:41:161:51 | 'change_me' | HardcodedCredentials.js:161:41:161:51 | 'change_me' |
341+
| HardcodedCredentials.js:160:38:160:56 | "oiuneawrgiyubaegr" | HardcodedCredentials.js:160:38:160:56 | "oiuneawrgiyubaegr" |
342+
| HardcodedCredentials.js:161:41:161:59 | 'oiuneawrgiyubaegr' | HardcodedCredentials.js:161:41:161:59 | 'oiuneawrgiyubaegr' |
331343
| HardcodedCredentials.js:164:35:164:45 | 'change_me' | HardcodedCredentials.js:164:35:164:45 | 'change_me' |
332344
| HardcodedCredentials.js:171:11:171:25 | USER | HardcodedCredentials.js:173:35:173:38 | USER |
333345
| HardcodedCredentials.js:171:18:171:25 | 'sdsdag' | HardcodedCredentials.js:171:11:171:25 | USER |
@@ -399,6 +411,10 @@ edges
399411
| HardcodedCredentials.js:293:37:293:65 | `Basic ... xxxxxx` | HardcodedCredentials.js:293:37:293:65 | `Basic ... xxxxxx` |
400412
| HardcodedCredentials.js:294:37:294:70 | `Basic ... gbbbbb` | HardcodedCredentials.js:294:37:294:70 | `Basic ... gbbbbb` |
401413
| HardcodedCredentials.js:295:37:295:66 | `Basic ... 000001` | HardcodedCredentials.js:295:37:295:66 | `Basic ... 000001` |
414+
| HardcodedCredentials.js:299:44:299:52 | 'mytoken' | HardcodedCredentials.js:299:44:299:52 | 'mytoken' |
415+
| HardcodedCredentials.js:300:44:300:56 | 'SampleToken' | HardcodedCredentials.js:300:44:300:56 | 'SampleToken' |
416+
| HardcodedCredentials.js:301:44:301:55 | 'MyPassword' | HardcodedCredentials.js:301:44:301:55 | 'MyPassword' |
417+
| HardcodedCredentials.js:302:44:302:69 | 'iubfew ... ybgera' | HardcodedCredentials.js:302:44:302:69 | 'iubfew ... ybgera' |
402418
#select
403419
| HardcodedCredentials.js:5:15:5:22 | 'dbuser' | HardcodedCredentials.js:5:15:5:22 | 'dbuser' | HardcodedCredentials.js:5:15:5:22 | 'dbuser' | The hard-coded value "dbuser" is used as $@. | HardcodedCredentials.js:5:15:5:22 | 'dbuser' | user name |
404420
| HardcodedCredentials.js:8:19:8:28 | 'hgfedcba' | HardcodedCredentials.js:8:19:8:28 | 'hgfedcba' | HardcodedCredentials.js:8:19:8:28 | 'hgfedcba' | The hard-coded value "hgfedcba" is used as $@. | HardcodedCredentials.js:8:19:8:28 | 'hgfedcba' | password |
@@ -448,8 +464,8 @@ edges
448464
| HardcodedCredentials.js:130:44:130:53 | 'hgfedcba' | HardcodedCredentials.js:130:44:130:53 | 'hgfedcba' | HardcodedCredentials.js:130:44:130:53 | 'hgfedcba' | The hard-coded value "hgfedcba" is used as $@. | HardcodedCredentials.js:130:44:130:53 | 'hgfedcba' | key |
449465
| HardcodedCredentials.js:131:52:131:61 | 'hgfedcba' | HardcodedCredentials.js:131:52:131:61 | 'hgfedcba' | HardcodedCredentials.js:131:52:131:61 | 'hgfedcba' | The hard-coded value "hgfedcba" is used as $@. | HardcodedCredentials.js:131:52:131:61 | 'hgfedcba' | key |
450466
| HardcodedCredentials.js:135:41:135:50 | "hgfedcba" | HardcodedCredentials.js:135:41:135:50 | "hgfedcba" | HardcodedCredentials.js:135:41:135:50 | "hgfedcba" | The hard-coded value "hgfedcba" is used as $@. | HardcodedCredentials.js:135:41:135:50 | "hgfedcba" | key |
451-
| HardcodedCredentials.js:160:38:160:48 | "change_me" | HardcodedCredentials.js:160:38:160:48 | "change_me" | HardcodedCredentials.js:160:38:160:48 | "change_me" | The hard-coded value "change_me" is used as $@. | HardcodedCredentials.js:160:38:160:48 | "change_me" | key |
