|
22 | 22 | cp.execSync(cmd); // BAD |
23 | 23 | } |
24 | 24 | </code></pre> |
25 | | - |
| 25 | + |
26 | 26 | 2. [javascript/ql/src/Security/CWE-078/examples/shell-command-injection-from-environment.js](https://github.com/github/codeql/blob/48015e5a2e6202131f2d1062cc066dc33ed69a9b/javascript/ql/src/Security/CWE-078/examples/shell-command-injection-from-environment.js#L4-L4) |
27 | 27 | <pre><code class="javascript"> path = require("path"); |
28 | 28 | function cleanupTemp() { |
29 | 29 | let cmd = "rm -rf " + <strong>path.join(__dirname, "temp")</strong>; |
30 | 30 | cp.execSync(cmd); // BAD |
31 | 31 | } |
32 | 32 | </code></pre> |
33 | | - |
| 33 | + |
34 | 34 | 3. [javascript/ql/src/Security/CWE-078/examples/shell-command-injection-from-environment.js](https://github.com/github/codeql/blob/48015e5a2e6202131f2d1062cc066dc33ed69a9b/javascript/ql/src/Security/CWE-078/examples/shell-command-injection-from-environment.js#L4-L4) |
35 | 35 | <pre><code class="javascript"> path = require("path"); |
36 | 36 | function cleanupTemp() { |
37 | 37 | let cmd = <strong>"rm -rf " + path.join(__dirname, "temp")</strong>; |
38 | 38 | cp.execSync(cmd); // BAD |
39 | 39 | } |
40 | 40 | </code></pre> |
41 | | - |
| 41 | + |
42 | 42 | 4. [javascript/ql/src/Security/CWE-078/examples/shell-command-injection-from-environment.js](https://github.com/github/codeql/blob/48015e5a2e6202131f2d1062cc066dc33ed69a9b/javascript/ql/src/Security/CWE-078/examples/shell-command-injection-from-environment.js#L4-L4) |
43 | 43 | <pre><code class="javascript"> path = require("path"); |
44 | 44 | function cleanupTemp() { |
45 | 45 | let <strong>cmd = "rm -rf " + path.join(__dirname, "temp")</strong>; |
46 | 46 | cp.execSync(cmd); // BAD |
47 | 47 | } |
48 | 48 | </code></pre> |
49 | | - |
| 49 | + |
50 | 50 | 5. [javascript/ql/src/Security/CWE-078/examples/shell-command-injection-from-environment.js](https://github.com/github/codeql/blob/48015e5a2e6202131f2d1062cc066dc33ed69a9b/javascript/ql/src/Security/CWE-078/examples/shell-command-injection-from-environment.js#L5-L5) |
51 | 51 | <pre><code class="javascript">function cleanupTemp() { |
52 | 52 | let cmd = "rm -rf " + path.join(__dirname, "temp"); |
53 | 53 | cp.execSync(<strong>cmd</strong>); // BAD |
54 | 54 | } |
55 | 55 | </code></pre> |
56 | | - |
57 | 56 |
|
58 | 57 | </details> |
59 | 58 |
|
|
79 | 78 | <pre><code class="javascript">(function() { |
80 | 79 | cp.execFileSync('rm', ['-rf', path.join(__dirname, "temp")]); // GOOD |
81 | 80 | cp.execSync('rm -rf ' + path.join(<strong>__dirname</strong>, "temp")); // BAD |
82 | | - |
| 81 | + |
83 | 82 | execa.shell('rm -rf ' + path.join(__dirname, "temp")); // NOT OK |
84 | 83 | </code></pre> |
85 | | - |
| 84 | + |
86 | 85 | 2. [javascript/ql/test/query-tests/Security/CWE-078/tst_shell-command-injection-from-environment.js](https://github.com/github/codeql/blob/48015e5a2e6202131f2d1062cc066dc33ed69a9b/javascript/ql/test/query-tests/Security/CWE-078/tst_shell-command-injection-from-environment.js#L6-L6) |
87 | 86 | <pre><code class="javascript">(function() { |
88 | 87 | cp.execFileSync('rm', ['-rf', path.join(__dirname, "temp")]); // GOOD |
89 | 88 | cp.execSync('rm -rf ' + <strong>path.join(__dirname, "temp")</strong>); // BAD |
90 | | - |
| 89 | + |
91 | 90 | execa.shell('rm -rf ' + path.join(__dirname, "temp")); // NOT OK |
92 | 91 | </code></pre> |
93 | | - |
| 92 | + |
94 | 93 | 3. [javascript/ql/test/query-tests/Security/CWE-078/tst_shell-command-injection-from-environment.js](https://github.com/github/codeql/blob/48015e5a2e6202131f2d1062cc066dc33ed69a9b/javascript/ql/test/query-tests/Security/CWE-078/tst_shell-command-injection-from-environment.js#L6-L6) |
95 | 94 | <pre><code class="javascript">(function() { |
96 | 95 | cp.execFileSync('rm', ['-rf', path.join(__dirname, "temp")]); // GOOD |
97 | 96 | cp.execSync(<strong>'rm -rf ' + path.join(__dirname, "temp")</strong>); // BAD |
98 | | - |
| 97 | + |
99 | 98 | execa.shell('rm -rf ' + path.join(__dirname, "temp")); // NOT OK |
