hohn/codeql
1
0
Fork 0
mirror of https://github.com/github/codeql.git synced 2026-04-30 19:26:02 +02:00
Code Issues Packages Projects Releases Wiki Activity

JS: Add test showing FPs

Browse Source
This commit is contained in:
Asger Feldthaus
2020-07-03 14:26:10 +01:00
parent 04a0d47ab9
commit 4c06eb8bfe
2 changed files with 104 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

65
javascript/ql/test/query-tests/Security/CWE-601/ClientSideUrlRedirect/ClientSideUrlRedirect.expected
View File

@@ -1,4 +1,31 @@
nodes
| sanitizer.js:2:9:2:25 | url |
| sanitizer.js:2:15:2:25 | window.name |
| sanitizer.js:2:15:2:25 | window.name |
| sanitizer.js:4:27:4:29 | url |
| sanitizer.js:4:27:4:29 | url |
| sanitizer.js:7:27:7:29 | url |
| sanitizer.js:7:27:7:29 | url |
| sanitizer.js:10:27:10:29 | url |
| sanitizer.js:10:27:10:29 | url |
| sanitizer.js:13:27:13:29 | url |
| sanitizer.js:13:27:13:29 | url |
| sanitizer.js:16:27:16:29 | url |
| sanitizer.js:16:27:16:29 | url |
| sanitizer.js:19:27:19:29 | url |
| sanitizer.js:19:27:19:29 | url |
| sanitizer.js:22:27:22:29 | url |
| sanitizer.js:22:27:22:29 | url |
| sanitizer.js:25:27:25:29 | url |
| sanitizer.js:25:27:25:29 | url |
| sanitizer.js:28:27:28:29 | url |
| sanitizer.js:28:27:28:29 | url |
| sanitizer.js:31:27:31:29 | url |
| sanitizer.js:31:27:31:29 | url |
| sanitizer.js:34:27:34:29 | url |
| sanitizer.js:34:27:34:29 | url |
| sanitizer.js:37:27:37:29 | url |
| sanitizer.js:37:27:37:29 | url |
| tst2.js:2:7:2:33 | href |
| tst2.js:2:7:2:33 | href |
| tst2.js:2:14:2:28 | window.location |
@@ -80,6 +107,32 @@ nodes
| tst.js:6:34:6:50 | document.location |
| tst.js:6:34:6:55 | documen ... on.href |
edges
| sanitizer.js:2:9:2:25 | url | sanitizer.js:4:27:4:29 | url |
| sanitizer.js:2:9:2:25 | url | sanitizer.js:4:27:4:29 | url |
| sanitizer.js:2:9:2:25 | url | sanitizer.js:7:27:7:29 | url |
| sanitizer.js:2:9:2:25 | url | sanitizer.js:7:27:7:29 | url |
| sanitizer.js:2:9:2:25 | url | sanitizer.js:10:27:10:29 | url |
| sanitizer.js:2:9:2:25 | url | sanitizer.js:10:27:10:29 | url |
| sanitizer.js:2:9:2:25 | url | sanitizer.js:13:27:13:29 | url |
| sanitizer.js:2:9:2:25 | url | sanitizer.js:13:27:13:29 | url |
| sanitizer.js:2:9:2:25 | url | sanitizer.js:16:27:16:29 | url |
| sanitizer.js:2:9:2:25 | url | sanitizer.js:16:27:16:29 | url |
| sanitizer.js:2:9:2:25 | url | sanitizer.js:19:27:19:29 | url |
| sanitizer.js:2:9:2:25 | url | sanitizer.js:19:27:19:29 | url |
| sanitizer.js:2:9:2:25 | url | sanitizer.js:22:27:22:29 | url |
| sanitizer.js:2:9:2:25 | url | sanitizer.js:22:27:22:29 | url |
| sanitizer.js:2:9:2:25 | url | sanitizer.js:25:27:25:29 | url |
| sanitizer.js:2:9:2:25 | url | sanitizer.js:25:27:25:29 | url |
| sanitizer.js:2:9:2:25 | url | sanitizer.js:28:27:28:29 | url |
| sanitizer.js:2:9:2:25 | url | sanitizer.js:28:27:28:29 | url |
| sanitizer.js:2:9:2:25 | url | sanitizer.js:31:27:31:29 | url |
| sanitizer.js:2:9:2:25 | url | sanitizer.js:31:27:31:29 | url |
| sanitizer.js:2:9:2:25 | url | sanitizer.js:34:27:34:29 | url |
| sanitizer.js:2:9:2:25 | url | sanitizer.js:34:27:34:29 | url |
| sanitizer.js:2:9:2:25 | url | sanitizer.js:37:27:37:29 | url |
| sanitizer.js:2:9:2:25 | url | sanitizer.js:37:27:37:29 | url |
| sanitizer.js:2:15:2:25 | window.name | sanitizer.js:2:9:2:25 | url |
| sanitizer.js:2:15:2:25 | window.name | sanitizer.js:2:9:2:25 | url |
| tst2.js:2:7:2:33 | href | tst2.js:4:21:4:24 | href |
| tst2.js:2:7:2:33 | href | tst2.js:4:21:4:24 | href |
| tst2.js:2:14:2:28 | window.location | tst2.js:2:14:2:33 | window.location.href |
@@ -155,6 +208,18 @@ edges
| tst.js:6:34:6:50 | document.location | tst.js:6:34:6:55 | documen ... on.href |
| tst.js:6:34:6:55 | documen ... on.href | tst.js:6:20:6:56 | indirec ... n.href) |
#select
| sanitizer.js:4:27:4:29 | url | sanitizer.js:2:15:2:25 | window.name | sanitizer.js:4:27:4:29 | url | Untrusted URL redirection due to $@. | sanitizer.js:2:15:2:25 | window.name | user-provided value |
| sanitizer.js:7:27:7:29 | url | sanitizer.js:2:15:2:25 | window.name | sanitizer.js:7:27:7:29 | url | Untrusted URL redirection due to $@. | sanitizer.js:2:15:2:25 | window.name | user-provided value |
| sanitizer.js:10:27:10:29 | url | sanitizer.js:2:15:2:25 | window.name | sanitizer.js:10:27:10:29 | url | Untrusted URL redirection due to $@. | sanitizer.js:2:15:2:25 | window.name | user-provided value |
| sanitizer.js:13:27:13:29 | url | sanitizer.js:2:15:2:25 | window.name | sanitizer.js:13:27:13:29 | url | Untrusted URL redirection due to $@. | sanitizer.js:2:15:2:25 | window.name | user-provided value |
| sanitizer.js:16:27:16:29 | url | sanitizer.js:2:15:2:25 | window.name | sanitizer.js:16:27:16:29 | url | Untrusted URL redirection due to $@. | sanitizer.js:2:15:2:25 | window.name | user-provided value |
| sanitizer.js:19:27:19:29 | url | sanitizer.js:2:15:2:25 | window.name | sanitizer.js:19:27:19:29 | url | Untrusted URL redirection due to $@. | sanitizer.js:2:15:2:25 | window.name | user-provided value |
| sanitizer.js:22:27:22:29 | url | sanitizer.js:2:15:2:25 | window.name | sanitizer.js:22:27:22:29 | url | Untrusted URL redirection due to $@. | sanitizer.js:2:15:2:25 | window.name | user-provided value |
| sanitizer.js:25:27:25:29 | url | sanitizer.js:2:15:2:25 | window.name | sanitizer.js:25:27:25:29 | url | Untrusted URL redirection due to $@. | sanitizer.js:2:15:2:25 | window.name | user-provided value |
| sanitizer.js:28:27:28:29 | url | sanitizer.js:2:15:2:25 | window.name | sanitizer.js:28:27:28:29 | url | Untrusted URL redirection due to $@. | sanitizer.js:2:15:2:25 | window.name | user-provided value |
| sanitizer.js:31:27:31:29 | url | sanitizer.js:2:15:2:25 | window.name | sanitizer.js:31:27:31:29 | url | Untrusted URL redirection due to $@. | sanitizer.js:2:15:2:25 | window.name | user-provided value |
| sanitizer.js:34:27:34:29 | url | sanitizer.js:2:15:2:25 | window.name | sanitizer.js:34:27:34:29 | url | Untrusted URL redirection due to $@. | sanitizer.js:2:15:2:25 | window.name | user-provided value |
| sanitizer.js:37:27:37:29 | url | sanitizer.js:2:15:2:25 | window.name | sanitizer.js:37:27:37:29 | url | Untrusted URL redirection due to $@. | sanitizer.js:2:15:2:25 | window.name | user-provided value |
| tst2.js:4:21:4:55 | href.su ... '?')+1) | tst2.js:2:14:2:28 | window.location | tst2.js:4:21:4:55 | href.su ... '?')+1) | Untrusted URL redirection due to $@. | tst2.js:2:14:2:28 | window.location | user-provided value |
| tst6.js:4:21:4:28 | redirect | tst6.js:2:18:2:45 | $locati ... irect') | tst6.js:4:21:4:28 | redirect | Untrusted URL redirection due to $@. | tst6.js:2:18:2:45 | $locati ... irect') | user-provided value |
| tst6.js:6:17:6:24 | redirect | tst6.js:2:18:2:45 | $locati ... irect') | tst6.js:6:17:6:24 | redirect | Untrusted URL redirection due to $@. | tst6.js:2:18:2:45 | $locati ... irect') | user-provided value |

