Skip to content

Commit d775135

Browse files
committed
update tests
1 parent 2226f51 commit d775135

2 files changed

Lines changed: 202 additions & 0 deletions

File tree

javascript/ql/test/query-tests/Security/CWE-798/HardcodedCredentials.expected

Lines changed: 101 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -213,6 +213,11 @@ nodes
213213
| HardcodedCredentials.js:245:22:245:44 | "myHard ... ateKey" |
214214
| HardcodedCredentials.js:246:42:246:51 | privateKey |
215215
| HardcodedCredentials.js:246:42:246:51 | privateKey |
216+
| HardcodedCredentials.js:248:9:248:42 | publicKey |
217+
| HardcodedCredentials.js:248:21:248:42 | "myHard ... licKey" |
218+
| HardcodedCredentials.js:248:21:248:42 | "myHard ... licKey" |
219+
| HardcodedCredentials.js:249:23:249:31 | publicKey |
220+
| HardcodedCredentials.js:249:23:249:31 | publicKey |
216221
| HardcodedCredentials.js:260:30:260:40 | `Basic foo` |
217222
| HardcodedCredentials.js:260:30:260:40 | `Basic foo` |
218223
| HardcodedCredentials.js:260:30:260:40 | `Basic foo` |
@@ -283,6 +288,50 @@ nodes
283288
| HardcodedCredentials.js:302:44:302:69 | 'iubfew ... ybgera' |
284289
| HardcodedCredentials.js:302:44:302:69 | 'iubfew ... ybgera' |
285290
| HardcodedCredentials.js:302:44:302:69 | 'iubfew ... ybgera' |
291+
| HardcodedCredentials.js:308:9:308:44 | privateKey |
292+
| HardcodedCredentials.js:308:22:308:44 | "myHard ... ateKey" |
293+
| HardcodedCredentials.js:308:22:308:44 | "myHard ... ateKey" |
294+
| HardcodedCredentials.js:309:34:309:43 | privateKey |
295+
| HardcodedCredentials.js:309:34:309:43 | privateKey |
296+
| HardcodedCredentials.js:316:9:316:44 | privateKey |
297+
| HardcodedCredentials.js:316:22:316:44 | "myHard ... ateKey" |
298+
| HardcodedCredentials.js:316:22:316:44 | "myHard ... ateKey" |
299+
| HardcodedCredentials.js:317:27:317:62 | new Tex ... ateKey) |
300+
| HardcodedCredentials.js:317:27:317:62 | new Tex ... ateKey) |
301+
| HardcodedCredentials.js:317:52:317:61 | privateKey |
302+
| HardcodedCredentials.js:320:11:323:29 | spki |
303+
| HardcodedCredentials.js:320:18:323:29 | `-----B ... Y-----` |
304+
| HardcodedCredentials.js:320:18:323:29 | `-----B ... Y-----` |
305+
| HardcodedCredentials.js:324:11:324:58 | publicKey |
306+
| HardcodedCredentials.js:324:23:324:58 | await j ... RS256') |
307+
| HardcodedCredentials.js:324:45:324:48 | spki |
308+
| HardcodedCredentials.js:325:27:325:35 | publicKey |
309+
| HardcodedCredentials.js:325:27:325:35 | publicKey |
310+
| HardcodedCredentials.js:331:9:331:43 | secretKey |
311+
| HardcodedCredentials.js:331:21:331:43 | "myHard ... ateKey" |
312+
| HardcodedCredentials.js:331:21:331:43 | "myHard ... ateKey" |
313+
| HardcodedCredentials.js:336:21:336:29 | secretKey |
314+
| HardcodedCredentials.js:336:21:336:29 | secretKey |
315+
| HardcodedCredentials.js:347:21:347:52 | Buffer. ... ase64") |
316+
| HardcodedCredentials.js:347:21:347:52 | Buffer. ... ase64") |
317+
| HardcodedCredentials.js:347:33:347:41 | secretKey |
318+
| HardcodedCredentials.js:362:9:362:43 | secretKey |
319+
| HardcodedCredentials.js:362:21:362:43 | "myHard ... ateKey" |
320+
| HardcodedCredentials.js:362:21:362:43 | "myHard ... ateKey" |
321+
| HardcodedCredentials.js:365:24:365:32 | secretKey |
322+
| HardcodedCredentials.js:365:24:365:32 | secretKey |
