mirror of
https://github.com/github/codeql.git
synced 2026-05-03 12:45:27 +02:00
Xss through DOM
This commit is contained in:
Erik Krogh Kristensen
@@ -0,0 +1,63 @@
|
||||
nodes
|
||||
| xss-through-dom.js:2:16:2:34 | $("textarea").val() |
|
||||
| xss-through-dom.js:2:16:2:34 | $("textarea").val() |
|
||||
| xss-through-dom.js:2:16:2:34 | $("textarea").val() |
|
||||
| xss-through-dom.js:4:16:4:40 | $(".som ... .text() |
|
||||
| xss-through-dom.js:4:16:4:40 | $(".som ... .text() |
|
||||
| xss-through-dom.js:4:16:4:40 | $(".som ... .text() |
|
||||
| xss-through-dom.js:8:16:8:53 | $(".som ... arget") |
|
||||
| xss-through-dom.js:8:16:8:53 | $(".som ... arget") |
|
||||
| xss-through-dom.js:8:16:8:53 | $(".som ... arget") |
|
||||
| xss-through-dom.js:11:3:11:42 | documen ... nerText |
|
||||
| xss-through-dom.js:11:3:11:42 | documen ... nerText |
|
||||
| xss-through-dom.js:11:3:11:42 | documen ... nerText |
|
||||
| xss-through-dom.js:19:3:19:44 | documen ... Content |
|
||||
| xss-through-dom.js:19:3:19:44 | documen ... Content |
|
||||
| xss-through-dom.js:19:3:19:44 | documen ... Content |
|
||||
| xss-through-dom.js:23:3:23:48 | documen ... ].value |
|
||||
| xss-through-dom.js:23:3:23:48 | documen ... ].value |
|
||||
| xss-through-dom.js:23:3:23:48 | documen ... ].value |
|
||||
| xss-through-dom.js:27:3:27:61 | documen ... arget') |
|
||||
| xss-through-dom.js:27:3:27:61 | documen ... arget') |
|
||||
| xss-through-dom.js:27:3:27:61 | documen ... arget') |
|
||||
| xss-through-dom.js:51:30:51:48 | $("textarea").val() |
|
||||
| xss-through-dom.js:51:30:51:48 | $("textarea").val() |
|
||||
| xss-through-dom.js:51:30:51:48 | $("textarea").val() |
|
||||
| xss-through-dom.js:54:31:54:49 | $("textarea").val() |
|
||||
| xss-through-dom.js:54:31:54:49 | $("textarea").val() |
|
||||
| xss-through-dom.js:54:31:54:49 | $("textarea").val() |
|
||||
| xss-through-dom.js:56:30:56:51 | $("inpu ... 0).name |
|
||||
| xss-through-dom.js:56:30:56:51 | $("inpu ... 0).name |
|
||||
| xss-through-dom.js:56:30:56:51 | $("inpu ... 0).name |
|
||||
| xss-through-dom.js:57:30:57:67 | $("inpu ... "name") |
|
||||
| xss-through-dom.js:57:30:57:67 | $("inpu ... "name") |
|
||||
| xss-through-dom.js:57:30:57:67 | $("inpu ... "name") |
|
||||
| xss-through-dom.js:61:30:61:69 | $(docum ... value") |
|
||||
| xss-through-dom.js:61:30:61:69 | $(docum ... value") |
|
||||
| xss-through-dom.js:61:30:61:69 | $(docum ... value") |
|
||||
edges
|
||||
| xss-through-dom.js:2:16:2:34 | $("textarea").val() | xss-through-dom.js:2:16:2:34 | $("textarea").val() |
|
||||
| xss-through-dom.js:4:16:4:40 | $(".som ... .text() | xss-through-dom.js:4:16:4:40 | $(".som ... .text() |
|
||||
| xss-through-dom.js:8:16:8:53 | $(".som ... arget") | xss-through-dom.js:8:16:8:53 | $(".som ... arget") |
|
||||
| xss-through-dom.js:11:3:11:42 | documen ... nerText | xss-through-dom.js:11:3:11:42 | documen ... nerText |
|
||||
| xss-through-dom.js:19:3:19:44 | documen ... Content | xss-through-dom.js:19:3:19:44 | documen ... Content |
|
||||
| xss-through-dom.js:23:3:23:48 | documen ... ].value | xss-through-dom.js:23:3:23:48 | documen ... ].value |
