Skip to content

Commit f2b813a

Browse files
jheliejhelie
committed
ML: add regression test for effective sink that is also NotASink
1 parent 407a8a7 commit f2b813a

File tree

4 files changed

+196
-0
lines changed

4 files changed

+196
-0
lines changed

‎javascript/ql/experimental/adaptivethreatmodeling/test/endpoint_unit_tests/ExtractEndpointData.expected

Lines changed: 63 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -251,6 +251,53 @@ endpoints
251251
| index.js:78:30:78:39 | "someData" | Xss | isExcludedFromEndToEndEvaluation | false | boolean |
252252
| index.js:78:30:78:39 | "someData" | Xss | notASinkReason | LoggerMethod | string |
253253
| index.js:78:30:78:39 | "someData" | Xss | sinkLabel | NotASink | string |
254+
| index.js:83:10:85:3 | {\\n " ... ar,\\n } | NosqlInjection | hasFlowFromSource | false | boolean |
255+
| index.js:83:10:85:3 | {\\n " ... ar,\\n } | NosqlInjection | isConstantExpression | false | boolean |
256+
| index.js:83:10:85:3 | {\\n " ... ar,\\n } | NosqlInjection | isExcludedFromEndToEndEvaluation | false | boolean |
257+
| index.js:83:10:85:3 | {\\n " ... ar,\\n } | NosqlInjection | notASinkReason | ClientRequest | string |
258+
| index.js:83:10:85:3 | {\\n " ... ar,\\n } | NosqlInjection | notASinkReason | JQueryArgument | string |
259+
| index.js:83:10:85:3 | {\\n " ... ar,\\n } | NosqlInjection | sinkLabel | NotASink | string |
260+
| index.js:83:10:85:3 | {\\n " ... ar,\\n } | SqlInjection | hasFlowFromSource | false | boolean |
261+
| index.js:83:10:85:3 | {\\n " ... ar,\\n } | SqlInjection | isConstantExpression | false | boolean |
262+
| index.js:83:10:85:3 | {\\n " ... ar,\\n } | SqlInjection | isExcludedFromEndToEndEvaluation | false | boolean |
263+
| index.js:83:10:85:3 | {\\n " ... ar,\\n } | SqlInjection | notASinkReason | ClientRequest | string |
264+
| index.js:83:10:85:3 | {\\n " ... ar,\\n } | SqlInjection | notASinkReason | JQueryArgument | string |
265+
| index.js:83:10:85:3 | {\\n " ... ar,\\n } | SqlInjection | sinkLabel | NotASink | string |
266+
| index.js:83:10:85:3 | {\\n " ... ar,\\n } | TaintedPath | hasFlowFromSource | false | boolean |
267+
| index.js:83:10:85:3 | {\\n " ... ar,\\n } | TaintedPath | isConstantExpression | false | boolean |
268+
| index.js:83:10:85:3 | {\\n " ... ar,\\n } | TaintedPath | isExcludedFromEndToEndEvaluation | false | boolean |
269+
| index.js:83:10:85:3 | {\\n " ... ar,\\n } | TaintedPath | notASinkReason | ClientRequest | string |
270+
| index.js:83:10:85:3 | {\\n " ... ar,\\n } | TaintedPath | notASinkReason | JQueryArgument | string |
271+
| index.js:83:10:85:3 | {\\n " ... ar,\\n } | TaintedPath | sinkLabel | NotASink | string |
272+
| index.js:83:10:85:3 | {\\n " ... ar,\\n } | Xss | hasFlowFromSource | false | boolean |
273+
| index.js:83:10:85:3 | {\\n " ... ar,\\n } | Xss | isConstantExpression | false | boolean |
274+
| index.js:83:10:85:3 | {\\n " ... ar,\\n } | Xss | isExcludedFromEndToEndEvaluation | false | boolean |
275+
| index.js:83:10:85:3 | {\\n " ... ar,\\n } | Xss | notASinkReason | ClientRequest | string |
276+
| index.js:83:10:85:3 | {\\n " ... ar,\\n } | Xss | notASinkReason | JQueryArgument | string |
277+
| index.js:83:10:85:3 | {\\n " ... ar,\\n } | Xss | sinkLabel | NotASink | string |
278+
| index.js:84:12:84:18 | foo.bar | NosqlInjection | hasFlowFromSource | false | boolean |
279+
| index.js:84:12:84:18 | foo.bar | NosqlInjection | isConstantExpression | false | boolean |
280+
| index.js:84:12:84:18 | foo.bar | NosqlInjection | isExcludedFromEndToEndEvaluation | false | boolean |
