Skip to content

Commit d8a30c4

Browse files
erik-krogherik-krogh
committed
update expected output of TaintedPath tests
1 parent c0417ac commit d8a30c4

File tree

3 files changed

+193
-6
lines changed

3 files changed

+193
-6
lines changed

‎javascript/ql/test/query-tests/Security/CWE-022/TaintedPath/Consistency.expected‎

Lines changed: 0 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,3 @@
11
| normalizedPaths.js:208:38:208:63 | // OK - ... anyway | Spurious alert |
2-
| tainted-string-steps.js:13:41:13:72 | // NOT ... flagged | Missing alert |
3-
| tainted-string-steps.js:14:41:14:72 | // NOT ... flagged | Missing alert |
4-
| tainted-string-steps.js:15:50:15:81 | // NOT ... flagged | Missing alert |
52
| tainted-string-steps.js:25:43:25:74 | // NOT ... flagged | Missing alert |
63
| tainted-string-steps.js:26:49:26:74 | // OK - ... flagged | Spurious alert |

‎javascript/ql/test/query-tests/Security/CWE-022/TaintedPath/TaintedPath.expected‎

Lines changed: 190 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1412,6 +1412,73 @@ nodes
14121412
| tainted-string-steps.js:11:18:11:30 | path.slice(4) |
14131413
| tainted-string-steps.js:11:18:11:30 | path.slice(4) |
14141414
| tainted-string-steps.js:11:18:11:30 | path.slice(4) |
1415+
| tainted-string-steps.js:13:18:13:21 | path |
1416+
| tainted-string-steps.js:13:18:13:21 | path |
1417+
| tainted-string-steps.js:13:18:13:21 | path |
1418+
| tainted-string-steps.js:13:18:13:21 | path |
1419+
| tainted-string-steps.js:13:18:13:21 | path |
1420+
| tainted-string-steps.js:13:18:13:21 | path |
1421+
| tainted-string-steps.js:13:18:13:21 | path |
1422+
| tainted-string-steps.js:13:18:13:21 | path |
1423+
| tainted-string-steps.js:13:18:13:21 | path |
1424+
| tainted-string-steps.js:13:18:13:21 | path |
1425+
| tainted-string-steps.js:13:18:13:21 | path |
1426+
| tainted-string-steps.js:13:18:13:21 | path |
1427+
| tainted-string-steps.js:13:18:13:21 | path |
1428+
| tainted-string-steps.js:13:18:13:21 | path |
1429+
| tainted-string-steps.js:13:18:13:21 | path |
1430+
| tainted-string-steps.js:13:18:13:21 | path |
1431+
| tainted-string-steps.js:13:18:13:37 | path.concat(unknown) |
1432+
| tainted-string-steps.js:13:18:13:37 | path.concat(unknown) |
1433+
| tainted-string-steps.js:13:18:13:37 | path.concat(unknown) |
1434+
| tainted-string-steps.js:13:18:13:37 | path.concat(unknown) |
1435+
| tainted-string-steps.js:13:18:13:37 | path.concat(unknown) |
1436+
| tainted-string-steps.js:13:18:13:37 | path.concat(unknown) |
1437+
| tainted-string-steps.js:13:18:13:37 | path.concat(unknown) |
1438+
| tainted-string-steps.js:13:18:13:37 | path.concat(unknown) |
1439+
| tainted-string-steps.js:13:18:13:37 | path.concat(unknown) |
1440+
| tainted-string-steps.js:13:18:13:37 | path.concat(unknown) |
1441+
| tainted-string-steps.js:13:18:13:37 | path.concat(unknown) |
1442+
| tainted-string-steps.js:13:18:13:37 | path.concat(unknown) |
1443+
| tainted-string-steps.js:13:18:13:37 | path.concat(unknown) |
1444+
| tainted-string-steps.js:13:18:13:37 | path.concat(unknown) |
1445+
| tainted-string-steps.js:13:18:13:37 | path.concat(unknown) |
1446+
