hohn/codeql
1
0
Fork 0
mirror of https://github.com/github/codeql.git synced 2026-04-29 02:35:15 +02:00
Code Issues Packages Projects Releases Wiki Activity

use StringSplitCall in TaintedPath

Browse Source
This commit is contained in:
Erik Krogh Kristensen
2020-05-04 21:03:10 +02:00
parent 22ec12b130
commit 4dcf944ccd
2 changed files with 109 additions and 283 deletions
Download Patch File Download Diff File Expand all files Collapse all files

24
javascript/ql/src/semmle/javascript/security/dataflow/TaintedPath.qll
View File

@@ -97,23 +97,17 @@ module TaintedPath {
)
)
or
// A `str.split()` call can either split into path elements (`str.split("/")`) or split by some other string.
exists(StringSplitCall mcn | dst = mcn and mcn.getUnsplit() = src |
if mcn.getSplitAt() = "/"
then
srclabel.(Label::PosixPath).canContainDotDotSlash() and
dstlabel instanceof Label::SplitPath
else srclabel = dstlabel
)
or
// array method calls of interest
exists(DataFlow::MethodCallNode mcn, string name | dst = mcn and mcn.calls(src, name) |
// A `str.split()` call can either split into path elements (`str.split("/")`) or split by some other string.
name = "split" and
(
if
exists(DataFlow::Node splitBy | splitBy = mcn.getArgument(0) |
splitBy.mayHaveStringValue("/") or
any(DataFlow::RegExpCreationNode reg | reg.getRoot().getAMatchedString() = "/")
.flowsTo(splitBy)
)
then
srclabel.(Label::PosixPath).canContainDotDotSlash() and
dstlabel instanceof Label::SplitPath
else srclabel = dstlabel
)
or
(
name = "pop" or
name = "shift"

368
javascript/ql/test/query-tests/Security/CWE-022/TaintedPath/TaintedPath.expected
View File

@@ -977,18 +977,6 @@ nodes
| TaintedPath.js:153:7:153:29 | split |
| TaintedPath.js:153:7:153:29 | split |
| TaintedPath.js:153:7:153:29 | split |
| TaintedPath.js:153:15:153:18 | path |
| TaintedPath.js:153:15:153:18 | path |
| TaintedPath.js:153:15:153:18 | path |
| TaintedPath.js:153:15:153:18 | path |
| TaintedPath.js:153:15:153:18 | path |
| TaintedPath.js:153:15:153:18 | path |
| TaintedPath.js:153:15:153:18 | path |
| TaintedPath.js:153:15:153:18 | path |
| TaintedPath.js:153:15:153:18 | path |
| TaintedPath.js:153:15:153:18 | path |
| TaintedPath.js:153:15:153:18 | path |
| TaintedPath.js:153:15:153:18 | path |
| TaintedPath.js:153:15:153:29 | path.split("/") |
| TaintedPath.js:153:15:153:29 | path.split("/") |
| TaintedPath.js:153:15:153:29 | path.split("/") |
@@ -2540,18 +2528,6 @@ nodes
| tainted-string-steps.js:18:18:18:35 | path.toLowerCase() |
| tainted-string-steps.js:18:18:18:35 | path.toLowerCase() |
| tainted-string-steps.js:18:18:18:35 | path.toLowerCase() |
| tainted-string-steps.js:22:18:22:21 | path |
| tainted-string-steps.js:22:18:22:21 | path |
| tainted-string-steps.js:22:18:22:21 | path |
| tainted-string-steps.js:22:18:22:21 | path |
| tainted-string-steps.js:22:18:22:21 | path |
| tainted-string-steps.js:22:18:22:21 | path |
| tainted-string-steps.js:22:18:22:21 | path |
| tainted-string-steps.js:22:18:22:21 | path |
| tainted-string-steps.js:22:18:22:21 | path |
| tainted-string-steps.js:22:18:22:21 | path |
| tainted-string-steps.js:22:18:22:21 | path |
| tainted-string-steps.js:22:18:22:21 | path |
| tainted-string-steps.js:22:18:22:32 | path.split('/') |
| tainted-string-steps.js:22:18:22:32 | path.split('/') |
| tainted-string-steps.js:22:18:22:32 | path.split('/') |
@@ -2569,18 +2545,6 @@ nodes
| tainted-string-steps.js:22:18:22:35 | path.split('/')[i] |
| tainted-string-steps.js:22:18:22:35 | path.split('/')[i] |
| tainted-string-steps.js:22:18:22:35 | path.split('/')[i] |
| tainted-string-steps.js:23:18:23:21 | path |
| tainted-string-steps.js:23:18:23:21 | path |
| tainted-string-steps.js:23:18:23:21 | path |
| tainted-string-steps.js:23:18:23:21 | path |
| tainted-string-steps.js:23:18:23:21 | path |
| tainted-string-steps.js:23:18:23:21 | path |
| tainted-string-steps.js:23:18:23:21 | path |
| tainted-string-steps.js:23:18:23:21 | path |
| tainted-string-steps.js:23:18:23:21 | path |
| tainted-string-steps.js:23:18:23:21 | path |
| tainted-string-steps.js:23:18:23:21 | path |
| tainted-string-steps.js:23:18:23:21 | path |
| tainted-string-steps.js:23:18:23:33 | path.split(/\\//) |
| tainted-string-steps.js:23:18:23:33 | path.split(/\\//) |
| tainted-string-steps.js:23:18:23:33 | path.split(/\\//) |
@@ -2598,22 +2562,6 @@ nodes
| tainted-string-steps.js:23:18:23:36 | path.split(/\\//)[i] |
| tainted-string-steps.js:23:18:23:36 | path.split(/\\//)[i] |
| tainted-string-steps.js:23:18:23:36 | path.split(/\\//)[i] |
| tainted-string-steps.js:24:18:24:21 | path |
| tainted-string-steps.js:24:18:24:21 | path |
| tainted-string-steps.js:24:18:24:21 | path |
| tainted-string-steps.js:24:18:24:21 | path |
| tainted-string-steps.js:24:18:24:21 | path |
| tainted-string-steps.js:24:18:24:21 | path |
| tainted-string-steps.js:24:18:24:21 | path |
| tainted-string-steps.js:24:18:24:21 | path |
| tainted-string-steps.js:24:18:24:21 | path |
| tainted-string-steps.js:24:18:24:21 | path |
| tainted-string-steps.js:24:18:24:21 | path |
| tainted-string-steps.js:24:18:24:21 | path |
| tainted-string-steps.js:24:18:24:21 | path |