281+
| index.js:84:12:84:18 | foo.bar | NosqlInjection | notASinkReason | ClientRequest | string |
282+
| index.js:84:12:84:18 | foo.bar | NosqlInjection | sinkLabel | NotASink | string |
283+
| index.js:84:12:84:18 | foo.bar | SqlInjection | hasFlowFromSource | false | boolean |
284+
| index.js:84:12:84:18 | foo.bar | SqlInjection | isConstantExpression | false | boolean |
285+
| index.js:84:12:84:18 | foo.bar | SqlInjection | isExcludedFromEndToEndEvaluation | false | boolean |
286+
| index.js:84:12:84:18 | foo.bar | SqlInjection | notASinkReason | ClientRequest | string |
287+
| index.js:84:12:84:18 | foo.bar | SqlInjection | sinkLabel | NotASink | string |
288+
| index.js:84:12:84:18 | foo.bar | SqlInjection | sinkLabel | Unknown | string |
289+
| index.js:84:12:84:18 | foo.bar | TaintedPath | hasFlowFromSource | false | boolean |
290+
| index.js:84:12:84:18 | foo.bar | TaintedPath | isConstantExpression | false | boolean |
291+
| index.js:84:12:84:18 | foo.bar | TaintedPath | isExcludedFromEndToEndEvaluation | false | boolean |
292+
| index.js:84:12:84:18 | foo.bar | TaintedPath | notASinkReason | ClientRequest | string |
293+
| index.js:84:12:84:18 | foo.bar | TaintedPath | sinkLabel | NotASink | string |
294+
| index.js:84:12:84:18 | foo.bar | TaintedPath | sinkLabel | Unknown | string |
295+
| index.js:84:12:84:18 | foo.bar | Xss | hasFlowFromSource | false | boolean |
296+
| index.js:84:12:84:18 | foo.bar | Xss | isConstantExpression | false | boolean |
297+
| index.js:84:12:84:18 | foo.bar | Xss | isExcludedFromEndToEndEvaluation | false | boolean |
298+
| index.js:84:12:84:18 | foo.bar | Xss | notASinkReason | ClientRequest | string |
299+
| index.js:84:12:84:18 | foo.bar | Xss | sinkLabel | NotASink | string |
300+
| index.js:84:12:84:18 | foo.bar | Xss | sinkLabel | Unknown | string |
254301
tokenFeatures
255302
| applications/examples/static/epydoc/epydoc.js:2:15:2:33 | "Should be ignored" | argumentIndex | 0 |
256303
| applications/examples/static/epydoc/epydoc.js:2:15:2:33 | "Should be ignored" | calleeAccessPath | |
@@ -412,3 +459,19 @@ tokenFeatures
412459
| index.js:78:30:78:39 | "someData" | enclosingFunctionBody | console log someData |
413460
| index.js:78:30:78:39 | "someData" | enclosingFunctionName | identity#functionalargument |
414461
| index.js:78:30:78:39 | "someData" | receiverName | console |
462+
| index.js:83:10:85:3 | {\\n " ... ar,\\n } | argumentIndex | 0 |
463+
| index.js:83:10:85:3 | {\\n " ... ar,\\n } | calleeAccessPath | |
464+
| index.js:83:10:85:3 | {\\n " ... ar,\\n } | calleeAccessPathWithStructuralInfo | |
465+
| index.js:83:10:85:3 | {\\n " ... ar,\\n } | calleeApiName | |
466+
| index.js:83:10:85:3 | {\\n " ... ar,\\n } | calleeName | ajax |
467+
| index.js:83:10:85:3 | {\\n " ... ar,\\n } | enclosingFunctionBody | foo $ ajax url foo bar |
468+
| index.js:83:10:85:3 | {\\n " ... ar,\\n } | enclosingFunctionName | effectiveSinkAndNotASink |
469+
| index.js:83:10:85:3 | {\\n " ... ar,\\n } | receiverName | $ |
470+
| index.js:84:12:84:18 | foo.bar | argumentIndex | |
471+
| index.js:84:12:84:18 | foo.bar | calleeAccessPath | |
472+
| index.js:84:12:84:18 | foo.bar | calleeAccessPathWithStructuralInfo | |
473+
| index.js:84:12:84:18 | foo.bar | calleeApiName | |
474+
| index.js:84:12:84:18 | foo.bar | calleeName | |
475+
| index.js:84:12:84:18 | foo.bar | enclosingFunctionBody | foo $ ajax url foo bar |
476+
| index.js:84:12:84:18 | foo.bar | enclosingFunctionName | effectiveSinkAndNotASink |
477+
| index.js:84:12:84:18 | foo.bar | receiverName | |