| tainted-string-steps.js:13:18:13:37 | path.concat(unknown) |
1447+
| tainted-string-steps.js:13:18:13:37 | path.concat(unknown) |
1448+
| tainted-string-steps.js:14:18:14:37 | unknown.concat(path) |
1449+
| tainted-string-steps.js:14:18:14:37 | unknown.concat(path) |
1450+
| tainted-string-steps.js:14:18:14:37 | unknown.concat(path) |
1451+
| tainted-string-steps.js:14:18:14:37 | unknown.concat(path) |
1452+
| tainted-string-steps.js:14:18:14:37 | unknown.concat(path) |
1453+
| tainted-string-steps.js:14:33:14:36 | path |
1454+
| tainted-string-steps.js:14:33:14:36 | path |
1455+
| tainted-string-steps.js:14:33:14:36 | path |
1456+
| tainted-string-steps.js:14:33:14:36 | path |
1457+
| tainted-string-steps.js:14:33:14:36 | path |
1458+
| tainted-string-steps.js:14:33:14:36 | path |
1459+
| tainted-string-steps.js:14:33:14:36 | path |
1460+
| tainted-string-steps.js:14:33:14:36 | path |
1461+
| tainted-string-steps.js:14:33:14:36 | path |
1462+
| tainted-string-steps.js:14:33:14:36 | path |
1463+
| tainted-string-steps.js:14:33:14:36 | path |
1464+
| tainted-string-steps.js:14:33:14:36 | path |
1465+
| tainted-string-steps.js:15:18:15:46 | unknown ... , path) |
1466+
| tainted-string-steps.js:15:18:15:46 | unknown ... , path) |
1467+
| tainted-string-steps.js:15:18:15:46 | unknown ... , path) |
1468+
| tainted-string-steps.js:15:18:15:46 | unknown ... , path) |
1469+
| tainted-string-steps.js:15:18:15:46 | unknown ... , path) |
1470+
| tainted-string-steps.js:15:42:15:45 | path |
1471+
| tainted-string-steps.js:15:42:15:45 | path |
1472+
| tainted-string-steps.js:15:42:15:45 | path |
1473+
| tainted-string-steps.js:15:42:15:45 | path |
1474+
| tainted-string-steps.js:15:42:15:45 | path |
1475+
| tainted-string-steps.js:15:42:15:45 | path |
1476+
| tainted-string-steps.js:15:42:15:45 | path |
1477+
| tainted-string-steps.js:15:42:15:45 | path |
1478+
| tainted-string-steps.js:15:42:15:45 | path |
1479+
| tainted-string-steps.js:15:42:15:45 | path |
1480+
| tainted-string-steps.js:15:42:15:45 | path |
1481+
| tainted-string-steps.js:15:42:15:45 | path |
14151482
| tainted-string-steps.js:17:18:17:21 | path |
14161483
| tainted-string-steps.js:17:18:17:21 | path |
14171484
| tainted-string-steps.js:17:18:17:21 | path |
@@ -3456,6 +3523,46 @@ edges
34563523
| tainted-string-steps.js:6:7:6:48 | path | tainted-string-steps.js:11:18:11:21 | path |
34573524
| tainted-string-steps.js:6:7:6:48 | path | tainted-string-steps.js:11:18:11:21 | path |
34583525
| tainted-string-steps.js:6:7:6:48 | path | tainted-string-steps.js:11:18:11:21 | path |
3526+
| tainted-string-steps.js:6:7:6:48 | path | tainted-string-steps.js:13:18:13:21 | path |
3527+
| tainted-string-steps.js:6:7:6:48 | path | tainted-string-steps.js:13:18:13:21 | path |
3528+
| tainted-string-steps.js:6:7:6:48 | path | tainted-string-steps.js:13:18:13:21 | path |
3529+
| tainted-string-steps.js:6:7:6:48 | path | tainted-string-steps.js:13:18:13:21 | path |
3530+
| tainted-string-steps.js:6:7:6:48 | path | tainted-string-steps.js:13:18:13:21 | path |
3531+
| tainted-string-steps.js:6:7:6:48 | path | tainted-string-steps.js:13:18:13:21 | path |
3532+