| tainted-string-steps.js:24:18:24:21 | path |
| tainted-string-steps.js:24:18:24:21 | path |
| tainted-string-steps.js:24:18:24:21 | path |
| tainted-string-steps.js:24:18:24:32 | path.split("?") |
| tainted-string-steps.js:24:18:24:32 | path.split("?") |
| tainted-string-steps.js:24:18:24:32 | path.split("?") |
@@ -2647,22 +2595,6 @@ nodes
| tainted-string-steps.js:24:18:24:35 | path.split("?")[0] |
| tainted-string-steps.js:24:18:24:35 | path.split("?")[0] |
| tainted-string-steps.js:24:18:24:35 | path.split("?")[0] |
| tainted-string-steps.js:26:18:26:21 | path |
| tainted-string-steps.js:26:18:26:21 | path |
| tainted-string-steps.js:26:18:26:21 | path |
| tainted-string-steps.js:26:18:26:21 | path |
| tainted-string-steps.js:26:18:26:21 | path |
| tainted-string-steps.js:26:18:26:21 | path |
| tainted-string-steps.js:26:18:26:21 | path |
| tainted-string-steps.js:26:18:26:21 | path |
| tainted-string-steps.js:26:18:26:21 | path |
| tainted-string-steps.js:26:18:26:21 | path |
| tainted-string-steps.js:26:18:26:21 | path |
| tainted-string-steps.js:26:18:26:21 | path |
| tainted-string-steps.js:26:18:26:21 | path |
| tainted-string-steps.js:26:18:26:21 | path |
| tainted-string-steps.js:26:18:26:21 | path |
| tainted-string-steps.js:26:18:26:21 | path |
| tainted-string-steps.js:26:18:26:36 | path.split(unknown) |
| tainted-string-steps.js:26:18:26:36 | path.split(unknown) |
| tainted-string-steps.js:26:18:26:36 | path.split(unknown) |
@@ -2696,22 +2628,6 @@ nodes
| tainted-string-steps.js:26:18:26:45 | path.sp ... hatever |
| tainted-string-steps.js:26:18:26:45 | path.sp ... hatever |
| tainted-string-steps.js:26:18:26:45 | path.sp ... hatever |
| tainted-string-steps.js:27:18:27:21 | path |
| tainted-string-steps.js:27:18:27:21 | path |
| tainted-string-steps.js:27:18:27:21 | path |
| tainted-string-steps.js:27:18:27:21 | path |
| tainted-string-steps.js:27:18:27:21 | path |
| tainted-string-steps.js:27:18:27:21 | path |
| tainted-string-steps.js:27:18:27:21 | path |
| tainted-string-steps.js:27:18:27:21 | path |
| tainted-string-steps.js:27:18:27:21 | path |
| tainted-string-steps.js:27:18:27:21 | path |
| tainted-string-steps.js:27:18:27:21 | path |
| tainted-string-steps.js:27:18:27:21 | path |
| tainted-string-steps.js:27:18:27:21 | path |
| tainted-string-steps.js:27:18:27:21 | path |
| tainted-string-steps.js:27:18:27:21 | path |
| tainted-string-steps.js:27:18:27:21 | path |
| tainted-string-steps.js:27:18:27:36 | path.split(unknown) |
| tainted-string-steps.js:27:18:27:36 | path.split(unknown) |
| tainted-string-steps.js:27:18:27:36 | path.split(unknown) |
@@ -4193,18 +4109,6 @@ edges
| TaintedPath.js:149:7:149:48 | path | TaintedPath.js:151:19:151:22 | path |
| TaintedPath.js:149:7:149:48 | path | TaintedPath.js:151:19:151:22 | path |
| TaintedPath.js:149:7:149:48 | path | TaintedPath.js:151:19:151:22 | path |
| TaintedPath.js:149:7:149:48 | path | TaintedPath.js:153:15:153:18 | path |
| TaintedPath.js:149:7:149:48 | path | TaintedPath.js:153:15:153:18 | path |
| TaintedPath.js:149:7:149:48 | path | TaintedPath.js:153:15:153:18 | path |
| TaintedPath.js:149:7:149:48 | path | TaintedPath.js:153:15:153:18 | path |
| TaintedPath.js:149:7:149:48 | path | TaintedPath.js:153:15:153:18 | path |
| TaintedPath.js:149:7:149:48 | path | TaintedPath.js:153:15:153:18 | path |
| TaintedPath.js:149:7:149:48 | path | TaintedPath.js:153:15:153:18 | path |
| TaintedPath.js:149:7:149:48 | path | TaintedPath.js:153:15:153:18 | path |
| TaintedPath.js:149:7:149:48 | path | TaintedPath.js:153:15:153:18 | path |
| TaintedPath.js:149:7:149:48 | path | TaintedPath.js:153:15:153:18 | path |
| TaintedPath.js:149:7:149:48 | path | TaintedPath.js:153:15:153:18 | path |
| TaintedPath.js:149:7:149:48 | path | TaintedPath.js:153:15:153:18 | path |
| TaintedPath.js:149:14:149:37 | url.par ... , true) | TaintedPath.js:149:14:149:43 | url.par ... ).query |
| TaintedPath.js:149:14:149:37 | url.par ... , true) | TaintedPath.js:149:14:149:43 | url.par ... ).query |
| TaintedPath.js:149:14:149:37 | url.par ... , true) | TaintedPath.js:149:14:149:43 | url.par ... ).query |
@@ -4253,6 +4157,18 @@ edges
| TaintedPath.js:149:14:149:48 | url.par ... ry.path | TaintedPath.js:149:7:149:48 | path |
| TaintedPath.js:149:14:149:48 | url.par ... ry.path | TaintedPath.js:149:7:149:48 | path |
| TaintedPath.js:149:14:149:48 | url.par ... ry.path | TaintedPath.js:149:7:149:48 | path |
| TaintedPath.js:149:14:149:48 | url.par ... ry.path | TaintedPath.js:153:15:153:29 | path.split("/") |
| TaintedPath.js:149:14:149:48 | url.par ... ry.path | TaintedPath.js:153:15:153:29 | path.split("/") |
| TaintedPath.js:149:14:149:48 | url.par ... ry.path | TaintedPath.js:153:15:153:29 | path.split("/") |
| TaintedPath.js:149:14:149:48 | url.par ... ry.path | TaintedPath.js:153:15:153:29 | path.split("/") |
| TaintedPath.js:149:14:149:48 | url.par ... ry.path | TaintedPath.js:153:15:153:29 | path.split("/") |
| TaintedPath.js:149:14:149:48 | url.par ... ry.path | TaintedPath.js:153:15:153:29 | path.split("/") |
| TaintedPath.js:149:14:149:48 | url.par ... ry.path | TaintedPath.js:153:15:153:29 | path.split("/") |