452-
| HardcodedCredentials.js:161:41:161:51 | 'change_me' | HardcodedCredentials.js:161:41:161:51 | 'change_me' | HardcodedCredentials.js:161:41:161:51 | 'change_me' | The hard-coded value "change_me" is used as $@. | HardcodedCredentials.js:161:41:161:51 | 'change_me' | key |
467+
| HardcodedCredentials.js:160:38:160:56 | "oiuneawrgiyubaegr" | HardcodedCredentials.js:160:38:160:56 | "oiuneawrgiyubaegr" | HardcodedCredentials.js:160:38:160:56 | "oiuneawrgiyubaegr" | The hard-coded value "oiuneawrgiyubaegr" is used as $@. | HardcodedCredentials.js:160:38:160:56 | "oiuneawrgiyubaegr" | key |
468+
| HardcodedCredentials.js:161:41:161:59 | 'oiuneawrgiyubaegr' | HardcodedCredentials.js:161:41:161:59 | 'oiuneawrgiyubaegr' | HardcodedCredentials.js:161:41:161:59 | 'oiuneawrgiyubaegr' | The hard-coded value "oiuneawrgiyubaegr" is used as $@. | HardcodedCredentials.js:161:41:161:59 | 'oiuneawrgiyubaegr' | key |
453469
| HardcodedCredentials.js:171:18:171:25 | 'sdsdag' | HardcodedCredentials.js:171:18:171:25 | 'sdsdag' | HardcodedCredentials.js:178:30:178:44 | `Basic ${AUTH}` | The hard-coded value "sdsdag" is used as $@. | HardcodedCredentials.js:178:30:178:44 | `Basic ${AUTH}` | authorization header |
454470
| HardcodedCredentials.js:171:18:171:25 | 'sdsdag' | HardcodedCredentials.js:171:18:171:25 | 'sdsdag' | HardcodedCredentials.js:188:30:188:44 | `Basic ${AUTH}` | The hard-coded value "sdsdag" is used as $@. | HardcodedCredentials.js:188:30:188:44 | `Basic ${AUTH}` | authorization header |
455471
| HardcodedCredentials.js:171:18:171:25 | 'sdsdag' | HardcodedCredentials.js:171:18:171:25 | 'sdsdag' | HardcodedCredentials.js:195:37:195:51 | `Basic ${AUTH}` | The hard-coded value "sdsdag" is used as $@. | HardcodedCredentials.js:195:37:195:51 | `Basic ${AUTH}` | authorization header |
@@ -464,3 +480,4 @@ edges
464480
| HardcodedCredentials.js:245:22:245:44 | "myHard ... ateKey" | HardcodedCredentials.js:245:22:245:44 | "myHard ... ateKey" | HardcodedCredentials.js:246:42:246:51 | privateKey | The hard-coded value "myHardCodedPrivateKey" is used as $@. | HardcodedCredentials.js:246:42:246:51 | privateKey | key |
465481
| HardcodedCredentials.js:292:37:292:57 | `Basic ... sdsdag` | HardcodedCredentials.js:292:37:292:57 | `Basic ... sdsdag` | HardcodedCredentials.js:292:37:292:57 | `Basic ... sdsdag` | The hard-coded value "Basic sdsdag:sdsdag" is used as $@. | HardcodedCredentials.js:292:37:292:57 | `Basic ... sdsdag` | authorization header |
466482
| HardcodedCredentials.js:294:37:294:70 | `Basic ... gbbbbb` | HardcodedCredentials.js:294:37:294:70 | `Basic ... gbbbbb` | HardcodedCredentials.js:294:37:294:70 | `Basic ... gbbbbb` | The hard-coded value "Basic sdsdag:aaaiuogrweuibgbbbbb" is used as $@. | HardcodedCredentials.js:294:37:294:70 | `Basic ... gbbbbb` | authorization header |
483+
| HardcodedCredentials.js:302:44:302:69 | 'iubfew ... ybgera' | HardcodedCredentials.js:302:44:302:69 | 'iubfew ... ybgera' | HardcodedCredentials.js:302:44:302:69 | 'iubfew ... ybgera' | The hard-coded value "iubfewiaaweiybgaeuybgera" is used as $@. | HardcodedCredentials.js:302:44:302:69 | 'iubfew ... ybgera' | key |