| tainted-string-steps.js:6:7:6:48 | path | tainted-string-steps.js:13:18:13:21 | path |
3533+
| tainted-string-steps.js:6:7:6:48 | path | tainted-string-steps.js:13:18:13:21 | path |
3534+
| tainted-string-steps.js:6:7:6:48 | path | tainted-string-steps.js:13:18:13:21 | path |
3535+
| tainted-string-steps.js:6:7:6:48 | path | tainted-string-steps.js:13:18:13:21 | path |
3536+
| tainted-string-steps.js:6:7:6:48 | path | tainted-string-steps.js:13:18:13:21 | path |
3537+
| tainted-string-steps.js:6:7:6:48 | path | tainted-string-steps.js:13:18:13:21 | path |
3538+
| tainted-string-steps.js:6:7:6:48 | path | tainted-string-steps.js:13:18:13:21 | path |
3539+
| tainted-string-steps.js:6:7:6:48 | path | tainted-string-steps.js:13:18:13:21 | path |
3540+
| tainted-string-steps.js:6:7:6:48 | path | tainted-string-steps.js:13:18:13:21 | path |
3541+
| tainted-string-steps.js:6:7:6:48 | path | tainted-string-steps.js:13:18:13:21 | path |
3542+
| tainted-string-steps.js:6:7:6:48 | path | tainted-string-steps.js:14:33:14:36 | path |
3543+
| tainted-string-steps.js:6:7:6:48 | path | tainted-string-steps.js:14:33:14:36 | path |
3544+
| tainted-string-steps.js:6:7:6:48 | path | tainted-string-steps.js:14:33:14:36 | path |
3545+
| tainted-string-steps.js:6:7:6:48 | path | tainted-string-steps.js:14:33:14:36 | path |
3546+
| tainted-string-steps.js:6:7:6:48 | path | tainted-string-steps.js:14:33:14:36 | path |
3547+
| tainted-string-steps.js:6:7:6:48 | path | tainted-string-steps.js:14:33:14:36 | path |
3548+
| tainted-string-steps.js:6:7:6:48 | path | tainted-string-steps.js:14:33:14:36 | path |
3549+
| tainted-string-steps.js:6:7:6:48 | path | tainted-string-steps.js:14:33:14:36 | path |
3550+
| tainted-string-steps.js:6:7:6:48 | path | tainted-string-steps.js:14:33:14:36 | path |
3551+
| tainted-string-steps.js:6:7:6:48 | path | tainted-string-steps.js:14:33:14:36 | path |
3552+
| tainted-string-steps.js:6:7:6:48 | path | tainted-string-steps.js:14:33:14:36 | path |
3553+
| tainted-string-steps.js:6:7:6:48 | path | tainted-string-steps.js:14:33:14:36 | path |
3554+
| tainted-string-steps.js:6:7:6:48 | path | tainted-string-steps.js:15:42:15:45 | path |
3555+
| tainted-string-steps.js:6:7:6:48 | path | tainted-string-steps.js:15:42:15:45 | path |
3556+
| tainted-string-steps.js:6:7:6:48 | path | tainted-string-steps.js:15:42:15:45 | path |
3557+
| tainted-string-steps.js:6:7:6:48 | path | tainted-string-steps.js:15:42:15:45 | path |
3558+
| tainted-string-steps.js:6:7:6:48 | path | tainted-string-steps.js:15:42:15:45 | path |
3559+
| tainted-string-steps.js:6:7:6:48 | path | tainted-string-steps.js:15:42:15:45 | path |
3560+
| tainted-string-steps.js:6:7:6:48 | path | tainted-string-steps.js:15:42:15:45 | path |
3561+
| tainted-string-steps.js:6:7:6:48 | path | tainted-string-steps.js:15:42:15:45 | path |
3562+
| tainted-string-steps.js:6:7:6:48 | path | tainted-string-steps.js:15:42:15:45 | path |
3563+
| tainted-string-steps.js:6:7:6:48 | path | tainted-string-steps.js:15:42:15:45 | path |
3564+
| tainted-string-steps.js:6:7:6:48 | path | tainted-string-steps.js:15:42:15:45 | path |
3565+