| TaintedPath.js:149:14:149:48 | url.par ... ry.path | TaintedPath.js:153:15:153:29 | path.split("/") |
| TaintedPath.js:149:14:149:48 | url.par ... ry.path | TaintedPath.js:153:15:153:29 | path.split("/") |
| TaintedPath.js:149:14:149:48 | url.par ... ry.path | TaintedPath.js:153:15:153:29 | path.split("/") |
| TaintedPath.js:149:14:149:48 | url.par ... ry.path | TaintedPath.js:153:15:153:29 | path.split("/") |
| TaintedPath.js:149:14:149:48 | url.par ... ry.path | TaintedPath.js:153:15:153:29 | path.split("/") |
| TaintedPath.js:149:24:149:30 | req.url | TaintedPath.js:149:14:149:37 | url.par ... , true) |
| TaintedPath.js:149:24:149:30 | req.url | TaintedPath.js:149:14:149:37 | url.par ... , true) |
| TaintedPath.js:149:24:149:30 | req.url | TaintedPath.js:149:14:149:37 | url.par ... , true) |
@@ -4309,18 +4225,6 @@ edges
| TaintedPath.js:153:7:153:29 | split | TaintedPath.js:168:19:168:23 | split |
| TaintedPath.js:153:7:153:29 | split | TaintedPath.js:168:19:168:23 | split |
| TaintedPath.js:153:7:153:29 | split | TaintedPath.js:168:19:168:23 | split |
| TaintedPath.js:153:15:153:18 | path | TaintedPath.js:153:15:153:29 | path.split("/") |
| TaintedPath.js:153:15:153:18 | path | TaintedPath.js:153:15:153:29 | path.split("/") |
| TaintedPath.js:153:15:153:18 | path | TaintedPath.js:153:15:153:29 | path.split("/") |
| TaintedPath.js:153:15:153:18 | path | TaintedPath.js:153:15:153:29 | path.split("/") |
| TaintedPath.js:153:15:153:18 | path | TaintedPath.js:153:15:153:29 | path.split("/") |
| TaintedPath.js:153:15:153:18 | path | TaintedPath.js:153:15:153:29 | path.split("/") |
| TaintedPath.js:153:15:153:18 | path | TaintedPath.js:153:15:153:29 | path.split("/") |
| TaintedPath.js:153:15:153:18 | path | TaintedPath.js:153:15:153:29 | path.split("/") |
| TaintedPath.js:153:15:153:18 | path | TaintedPath.js:153:15:153:29 | path.split("/") |
| TaintedPath.js:153:15:153:18 | path | TaintedPath.js:153:15:153:29 | path.split("/") |
| TaintedPath.js:153:15:153:18 | path | TaintedPath.js:153:15:153:29 | path.split("/") |
| TaintedPath.js:153:15:153:18 | path | TaintedPath.js:153:15:153:29 | path.split("/") |
| TaintedPath.js:153:15:153:29 | path.split("/") | TaintedPath.js:153:7:153:29 | split |
| TaintedPath.js:153:15:153:29 | path.split("/") | TaintedPath.js:153:7:153:29 | split |
| TaintedPath.js:153:15:153:29 | path.split("/") | TaintedPath.js:153:7:153:29 | split |
@@ -6034,78 +5938,6 @@ edges
| tainted-string-steps.js:6:7:6:48 | path | tainted-string-steps.js:18:18:18:21 | path |
| tainted-string-steps.js:6:7:6:48 | path | tainted-string-steps.js:18:18:18:21 | path |
| tainted-string-steps.js:6:7:6:48 | path | tainted-string-steps.js:18:18:18:21 | path |
| tainted-string-steps.js:6:7:6:48 | path | tainted-string-steps.js:22:18:22:21 | path |
| tainted-string-steps.js:6:7:6:48 | path | tainted-string-steps.js:22:18:22:21 | path |
| tainted-string-steps.js:6:7:6:48 | path | tainted-string-steps.js:22:18:22:21 | path |
| tainted-string-steps.js:6:7:6:48 | path | tainted-string-steps.js:22:18:22:21 | path |
| tainted-string-steps.js:6:7:6:48 | path | tainted-string-steps.js:22:18:22:21 | path |
| tainted-string-steps.js:6:7:6:48 | path | tainted-string-steps.js:22:18:22:21 | path |
| tainted-string-steps.js:6:7:6:48 | path | tainted-string-steps.js:22:18:22:21 | path |
| tainted-string-steps.js:6:7:6:48 | path | tainted-string-steps.js:22:18:22:21 | path |
| tainted-string-steps.js:6:7:6:48 | path | tainted-string-steps.js:22:18:22:21 | path |
| tainted-string-steps.js:6:7:6:48 | path | tainted-string-steps.js:22:18:22:21 | path |
| tainted-string-steps.js:6:7:6:48 | path | tainted-string-steps.js:22:18:22:21 | path |
| tainted-string-steps.js:6:7:6:48 | path | tainted-string-steps.js:22:18:22:21 | path |
| tainted-string-steps.js:6:7:6:48 | path | tainted-string-steps.js:23:18:23:21 | path |
| tainted-string-steps.js:6:7:6:48 | path | tainted-string-steps.js:23:18:23:21 | path |
| tainted-string-steps.js:6:7:6:48 | path | tainted-string-steps.js:23:18:23:21 | path |
| tainted-string-steps.js:6:7:6:48 | path | tainted-string-steps.js:23:18:23:21 | path |
| tainted-string-steps.js:6:7:6:48 | path | tainted-string-steps.js:23:18:23:21 | path |
| tainted-string-steps.js:6:7:6:48 | path | tainted-string-steps.js:23:18:23:21 | path |
| tainted-string-steps.js:6:7:6:48 | path | tainted-string-steps.js:23:18:23:21 | path |
| tainted-string-steps.js:6:7:6:48 | path | tainted-string-steps.js:23:18:23:21 | path |
| tainted-string-steps.js:6:7:6:48 | path | tainted-string-steps.js:23:18:23:21 | path |
| tainted-string-steps.js:6:7:6:48 | path | tainted-string-steps.js:23:18:23:21 | path |
| tainted-string-steps.js:6:7:6:48 | path | tainted-string-steps.js:23:18:23:21 | path |
| tainted-string-steps.js:6:7:6:48 | path | tainted-string-steps.js:23:18:23:21 | path |
| tainted-string-steps.js:6:7:6:48 | path | tainted-string-steps.js:24:18:24:21 | path |
| tainted-string-steps.js:6:7:6:48 | path | tainted-string-steps.js:24:18:24:21 | path |
| tainted-string-steps.js:6:7:6:48 | path | tainted-string-steps.js:24:18:24:21 | path |
| tainted-string-steps.js:6:7:6:48 | path | tainted-string-steps.js:24:18:24:21 | path |
