Skip to content

Commit 93a3833

Browse files
MathiasVPMathiasVP
committed
PS: Accept query test changes.
1 parent 5692eb0 commit 93a3833

File tree

2 files changed

+64
-3
lines changed

2 files changed

+64
-3
lines changed

‎powershell/ql/test/query-tests/security/cwe-022/test.ps1‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -6,14 +6,14 @@ foreach ($entry in $zip.Entries) {
66
$targetPath = Join-Path $extractPath $entry.FullName
77
$fullTargetPath = [System.IO.Path]::GetFullPath($targetPath)
88

9-
[System.IO.Compression.ZipFileExtensions]::ExtractToFile($entry, $fullTargetPath) # BAD [NOT DETECTED]
9+
[System.IO.Compression.ZipFileExtensions]::ExtractToFile($entry, $fullTargetPath) # BAD
1010
}
1111

1212
foreach ($entry in $zip.Entries) {
1313
$targetPath = Join-Path $extractPath $entry.FullName
1414
$fullTargetPath = [System.IO.Path]::GetFullPath($targetPath)
1515

16-
$stream = [System.IO.File]::Open($fullTargetPath, 'Create') # BAD [NOT DETECTED]
16+
$stream = [System.IO.File]::Open($fullTargetPath, 'Create') # BAD
1717
$entry.Open().CopyTo($stream)
1818
$stream.Close()
1919
}
@@ -24,6 +24,6 @@ foreach ($entry in $zip.Entries) {
2424

2525
$extractRoot = [System.IO.Path]::GetFullPath($extractPath)
2626
if ($fullTargetPath.StartsWith($extractRoot)) {
27-
[System.IO.Compression.ZipFileExtensions]::ExtractToFile($entry, $fullTargetPath) # GOOD
27+
[System.IO.Compression.ZipFileExtensions]::ExtractToFile($entry, $fullTargetPath) # GOOD [FALSE POSITIVE]
2828
}
2929
}

