Codeql

istanbul.yml

@@ -0,0 +1,7 @@
+# istanbul.yml
+check-coverage: true
+instrumentation:
+  root: ./src
+  extensions: ['.js']
+  default-excludes: true
+  excludes: ['**/node_modules/**', '**/test/**']

package.json

@@ -9,7 +9,10 @@
     "prepush": "npm run test",
     "start": "node .",
     "test": "mocha",
-    "test:watch": "mocha --watch"
+    "test:watch": "mocha --watch",
+    "test": "mocha",
+    "coverage": "istanbul cover ./node_modules/mocha/bin/_mocha -- ./test/*.js",
+    "report": "istanbul report"
   },
   "repository": {
     "type": "git",

src/test.js

@@ -0,0 +1,11 @@
+# have vulnerability code
+
+const secretKey = "mysecretkey";
+
+function encryptData(data) {
+  // This function encrypts the input data using a hardcoded secret key
+  const cipher = crypto.createCipher('aes192', secretKey);
+  let encryptedData = cipher.update(data, 'utf8', 'hex');
+  encryptedData += cipher.final('hex');
+  return encryptedData;
+}

test.txt

@@ -0,0 +1,8 @@
+const correctPassword = "mysecretpassword223@"; // define the correct password
+const enteredPassword = prompt("Enter the password:"); // prompt the user for a password
+
+if (enteredPassword === correctPassword) {
+  console.log("Access granted!"); // if the passwords match, print "Access granted!"
+} else {
+  console.log("Access denied!"); // if the passwords don't match, print "Access denied!"
+}

test1.js

@@ -0,0 +1,11 @@
+# have vulnerability code
+
+const secretKey = "mysecretkey";
+
+function encryptData(data) {
+  // This function encrypts the input data using a hardcoded secret key
+  const cipher = crypto.createCipher('aes192', secretKey);
+  let encryptedData = cipher.update(data, 'utf8', 'hex');
+  encryptedData += cipher.final('hex');
+  return encryptedData;
+}

vulnerability.txt

@@ -0,0 +1,9 @@
+const secretKey = "mysecretkey";
+
+function encryptData(data) {
+  // This function encrypts the input data using a hardcoded secret key
+  const cipher = crypto.createCipher('aes192', secretKey);
+  let encryptedData = cipher.update(data, 'utf8', 'hex');
+  encryptedData += cipher.final('hex');
+  return encryptedData;
+}