| tainted-string-steps.js:6:7:6:48 | path | tainted-string-steps.js:15:42:15:45 | path |
34593566
| tainted-string-steps.js:6:7:6:48 | path | tainted-string-steps.js:17:18:17:21 | path |
34603567
| tainted-string-steps.js:6:7:6:48 | path | tainted-string-steps.js:17:18:17:21 | path |
34613568
| tainted-string-steps.js:6:7:6:48 | path | tainted-string-steps.js:17:18:17:21 | path |
@@ -3744,6 +3851,86 @@ edges
37443851
| tainted-string-steps.js:11:18:11:21 | path | tainted-string-steps.js:11:18:11:30 | path.slice(4) |
37453852
| tainted-string-steps.js:11:18:11:21 | path | tainted-string-steps.js:11:18:11:30 | path.slice(4) |
37463853
| tainted-string-steps.js:11:18:11:21 | path | tainted-string-steps.js:11:18:11:30 | path.slice(4) |
3854+
| tainted-string-steps.js:13:18:13:21 | path | tainted-string-steps.js:13:18:13:37 | path.concat(unknown) |
3855+
| tainted-string-steps.js:13:18:13:21 | path | tainted-string-steps.js:13:18:13:37 | path.concat(unknown) |
3856+
| tainted-string-steps.js:13:18:13:21 | path | tainted-string-steps.js:13:18:13:37 | path.concat(unknown) |
3857+
| tainted-string-steps.js:13:18:13:21 | path | tainted-string-steps.js:13:18:13:37 | path.concat(unknown) |
3858+
| tainted-string-steps.js:13:18:13:21 | path | tainted-string-steps.js:13:18:13:37 | path.concat(unknown) |
3859+
| tainted-string-steps.js:13:18:13:21 | path | tainted-string-steps.js:13:18:13:37 | path.concat(unknown) |
3860+
| tainted-string-steps.js:13:18:13:21 | path | tainted-string-steps.js:13:18:13:37 | path.concat(unknown) |
3861+
| tainted-string-steps.js:13:18:13:21 | path | tainted-string-steps.js:13:18:13:37 | path.concat(unknown) |
3862+
| tainted-string-steps.js:13:18:13:21 | path | tainted-string-steps.js:13:18:13:37 | path.concat(unknown) |
3863+
| tainted-string-steps.js:13:18:13:21 | path | tainted-string-steps.js:13:18:13:37 | path.concat(unknown) |
3864+
| tainted-string-steps.js:13:18:13:21 | path | tainted-string-steps.js:13:18:13:37 | path.concat(unknown) |
3865+
| tainted-string-steps.js:13:18:13:21 | path | tainted-string-steps.js:13:18:13:37 | path.concat(unknown) |
3866+
| tainted-string-steps.js:13:18:13:21 | path | tainted-string-steps.js:13:18:13:37 | path.concat(unknown) |
3867+
| tainted-string-steps.js:13:18:13:21 | path | tainted-string-steps.js:13:18:13:37 | path.concat(unknown) |
3868+
| tainted-string-steps.js:13:18:13:21 | path | tainted-string-steps.js:13:18:13:37 | path.concat(unknown) |
3869+
| tainted-string-steps.js:13:18:13:21 | path | tainted-string-steps.js:13:18:13:37 | path.concat(unknown) |
3870+
| tainted-string-steps.js:13:18:13:21 | path | tainted-string-steps.js:13:18:13:37 | path.concat(unknown) |
3871+
| tainted-string-steps.js:13:18:13:21 | path | tainted-string-steps.js:13:18:13:37 | path.concat(unknown) |
3872+
| tainted-string-steps.js:13:18:13:21 | path | tainted-string-steps.js:13:18:13:37 | path.concat(unknown) |
3873+
| tainted-string-steps.js:13:18:13:21 | path | tainted-string-steps.js:13:18:13:37 | path.concat(unknown) |
3874+
| tainted-string-steps.js:13:18:13:21 | path | tainted-string-steps.js:13:18:13:37 | path.concat(unknown) |
3875+