|
||||
| xss-through-dom.js:27:3:27:61 | documen ... arget') | xss-through-dom.js:27:3:27:61 | documen ... arget') |
|
||||
| xss-through-dom.js:51:30:51:48 | $("textarea").val() | xss-through-dom.js:51:30:51:48 | $("textarea").val() |
|
||||
| xss-through-dom.js:54:31:54:49 | $("textarea").val() | xss-through-dom.js:54:31:54:49 | $("textarea").val() |
|
||||
| xss-through-dom.js:56:30:56:51 | $("inpu ... 0).name | xss-through-dom.js:56:30:56:51 | $("inpu ... 0).name |
|
||||
| xss-through-dom.js:57:30:57:67 | $("inpu ... "name") | xss-through-dom.js:57:30:57:67 | $("inpu ... "name") |
|
||||
| xss-through-dom.js:61:30:61:69 | $(docum ... value") | xss-through-dom.js:61:30:61:69 | $(docum ... value") |
|
||||
#select
|
||||
| xss-through-dom.js:2:16:2:34 | $("textarea").val() | xss-through-dom.js:2:16:2:34 | $("textarea").val() | xss-through-dom.js:2:16:2:34 | $("textarea").val() | Cross-site scripting vulnerability due to $@. | xss-through-dom.js:2:16:2:34 | $("textarea").val() | DOM text |
|
||||
| xss-through-dom.js:4:16:4:40 | $(".som ... .text() | xss-through-dom.js:4:16:4:40 | $(".som ... .text() | xss-through-dom.js:4:16:4:40 | $(".som ... .text() | Cross-site scripting vulnerability due to $@. | xss-through-dom.js:4:16:4:40 | $(".som ... .text() | DOM text |
|
||||
| xss-through-dom.js:8:16:8:53 | $(".som ... arget") | xss-through-dom.js:8:16:8:53 | $(".som ... arget") | xss-through-dom.js:8:16:8:53 | $(".som ... arget") | Cross-site scripting vulnerability due to $@. | xss-through-dom.js:8:16:8:53 | $(".som ... arget") | DOM text |
|
||||
| xss-through-dom.js:11:3:11:42 | documen ... nerText | xss-through-dom.js:11:3:11:42 | documen ... nerText | xss-through-dom.js:11:3:11:42 | documen ... nerText | Cross-site scripting vulnerability due to $@. | xss-through-dom.js:11:3:11:42 | documen ... nerText | DOM text |
|
||||
| xss-through-dom.js:19:3:19:44 | documen ... Content | xss-through-dom.js:19:3:19:44 | documen ... Content | xss-through-dom.js:19:3:19:44 | documen ... Content | Cross-site scripting vulnerability due to $@. | xss-through-dom.js:19:3:19:44 | documen ... Content | DOM text |
|
||||
| xss-through-dom.js:23:3:23:48 | documen ... ].value | xss-through-dom.js:23:3:23:48 | documen ... ].value | xss-through-dom.js:23:3:23:48 | documen ... ].value | Cross-site scripting vulnerability due to $@. | xss-through-dom.js:23:3:23:48 | documen ... ].value | DOM text |
|
||||
| xss-through-dom.js:27:3:27:61 | documen ... arget') | xss-through-dom.js:27:3:27:61 | documen ... arget') | xss-through-dom.js:27:3:27:61 | documen ... arget') | Cross-site scripting vulnerability due to $@. | xss-through-dom.js:27:3:27:61 | documen ... arget') | DOM text |
|
||||
| xss-through-dom.js:51:30:51:48 | $("textarea").val() | xss-through-dom.js:51:30:51:48 | $("textarea").val() | xss-through-dom.js:51:30:51:48 | $("textarea").val() | Cross-site scripting vulnerability due to $@. | xss-through-dom.js:51:30:51:48 | $("textarea").val() | DOM text |
|
||||