‎javascript/ql/test/query-tests/Security/CWE-798/HardcodedCredentials.js‎

Lines changed: 6 additions & 100 deletions
Original file line numberDiff line numberDiff line change
@@ -157,8 +157,8 @@
157157
})();
158158

159159
(function(){
160-
require("cookie-session")({ secret: "change_me" }); // NOT OK
161-
require('crypto').createHmac('sha256', 'change_me'); // NOT OK
160+
require("cookie-session")({ secret: "oiuneawrgiyubaegr" }); // NOT OK
161+
require('crypto').createHmac('sha256', 'oiuneawrgiyubaegr'); // NOT OK
162162

163163
var basicAuth = require('express-basic-auth');
164164
basicAuth({users: { [adminName]: 'change_me' }}); // OK
@@ -296,102 +296,8 @@
296296
});
297297

298298
(function () {
299-
const jwt_simple = require("jwt-simple");
300-
301-
var privateKey = "myHardCodedPrivateKey";
302-
jwt_simple.decode(UserToken, privateKey); // NOT OK
303-
})();
304-
305-
306-
(async function () {
307-
const jose = require("jose");
308-
309-
var privateKey = "myHardCodedPrivateKey";
310-
jose.jwtVerify(token, new TextEncoder().encode(privateKey)) // NOT OK
311-
312-
313-
const spki = `-----BEGIN PUBLIC KEY-----
314-
MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAwhYOFK2Ocbbpb/zVypi9
315-
...
316-
-----END PUBLIC KEY-----`
317-
const publicKey = await jose.importSPKI(spki, 'RS256')
318-
jose.jwtVerify(token, publicKey) // NOT OK
319-
})();
320-
321-
(function () {
322-
const expressjwt = require("express-jwt");
323-
324-
var secretKey = "myHardCodedPrivateKey";
325-
326-
app.get(
327-
"/protected",
328-
expressjwt.expressjwt({
329-
secret: secretKey, algorithms: ["HS256"] // NOT OK
330-
}),
331-
function (req, res) {
332-
if (!req.auth.admin) return res.sendStatus(401);
333-
res.sendStatus(200);
334-
}
335-
);
336-
337-
app.get(
338-
"/protected",
339-
expressjwt.expressjwt({
340-
secret: Buffer.from(secretKey, "base64"), // NOT OK
341-
algorithms: ["RS256"],
342-
}),
343-
function (req, res) {
344-
if (!req.auth.admin) return res.sendStatus(401);
345-
res.sendStatus(200);
346-
}
347-
);
348-
349-
})();
350-
351-
(function () {
352-
const JwtStrategy = require('passport-jwt').Strategy;
353-
const passport = require('passport')
354-
355-
var secretKey = "myHardCodedPrivateKey";
356-
357-
const opts = {}
358-
opts.secretOrKey = secretKey; // NOT OK
359-
passport.use(new JwtStrategy(opts, function (jwt_payload, done) {
360-
return done(null, false);
361-
}));
362-
363-
passport.use(new JwtStrategy({
364-
secretOrKeyProvider: function (request, rawJwtToken, done) {
365-
return done(null, secretKey) // NOT OK
366-
}
367-
}, function (jwt_payload, done) {
368-
return done(null, false);
369-
}));
370-
})();
371-
372-
(function () {
373-
import NextAuth from "next-auth"
374-
import AppleProvider from "next-auth/providers/apple"
375-
376-
var secretKey = "myHardCodedPrivateKey";
377-
378-
NextAuth({
379-
secret: secretKey, // NOT OK
380-
providers: [
381-
AppleProvider({
382-
clientId: process.env.APPLE_ID,
383-
clientSecret: process.env.APPLE_SECRET,
384-
}),
385-
],
386-
})
387-
})();
388-
389-
(function () {
390-
const Koa = require('koa');
391-
const jwt = require('koa-jwt');
392-
const app = new Koa();
393-
394-
var secretKey = "myHardCodedPrivateKey";
395-
396-
app.use(jwt({ secret: secretKey })); // NOT OK
299+
require('crypto').createHmac('sha256', 'mytoken'); // OK
300+
require('crypto').createHmac('sha256', 'SampleToken'); // OK
301+
require('crypto').createHmac('sha256', 'MyPassword'); // OK
302+
require('crypto').createHmac('sha256', 'iubfewiaaweiybgaeuybgera'); // NOT OK
397303
})();

0 commit comments

Comments
 (0)