Skip to content

XSJS queries and CodeQL update #129

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom
Merged
merged 9 commits into from
Jul 24, 2024
Merged

XSJS queries and CodeQL update #129

merged 9 commits into from
Jul 24, 2024

Conversation

@mbaluda
Copy link
Contributor

@mbaluda mbaluda commented Jul 21, 2024 •
edited
Loading

@mbaluda mbaluda self-assigned this Jul 21, 2024
github-advanced-security[bot]
github-advanced-security bot found potential problems Jul 21, 2024
View reviewed changes
javascript/frameworks/XSJS/test/queries/XSJSZipSlip/XSJSZipSlip.xsjs

for (var entryPath in zipArchive) {
var targetFilePath = require("path").join(targetFolderName, entryPath)
require("fs").createWriteStream(targetFilePath).write(zip[entryPath]);

Check failure

Code scanning / CodeQL

XSJS Zip Slip

The path of [this zip file](1) being saved depends on a [user-provided value](2).
javascript/frameworks/XSJS/test/queries/XSJSUrlRedirect/XSJSUrlRedirect.xsjs
function test1(requestParameters) {
let someParameterValue = requestParameters.get("someParameter");
$.response.status = $.net.http.OK;
$.response.headers.set("location", someParameterValue);

Check warning

Code scanning / CodeQL

XSJS URL Redirect

[This URL](1) depends on a [user-provided value](2).
javascript/frameworks/XSJS/test/queries/XSJSSqlInjection/XSJSSqlInjection.xsjs
let query = "INSERT INTO " + someParameterValue1 + ".ENTITY (COL1) VALUES (" + someParameterValue2 + ")";

let dbConnection = $.db.getConnection();
let preparedStatement = dbConnection.prepareStatement(query);

Check failure

Code scanning / CodeQL

XSJS SQL injection

This query depends on a [user-provided value](1). This query depends on a [user-provided value](2).
javascript/frameworks/XSJS/test/queries/XSJSReflectedXss/XSJSReflectedXss.xsjs
function test1(requestParameters) {
let someParameterValue1 = requestParameters.get("someParameter1");
$.response.contentType = "text/html";
$.response.setBody(requestParameterHandler(someParameterValue1));

Check failure

Code scanning / CodeQL

XSJS Reflected XSS

Reflected XSS vulnerability due to [user-provided value](1).
@mbaluda mbaluda requested a review from jeongsoolee09 July 21, 2024 10:52
@jeongsoolee09
Copy link
Contributor

jeongsoolee09 commented Jul 22, 2024

@mbaluda Thanks a lot! Can you change the toplevel folder name (javascript/frameworks/XSJS) to lowercase (javascript/frameworks/xsjs) to match the name of other framework folders?

github-advanced-security[bot]
github-advanced-security bot found potential problems Jul 22, 2024
View reviewed changes
javascript/frameworks/xsjs/test/queries/XSJSZipSlip/XSJSZipSlip.xsjs

for (var entryPath in zipArchive) {
var targetFilePath = require("path").join(targetFolderName, entryPath)
require("fs").createWriteStream(targetFilePath).write(zip[entryPath]);

Check failure

Code scanning / CodeQL

XSJS Zip Slip

The path of [this zip file](1) being saved depends on a [user-provided value](2).
javascript/frameworks/xsjs/test/queries/XSJSUrlRedirect/XSJSUrlRedirect.xsjs
function test1(requestParameters) {
let someParameterValue = requestParameters.get("someParameter");
$.response.status = $.net.http.OK;
$.response.headers.set("location", someParameterValue);

Check warning

Code scanning / CodeQL

XSJS URL Redirect

[This URL](1) depends on a [user-provided value](2).
javascript/frameworks/xsjs/test/queries/XSJSSqlInjection/XSJSSqlInjection.xsjs
let query = "INSERT INTO " + someParameterValue1 + ".ENTITY (COL1) VALUES (" + someParameterValue2 + ")";

let dbConnection = $.db.getConnection();
let preparedStatement = dbConnection.prepareStatement(query);

Check failure

Code scanning / CodeQL

XSJS SQL injection

This query depends on a [user-provided value](1). This query depends on a [user-provided value](2).
javascript/frameworks/xsjs/test/queries/XSJSReflectedXss/XSJSReflectedXss.xsjs
function test1(requestParameters) {
let someParameterValue1 = requestParameters.get("someParameter1");
$.response.contentType = "text/html";
$.response.setBody(requestParameterHandler(someParameterValue1));

Check failure

Code scanning / CodeQL

XSJS Reflected XSS

Reflected XSS vulnerability due to [user-provided value](1).
jeongsoolee09
jeongsoolee09 approved these changes Jul 24, 2024
View reviewed changes
Copy link
Contributor

@jeongsoolee09 jeongsoolee09 left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

:shipit:

@jeongsoolee09 jeongsoolee09 merged commit 1e27135 into main Jul 24, 2024
@jeongsoolee09 jeongsoolee09 deleted the mbaluda/xsjs branch July 24, 2024 23:34
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@jeongsoolee09 jeongsoolee09 jeongsoolee09 approved these changes

Assignees

@mbaluda mbaluda

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

3 participants

@mbaluda @jeongsoolee09