‎powershell/ql/test/query-tests/security/cwe-022/zipslip.expected‎

Lines changed: 61 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,3 +1,64 @@
11
edges
2+
| file://:0:0:0:0 | [summary param] pos(0, {}) in microsoft.powershell.management!;Method[join-path] | file://:0:0:0:0 | [summary] to write: ReturnValue in microsoft.powershell.management!;Method[join-path] | provenance | MaD:36 |
3+
| file://:0:0:0:0 | [summary param] pos(0, {}) in system.io.path!;Method[getfullpath] | file://:0:0:0:0 | [summary] to write: ReturnValue in system.io.path!;Method[getfullpath] | provenance | MaD:103 |
4+
| test.ps1:6:5:6:15 | targetPath | test.ps1:7:53:7:63 | targetPath | provenance | |
5+
| test.ps1:6:19:6:56 | Call to join-path | test.ps1:6:5:6:15 | targetPath | provenance | |
6+
| test.ps1:6:42:6:56 | fullname | file://:0:0:0:0 | [summary param] pos(0, {}) in microsoft.powershell.management!;Method[join-path] | provenance | |
7+
| test.ps1:6:42:6:56 | fullname | test.ps1:6:19:6:56 | Call to join-path | provenance | MaD:36 |
8+
| test.ps1:7:5:7:19 | fullTargetPath | test.ps1:9:70:9:84 | fullTargetPath | provenance | |
9+
| test.ps1:7:23:7:64 | Call to getfullpath | test.ps1:7:5:7:19 | fullTargetPath | provenance | |
10+
| test.ps1:7:53:7:63 | targetPath | file://:0:0:0:0 | [summary param] pos(0, {}) in system.io.path!;Method[getfullpath] | provenance | |
11+
| test.ps1:7:53:7:63 | targetPath | test.ps1:7:23:7:64 | Call to getfullpath | provenance | MaD:103 |
12+
| test.ps1:13:5:13:15 | targetPath | test.ps1:14:53:14:63 | targetPath | provenance | |
13+
| test.ps1:13:19:13:56 | Call to join-path | test.ps1:13:5:13:15 | targetPath | provenance | |
14+
| test.ps1:13:42:13:56 | fullname | file://:0:0:0:0 | [summary param] pos(0, {}) in microsoft.powershell.management!;Method[join-path] | provenance | |
15+
| test.ps1:13:42:13:56 | fullname | test.ps1:13:19:13:56 | Call to join-path | provenance | MaD:36 |
16+
| test.ps1:14:5:14:19 | fullTargetPath | test.ps1:16:38:16:52 | fullTargetPath | provenance | |
17+
| test.ps1:14:23:14:64 | Call to getfullpath | test.ps1:14:5:14:19 | fullTargetPath | provenance | |
18+
| test.ps1:14:53:14:63 | targetPath | file://:0:0:0:0 | [summary param] pos(0, {}) in system.io.path!;Method[getfullpath] | provenance | |
19+
| test.ps1:14:53:14:63 | targetPath | test.ps1:14:23:14:64 | Call to getfullpath | provenance | MaD:103 |
20+
| test.ps1:22:5:22:15 | targetPath | test.ps1:23:53:23:63 | targetPath | provenance | |
21+
| test.ps1:22:19:22:56 | Call to join-path | test.ps1:22:5:22:15 | targetPath | provenance | |
22+
| test.ps1:22:42:22:56 | fullname | file://:0:0:0:0 | [summary param] pos(0, {}) in microsoft.powershell.management!;Method[join-path] | provenance | |
23+
| test.ps1:22:42:22:56 | fullname | test.ps1:22:19:22:56 | Call to join-path | provenance | MaD:36 |
24+
| test.ps1:23:5:23:19 | fullTargetPath | test.ps1:27:74:27:88 | fullTargetPath | provenance | |
25+
| test.ps1:23:23:23:64 | Call to getfullpath | test.ps1:23:5:23:19 | fullTargetPath | provenance | |
26+
| test.ps1:23:53:23:63 | targetPath | file://:0:0:0:0 | [summary param] pos(0, {}) in system.io.path!;Method[getfullpath] | provenance | |
27+
| test.ps1:23:53:23:63 | targetPath | test.ps1:23:23:23:64 | Call to getfullpath | provenance | MaD:103 |
28+
nodes
29+
| file://:0:0:0:0 | [summary param] pos(0, {}) in microsoft.powershell.management!;Method[join-path] | semmle.label | [summary param] pos(0, {}) in microsoft.powershell.management!;Method[join-path] |
30+
| file://:0:0:0:0 | [summary param] pos(0, {}) in system.io.path!;Method[getfullpath] | semmle.label | [summary param] pos(0, {}) in system.io.path!;Method[getfullpath] |
31+
| file://:0:0:0:0 | [summary] to write: ReturnValue in microsoft.powershell.management!;Method[join-path] | semmle.label | [summary] to write: ReturnValue in microsoft.powershell.management!;Method[join-path] |
32+
| file://:0:0:0:0 | [summary] to write: ReturnValue in system.io.path!;Method[getfullpath] | semmle.label | [summary] to write: ReturnValue in system.io.path!;Method[getfullpath] |