‎javascript/ql/experimental/adaptivethreatmodeling/test/endpoint_unit_tests/ExtractEndpointDataEvaluation.expected

Lines changed: 63 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -231,6 +231,53 @@ endpoints
231231
| index.js:78:30:78:39 | "someData" | Xss | isExcludedFromEndToEndEvaluation | false | boolean |
232232
| index.js:78:30:78:39 | "someData" | Xss | notASinkReason | LoggerMethod | string |
233233
| index.js:78:30:78:39 | "someData" | Xss | sinkLabel | NotASink | string |
234+
| index.js:83:10:85:3 | {\\n " ... ar,\\n } | NosqlInjection | hasFlowFromSource | false | boolean |
235+
| index.js:83:10:85:3 | {\\n " ... ar,\\n } | NosqlInjection | isConstantExpression | false | boolean |
236+
| index.js:83:10:85:3 | {\\n " ... ar,\\n } | NosqlInjection | isExcludedFromEndToEndEvaluation | false | boolean |
237+
| index.js:83:10:85:3 | {\\n " ... ar,\\n } | NosqlInjection | notASinkReason | ClientRequest | string |
238+
| index.js:83:10:85:3 | {\\n " ... ar,\\n } | NosqlInjection | notASinkReason | JQueryArgument | string |
239+
| index.js:83:10:85:3 | {\\n " ... ar,\\n } | NosqlInjection | sinkLabel | NotASink | string |
240+
| index.js:83:10:85:3 | {\\n " ... ar,\\n } | SqlInjection | hasFlowFromSource | false | boolean |
241+
| index.js:83:10:85:3 | {\\n " ... ar,\\n } | SqlInjection | isConstantExpression | false | boolean |
242+
| index.js:83:10:85:3 | {\\n " ... ar,\\n } | SqlInjection | isExcludedFromEndToEndEvaluation | false | boolean |
243+
| index.js:83:10:85:3 | {\\n " ... ar,\\n } | SqlInjection | notASinkReason | ClientRequest | string |
244+
| index.js:83:10:85:3 | {\\n " ... ar,\\n } | SqlInjection | notASinkReason | JQueryArgument | string |
245+
| index.js:83:10:85:3 | {\\n " ... ar,\\n } | SqlInjection | sinkLabel | NotASink | string |
246+
| index.js:83:10:85:3 | {\\n " ... ar,\\n } | TaintedPath | hasFlowFromSource | false | boolean |
247+
| index.js:83:10:85:3 | {\\n " ... ar,\\n } | TaintedPath | isConstantExpression | false | boolean |
248+
| index.js:83:10:85:3 | {\\n " ... ar,\\n } | TaintedPath | isExcludedFromEndToEndEvaluation | false | boolean |
249+
| index.js:83:10:85:3 | {\\n " ... ar,\\n } | TaintedPath | notASinkReason | ClientRequest | string |
250+
| index.js:83:10:85:3 | {\\n " ... ar,\\n } | TaintedPath | notASinkReason | JQueryArgument | string |
251+
| index.js:83:10:85:3 | {\\n " ... ar,\\n } | TaintedPath | sinkLabel | NotASink | string |
252+
| index.js:83:10:85:3 | {\\n " ... ar,\\n } | Xss | hasFlowFromSource | false | boolean |
253+
| index.js:83:10:85:3 | {\\n " ... ar,\\n } | Xss | isConstantExpression | false | boolean |
254+
| index.js:83:10:85:3 | {\\n " ... ar,\\n } | Xss | isExcludedFromEndToEndEvaluation | false | boolean |
255+
| index.js:83:10:85:3 | {\\n " ... ar,\\n } | Xss | notASinkReason | ClientRequest | string |
256+
| index.js:83:10:85:3 | {\\n " ... ar,\\n } | Xss | notASinkReason | JQueryArgument | string |
257+
| index.js:83:10:85:3 | {\\n " ... ar,\\n } | Xss | sinkLabel | NotASink | string |
258+
| index.js:84:12:84:18 | foo.bar | NosqlInjection | hasFlowFromSource | false | boolean |
259+
| index.js:84:12:84:18 | foo.bar | NosqlInjection | isConstantExpression | false | boolean |
260+
| index.js:84:12:84:18 | foo.bar | NosqlInjection | isExcludedFromEndToEndEvaluation | false | boolean |
261+
| index.js:84:12:84:18 | foo.bar | NosqlInjection | notASinkReason | ClientRequest | string |