| tainted-string-steps.js:13:18:13:21 | path | tainted-string-steps.js:13:18:13:37 | path.concat(unknown) |
3876+
| tainted-string-steps.js:13:18:13:21 | path | tainted-string-steps.js:13:18:13:37 | path.concat(unknown) |
3877+
| tainted-string-steps.js:13:18:13:21 | path | tainted-string-steps.js:13:18:13:37 | path.concat(unknown) |
3878+
| tainted-string-steps.js:13:18:13:21 | path | tainted-string-steps.js:13:18:13:37 | path.concat(unknown) |
3879+
| tainted-string-steps.js:13:18:13:21 | path | tainted-string-steps.js:13:18:13:37 | path.concat(unknown) |
3880+
| tainted-string-steps.js:13:18:13:21 | path | tainted-string-steps.js:13:18:13:37 | path.concat(unknown) |
3881+
| tainted-string-steps.js:13:18:13:21 | path | tainted-string-steps.js:13:18:13:37 | path.concat(unknown) |
3882+
| tainted-string-steps.js:13:18:13:21 | path | tainted-string-steps.js:13:18:13:37 | path.concat(unknown) |
3883+
| tainted-string-steps.js:13:18:13:21 | path | tainted-string-steps.js:13:18:13:37 | path.concat(unknown) |
3884+
| tainted-string-steps.js:13:18:13:21 | path | tainted-string-steps.js:13:18:13:37 | path.concat(unknown) |
3885+
| tainted-string-steps.js:13:18:13:21 | path | tainted-string-steps.js:13:18:13:37 | path.concat(unknown) |
3886+
| tainted-string-steps.js:14:33:14:36 | path | tainted-string-steps.js:14:18:14:37 | unknown.concat(path) |
3887+
| tainted-string-steps.js:14:33:14:36 | path | tainted-string-steps.js:14:18:14:37 | unknown.concat(path) |
3888+
| tainted-string-steps.js:14:33:14:36 | path | tainted-string-steps.js:14:18:14:37 | unknown.concat(path) |
3889+
| tainted-string-steps.js:14:33:14:36 | path | tainted-string-steps.js:14:18:14:37 | unknown.concat(path) |
3890+
| tainted-string-steps.js:14:33:14:36 | path | tainted-string-steps.js:14:18:14:37 | unknown.concat(path) |
3891+
| tainted-string-steps.js:14:33:14:36 | path | tainted-string-steps.js:14:18:14:37 | unknown.concat(path) |
3892+
| tainted-string-steps.js:14:33:14:36 | path | tainted-string-steps.js:14:18:14:37 | unknown.concat(path) |
3893+
| tainted-string-steps.js:14:33:14:36 | path | tainted-string-steps.js:14:18:14:37 | unknown.concat(path) |
3894+
| tainted-string-steps.js:14:33:14:36 | path | tainted-string-steps.js:14:18:14:37 | unknown.concat(path) |
3895+
| tainted-string-steps.js:14:33:14:36 | path | tainted-string-steps.js:14:18:14:37 | unknown.concat(path) |
3896+
| tainted-string-steps.js:14:33:14:36 | path | tainted-string-steps.js:14:18:14:37 | unknown.concat(path) |
3897+
| tainted-string-steps.js:14:33:14:36 | path | tainted-string-steps.js:14:18:14:37 | unknown.concat(path) |
3898+
| tainted-string-steps.js:14:33:14:36 | path | tainted-string-steps.js:14:18:14:37 | unknown.concat(path) |
3899+
| tainted-string-steps.js:14:33:14:36 | path | tainted-string-steps.js:14:18:14:37 | unknown.concat(path) |
3900+
| tainted-string-steps.js:14:33:14:36 | path | tainted-string-steps.js:14:18:14:37 | unknown.concat(path) |
3901+
| tainted-string-steps.js:14:33:14:36 | path | tainted-string-steps.js:14:18:14:37 | unknown.concat(path) |
3902+
| tainted-string-steps.js:14:33:14:36 | path | tainted-string-steps.js:14:18:14:37 | unknown.concat(path) |