323+
| HardcodedCredentials.js:372:31:372:39 | secretKey |
324+
| HardcodedCredentials.js:372:31:372:39 | secretKey |
325+
| HardcodedCredentials.js:383:9:383:43 | secretKey |
326+
| HardcodedCredentials.js:383:21:383:43 | "myHard ... ateKey" |
327+
| HardcodedCredentials.js:383:21:383:43 | "myHard ... ateKey" |
328+
| HardcodedCredentials.js:386:17:386:25 | secretKey |
329+
| HardcodedCredentials.js:386:17:386:25 | secretKey |
330+
| HardcodedCredentials.js:401:9:401:43 | secretKey |
331+
| HardcodedCredentials.js:401:21:401:43 | "myHard ... ateKey" |
332+
| HardcodedCredentials.js:401:21:401:43 | "myHard ... ateKey" |
333+
| HardcodedCredentials.js:403:27:403:35 | secretKey |
334+
| HardcodedCredentials.js:403:27:403:35 | secretKey |
286335
edges
287336
| HardcodedCredentials.js:5:15:5:22 | 'dbuser' | HardcodedCredentials.js:5:15:5:22 | 'dbuser' |
288337
| HardcodedCredentials.js:8:19:8:28 | 'hgfedcba' | HardcodedCredentials.js:8:19:8:28 | 'hgfedcba' |
@@ -384,10 +433,15 @@ edges
384433
| HardcodedCredentials.js:237:35:237:91 | Buffer. ... ase64') | HardcodedCredentials.js:237:24:237:91 | 'Basic ... ase64') |
385434
| HardcodedCredentials.js:237:47:237:54 | username | HardcodedCredentials.js:237:47:237:71 | usernam ... assword |
386435
| HardcodedCredentials.js:237:47:237:71 | usernam ... assword | HardcodedCredentials.js:237:35:237:72 | Buffer. ... ssword) |
436+
| HardcodedCredentials.js:237:47:237:71 | usernam ... assword | HardcodedCredentials.js:237:35:237:91 | Buffer. ... ase64') |
387437
| HardcodedCredentials.js:245:9:245:44 | privateKey | HardcodedCredentials.js:246:42:246:51 | privateKey |
388438
| HardcodedCredentials.js:245:9:245:44 | privateKey | HardcodedCredentials.js:246:42:246:51 | privateKey |
389439
| HardcodedCredentials.js:245:22:245:44 | "myHard ... ateKey" | HardcodedCredentials.js:245:9:245:44 | privateKey |
390440
| HardcodedCredentials.js:245:22:245:44 | "myHard ... ateKey" | HardcodedCredentials.js:245:9:245:44 | privateKey |
441+
| HardcodedCredentials.js:248:9:248:42 | publicKey | HardcodedCredentials.js:249:23:249:31 | publicKey |
442+
| HardcodedCredentials.js:248:9:248:42 | publicKey | HardcodedCredentials.js:249:23:249:31 | publicKey |
443+
| HardcodedCredentials.js:248:21:248:42 | "myHard ... licKey" | HardcodedCredentials.js:248:9:248:42 | publicKey |
444+
| HardcodedCredentials.js:248:21:248:42 | "myHard ... licKey" | HardcodedCredentials.js:248:9:248:42 | publicKey |
391445
| HardcodedCredentials.js:260:30:260:40 | `Basic foo` | HardcodedCredentials.js:260:30:260:40 | `Basic foo` |
392446
| HardcodedCredentials.js:268:33:268:56 | foo ? ' ... 'OAuth' | HardcodedCredentials.js:268:30:268:73 | `${foo ... Token}` |
393447
| HardcodedCredentials.js:268:33:268:56 | foo ? ' ... 'OAuth' | HardcodedCredentials.js:268:30:268:73 | `${foo ... Token}` |
@@ -415,6 +469,43 @@ edges
415469
| HardcodedCredentials.js:300:44:300:56 | 'SampleToken' | HardcodedCredentials.js:300:44:300:56 | 'SampleToken' |
416470
| HardcodedCredentials.js:301:44:301:55 | 'MyPassword' | HardcodedCredentials.js:301:44:301:55 | 'MyPassword' |
417471
| HardcodedCredentials.js:302:44:302:69 | 'iubfew ... ybgera' | HardcodedCredentials.js:302:44:302:69 | 'iubfew ... ybgera' |
472+