262+
| index.js:84:12:84:18 | foo.bar | NosqlInjection | sinkLabel | NotASink | string |
263+
| index.js:84:12:84:18 | foo.bar | SqlInjection | hasFlowFromSource | false | boolean |
264+
| index.js:84:12:84:18 | foo.bar | SqlInjection | isConstantExpression | false | boolean |
265+
| index.js:84:12:84:18 | foo.bar | SqlInjection | isExcludedFromEndToEndEvaluation | false | boolean |
266+
| index.js:84:12:84:18 | foo.bar | SqlInjection | notASinkReason | ClientRequest | string |
267+
| index.js:84:12:84:18 | foo.bar | SqlInjection | sinkLabel | NotASink | string |
268+
| index.js:84:12:84:18 | foo.bar | SqlInjection | sinkLabel | Unknown | string |
269+
| index.js:84:12:84:18 | foo.bar | TaintedPath | hasFlowFromSource | false | boolean |
270+
| index.js:84:12:84:18 | foo.bar | TaintedPath | isConstantExpression | false | boolean |
271+
| index.js:84:12:84:18 | foo.bar | TaintedPath | isExcludedFromEndToEndEvaluation | false | boolean |
272+
| index.js:84:12:84:18 | foo.bar | TaintedPath | notASinkReason | ClientRequest | string |
273+
| index.js:84:12:84:18 | foo.bar | TaintedPath | sinkLabel | NotASink | string |
274+
| index.js:84:12:84:18 | foo.bar | TaintedPath | sinkLabel | Unknown | string |
275+
| index.js:84:12:84:18 | foo.bar | Xss | hasFlowFromSource | false | boolean |
276+
| index.js:84:12:84:18 | foo.bar | Xss | isConstantExpression | false | boolean |
277+
| index.js:84:12:84:18 | foo.bar | Xss | isExcludedFromEndToEndEvaluation | false | boolean |
278+
| index.js:84:12:84:18 | foo.bar | Xss | notASinkReason | ClientRequest | string |
279+
| index.js:84:12:84:18 | foo.bar | Xss | sinkLabel | NotASink | string |
280+
| index.js:84:12:84:18 | foo.bar | Xss | sinkLabel | Unknown | string |
234281
tokenFeatures
235282
| index.js:1:25:1:33 | "express" | argumentIndex | 0 |
236283
| index.js:1:25:1:33 | "express" | calleeAccessPath | |
@@ -384,3 +431,19 @@ tokenFeatures
384431
| index.js:78:30:78:39 | "someData" | enclosingFunctionBody | console log someData |
385432
| index.js:78:30:78:39 | "someData" | enclosingFunctionName | identity#functionalargument |
386433
| index.js:78:30:78:39 | "someData" | receiverName | console |
434+
| index.js:83:10:85:3 | {\\n " ... ar,\\n } | argumentIndex | 0 |
435+
| index.js:83:10:85:3 | {\\n " ... ar,\\n } | calleeAccessPath | |
436+
| index.js:83:10:85:3 | {\\n " ... ar,\\n } | calleeAccessPathWithStructuralInfo | |
437+
| index.js:83:10:85:3 | {\\n " ... ar,\\n } | calleeApiName | |
438+
| index.js:83:10:85:3 | {\\n " ... ar,\\n } | calleeName | ajax |
439+
| index.js:83:10:85:3 | {\\n " ... ar,\\n } | enclosingFunctionBody | foo $ ajax url foo bar |
440+
| index.js:83:10:85:3 | {\\n " ... ar,\\n } | enclosingFunctionName | effectiveSinkAndNotASink |
441+
| index.js:83:10:85:3 | {\\n " ... ar,\\n } | receiverName | $ |
442+
| index.js:84:12:84:18 | foo.bar | argumentIndex | |
443+
| index.js:84:12:84:18 | foo.bar | calleeAccessPath | |
444+
| index.js:84:12:84:18 | foo.bar | calleeAccessPathWithStructuralInfo | |
445+
| index.js:84:12:84:18 | foo.bar | calleeApiName | |
446+
| index.js:84:12:84:18 | foo.bar | calleeName | |
447+
| index.js:84:12:84:18 | foo.bar | enclosingFunctionBody | foo $ ajax url foo bar |
448+
| index.js:84:12:84:18 | foo.bar | enclosingFunctionName | effectiveSinkAndNotASink |
449+
| index.js:84:12:84:18 | foo.bar | receiverName | |

