Skip to content

Commit e795630

Browse files
MathiasVPMathiasVP
committed
PS: Add false positive.
1 parent ae4b3e8 commit e795630

2 files changed

Lines changed: 101 additions & 1 deletion

File tree

‎powershell/ql/test/query-tests/security/cwe-089/SqlInjection.expected‎

Lines changed: 72 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -4,12 +4,44 @@ edges
44
| test.ps1:1:1:1:10 | userinput | test.ps1:17:24:17:76 | SELECT * FROM MyTable WHERE MyColumn = '$userinput' | provenance | |
55
| test.ps1:1:1:1:10 | userinput | test.ps1:28:24:28:76 | SELECT * FROM MyTable WHERE MyColumn = '$userinput' | provenance | |
66
| test.ps1:1:1:1:10 | userinput | test.ps1:78:13:78:22 | userinput | provenance | |
7+
| test.ps1:1:1:1:10 | userinput | test.ps1:109:22:109:31 | userinput | provenance | |
8+
| test.ps1:1:1:1:10 | userinput | test.ps1:109:33:109:42 | userinput | provenance | |
9+
| test.ps1:1:1:1:10 | userinput | test.ps1:109:44:109:53 | userinput | provenance | |
10+
| test.ps1:1:1:1:10 | userinput | test.ps1:109:55:109:64 | userinput | provenance | |
11+
| test.ps1:1:1:1:10 | userinput | test.ps1:109:66:109:75 | userinput | provenance | |
12+
| test.ps1:1:1:1:10 | userinput | test.ps1:109:77:109:86 | userinput | provenance | |
13+
| test.ps1:1:1:1:10 | userinput | test.ps1:109:88:109:97 | userinput | provenance | |
14+
| test.ps1:1:1:1:10 | userinput | test.ps1:109:99:109:108 | userinput | provenance | |
715
| test.ps1:1:14:1:45 | Call to read-host | test.ps1:1:1:1:10 | userinput | provenance | Src:MaD:0 |
816
| test.ps1:4:1:4:6 | query | test.ps1:5:72:5:77 | query | provenance | |
917
| test.ps1:8:1:8:6 | query | test.ps1:9:72:9:77 | query | provenance | |
1018
| test.ps1:72:1:72:11 | QueryConn2 [element Query] | test.ps1:81:15:81:25 | QueryConn2 | provenance | |
1119
| test.ps1:72:15:79:1 | ${...} [element Query] | test.ps1:72:1:72:11 | QueryConn2 [element Query] | provenance | |
1220
| test.ps1:78:13:78:22 | userinput | test.ps1:72:15:79:1 | ${...} [element Query] | provenance | |
21+
| test.ps1:83:31:83:37 | i | test.ps1:84:5:84:11 | query1 | provenance | |
22+
| test.ps1:83:40:83:47 | l | test.ps1:87:5:87:11 | query2 | provenance | |
23+
| test.ps1:83:50:83:58 | f | test.ps1:90:5:90:11 | query3 | provenance | |
24+
| test.ps1:83:61:83:70 | d | test.ps1:93:5:93:11 | query4 | provenance | |
25+
| test.ps1:83:73:83:85 | dec | test.ps1:96:5:96:11 | query5 | provenance | |
26+
| test.ps1:83:88:83:95 | c | test.ps1:99:5:99:11 | query6 | provenance | |
27+
| test.ps1:83:98:83:105 | b | test.ps1:102:5:102:11 | query7 | provenance | |
28+
| test.ps1:83:108:83:120 | dt | test.ps1:105:5:105:11 | query8 | provenance | |
29+
| test.ps1:84:5:84:11 | query1 | test.ps1:85:76:85:82 | query1 | provenance | |
30+
| test.ps1:87:5:87:11 | query2 | test.ps1:88:76:88:82 | query2 | provenance | |
31+
| test.ps1:90:5:90:11 | query3 | test.ps1:91:76:91:82 | query3 | provenance | |
32+
| test.ps1:93:5:93:11 | query4 | test.ps1:94:76:94:82 | query4 | provenance | |
33+
| test.ps1:96:5:96:11 | query5 | test.ps1:97:76:97:82 | query5 | provenance | |
34+
| test.ps1:99:5:99:11 | query6 | test.ps1:100:76:100:82 | query6 | provenance | |
35+
| test.ps1:102:5:102:11 | query7 | test.ps1:103:76:103:82 | query7 | provenance | |
36+
| test.ps1:105:5:105:11 | query8 | test.ps1:106:76:106:82 | query8 | provenance | |
37+
| test.ps1:109:22:109:31 | userinput | test.ps1:83:31:83:37 | i | provenance | |
38+
| test.ps1:109:33:109:42 | userinput | test.ps1:83:40:83:47 | l | provenance | |
39+
| test.ps1:109:44:109:53 | userinput | test.ps1:83:50:83:58 | f | provenance | |
40+
| test.ps1:109:55:109:64 | userinput | test.ps1:83:61:83:70 | d | provenance | |
41+
| test.ps1:109:66:109:75 | userinput | test.ps1:83:73:83:85 | dec | provenance | |
42+
| test.ps1:109:77:109:86 | userinput | test.ps1:83:88:83:95 | c | provenance | |
43+
| test.ps1:109:88:109:97 | userinput | test.ps1:83:98:83:105 | b | provenance | |
44+
| test.ps1:109:99:109:108 | userinput | test.ps1:83:108:83:120 | dt | provenance | |
1345
nodes
1446
| test.ps1:1:1:1:10 | userinput | semmle.label | userinput |
1547
| test.ps1:1:14:1:45 | Call to read-host | semmle.label | Call to read-host |
@@ -23,10 +55,50 @@ nodes
2355
| test.ps1:72:15:79:1 | ${...} [element Query] | semmle.label | ${...} [element Query] |
2456
| test.ps1:78:13:78:22 | userinput | semmle.label | userinput |
2557
| test.ps1:81:15:81:25 | QueryConn2 | semmle.label | QueryConn2 |
58+
| test.ps1:83:31:83:37 | i | semmle.label | i |
59+
| test.ps1:83:40:83:47 | l | semmle.label | l |
60+
| test.ps1:83:50:83:58 | f | semmle.label | f |
61+
| test.ps1:83:61:83:70 | d | semmle.label | d |