| xss-through-dom.js:54:31:54:49 | $("textarea").val() | xss-through-dom.js:54:31:54:49 | $("textarea").val() | xss-through-dom.js:54:31:54:49 | $("textarea").val() | Cross-site scripting vulnerability due to $@. | xss-through-dom.js:54:31:54:49 | $("textarea").val() | DOM text |
|
||||
| xss-through-dom.js:56:30:56:51 | $("inpu ... 0).name | xss-through-dom.js:56:30:56:51 | $("inpu ... 0).name | xss-through-dom.js:56:30:56:51 | $("inpu ... 0).name | Cross-site scripting vulnerability due to $@. | xss-through-dom.js:56:30:56:51 | $("inpu ... 0).name | DOM text |
|
||||
| xss-through-dom.js:57:30:57:67 | $("inpu ... "name") | xss-through-dom.js:57:30:57:67 | $("inpu ... "name") | xss-through-dom.js:57:30:57:67 | $("inpu ... "name") | Cross-site scripting vulnerability due to $@. | xss-through-dom.js:57:30:57:67 | $("inpu ... "name") | DOM text |
|
||||
| xss-through-dom.js:61:30:61:69 | $(docum ... value") | xss-through-dom.js:61:30:61:69 | $(docum ... value") | xss-through-dom.js:61:30:61:69 | $(docum ... value") | Cross-site scripting vulnerability due to $@. | xss-through-dom.js:61:30:61:69 | $(docum ... value") | DOM text |
|
||||
@@ -0,0 +1 @@
|
||||
Security/CWE-079/XssThroughDom.ql
|
||||
@@ -0,0 +1,62 @@
|
||||
(function () {
|
||||
$("#id").html($("textarea").val()); // NOT OK.
|
||||
|
||||
$("#id").html($(".some-element").text()); // NOT OK.
|
||||
|
||||
$("#id").html($(".some-element").attr("foo", "bar")); // OK.
|
||||
$("#id").html($(".some-element").attr({"foo": "bar"})); // OK.
|
||||
$("#id").html($(".some-element").attr("data-target")); // NOT OK.
|
||||
|
||||
$("#id").html(
|
||||
document.getElementById("foo").innerText // NOT OK.
|
||||
);
|
||||
|
||||
$("#id").html(
|
||||
document.getElementById("foo").innerHTML // OK - only repeats existing XSS.
|
||||
);
|
||||
|
||||
$("#id").html(
|
||||
document.getElementById("foo").textContent // NOT OK.
|
||||
);
|
||||
|
||||
$("#id").html(
|
||||
document.querySelectorAll("textarea")[0].value // NOT OK.
|
||||
);
|
||||
|
||||
$("#id").html(
|
||||
document.getElementById('div1').getAttribute('data-target') // NOT OK
|
||||
);
|
||||
|
||||
function safe1(x) { // overloaded function.
|
||||
if (x.jquery) {
|
||||
var foo = $(x); // OK
|
||||
}
|
||||
|
||||
}
|
||||
safe1($("textarea").val());
|
||||
|
||||
function safe2(x) { // overloaded function.
|
||||
if (typeof x === "object") {
|
||||
var foo = $(x); // OK
|
||||
}
|
||||
}
|
||||
safe2($("textarea").val());
|
||||
|
||||
|
||||
$("#id").html(
|
||||
$("<p>" + something() + "</p>").text() // OK - this is for a flow-step to catch, not this query.
|
||||
);
|
||||
|
||||
|
||||
$("#id").get(0).innerHTML = $("textarea").val(); // NOT OK.
|
||||
|
||||
var base = $("#id");
|
||||
base[html ? 'html' : 'text']($("textarea").val()); // NOT OK.
|
||||
|
||||
$("#id").get(0).innerHTML = $("input").get(0).name; // NOT OK.
|
||||
$("#id").get(0).innerHTML = $("input").get(0).getAttribute("name"); // NOT OK.
|
||||
|
||||
$("#id").get(0).innerHTML = $("input").getAttribute("id"); // OK.
|
||||
|
||||
$("#id").get(0).innerHTML = $(document).find("option").attr("value"); // NOT OK.
|
||||
})();
|
||||
Reference in New Issue
Block a user