3903+
| tainted-string-steps.js:14:33:14:36 | path | tainted-string-steps.js:14:18:14:37 | unknown.concat(path) |
3904+
| tainted-string-steps.js:14:33:14:36 | path | tainted-string-steps.js:14:18:14:37 | unknown.concat(path) |
3905+
| tainted-string-steps.js:14:33:14:36 | path | tainted-string-steps.js:14:18:14:37 | unknown.concat(path) |
3906+
| tainted-string-steps.js:14:33:14:36 | path | tainted-string-steps.js:14:18:14:37 | unknown.concat(path) |
3907+
| tainted-string-steps.js:14:33:14:36 | path | tainted-string-steps.js:14:18:14:37 | unknown.concat(path) |
3908+
| tainted-string-steps.js:14:33:14:36 | path | tainted-string-steps.js:14:18:14:37 | unknown.concat(path) |
3909+
| tainted-string-steps.js:14:33:14:36 | path | tainted-string-steps.js:14:18:14:37 | unknown.concat(path) |
3910+
| tainted-string-steps.js:15:42:15:45 | path | tainted-string-steps.js:15:18:15:46 | unknown ... , path) |
3911+
| tainted-string-steps.js:15:42:15:45 | path | tainted-string-steps.js:15:18:15:46 | unknown ... , path) |
3912+
| tainted-string-steps.js:15:42:15:45 | path | tainted-string-steps.js:15:18:15:46 | unknown ... , path) |
3913+
| tainted-string-steps.js:15:42:15:45 | path | tainted-string-steps.js:15:18:15:46 | unknown ... , path) |
3914+
| tainted-string-steps.js:15:42:15:45 | path | tainted-string-steps.js:15:18:15:46 | unknown ... , path) |
3915+
| tainted-string-steps.js:15:42:15:45 | path | tainted-string-steps.js:15:18:15:46 | unknown ... , path) |
3916+
| tainted-string-steps.js:15:42:15:45 | path | tainted-string-steps.js:15:18:15:46 | unknown ... , path) |
3917+
| tainted-string-steps.js:15:42:15:45 | path | tainted-string-steps.js:15:18:15:46 | unknown ... , path) |
3918+
| tainted-string-steps.js:15:42:15:45 | path | tainted-string-steps.js:15:18:15:46 | unknown ... , path) |
3919+
| tainted-string-steps.js:15:42:15:45 | path | tainted-string-steps.js:15:18:15:46 | unknown ... , path) |
3920+
| tainted-string-steps.js:15:42:15:45 | path | tainted-string-steps.js:15:18:15:46 | unknown ... , path) |
3921+
| tainted-string-steps.js:15:42:15:45 | path | tainted-string-steps.js:15:18:15:46 | unknown ... , path) |
3922+
| tainted-string-steps.js:15:42:15:45 | path | tainted-string-steps.js:15:18:15:46 | unknown ... , path) |
3923+
| tainted-string-steps.js:15:42:15:45 | path | tainted-string-steps.js:15:18:15:46 | unknown ... , path) |
3924+
| tainted-string-steps.js:15:42:15:45 | path | tainted-string-steps.js:15:18:15:46 | unknown ... , path) |
3925+
| tainted-string-steps.js:15:42:15:45 | path | tainted-string-steps.js:15:18:15:46 | unknown ... , path) |
3926+
| tainted-string-steps.js:15:42:15:45 | path | tainted-string-steps.js:15:18:15:46 | unknown ... , path) |
3927+
| tainted-string-steps.js:15:42:15:45 | path | tainted-string-steps.js:15:18:15:46 | unknown ... , path) |
3928+
| tainted-string-steps.js:15:42:15:45 | path | tainted-string-steps.js:15:18:15:46 | unknown ... , path) |
3929+
| tainted-string-steps.js:15:42:15:45 | path | tainted-string-steps.js:15:18:15:46 | unknown ... , path) |
3930+
| tainted-string-steps.js:15:42:15:45 | path | tainted-string-steps.js:15:18:15:46 | unknown ... , path) |