33+
| test.ps1:6:5:6:15 | targetPath | semmle.label | targetPath |
34+
| test.ps1:6:19:6:56 | Call to join-path | semmle.label | Call to join-path |
35+
| test.ps1:6:42:6:56 | fullname | semmle.label | fullname |
36+
| test.ps1:7:5:7:19 | fullTargetPath | semmle.label | fullTargetPath |
37+
| test.ps1:7:23:7:64 | Call to getfullpath | semmle.label | Call to getfullpath |
38+
| test.ps1:7:53:7:63 | targetPath | semmle.label | targetPath |
39+
| test.ps1:9:70:9:84 | fullTargetPath | semmle.label | fullTargetPath |
40+
| test.ps1:13:5:13:15 | targetPath | semmle.label | targetPath |
41+
| test.ps1:13:19:13:56 | Call to join-path | semmle.label | Call to join-path |
42+
| test.ps1:13:42:13:56 | fullname | semmle.label | fullname |
43+
| test.ps1:14:5:14:19 | fullTargetPath | semmle.label | fullTargetPath |
44+
| test.ps1:14:23:14:64 | Call to getfullpath | semmle.label | Call to getfullpath |
45+
| test.ps1:14:53:14:63 | targetPath | semmle.label | targetPath |
46+
| test.ps1:16:38:16:52 | fullTargetPath | semmle.label | fullTargetPath |
47+
| test.ps1:22:5:22:15 | targetPath | semmle.label | targetPath |
48+
| test.ps1:22:19:22:56 | Call to join-path | semmle.label | Call to join-path |
49+
| test.ps1:22:42:22:56 | fullname | semmle.label | fullname |
50+
| test.ps1:23:5:23:19 | fullTargetPath | semmle.label | fullTargetPath |
51+
| test.ps1:23:23:23:64 | Call to getfullpath | semmle.label | Call to getfullpath |
52+
| test.ps1:23:53:23:63 | targetPath | semmle.label | targetPath |
53+
| test.ps1:27:74:27:88 | fullTargetPath | semmle.label | fullTargetPath |
254
subpaths
55+
| test.ps1:6:42:6:56 | fullname | file://:0:0:0:0 | [summary param] pos(0, {}) in microsoft.powershell.management!;Method[join-path] | file://:0:0:0:0 | [summary] to write: ReturnValue in microsoft.powershell.management!;Method[join-path] | test.ps1:6:19:6:56 | Call to join-path |
56+
| test.ps1:7:53:7:63 | targetPath | file://:0:0:0:0 | [summary param] pos(0, {}) in system.io.path!;Method[getfullpath] | file://:0:0:0:0 | [summary] to write: ReturnValue in system.io.path!;Method[getfullpath] | test.ps1:7:23:7:64 | Call to getfullpath |
57+
| test.ps1:13:42:13:56 | fullname | file://:0:0:0:0 | [summary param] pos(0, {}) in microsoft.powershell.management!;Method[join-path] | file://:0:0:0:0 | [summary] to write: ReturnValue in microsoft.powershell.management!;Method[join-path] | test.ps1:13:19:13:56 | Call to join-path |
58+
| test.ps1:14:53:14:63 | targetPath | file://:0:0:0:0 | [summary param] pos(0, {}) in system.io.path!;Method[getfullpath] | file://:0:0:0:0 | [summary] to write: ReturnValue in system.io.path!;Method[getfullpath] | test.ps1:14:23:14:64 | Call to getfullpath |
59+
| test.ps1:22:42:22:56 | fullname | file://:0:0:0:0 | [summary param] pos(0, {}) in microsoft.powershell.management!;Method[join-path] | file://:0:0:0:0 | [summary] to write: ReturnValue in microsoft.powershell.management!;Method[join-path] | test.ps1:22:19:22:56 | Call to join-path |
60+
| test.ps1:23:53:23:63 | targetPath | file://:0:0:0:0 | [summary param] pos(0, {}) in system.io.path!;Method[getfullpath] | file://:0:0:0:0 | [summary] to write: ReturnValue in system.io.path!;Method[getfullpath] | test.ps1:23:23:23:64 | Call to getfullpath |
361
#select
62+
| test.ps1:6:42:6:56 | fullname | test.ps1:6:42:6:56 | fullname | test.ps1:9:70:9:84 | fullTargetPath | Unsanitized archive entry, which may contain '..', is used in a $@. | test.ps1:9:70:9:84 | fullTargetPath | file system operation |
63+
| test.ps1:13:42:13:56 | fullname | test.ps1:13:42:13:56 | fullname | test.ps1:16:38:16:52 | fullTargetPath | Unsanitized archive entry, which may contain '..', is used in a $@. | test.ps1:16:38:16:52 | fullTargetPath | file system operation |
64+
| test.ps1:22:42:22:56 | fullname | test.ps1:22:42:22:56 | fullname | test.ps1:27:74:27:88 | fullTargetPath | Unsanitized archive entry, which may contain '..', is used in a $@. | test.ps1:27:74:27:88 | fullTargetPath | file system operation |

0 commit comments

Comments
 (0)