| tainted-string-steps.js:6:7:6:48 | path | tainted-string-steps.js:24:18:24:21 | path |
| tainted-string-steps.js:6:7:6:48 | path | tainted-string-steps.js:24:18:24:21 | path |
| tainted-string-steps.js:6:7:6:48 | path | tainted-string-steps.js:24:18:24:21 | path |
| tainted-string-steps.js:6:7:6:48 | path | tainted-string-steps.js:24:18:24:21 | path |
| tainted-string-steps.js:6:7:6:48 | path | tainted-string-steps.js:24:18:24:21 | path |
| tainted-string-steps.js:6:7:6:48 | path | tainted-string-steps.js:24:18:24:21 | path |
| tainted-string-steps.js:6:7:6:48 | path | tainted-string-steps.js:24:18:24:21 | path |
| tainted-string-steps.js:6:7:6:48 | path | tainted-string-steps.js:24:18:24:21 | path |
| tainted-string-steps.js:6:7:6:48 | path | tainted-string-steps.js:24:18:24:21 | path |
| tainted-string-steps.js:6:7:6:48 | path | tainted-string-steps.js:24:18:24:21 | path |
| tainted-string-steps.js:6:7:6:48 | path | tainted-string-steps.js:24:18:24:21 | path |
| tainted-string-steps.js:6:7:6:48 | path | tainted-string-steps.js:24:18:24:21 | path |
| tainted-string-steps.js:6:7:6:48 | path | tainted-string-steps.js:26:18:26:21 | path |
| tainted-string-steps.js:6:7:6:48 | path | tainted-string-steps.js:26:18:26:21 | path |
| tainted-string-steps.js:6:7:6:48 | path | tainted-string-steps.js:26:18:26:21 | path |
| tainted-string-steps.js:6:7:6:48 | path | tainted-string-steps.js:26:18:26:21 | path |
| tainted-string-steps.js:6:7:6:48 | path | tainted-string-steps.js:26:18:26:21 | path |
| tainted-string-steps.js:6:7:6:48 | path | tainted-string-steps.js:26:18:26:21 | path |
| tainted-string-steps.js:6:7:6:48 | path | tainted-string-steps.js:26:18:26:21 | path |
| tainted-string-steps.js:6:7:6:48 | path | tainted-string-steps.js:26:18:26:21 | path |
| tainted-string-steps.js:6:7:6:48 | path | tainted-string-steps.js:26:18:26:21 | path |
| tainted-string-steps.js:6:7:6:48 | path | tainted-string-steps.js:26:18:26:21 | path |
| tainted-string-steps.js:6:7:6:48 | path | tainted-string-steps.js:26:18:26:21 | path |
| tainted-string-steps.js:6:7:6:48 | path | tainted-string-steps.js:26:18:26:21 | path |
| tainted-string-steps.js:6:7:6:48 | path | tainted-string-steps.js:26:18:26:21 | path |
| tainted-string-steps.js:6:7:6:48 | path | tainted-string-steps.js:26:18:26:21 | path |
| tainted-string-steps.js:6:7:6:48 | path | tainted-string-steps.js:26:18:26:21 | path |
| tainted-string-steps.js:6:7:6:48 | path | tainted-string-steps.js:26:18:26:21 | path |
| tainted-string-steps.js:6:7:6:48 | path | tainted-string-steps.js:27:18:27:21 | path |
| tainted-string-steps.js:6:7:6:48 | path | tainted-string-steps.js:27:18:27:21 | path |
| tainted-string-steps.js:6:7:6:48 | path | tainted-string-steps.js:27:18:27:21 | path |
| tainted-string-steps.js:6:7:6:48 | path | tainted-string-steps.js:27:18:27:21 | path |
| tainted-string-steps.js:6:7:6:48 | path | tainted-string-steps.js:27:18:27:21 | path |
| tainted-string-steps.js:6:7:6:48 | path | tainted-string-steps.js:27:18:27:21 | path |
| tainted-string-steps.js:6:7:6:48 | path | tainted-string-steps.js:27:18:27:21 | path |
| tainted-string-steps.js:6:7:6:48 | path | tainted-string-steps.js:27:18:27:21 | path |
| tainted-string-steps.js:6:7:6:48 | path | tainted-string-steps.js:27:18:27:21 | path |
| tainted-string-steps.js:6:7:6:48 | path | tainted-string-steps.js:27:18:27:21 | path |
| tainted-string-steps.js:6:7:6:48 | path | tainted-string-steps.js:27:18:27:21 | path |
| tainted-string-steps.js:6:7:6:48 | path | tainted-string-steps.js:27:18:27:21 | path |
| tainted-string-steps.js:6:7:6:48 | path | tainted-string-steps.js:27:18:27:21 | path |
| tainted-string-steps.js:6:7:6:48 | path | tainted-string-steps.js:27:18:27:21 | path |
| tainted-string-steps.js:6:7:6:48 | path | tainted-string-steps.js:27:18:27:21 | path |
| tainted-string-steps.js:6:7:6:48 | path | tainted-string-steps.js:27:18:27:21 | path |
| tainted-string-steps.js:6:14:6:37 | url.par ... , true) | tainted-string-steps.js:6:14:6:43 | url.par ... ).query |
| tainted-string-steps.js:6:14:6:37 | url.par ... , true) | tainted-string-steps.js:6:14:6:43 | url.par ... ).query |
| tainted-string-steps.js:6:14:6:37 | url.par ... , true) | tainted-string-steps.js:6:14:6:43 | url.par ... ).query |
@@ -6154,6 +5986,94 @@ edges
| tainted-string-steps.js:6:14:6:48 | url.par ... ry.path | tainted-string-steps.js:6:7:6:48 | path |
| tainted-string-steps.js:6:14:6:48 | url.par ... ry.path | tainted-string-steps.js:6:7:6:48 | path |
| tainted-string-steps.js:6:14:6:48 | url.par ... ry.path | tainted-string-steps.js:6:7:6:48 | path |
| tainted-string-steps.js:6:14:6:48 | url.par ... ry.path | tainted-string-steps.js:22:18:22:32 | path.split('/') |
| tainted-string-steps.js:6:14:6:48 | url.par ... ry.path | tainted-string-steps.js:22:18:22:32 | path.split('/') |
| tainted-string-steps.js:6:14:6:48 | url.par ... ry.path | tainted-string-steps.js:22:18:22:32 | path.split('/') |
| tainted-string-steps.js:6:14:6:48 | url.par ... ry.path | tainted-string-steps.js:22:18:22:32 | path.split('/') |
| tainted-string-steps.js:6:14:6:48 | url.par ... ry.path | tainted-string-steps.js:22:18:22:32 | path.split('/') |