| HardcodedCredentials.js:308:9:308:44 | privateKey | HardcodedCredentials.js:309:34:309:43 | privateKey |
473+
| HardcodedCredentials.js:308:9:308:44 | privateKey | HardcodedCredentials.js:309:34:309:43 | privateKey |
474+
| HardcodedCredentials.js:308:22:308:44 | "myHard ... ateKey" | HardcodedCredentials.js:308:9:308:44 | privateKey |
475+
| HardcodedCredentials.js:308:22:308:44 | "myHard ... ateKey" | HardcodedCredentials.js:308:9:308:44 | privateKey |
476+
| HardcodedCredentials.js:316:9:316:44 | privateKey | HardcodedCredentials.js:317:52:317:61 | privateKey |
477+
| HardcodedCredentials.js:316:22:316:44 | "myHard ... ateKey" | HardcodedCredentials.js:316:9:316:44 | privateKey |
478+
| HardcodedCredentials.js:316:22:316:44 | "myHard ... ateKey" | HardcodedCredentials.js:316:9:316:44 | privateKey |
479+
| HardcodedCredentials.js:317:52:317:61 | privateKey | HardcodedCredentials.js:317:27:317:62 | new Tex ... ateKey) |
480+
| HardcodedCredentials.js:317:52:317:61 | privateKey | HardcodedCredentials.js:317:27:317:62 | new Tex ... ateKey) |
481+
| HardcodedCredentials.js:320:11:323:29 | spki | HardcodedCredentials.js:324:45:324:48 | spki |
482+
| HardcodedCredentials.js:320:18:323:29 | `-----B ... Y-----` | HardcodedCredentials.js:320:11:323:29 | spki |
483+
| HardcodedCredentials.js:320:18:323:29 | `-----B ... Y-----` | HardcodedCredentials.js:320:11:323:29 | spki |
484+
| HardcodedCredentials.js:324:11:324:58 | publicKey | HardcodedCredentials.js:325:27:325:35 | publicKey |
485+
| HardcodedCredentials.js:324:11:324:58 | publicKey | HardcodedCredentials.js:325:27:325:35 | publicKey |
486+
| HardcodedCredentials.js:324:23:324:58 | await j ... RS256') | HardcodedCredentials.js:324:11:324:58 | publicKey |
487+
| HardcodedCredentials.js:324:45:324:48 | spki | HardcodedCredentials.js:324:23:324:58 | await j ... RS256') |
488+
| HardcodedCredentials.js:331:9:331:43 | secretKey | HardcodedCredentials.js:336:21:336:29 | secretKey |
489+
| HardcodedCredentials.js:331:9:331:43 | secretKey | HardcodedCredentials.js:336:21:336:29 | secretKey |
490+
| HardcodedCredentials.js:331:9:331:43 | secretKey | HardcodedCredentials.js:347:33:347:41 | secretKey |
491+
| HardcodedCredentials.js:331:21:331:43 | "myHard ... ateKey" | HardcodedCredentials.js:331:9:331:43 | secretKey |
492+
| HardcodedCredentials.js:331:21:331:43 | "myHard ... ateKey" | HardcodedCredentials.js:331:9:331:43 | secretKey |
493+
| HardcodedCredentials.js:347:33:347:41 | secretKey | HardcodedCredentials.js:347:21:347:52 | Buffer. ... ase64") |
494+
| HardcodedCredentials.js:347:33:347:41 | secretKey | HardcodedCredentials.js:347:21:347:52 | Buffer. ... ase64") |
495+
| HardcodedCredentials.js:362:9:362:43 | secretKey | HardcodedCredentials.js:365:24:365:32 | secretKey |
496+
| HardcodedCredentials.js:362:9:362:43 | secretKey | HardcodedCredentials.js:365:24:365:32 | secretKey |
497+
| HardcodedCredentials.js:362:9:362:43 | secretKey | HardcodedCredentials.js:372:31:372:39 | secretKey |
498+
| HardcodedCredentials.js:362:9:362:43 | secretKey | HardcodedCredentials.js:372:31:372:39 | secretKey |
499+
| HardcodedCredentials.js:362:21:362:43 | "myHard ... ateKey" | HardcodedCredentials.js:362:9:362:43 | secretKey |
500+
| HardcodedCredentials.js:362:21:362:43 | "myHard ... ateKey" | HardcodedCredentials.js:362:9:362:43 | secretKey |