100 | 99 | </code></pre> |
101 | | - |
102 | 100 |
|
103 | 101 | </details> |
104 | 102 |
|
|
122 | 120 |
|
123 | 121 | 1. [javascript/ql/test/query-tests/Security/CWE-078/tst_shell-command-injection-from-environment.js](https://github.com/github/codeql/blob/48015e5a2e6202131f2d1062cc066dc33ed69a9b/javascript/ql/test/query-tests/Security/CWE-078/tst_shell-command-injection-from-environment.js#L8-L8) |
124 | 122 | <pre><code class="javascript"> cp.execSync('rm -rf ' + path.join(__dirname, "temp")); // BAD |
125 | | - |
| 123 | + |
126 | 124 | execa.shell('rm -rf ' + path.join(<strong>__dirname</strong>, "temp")); // NOT OK |
127 | 125 | execa.shellSync('rm -rf ' + path.join(__dirname, "temp")); // NOT OK |
128 | | - |
| 126 | + |
129 | 127 | </code></pre> |
130 | | - |
| 128 | + |
131 | 129 | 2. [javascript/ql/test/query-tests/Security/CWE-078/tst_shell-command-injection-from-environment.js](https://github.com/github/codeql/blob/48015e5a2e6202131f2d1062cc066dc33ed69a9b/javascript/ql/test/query-tests/Security/CWE-078/tst_shell-command-injection-from-environment.js#L8-L8) |
132 | 130 | <pre><code class="javascript"> cp.execSync('rm -rf ' + path.join(__dirname, "temp")); // BAD |
133 | | - |
| 131 | + |
134 | 132 | execa.shell('rm -rf ' + <strong>path.join(__dirname, "temp")</strong>); // NOT OK |
135 | 133 | execa.shellSync('rm -rf ' + path.join(__dirname, "temp")); // NOT OK |
136 | | - |
| 134 | + |
137 | 135 | </code></pre> |
138 | | - |
| 136 | + |
139 | 137 | 3. [javascript/ql/test/query-tests/Security/CWE-078/tst_shell-command-injection-from-environment.js](https://github.com/github/codeql/blob/48015e5a2e6202131f2d1062cc066dc33ed69a9b/javascript/ql/test/query-tests/Security/CWE-078/tst_shell-command-injection-from-environment.js#L8-L8) |
140 | 138 | <pre><code class="javascript"> cp.execSync('rm -rf ' + path.join(__dirname, "temp")); // BAD |
141 | | - |
| 139 | + |
142 | 140 | execa.shell(<strong>'rm -rf ' + path.join(__dirname, "temp")</strong>); // NOT OK |
143 | 141 | execa.shellSync('rm -rf ' + path.join(__dirname, "temp")); // NOT OK |
144 | | - |
| 142 | + |
145 | 143 | </code></pre> |
146 | | - |
147 | 144 |
|
148 | 145 | </details> |
149 | 146 |
|
|
169 | 166 | <pre><code class="javascript"> |
170 | 167 | execa.shell('rm -rf ' + path.join(__dirname, "temp")); // NOT OK |
171 | 168 | execa.shellSync('rm -rf ' + path.join(<strong>__dirname</strong>, "temp")); // NOT OK |
172 | | - |
| 169 | + |
173 | 170 | const safe = "\"" + path.join(__dirname, "temp") + "\""; |
174 | 171 | </code></pre> |
175 | | - |
| 172 | + |
176 | 173 | 2. [javascript/ql/test/query-tests/Security/CWE-078/tst_shell-command-injection-from-environment.js](https://github.com/github/codeql/blob/48015e5a2e6202131f2d1062cc066dc33ed69a9b/javascript/ql/test/query-tests/Security/CWE-078/tst_shell-command-injection-from-environment.js#L9-L9) |
177 | 174 | <pre><code class="javascript"> |
178 | 175 | execa.shell('rm -rf ' + path.join(__dirname, "temp")); // NOT OK |
179 | 176 | execa.shellSync('rm -rf ' + <strong>path.join(__dirname, "temp")</strong>); // NOT OK |
180 | | - |
| 177 | + |
181 | 178 | const safe = "\"" + path.join(__dirname, "temp") + "\""; |
182 | 179 | </code></pre> |
183 | | - |
| 180 | + |
184 | 181 | 3. [javascript/ql/test/query-tests/Security/CWE-078/tst_shell-command-injection-from-environment.js](https://github.com/github/codeql/blob/48015e5a2e6202131f2d1062cc066dc33ed69a9b/javascript/ql/test/query-tests/Security/CWE-078/tst_shell-command-injection-from-environment.js#L9-L9) |
185 | 182 | <pre><code class="javascript"> |
186 | 183 | execa.shell('rm -rf ' + path.join(__dirname, "temp")); // NOT OK |
187 | 184 | execa.shellSync(<strong>'rm -rf ' + path.join(__dirname, "temp")</strong>); // NOT OK |
188 | | - |
| 185 | + |
189 | 186 | const safe = "\"" + path.join(__dirname, "temp") + "\""; |
190 | 187 | </code></pre> |
191 | | - |
192 | 188 |
|
193 | 189 | </details> |
194 | 190 |
|
|
0 commit comments