| tainted-string-steps.js:6:14:6:48 | url.par ... ry.path | tainted-string-steps.js:22:18:22:32 | path.split('/') |
| tainted-string-steps.js:6:14:6:48 | url.par ... ry.path | tainted-string-steps.js:22:18:22:32 | path.split('/') |
| tainted-string-steps.js:6:14:6:48 | url.par ... ry.path | tainted-string-steps.js:22:18:22:32 | path.split('/') |
| tainted-string-steps.js:6:14:6:48 | url.par ... ry.path | tainted-string-steps.js:22:18:22:32 | path.split('/') |
| tainted-string-steps.js:6:14:6:48 | url.par ... ry.path | tainted-string-steps.js:22:18:22:32 | path.split('/') |
| tainted-string-steps.js:6:14:6:48 | url.par ... ry.path | tainted-string-steps.js:22:18:22:32 | path.split('/') |
| tainted-string-steps.js:6:14:6:48 | url.par ... ry.path | tainted-string-steps.js:22:18:22:32 | path.split('/') |
| tainted-string-steps.js:6:14:6:48 | url.par ... ry.path | tainted-string-steps.js:23:18:23:33 | path.split(/\\//) |
| tainted-string-steps.js:6:14:6:48 | url.par ... ry.path | tainted-string-steps.js:23:18:23:33 | path.split(/\\//) |
| tainted-string-steps.js:6:14:6:48 | url.par ... ry.path | tainted-string-steps.js:23:18:23:33 | path.split(/\\//) |
| tainted-string-steps.js:6:14:6:48 | url.par ... ry.path | tainted-string-steps.js:23:18:23:33 | path.split(/\\//) |
| tainted-string-steps.js:6:14:6:48 | url.par ... ry.path | tainted-string-steps.js:23:18:23:33 | path.split(/\\//) |
| tainted-string-steps.js:6:14:6:48 | url.par ... ry.path | tainted-string-steps.js:23:18:23:33 | path.split(/\\//) |
| tainted-string-steps.js:6:14:6:48 | url.par ... ry.path | tainted-string-steps.js:23:18:23:33 | path.split(/\\//) |
| tainted-string-steps.js:6:14:6:48 | url.par ... ry.path | tainted-string-steps.js:23:18:23:33 | path.split(/\\//) |
| tainted-string-steps.js:6:14:6:48 | url.par ... ry.path | tainted-string-steps.js:23:18:23:33 | path.split(/\\//) |
| tainted-string-steps.js:6:14:6:48 | url.par ... ry.path | tainted-string-steps.js:23:18:23:33 | path.split(/\\//) |
| tainted-string-steps.js:6:14:6:48 | url.par ... ry.path | tainted-string-steps.js:23:18:23:33 | path.split(/\\//) |
| tainted-string-steps.js:6:14:6:48 | url.par ... ry.path | tainted-string-steps.js:23:18:23:33 | path.split(/\\//) |
| tainted-string-steps.js:6:14:6:48 | url.par ... ry.path | tainted-string-steps.js:24:18:24:32 | path.split("?") |
| tainted-string-steps.js:6:14:6:48 | url.par ... ry.path | tainted-string-steps.js:24:18:24:32 | path.split("?") |
| tainted-string-steps.js:6:14:6:48 | url.par ... ry.path | tainted-string-steps.js:24:18:24:32 | path.split("?") |
| tainted-string-steps.js:6:14:6:48 | url.par ... ry.path | tainted-string-steps.js:24:18:24:32 | path.split("?") |
| tainted-string-steps.js:6:14:6:48 | url.par ... ry.path | tainted-string-steps.js:24:18:24:32 | path.split("?") |
| tainted-string-steps.js:6:14:6:48 | url.par ... ry.path | tainted-string-steps.js:24:18:24:32 | path.split("?") |
| tainted-string-steps.js:6:14:6:48 | url.par ... ry.path | tainted-string-steps.js:24:18:24:32 | path.split("?") |
| tainted-string-steps.js:6:14:6:48 | url.par ... ry.path | tainted-string-steps.js:24:18:24:32 | path.split("?") |
| tainted-string-steps.js:6:14:6:48 | url.par ... ry.path | tainted-string-steps.js:24:18:24:32 | path.split("?") |
| tainted-string-steps.js:6:14:6:48 | url.par ... ry.path | tainted-string-steps.js:24:18:24:32 | path.split("?") |
| tainted-string-steps.js:6:14:6:48 | url.par ... ry.path | tainted-string-steps.js:24:18:24:32 | path.split("?") |
| tainted-string-steps.js:6:14:6:48 | url.par ... ry.path | tainted-string-steps.js:24:18:24:32 | path.split("?") |
| tainted-string-steps.js:6:14:6:48 | url.par ... ry.path | tainted-string-steps.js:24:18:24:32 | path.split("?") |
| tainted-string-steps.js:6:14:6:48 | url.par ... ry.path | tainted-string-steps.js:24:18:24:32 | path.split("?") |
| tainted-string-steps.js:6:14:6:48 | url.par ... ry.path | tainted-string-steps.js:24:18:24:32 | path.split("?") |
| tainted-string-steps.js:6:14:6:48 | url.par ... ry.path | tainted-string-steps.js:24:18:24:32 | path.split("?") |
| tainted-string-steps.js:6:14:6:48 | url.par ... ry.path | tainted-string-steps.js:26:18:26:36 | path.split(unknown) |
| tainted-string-steps.js:6:14:6:48 | url.par ... ry.path | tainted-string-steps.js:26:18:26:36 | path.split(unknown) |
| tainted-string-steps.js:6:14:6:48 | url.par ... ry.path | tainted-string-steps.js:26:18:26:36 | path.split(unknown) |
| tainted-string-steps.js:6:14:6:48 | url.par ... ry.path | tainted-string-steps.js:26:18:26:36 | path.split(unknown) |
| tainted-string-steps.js:6:14:6:48 | url.par ... ry.path | tainted-string-steps.js:26:18:26:36 | path.split(unknown) |
| tainted-string-steps.js:6:14:6:48 | url.par ... ry.path | tainted-string-steps.js:26:18:26:36 | path.split(unknown) |
| tainted-string-steps.js:6:14:6:48 | url.par ... ry.path | tainted-string-steps.js:26:18:26:36 | path.split(unknown) |
| tainted-string-steps.js:6:14:6:48 | url.par ... ry.path | tainted-string-steps.js:26:18:26:36 | path.split(unknown) |
| tainted-string-steps.js:6:14:6:48 | url.par ... ry.path | tainted-string-steps.js:26:18:26:36 | path.split(unknown) |