501+
| HardcodedCredentials.js:383:9:383:43 | secretKey | HardcodedCredentials.js:386:17:386:25 | secretKey |
502+
| HardcodedCredentials.js:383:9:383:43 | secretKey | HardcodedCredentials.js:386:17:386:25 | secretKey |
503+
| HardcodedCredentials.js:383:21:383:43 | "myHard ... ateKey" | HardcodedCredentials.js:383:9:383:43 | secretKey |
504+
| HardcodedCredentials.js:383:21:383:43 | "myHard ... ateKey" | HardcodedCredentials.js:383:9:383:43 | secretKey |
505+
| HardcodedCredentials.js:401:9:401:43 | secretKey | HardcodedCredentials.js:403:27:403:35 | secretKey |
506+
| HardcodedCredentials.js:401:9:401:43 | secretKey | HardcodedCredentials.js:403:27:403:35 | secretKey |
507+
| HardcodedCredentials.js:401:21:401:43 | "myHard ... ateKey" | HardcodedCredentials.js:401:9:401:43 | secretKey |
508+
| HardcodedCredentials.js:401:21:401:43 | "myHard ... ateKey" | HardcodedCredentials.js:401:9:401:43 | secretKey |
418509
#select
419510
| HardcodedCredentials.js:5:15:5:22 | 'dbuser' | HardcodedCredentials.js:5:15:5:22 | 'dbuser' | HardcodedCredentials.js:5:15:5:22 | 'dbuser' | The hard-coded value "dbuser" is used as $@. | HardcodedCredentials.js:5:15:5:22 | 'dbuser' | user name |
420511
| HardcodedCredentials.js:8:19:8:28 | 'hgfedcba' | HardcodedCredentials.js:8:19:8:28 | 'hgfedcba' | HardcodedCredentials.js:8:19:8:28 | 'hgfedcba' | The hard-coded value "hgfedcba" is used as $@. | HardcodedCredentials.js:8:19:8:28 | 'hgfedcba' | password |
@@ -478,6 +569,16 @@ edges
478569
| HardcodedCredentials.js:215:18:215:25 | 'sdsdag' | HardcodedCredentials.js:215:18:215:25 | 'sdsdag' | HardcodedCredentials.js:221:37:221:51 | `Basic ${AUTH}` | The hard-coded value "sdsdag" is used as $@. | HardcodedCredentials.js:221:37:221:51 | `Basic ${AUTH}` | authorization header |
479570
| HardcodedCredentials.js:231:22:231:29 | 'sdsdag' | HardcodedCredentials.js:231:22:231:29 | 'sdsdag' | HardcodedCredentials.js:237:24:237:91 | 'Basic ... ase64') | The hard-coded value "sdsdag" is used as $@. | HardcodedCredentials.js:237:24:237:91 | 'Basic ... ase64') | authorization header |
480571
| HardcodedCredentials.js:245:22:245:44 | "myHard ... ateKey" | HardcodedCredentials.js:245:22:245:44 | "myHard ... ateKey" | HardcodedCredentials.js:246:42:246:51 | privateKey | The hard-coded value "myHardCodedPrivateKey" is used as $@. | HardcodedCredentials.js:246:42:246:51 | privateKey | key |
572+
| HardcodedCredentials.js:248:21:248:42 | "myHard ... licKey" | HardcodedCredentials.js:248:21:248:42 | "myHard ... licKey" | HardcodedCredentials.js:249:23:249:31 | publicKey | The hard-coded value "myHardCodedPublicKey" is used as $@. | HardcodedCredentials.js:249:23:249:31 | publicKey | key |
481573
| HardcodedCredentials.js:292:37:292:57 | `Basic ... sdsdag` | HardcodedCredentials.js:292:37:292:57 | `Basic ... sdsdag` | HardcodedCredentials.js:292:37:292:57 | `Basic ... sdsdag` | The hard-coded value "Basic sdsdag:sdsdag" is used as $@. | HardcodedCredentials.js:292:37:292:57 | `Basic ... sdsdag` | authorization header |
482574
| HardcodedCredentials.js:294:37:294:70 | `Basic ... gbbbbb` | HardcodedCredentials.js:294:37:294:70 | `Basic ... gbbbbb` | HardcodedCredentials.js:294:37:294:70 | `Basic ... gbbbbb` | The hard-coded value "Basic sdsdag:aaaiuogrweuibgbbbbb" is used as $@. | HardcodedCredentials.js:294:37:294:70 | `Basic ... gbbbbb` | authorization header |