3931+
| tainted-string-steps.js:15:42:15:45 | path | tainted-string-steps.js:15:18:15:46 | unknown ... , path) |
3932+
| tainted-string-steps.js:15:42:15:45 | path | tainted-string-steps.js:15:18:15:46 | unknown ... , path) |
3933+
| tainted-string-steps.js:15:42:15:45 | path | tainted-string-steps.js:15:18:15:46 | unknown ... , path) |
37473934
| tainted-string-steps.js:17:18:17:21 | path | tainted-string-steps.js:17:18:17:28 | path.trim() |
37483935
| tainted-string-steps.js:17:18:17:21 | path | tainted-string-steps.js:17:18:17:28 | path.trim() |
37493936
| tainted-string-steps.js:17:18:17:21 | path | tainted-string-steps.js:17:18:17:28 | path.trim() |
@@ -4035,6 +4222,9 @@ edges
40354222
| tainted-string-steps.js:9:18:9:37 | path.substring(0, i) | tainted-string-steps.js:6:24:6:30 | req.url | tainted-string-steps.js:9:18:9:37 | path.substring(0, i) | This path depends on $@. | tainted-string-steps.js:6:24:6:30 | req.url | a user-provided value |
40364223
| tainted-string-steps.js:10:18:10:31 | path.substr(4) | tainted-string-steps.js:6:24:6:30 | req.url | tainted-string-steps.js:10:18:10:31 | path.substr(4) | This path depends on $@. | tainted-string-steps.js:6:24:6:30 | req.url | a user-provided value |
40374224
| tainted-string-steps.js:11:18:11:30 | path.slice(4) | tainted-string-steps.js:6:24:6:30 | req.url | tainted-string-steps.js:11:18:11:30 | path.slice(4) | This path depends on $@. | tainted-string-steps.js:6:24:6:30 | req.url | a user-provided value |
4225+
| tainted-string-steps.js:13:18:13:37 | path.concat(unknown) | tainted-string-steps.js:6:24:6:30 | req.url | tainted-string-steps.js:13:18:13:37 | path.concat(unknown) | This path depends on $@. | tainted-string-steps.js:6:24:6:30 | req.url | a user-provided value |
4226+
| tainted-string-steps.js:14:18:14:37 | unknown.concat(path) | tainted-string-steps.js:6:24:6:30 | req.url | tainted-string-steps.js:14:18:14:37 | unknown.concat(path) | This path depends on $@. | tainted-string-steps.js:6:24:6:30 | req.url | a user-provided value |
4227+
| tainted-string-steps.js:15:18:15:46 | unknown ... , path) | tainted-string-steps.js:6:24:6:30 | req.url | tainted-string-steps.js:15:18:15:46 | unknown ... , path) | This path depends on $@. | tainted-string-steps.js:6:24:6:30 | req.url | a user-provided value |
40384228
| tainted-string-steps.js:17:18:17:28 | path.trim() | tainted-string-steps.js:6:24:6:30 | req.url | tainted-string-steps.js:17:18:17:28 | path.trim() | This path depends on $@. | tainted-string-steps.js:6:24:6:30 | req.url | a user-provided value |
40394229
| tainted-string-steps.js:18:18:18:35 | path.toLowerCase() | tainted-string-steps.js:6:24:6:30 | req.url | tainted-string-steps.js:18:18:18:35 | path.toLowerCase() | This path depends on $@. | tainted-string-steps.js:6:24:6:30 | req.url | a user-provided value |
40404230
| tainted-string-steps.js:24:18:24:35 | path.split("?")[0] | tainted-string-steps.js:6:24:6:30 | req.url | tainted-string-steps.js:24:18:24:35 | path.split("?")[0] | This path depends on $@. | tainted-string-steps.js:6:24:6:30 | req.url | a user-provided value |

0 commit comments

Comments
 (0)