| tainted-string-steps.js:6:14:6:48 | url.par ... ry.path | tainted-string-steps.js:26:18:26:36 | path.split(unknown) |
| tainted-string-steps.js:6:14:6:48 | url.par ... ry.path | tainted-string-steps.js:26:18:26:36 | path.split(unknown) |
| tainted-string-steps.js:6:14:6:48 | url.par ... ry.path | tainted-string-steps.js:26:18:26:36 | path.split(unknown) |
| tainted-string-steps.js:6:14:6:48 | url.par ... ry.path | tainted-string-steps.js:26:18:26:36 | path.split(unknown) |
| tainted-string-steps.js:6:14:6:48 | url.par ... ry.path | tainted-string-steps.js:26:18:26:36 | path.split(unknown) |
| tainted-string-steps.js:6:14:6:48 | url.par ... ry.path | tainted-string-steps.js:26:18:26:36 | path.split(unknown) |
| tainted-string-steps.js:6:14:6:48 | url.par ... ry.path | tainted-string-steps.js:26:18:26:36 | path.split(unknown) |
| tainted-string-steps.js:6:14:6:48 | url.par ... ry.path | tainted-string-steps.js:27:18:27:36 | path.split(unknown) |
| tainted-string-steps.js:6:14:6:48 | url.par ... ry.path | tainted-string-steps.js:27:18:27:36 | path.split(unknown) |
| tainted-string-steps.js:6:14:6:48 | url.par ... ry.path | tainted-string-steps.js:27:18:27:36 | path.split(unknown) |
| tainted-string-steps.js:6:14:6:48 | url.par ... ry.path | tainted-string-steps.js:27:18:27:36 | path.split(unknown) |
| tainted-string-steps.js:6:14:6:48 | url.par ... ry.path | tainted-string-steps.js:27:18:27:36 | path.split(unknown) |
| tainted-string-steps.js:6:14:6:48 | url.par ... ry.path | tainted-string-steps.js:27:18:27:36 | path.split(unknown) |
| tainted-string-steps.js:6:14:6:48 | url.par ... ry.path | tainted-string-steps.js:27:18:27:36 | path.split(unknown) |
| tainted-string-steps.js:6:14:6:48 | url.par ... ry.path | tainted-string-steps.js:27:18:27:36 | path.split(unknown) |
| tainted-string-steps.js:6:14:6:48 | url.par ... ry.path | tainted-string-steps.js:27:18:27:36 | path.split(unknown) |
| tainted-string-steps.js:6:14:6:48 | url.par ... ry.path | tainted-string-steps.js:27:18:27:36 | path.split(unknown) |
| tainted-string-steps.js:6:14:6:48 | url.par ... ry.path | tainted-string-steps.js:27:18:27:36 | path.split(unknown) |
| tainted-string-steps.js:6:14:6:48 | url.par ... ry.path | tainted-string-steps.js:27:18:27:36 | path.split(unknown) |
| tainted-string-steps.js:6:14:6:48 | url.par ... ry.path | tainted-string-steps.js:27:18:27:36 | path.split(unknown) |
| tainted-string-steps.js:6:14:6:48 | url.par ... ry.path | tainted-string-steps.js:27:18:27:36 | path.split(unknown) |
| tainted-string-steps.js:6:14:6:48 | url.par ... ry.path | tainted-string-steps.js:27:18:27:36 | path.split(unknown) |
| tainted-string-steps.js:6:14:6:48 | url.par ... ry.path | tainted-string-steps.js:27:18:27:36 | path.split(unknown) |
| tainted-string-steps.js:6:14:6:48 | url.par ... ry.path | tainted-string-steps.js:27:18:27:36 | path.split(unknown) |
| tainted-string-steps.js:6:14:6:48 | url.par ... ry.path | tainted-string-steps.js:27:18:27:36 | path.split(unknown) |
| tainted-string-steps.js:6:14:6:48 | url.par ... ry.path | tainted-string-steps.js:27:18:27:36 | path.split(unknown) |
| tainted-string-steps.js:6:14:6:48 | url.par ... ry.path | tainted-string-steps.js:27:18:27:36 | path.split(unknown) |
| tainted-string-steps.js:6:14:6:48 | url.par ... ry.path | tainted-string-steps.js:27:18:27:36 | path.split(unknown) |
| tainted-string-steps.js:6:14:6:48 | url.par ... ry.path | tainted-string-steps.js:27:18:27:36 | path.split(unknown) |
| tainted-string-steps.js:6:14:6:48 | url.par ... ry.path | tainted-string-steps.js:27:18:27:36 | path.split(unknown) |
| tainted-string-steps.js:6:14:6:48 | url.par ... ry.path | tainted-string-steps.js:27:18:27:36 | path.split(unknown) |
| tainted-string-steps.js:6:14:6:48 | url.par ... ry.path | tainted-string-steps.js:27:18:27:36 | path.split(unknown) |
| tainted-string-steps.js:6:14:6:48 | url.par ... ry.path | tainted-string-steps.js:27:18:27:36 | path.split(unknown) |
| tainted-string-steps.js:6:14:6:48 | url.par ... ry.path | tainted-string-steps.js:27:18:27:36 | path.split(unknown) |
| tainted-string-steps.js:6:14:6:48 | url.par ... ry.path | tainted-string-steps.js:27:18:27:36 | path.split(unknown) |
| tainted-string-steps.js:6:14:6:48 | url.par ... ry.path | tainted-string-steps.js:27:18:27:36 | path.split(unknown) |
| tainted-string-steps.js:6:14:6:48 | url.par ... ry.path | tainted-string-steps.js:27:18:27:36 | path.split(unknown) |
| tainted-string-steps.js:6:14:6:48 | url.par ... ry.path | tainted-string-steps.js:27:18:27:36 | path.split(unknown) |
| tainted-string-steps.js:6:14:6:48 | url.par ... ry.path | tainted-string-steps.js:27:18:27:36 | path.split(unknown) |
| tainted-string-steps.js:6:24:6:30 | req.url | tainted-string-steps.js:6:14:6:37 | url.par ... , true) |
| tainted-string-steps.js:6:24:6:30 | req.url | tainted-string-steps.js:6:14:6:37 | url.par ... , true) |
| tainted-string-steps.js:6:24:6:30 | req.url | tainted-string-steps.js:6:14:6:37 | url.par ... , true) |
@@ -6458,18 +6378,6 @@ edges
| tainted-string-steps.js:18:18:18:21 | path | tainted-string-steps.js:18:18:18:35 | path.toLowerCase() |