62+
| test.ps1:83:73:83:85 | dec | semmle.label | dec |
63+
| test.ps1:83:88:83:95 | c | semmle.label | c |
64+
| test.ps1:83:98:83:105 | b | semmle.label | b |
65+
| test.ps1:83:108:83:120 | dt | semmle.label | dt |
66+
| test.ps1:84:5:84:11 | query1 | semmle.label | query1 |
67+
| test.ps1:85:76:85:82 | query1 | semmle.label | query1 |
68+
| test.ps1:87:5:87:11 | query2 | semmle.label | query2 |
69+
| test.ps1:88:76:88:82 | query2 | semmle.label | query2 |
70+
| test.ps1:90:5:90:11 | query3 | semmle.label | query3 |
71+
| test.ps1:91:76:91:82 | query3 | semmle.label | query3 |
72+
| test.ps1:93:5:93:11 | query4 | semmle.label | query4 |
73+
| test.ps1:94:76:94:82 | query4 | semmle.label | query4 |
74+
| test.ps1:96:5:96:11 | query5 | semmle.label | query5 |
75+
| test.ps1:97:76:97:82 | query5 | semmle.label | query5 |
76+
| test.ps1:99:5:99:11 | query6 | semmle.label | query6 |
77+
| test.ps1:100:76:100:82 | query6 | semmle.label | query6 |
78+
| test.ps1:102:5:102:11 | query7 | semmle.label | query7 |
79+
| test.ps1:103:76:103:82 | query7 | semmle.label | query7 |
80+
| test.ps1:105:5:105:11 | query8 | semmle.label | query8 |
81+
| test.ps1:106:76:106:82 | query8 | semmle.label | query8 |
82+
| test.ps1:109:22:109:31 | userinput | semmle.label | userinput |
83+
| test.ps1:109:33:109:42 | userinput | semmle.label | userinput |
84+
| test.ps1:109:44:109:53 | userinput | semmle.label | userinput |
85+
| test.ps1:109:55:109:64 | userinput | semmle.label | userinput |
86+
| test.ps1:109:66:109:75 | userinput | semmle.label | userinput |
87+
| test.ps1:109:77:109:86 | userinput | semmle.label | userinput |
88+
| test.ps1:109:88:109:97 | userinput | semmle.label | userinput |
89+
| test.ps1:109:99:109:108 | userinput | semmle.label | userinput |
2690
subpaths
2791
#select
2892
| test.ps1:5:72:5:77 | query | test.ps1:1:14:1:45 | Call to read-host | test.ps1:5:72:5:77 | query | This SQL query depends on a $@. | test.ps1:1:14:1:45 | Call to read-host | read from stdin |
2993
| test.ps1:9:72:9:77 | query | test.ps1:1:14:1:45 | Call to read-host | test.ps1:9:72:9:77 | query | This SQL query depends on a $@. | test.ps1:1:14:1:45 | Call to read-host | read from stdin |
3094
| test.ps1:17:24:17:76 | SELECT * FROM MyTable WHERE MyColumn = '$userinput' | test.ps1:1:14:1:45 | Call to read-host | test.ps1:17:24:17:76 | SELECT * FROM MyTable WHERE MyColumn = '$userinput' | This SQL query depends on a $@. | test.ps1:1:14:1:45 | Call to read-host | read from stdin |
3195
| test.ps1:28:24:28:76 | SELECT * FROM MyTable WHERE MyColumn = '$userinput' | test.ps1:1:14:1:45 | Call to read-host | test.ps1:28:24:28:76 | SELECT * FROM MyTable WHERE MyColumn = '$userinput' | This SQL query depends on a $@. | test.ps1:1:14:1:45 | Call to read-host | read from stdin |
3296
| test.ps1:81:15:81:25 | QueryConn2 | test.ps1:1:14:1:45 | Call to read-host | test.ps1:81:15:81:25 | QueryConn2 | This SQL query depends on a $@. | test.ps1:1:14:1:45 | Call to read-host | read from stdin |
97+
| test.ps1:85:76:85:82 | query1 | test.ps1:1:14:1:45 | Call to read-host | test.ps1:85:76:85:82 | query1 | This SQL query depends on a $@. | test.ps1:1:14:1:45 | Call to read-host | read from stdin |
98+
| test.ps1:88:76:88:82 | query2 | test.ps1:1:14:1:45 | Call to read-host | test.ps1:88:76:88:82 | query2 | This SQL query depends on a $@. | test.ps1:1:14:1:45 | Call to read-host | read from stdin |
99+
| test.ps1:91:76:91:82 | query3 | test.ps1:1:14:1:45 | Call to read-host | test.ps1:91:76:91:82 | query3 | This SQL query depends on a $@. | test.ps1:1:14:1:45 | Call to read-host | read from stdin |
100+
| test.ps1:94:76:94:82 | query4 | test.ps1:1:14:1:45 | Call to read-host | test.ps1:94:76:94:82 | query4 | This SQL query depends on a $@. | test.ps1:1:14:1:45 | Call to read-host | read from stdin |
101+
| test.ps1:97:76:97:82 | query5 | test.ps1:1:14:1:45 | Call to read-host | test.ps1:97:76:97:82 | query5 | This SQL query depends on a $@. | test.ps1:1:14:1:45 | Call to read-host | read from stdin |
102+
| test.ps1:100:76:100:82 | query6 | test.ps1:1:14:1:45 | Call to read-host | test.ps1:100:76:100:82 | query6 | This SQL query depends on a $@. | test.ps1:1:14:1:45 | Call to read-host | read from stdin |
103+
| test.ps1:103:76:103:82 | query7 | test.ps1:1:14:1:45 | Call to read-host | test.ps1:103:76:103:82 | query7 | This SQL query depends on a $@. | test.ps1:1:14:1:45 | Call to read-host | read from stdin |
104+
| test.ps1:106:76:106:82 | query8 | test.ps1:1:14:1:45 | Call to read-host | test.ps1:106:76:106:82 | query8 | This SQL query depends on a $@. | test.ps1:1:14:1:45 | Call to read-host | read from stdin |