483575
| HardcodedCredentials.js:302:44:302:69 | 'iubfew ... ybgera' | HardcodedCredentials.js:302:44:302:69 | 'iubfew ... ybgera' | HardcodedCredentials.js:302:44:302:69 | 'iubfew ... ybgera' | The hard-coded value "iubfewiaaweiybgaeuybgera" is used as $@. | HardcodedCredentials.js:302:44:302:69 | 'iubfew ... ybgera' | key |
576+
| HardcodedCredentials.js:308:22:308:44 | "myHard ... ateKey" | HardcodedCredentials.js:308:22:308:44 | "myHard ... ateKey" | HardcodedCredentials.js:309:34:309:43 | privateKey | The hard-coded value "myHardCodedPrivateKey" is used as $@. | HardcodedCredentials.js:309:34:309:43 | privateKey | key |
577+
| HardcodedCredentials.js:316:22:316:44 | "myHard ... ateKey" | HardcodedCredentials.js:316:22:316:44 | "myHard ... ateKey" | HardcodedCredentials.js:317:27:317:62 | new Tex ... ateKey) | The hard-coded value "myHardCodedPrivateKey" is used as $@. | HardcodedCredentials.js:317:27:317:62 | new Tex ... ateKey) | key |
578+
| HardcodedCredentials.js:320:18:323:29 | `-----B ... Y-----` | HardcodedCredentials.js:320:18:323:29 | `-----B ... Y-----` | HardcodedCredentials.js:325:27:325:35 | publicKey | The hard-coded value "-----BEGIN PUBLIC KEY-----\n MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAwhYOFK2Ocbbpb/zVypi9\n ...\n -----END PUBLIC KEY-----" is used as $@. | HardcodedCredentials.js:325:27:325:35 | publicKey | key |
579+
| HardcodedCredentials.js:331:21:331:43 | "myHard ... ateKey" | HardcodedCredentials.js:331:21:331:43 | "myHard ... ateKey" | HardcodedCredentials.js:336:21:336:29 | secretKey | The hard-coded value "myHardCodedPrivateKey" is used as $@. | HardcodedCredentials.js:336:21:336:29 | secretKey | key |
580+
| HardcodedCredentials.js:331:21:331:43 | "myHard ... ateKey" | HardcodedCredentials.js:331:21:331:43 | "myHard ... ateKey" | HardcodedCredentials.js:347:21:347:52 | Buffer. ... ase64") | The hard-coded value "myHardCodedPrivateKey" is used as $@. | HardcodedCredentials.js:347:21:347:52 | Buffer. ... ase64") | key |
581+
| HardcodedCredentials.js:362:21:362:43 | "myHard ... ateKey" | HardcodedCredentials.js:362:21:362:43 | "myHard ... ateKey" | HardcodedCredentials.js:365:24:365:32 | secretKey | The hard-coded value "myHardCodedPrivateKey" is used as $@. | HardcodedCredentials.js:365:24:365:32 | secretKey | key |
582+
| HardcodedCredentials.js:362:21:362:43 | "myHard ... ateKey" | HardcodedCredentials.js:362:21:362:43 | "myHard ... ateKey" | HardcodedCredentials.js:372:31:372:39 | secretKey | The hard-coded value "myHardCodedPrivateKey" is used as $@. | HardcodedCredentials.js:372:31:372:39 | secretKey | key |
583+
| HardcodedCredentials.js:383:21:383:43 | "myHard ... ateKey" | HardcodedCredentials.js:383:21:383:43 | "myHard ... ateKey" | HardcodedCredentials.js:386:17:386:25 | secretKey | The hard-coded value "myHardCodedPrivateKey" is used as $@. | HardcodedCredentials.js:386:17:386:25 | secretKey | key |
584+
| HardcodedCredentials.js:401:21:401:43 | "myHard ... ateKey" | HardcodedCredentials.js:401:21:401:43 | "myHard ... ateKey" | HardcodedCredentials.js:403:27:403:35 | secretKey | The hard-coded value "myHardCodedPrivateKey" is used as $@. | HardcodedCredentials.js:403:27:403:35 | secretKey | key |