| tainted-string-steps.js:18:18:18:21 | path | tainted-string-steps.js:18:18:18:35 | path.toLowerCase() |
| tainted-string-steps.js:18:18:18:21 | path | tainted-string-steps.js:18:18:18:35 | path.toLowerCase() |
| tainted-string-steps.js:22:18:22:21 | path | tainted-string-steps.js:22:18:22:32 | path.split('/') |
| tainted-string-steps.js:22:18:22:21 | path | tainted-string-steps.js:22:18:22:32 | path.split('/') |
| tainted-string-steps.js:22:18:22:21 | path | tainted-string-steps.js:22:18:22:32 | path.split('/') |
| tainted-string-steps.js:22:18:22:21 | path | tainted-string-steps.js:22:18:22:32 | path.split('/') |
| tainted-string-steps.js:22:18:22:21 | path | tainted-string-steps.js:22:18:22:32 | path.split('/') |
| tainted-string-steps.js:22:18:22:21 | path | tainted-string-steps.js:22:18:22:32 | path.split('/') |
| tainted-string-steps.js:22:18:22:21 | path | tainted-string-steps.js:22:18:22:32 | path.split('/') |
| tainted-string-steps.js:22:18:22:21 | path | tainted-string-steps.js:22:18:22:32 | path.split('/') |
| tainted-string-steps.js:22:18:22:21 | path | tainted-string-steps.js:22:18:22:32 | path.split('/') |
| tainted-string-steps.js:22:18:22:21 | path | tainted-string-steps.js:22:18:22:32 | path.split('/') |
| tainted-string-steps.js:22:18:22:21 | path | tainted-string-steps.js:22:18:22:32 | path.split('/') |
| tainted-string-steps.js:22:18:22:21 | path | tainted-string-steps.js:22:18:22:32 | path.split('/') |
| tainted-string-steps.js:22:18:22:32 | path.split('/') | tainted-string-steps.js:22:18:22:35 | path.split('/')[i] |
| tainted-string-steps.js:22:18:22:32 | path.split('/') | tainted-string-steps.js:22:18:22:35 | path.split('/')[i] |
| tainted-string-steps.js:22:18:22:32 | path.split('/') | tainted-string-steps.js:22:18:22:35 | path.split('/')[i] |
@@ -6486,18 +6394,6 @@ edges
| tainted-string-steps.js:22:18:22:32 | path.split('/') | tainted-string-steps.js:22:18:22:35 | path.split('/')[i] |
| tainted-string-steps.js:22:18:22:32 | path.split('/') | tainted-string-steps.js:22:18:22:35 | path.split('/')[i] |
| tainted-string-steps.js:22:18:22:32 | path.split('/') | tainted-string-steps.js:22:18:22:35 | path.split('/')[i] |
| tainted-string-steps.js:23:18:23:21 | path | tainted-string-steps.js:23:18:23:33 | path.split(/\\//) |
| tainted-string-steps.js:23:18:23:21 | path | tainted-string-steps.js:23:18:23:33 | path.split(/\\//) |
| tainted-string-steps.js:23:18:23:21 | path | tainted-string-steps.js:23:18:23:33 | path.split(/\\//) |
| tainted-string-steps.js:23:18:23:21 | path | tainted-string-steps.js:23:18:23:33 | path.split(/\\//) |
| tainted-string-steps.js:23:18:23:21 | path | tainted-string-steps.js:23:18:23:33 | path.split(/\\//) |
| tainted-string-steps.js:23:18:23:21 | path | tainted-string-steps.js:23:18:23:33 | path.split(/\\//) |
| tainted-string-steps.js:23:18:23:21 | path | tainted-string-steps.js:23:18:23:33 | path.split(/\\//) |
| tainted-string-steps.js:23:18:23:21 | path | tainted-string-steps.js:23:18:23:33 | path.split(/\\//) |
| tainted-string-steps.js:23:18:23:21 | path | tainted-string-steps.js:23:18:23:33 | path.split(/\\//) |
| tainted-string-steps.js:23:18:23:21 | path | tainted-string-steps.js:23:18:23:33 | path.split(/\\//) |
| tainted-string-steps.js:23:18:23:21 | path | tainted-string-steps.js:23:18:23:33 | path.split(/\\//) |
| tainted-string-steps.js:23:18:23:21 | path | tainted-string-steps.js:23:18:23:33 | path.split(/\\//) |
| tainted-string-steps.js:23:18:23:33 | path.split(/\\//) | tainted-string-steps.js:23:18:23:36 | path.split(/\\//)[i] |
| tainted-string-steps.js:23:18:23:33 | path.split(/\\//) | tainted-string-steps.js:23:18:23:36 | path.split(/\\//)[i] |
| tainted-string-steps.js:23:18:23:33 | path.split(/\\//) | tainted-string-steps.js:23:18:23:36 | path.split(/\\//)[i] |
@@ -6514,22 +6410,6 @@ edges
| tainted-string-steps.js:23:18:23:33 | path.split(/\\//) | tainted-string-steps.js:23:18:23:36 | path.split(/\\//)[i] |
| tainted-string-steps.js:23:18:23:33 | path.split(/\\//) | tainted-string-steps.js:23:18:23:36 | path.split(/\\//)[i] |
| tainted-string-steps.js:23:18:23:33 | path.split(/\\//) | tainted-string-steps.js:23:18:23:36 | path.split(/\\//)[i] |
| tainted-string-steps.js:24:18:24:21 | path | tainted-string-steps.js:24:18:24:32 | path.split("?") |
| tainted-string-steps.js:24:18:24:21 | path | tainted-string-steps.js:24:18:24:32 | path.split("?") |
| tainted-string-steps.js:24:18:24:21 | path | tainted-string-steps.js:24:18:24:32 | path.split("?") |
| tainted-string-steps.js:24:18:24:21 | path | tainted-string-steps.js:24:18:24:32 | path.split("?") |
| tainted-string-steps.js:24:18:24:21 | path | tainted-string-steps.js:24:18:24:32 | path.split("?") |
| tainted-string-steps.js:24:18:24:21 | path | tainted-string-steps.js:24:18:24:32 | path.split("?") |
| tainted-string-steps.js:24:18:24:21 | path | tainted-string-steps.js:24:18:24:32 | path.split("?") |
| tainted-string-steps.js:24:18:24:21 | path | tainted-string-steps.js:24:18:24:32 | path.split("?") |
| tainted-string-steps.js:24:18:24:21 | path | tainted-string-steps.js:24:18:24:32 | path.split("?") |