‎powershell/ql/test/query-tests/security/cwe-089/test.ps1‎

Lines changed: 29 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -78,4 +78,32 @@ $QueryConn2 = @{
7878
Query = $userinput
7979
}
8080

81-
Invoke-Sqlcmd @QueryConn2 # BAD
81+
Invoke-Sqlcmd @QueryConn2 # BAD
82+
83+
function TakesTypedParameters([int]$i, [long]$l, [float]$f, [double]$d, [decimal]$dec, [char]$c, [bool]$b, [datetime]$dt) {
84+
$query1 = "SELECT * FROM MyTable WHERE MyColumn = '$i'"
85+
Invoke-Sqlcmd -ServerInstance "MyServer" -Database "MyDatabase" -Query $query1 # GOOD [FALSE POSITIVE]
86+
87+
$query2 = "SELECT * FROM MyTable WHERE MyColumn = '$l'"
88+
Invoke-Sqlcmd -ServerInstance "MyServer" -Database "MyDatabase" -Query $query2 # GOOD [FALSE POSITIVE]
89+
90+
$query3 = "SELECT * FROM MyTable WHERE MyColumn = '$f'"
91+
Invoke-Sqlcmd -ServerInstance "MyServer" -Database "MyDatabase" -Query $query3 # GOOD [FALSE POSITIVE]
92+
93+
$query4 = "SELECT * FROM MyTable WHERE MyColumn = '$d'"
94+
Invoke-Sqlcmd -ServerInstance "MyServer" -Database "MyDatabase" -Query $query4 # GOOD [FALSE POSITIVE]
95+
96+
$query5 = "SELECT * FROM MyTable WHERE MyColumn = '$dec'"
97+
Invoke-Sqlcmd -ServerInstance "MyServer" -Database "MyDatabase" -Query $query5 # GOOD [FALSE POSITIVE]
98+
99+
$query6 = "SELECT * FROM MyTable WHERE MyColumn = '$c'"
100+
Invoke-Sqlcmd -ServerInstance "MyServer" -Database "MyDatabase" -Query $query6 # GOOD [FALSE POSITIVE]
101+
102+
$query7 = "SELECT * FROM MyTable WHERE MyColumn = '$b'"
103+
Invoke-Sqlcmd -ServerInstance "MyServer" -Database "MyDatabase" -Query $query7 # GOOD [FALSE POSITIVE]
104+
105+
$query8 = "SELECT * FROM MyTable WHERE MyColumn = '$dt'"
106+
Invoke-Sqlcmd -ServerInstance "MyServer" -Database "MyDatabase" -Query $query8 # GOOD [FALSE POSITIVE]
107+
}
108+
109+
TakesTypedParameters $userinput $userinput $userinput $userinput $userinput $userinput $userinput $userinput

0 commit comments

Comments
 (0)