‎javascript/ql/experimental/adaptivethreatmodeling/test/endpoint_unit_tests/ExtractEndpointDataTraining.expected

Lines changed: 63 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -31,6 +31,53 @@ endpoints
3131
| index.js:28:13:28:28 | UNDEFINED_GLOBAL | NosqlInjection | isConstantExpression | false | boolean |
3232
| index.js:28:13:28:28 | UNDEFINED_GLOBAL | NosqlInjection | isExcludedFromEndToEndEvaluation | false | boolean |
3333
| index.js:28:13:28:28 | UNDEFINED_GLOBAL | NosqlInjection | sinkLabel | Sink | string |
34+
| index.js:83:10:85:3 | {\\n " ... ar,\\n } | NosqlInjection | hasFlowFromSource | false | boolean |
35+
| index.js:83:10:85:3 | {\\n " ... ar,\\n } | NosqlInjection | isConstantExpression | false | boolean |
36+
| index.js:83:10:85:3 | {\\n " ... ar,\\n } | NosqlInjection | isExcludedFromEndToEndEvaluation | false | boolean |
37+
| index.js:83:10:85:3 | {\\n " ... ar,\\n } | NosqlInjection | notASinkReason | ClientRequest | string |
38+
| index.js:83:10:85:3 | {\\n " ... ar,\\n } | NosqlInjection | notASinkReason | JQueryArgument | string |
39+
| index.js:83:10:85:3 | {\\n " ... ar,\\n } | NosqlInjection | sinkLabel | NotASink | string |
40+
| index.js:83:10:85:3 | {\\n " ... ar,\\n } | SqlInjection | hasFlowFromSource | false | boolean |
41+
| index.js:83:10:85:3 | {\\n " ... ar,\\n } | SqlInjection | isConstantExpression | false | boolean |
42+
| index.js:83:10:85:3 | {\\n " ... ar,\\n } | SqlInjection | isExcludedFromEndToEndEvaluation | false | boolean |
43+
| index.js:83:10:85:3 | {\\n " ... ar,\\n } | SqlInjection | notASinkReason | ClientRequest | string |
44+
| index.js:83:10:85:3 | {\\n " ... ar,\\n } | SqlInjection | notASinkReason | JQueryArgument | string |
45+
| index.js:83:10:85:3 | {\\n " ... ar,\\n } | SqlInjection | sinkLabel | NotASink | string |
46+
| index.js:83:10:85:3 | {\\n " ... ar,\\n } | TaintedPath | hasFlowFromSource | false | boolean |
47+
| index.js:83:10:85:3 | {\\n " ... ar,\\n } | TaintedPath | isConstantExpression | false | boolean |
48+
| index.js:83:10:85:3 | {\\n " ... ar,\\n } | TaintedPath | isExcludedFromEndToEndEvaluation | false | boolean |
49+
| index.js:83:10:85:3 | {\\n " ... ar,\\n } | TaintedPath | notASinkReason | ClientRequest | string |
50+
| index.js:83:10:85:3 | {\\n " ... ar,\\n } | TaintedPath | notASinkReason | JQueryArgument | string |
51+
| index.js:83:10:85:3 | {\\n " ... ar,\\n } | TaintedPath | sinkLabel | NotASink | string |