39
javascript/ql/test/query-tests/Security/CWE-601/ClientSideUrlRedirect/sanitizer.js Normal file
View File

@@ -0,0 +1,39 @@
function f() {
let url = window.name;
if (url.startsWith('https://example.com')) {
window.location = url; // NOT OK - can be example.com.evil.com
}
if (url.startsWith('https://example.com/')) {
window.location = url; // OK - but flagged anyway
}
if (url.startsWith('https://example.com//')) {
window.location = url; // OK - but flagged anyway
}
if (url.startsWith('https://example.com/foo')) {
window.location = url; // OK - but flagged anyway
}
if (url.startsWith('https://')) {
window.location = url; // NOT OK - does not restrict hostname
}
if (url.startsWith('https:/')) {
window.location = url; // NOT OK - does not restrict hostname
}
if (url.startsWith('https:')) {
window.location = url; // NOT OK - does not restrict hostname
}
if (url.startsWith('/')) {
window.location = url; // NOT OK - can be //evil.com
}
if (url.startsWith('//')) {
window.location = url; // NOT OK - can be //evil.com
}
if (url.startsWith('//example.com')) {
window.location = url; // NOT OK - can be //example.com.evil.com
}
if (url.startsWith('//example.com/')) {
window.location = url; // OK - but flagged anyway
}
if (url.endsWith('https://example.com/')) {
window.location = url; // NOT OK - could be evil.com?x=https://example.com/
}
}