javascript/ql/test/query-tests/Security/CWE-798/HardcodedCredentials.js

Lines changed: 101 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -300,4 +300,105 @@
300300
require('crypto').createHmac('sha256', 'SampleToken'); // OK
301301
require('crypto').createHmac('sha256', 'MyPassword'); // OK
302302
require('crypto').createHmac('sha256', 'iubfewiaaweiybgaeuybgera'); // NOT OK
303+
})();
304+
305+
(function () {
306+
const jwt_simple = require("jwt-simple");
307+
308+
var privateKey = "myHardCodedPrivateKey";
309+
jwt_simple.decode(UserToken, privateKey); // NOT OK
310+
})();
311+
312+
313+
(async function () {
314+
const jose = require("jose");
315+
316+
var privateKey = "myHardCodedPrivateKey";
317+
jose.jwtVerify(token, new TextEncoder().encode(privateKey)) // NOT OK
318+
319+
320+
const spki = `-----BEGIN PUBLIC KEY-----
321+
MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAwhYOFK2Ocbbpb/zVypi9
322+
...
323+
-----END PUBLIC KEY-----`
324+
const publicKey = await jose.importSPKI(spki, 'RS256')
325+
jose.jwtVerify(token, publicKey) // NOT OK
326+
})();
327+
328+
(function () {
329+
const expressjwt = require("express-jwt");
330+
331+
var secretKey = "myHardCodedPrivateKey";
332+
333+
app.get(
334+
"/protected",
335+
expressjwt.expressjwt({
336+
secret: secretKey, algorithms: ["HS256"] // NOT OK
337+
}),
338+
function (req, res) {
339+
if (!req.auth.admin) return res.sendStatus(401);
340+
res.sendStatus(200);
341+
}
342+
);
343+
344+
app.get(
345+
"/protected",
346+
expressjwt.expressjwt({
347+
secret: Buffer.from(secretKey, "base64"), // NOT OK
348+
algorithms: ["RS256"],
349+
}),
350+
function (req, res) {
351+
if (!req.auth.admin) return res.sendStatus(401);
352+
res.sendStatus(200);
353+
}
354+
);
355+
356+
})();
357+
358+
(function () {
359+
const JwtStrategy = require('passport-jwt').Strategy;
360+
const passport = require('passport')
361+
362+
var secretKey = "myHardCodedPrivateKey";
363+
364+
const opts = {}
365+
opts.secretOrKey = secretKey; // NOT OK
366+
passport.use(new JwtStrategy(opts, function (jwt_payload, done) {
367+
return done(null, false);
368+
}));
369+
370+
passport.use(new JwtStrategy({
371+
secretOrKeyProvider: function (request, rawJwtToken, done) {
372+
return done(null, secretKey) // NOT OK
373+
}
374+
}, function (jwt_payload, done) {
375+
return done(null, false);
376+
}));
377+
})();
378+
379+
(function () {
380+
import NextAuth from "next-auth"
381+
import AppleProvider from "next-auth/providers/apple"
382+
383+
var secretKey = "myHardCodedPrivateKey";
384+
385+
NextAuth({
386+
secret: secretKey, // NOT OK
387+
providers: [
388+
AppleProvider({
389+
clientId: process.env.APPLE_ID,
390+
clientSecret: process.env.APPLE_SECRET,
391+
}),
392+
],
393+
})
394+
})();
395+
396+
(function () {
397+
const Koa = require('koa');
398+
const jwt = require('koa-jwt');
399+
const app = new Koa();
400+
401+
var secretKey = "myHardCodedPrivateKey";
402+
403+
app.use(jwt({ secret: secretKey })); // NOT OK
303404
})();

0 commit comments

Comments
 (0)