52+
| index.js:83:10:85:3 | {\\n " ... ar,\\n } | Xss | hasFlowFromSource | false | boolean |
53+
| index.js:83:10:85:3 | {\\n " ... ar,\\n } | Xss | isConstantExpression | false | boolean |
54+
| index.js:83:10:85:3 | {\\n " ... ar,\\n } | Xss | isExcludedFromEndToEndEvaluation | false | boolean |
55+
| index.js:83:10:85:3 | {\\n " ... ar,\\n } | Xss | notASinkReason | ClientRequest | string |
56+
| index.js:83:10:85:3 | {\\n " ... ar,\\n } | Xss | notASinkReason | JQueryArgument | string |
57+
| index.js:83:10:85:3 | {\\n " ... ar,\\n } | Xss | sinkLabel | NotASink | string |
58+
| index.js:84:12:84:18 | foo.bar | NosqlInjection | hasFlowFromSource | false | boolean |
59+
| index.js:84:12:84:18 | foo.bar | NosqlInjection | isConstantExpression | false | boolean |
60+
| index.js:84:12:84:18 | foo.bar | NosqlInjection | isExcludedFromEndToEndEvaluation | false | boolean |
61+
| index.js:84:12:84:18 | foo.bar | NosqlInjection | notASinkReason | ClientRequest | string |
62+
| index.js:84:12:84:18 | foo.bar | NosqlInjection | sinkLabel | NotASink | string |
63+
| index.js:84:12:84:18 | foo.bar | SqlInjection | hasFlowFromSource | false | boolean |
64+
| index.js:84:12:84:18 | foo.bar | SqlInjection | isConstantExpression | false | boolean |
65+
| index.js:84:12:84:18 | foo.bar | SqlInjection | isExcludedFromEndToEndEvaluation | false | boolean |
66+
| index.js:84:12:84:18 | foo.bar | SqlInjection | notASinkReason | ClientRequest | string |
67+
| index.js:84:12:84:18 | foo.bar | SqlInjection | sinkLabel | NotASink | string |
68+
| index.js:84:12:84:18 | foo.bar | SqlInjection | sinkLabel | Unknown | string |
69+
| index.js:84:12:84:18 | foo.bar | TaintedPath | hasFlowFromSource | false | boolean |
70+
| index.js:84:12:84:18 | foo.bar | TaintedPath | isConstantExpression | false | boolean |
71+
| index.js:84:12:84:18 | foo.bar | TaintedPath | isExcludedFromEndToEndEvaluation | false | boolean |
72+
| index.js:84:12:84:18 | foo.bar | TaintedPath | notASinkReason | ClientRequest | string |
73+
| index.js:84:12:84:18 | foo.bar | TaintedPath | sinkLabel | NotASink | string |
74+
| index.js:84:12:84:18 | foo.bar | TaintedPath | sinkLabel | Unknown | string |
75+
| index.js:84:12:84:18 | foo.bar | Xss | hasFlowFromSource | false | boolean |
76+
| index.js:84:12:84:18 | foo.bar | Xss | isConstantExpression | false | boolean |
77+
| index.js:84:12:84:18 | foo.bar | Xss | isExcludedFromEndToEndEvaluation | false | boolean |
78+
| index.js:84:12:84:18 | foo.bar | Xss | notASinkReason | ClientRequest | string |
79+
| index.js:84:12:84:18 | foo.bar | Xss | sinkLabel | NotASink | string |
80+
| index.js:84:12:84:18 | foo.bar | Xss | sinkLabel | Unknown | string |
3481
tokenFeatures
3582
| index.js:9:15:9:45 | { 'isAd ... Admin } | argumentIndex | 0 |
3683
| index.js:9:15:9:45 | { 'isAd ... Admin } | calleeAccessPath | mongoose model find |
@@ -64,3 +111,19 @@ tokenFeatures
64111
| index.js:28:13:28:28 | UNDEFINED_GLOBAL | enclosingFunctionBody | User find UNDEFINED_GLOBAL |
65112
| index.js:28:13:28:28 | UNDEFINED_GLOBAL | enclosingFunctionName | notConstantExpression |
66113
| index.js:28:13:28:28 | UNDEFINED_GLOBAL | receiverName | User |
114+
| index.js:83:10:85:3 | {\\n " ... ar,\\n } | argumentIndex | 0 |
115+
| index.js:83:10:85:3 | {\\n " ... ar,\\n } | calleeAccessPath | |
116+
| index.js:83:10:85:3 | {\\n " ... ar,\\n } | calleeAccessPathWithStructuralInfo | |
117+
| index.js:83:10:85:3 | {\\n " ... ar,\\n } | calleeApiName | |
118+
| index.js:83:10:85:3 | {\\n " ... ar,\\n } | calleeName | ajax |
119+
| index.js:83:10:85:3 | {\\n " ... ar,\\n } | enclosingFunctionBody | foo $ ajax url foo bar |
120+
| index.js:83:10:85:3 | {\\n " ... ar,\\n } | enclosingFunctionName | effectiveSinkAndNotASink |
121+
| index.js:83:10:85:3 | {\\n " ... ar,\\n } | receiverName | $ |
122+
| index.js:84:12:84:18 | foo.bar | argumentIndex | |
123+
| index.js:84:12:84:18 | foo.bar | calleeAccessPath | |
124+
| index.js:84:12:84:18 | foo.bar | calleeAccessPathWithStructuralInfo | |
125+
| index.js:84:12:84:18 | foo.bar | calleeApiName | |
126+
| index.js:84:12:84:18 | foo.bar | calleeName | |
127+
| index.js:84:12:84:18 | foo.bar | enclosingFunctionBody | foo $ ajax url foo bar |
128+
| index.js:84:12:84:18 | foo.bar | enclosingFunctionName | effectiveSinkAndNotASink |
129+
| index.js:84:12:84:18 | foo.bar | receiverName | |

‎javascript/ql/experimental/adaptivethreatmodeling/test/endpoint_unit_tests/index.js

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -77,3 +77,10 @@ function veryLongFunctionBody() {
7777
// We should name the anonymous function here that's passed as an argument to `identity`.
7878
identity(() => console.log("someData"));
7979
}
80+
81+
82+
function effectiveSinkAndNotASink(foo) {
83+
$.ajax({
84+
"url": foo.bar,
85+
});
86+
}

0 commit comments

Comments
 (0)