| tainted-string-steps.js:24:18:24:21 | path | tainted-string-steps.js:24:18:24:32 | path.split("?") |
| tainted-string-steps.js:24:18:24:21 | path | tainted-string-steps.js:24:18:24:32 | path.split("?") |
| tainted-string-steps.js:24:18:24:21 | path | tainted-string-steps.js:24:18:24:32 | path.split("?") |
| tainted-string-steps.js:24:18:24:21 | path | tainted-string-steps.js:24:18:24:32 | path.split("?") |
| tainted-string-steps.js:24:18:24:21 | path | tainted-string-steps.js:24:18:24:32 | path.split("?") |
| tainted-string-steps.js:24:18:24:21 | path | tainted-string-steps.js:24:18:24:32 | path.split("?") |
| tainted-string-steps.js:24:18:24:21 | path | tainted-string-steps.js:24:18:24:32 | path.split("?") |
| tainted-string-steps.js:24:18:24:32 | path.split("?") | tainted-string-steps.js:24:18:24:35 | path.split("?")[0] |
| tainted-string-steps.js:24:18:24:32 | path.split("?") | tainted-string-steps.js:24:18:24:35 | path.split("?")[0] |
| tainted-string-steps.js:24:18:24:32 | path.split("?") | tainted-string-steps.js:24:18:24:35 | path.split("?")[0] |
@@ -6562,22 +6442,6 @@ edges
| tainted-string-steps.js:24:18:24:32 | path.split("?") | tainted-string-steps.js:24:18:24:35 | path.split("?")[0] |
| tainted-string-steps.js:24:18:24:32 | path.split("?") | tainted-string-steps.js:24:18:24:35 | path.split("?")[0] |
| tainted-string-steps.js:24:18:24:32 | path.split("?") | tainted-string-steps.js:24:18:24:35 | path.split("?")[0] |
| tainted-string-steps.js:26:18:26:21 | path | tainted-string-steps.js:26:18:26:36 | path.split(unknown) |
| tainted-string-steps.js:26:18:26:21 | path | tainted-string-steps.js:26:18:26:36 | path.split(unknown) |
| tainted-string-steps.js:26:18:26:21 | path | tainted-string-steps.js:26:18:26:36 | path.split(unknown) |
| tainted-string-steps.js:26:18:26:21 | path | tainted-string-steps.js:26:18:26:36 | path.split(unknown) |
| tainted-string-steps.js:26:18:26:21 | path | tainted-string-steps.js:26:18:26:36 | path.split(unknown) |
| tainted-string-steps.js:26:18:26:21 | path | tainted-string-steps.js:26:18:26:36 | path.split(unknown) |
| tainted-string-steps.js:26:18:26:21 | path | tainted-string-steps.js:26:18:26:36 | path.split(unknown) |
| tainted-string-steps.js:26:18:26:21 | path | tainted-string-steps.js:26:18:26:36 | path.split(unknown) |
| tainted-string-steps.js:26:18:26:21 | path | tainted-string-steps.js:26:18:26:36 | path.split(unknown) |
| tainted-string-steps.js:26:18:26:21 | path | tainted-string-steps.js:26:18:26:36 | path.split(unknown) |
| tainted-string-steps.js:26:18:26:21 | path | tainted-string-steps.js:26:18:26:36 | path.split(unknown) |
| tainted-string-steps.js:26:18:26:21 | path | tainted-string-steps.js:26:18:26:36 | path.split(unknown) |
| tainted-string-steps.js:26:18:26:21 | path | tainted-string-steps.js:26:18:26:36 | path.split(unknown) |
| tainted-string-steps.js:26:18:26:21 | path | tainted-string-steps.js:26:18:26:36 | path.split(unknown) |
| tainted-string-steps.js:26:18:26:21 | path | tainted-string-steps.js:26:18:26:36 | path.split(unknown) |
| tainted-string-steps.js:26:18:26:21 | path | tainted-string-steps.js:26:18:26:36 | path.split(unknown) |
| tainted-string-steps.js:26:18:26:36 | path.split(unknown) | tainted-string-steps.js:26:18:26:45 | path.sp ... hatever |
| tainted-string-steps.js:26:18:26:36 | path.split(unknown) | tainted-string-steps.js:26:18:26:45 | path.sp ... hatever |
| tainted-string-steps.js:26:18:26:36 | path.split(unknown) | tainted-string-steps.js:26:18:26:45 | path.sp ... hatever |
@@ -6610,38 +6474,6 @@ edges
| tainted-string-steps.js:26:18:26:36 | path.split(unknown) | tainted-string-steps.js:26:18:26:45 | path.sp ... hatever |
| tainted-string-steps.js:26:18:26:36 | path.split(unknown) | tainted-string-steps.js:26:18:26:45 | path.sp ... hatever |
| tainted-string-steps.js:26:18:26:36 | path.split(unknown) | tainted-string-steps.js:26:18:26:45 | path.sp ... hatever |
| tainted-string-steps.js:27:18:27:21 | path | tainted-string-steps.js:27:18:27:36 | path.split(unknown) |
| tainted-string-steps.js:27:18:27:21 | path | tainted-string-steps.js:27:18:27:36 | path.split(unknown) |
| tainted-string-steps.js:27:18:27:21 | path | tainted-string-steps.js:27:18:27:36 | path.split(unknown) |
| tainted-string-steps.js:27:18:27:21 | path | tainted-string-steps.js:27:18:27:36 | path.split(unknown) |
| tainted-string-steps.js:27:18:27:21 | path | tainted-string-steps.js:27:18:27:36 | path.split(unknown) |
| tainted-string-steps.js:27:18:27:21 | path | tainted-string-steps.js:27:18:27:36 | path.split(unknown) |
| tainted-string-steps.js:27:18:27:21 | path | tainted-string-steps.js:27:18:27:36 | path.split(unknown) |
| tainted-string-steps.js:27:18:27:21 | path | tainted-string-steps.js:27:18:27:36 | path.split(unknown) |
| tainted-string-steps.js:27:18:27:21 | path | tainted-string-steps.js:27:18:27:36 | path.split(unknown) |
| tainted-string-steps.js:27:18:27:21 | path | tainted-string-steps.js:27:18:27:36 | path.split(unknown) |
| tainted-string-steps.js:27:18:27:21 | path | tainted-string-steps.js:27:18:27:36 | path.split(unknown) |
| tainted-string-steps.js:27:18:27:21 | path | tainted-string-steps.js:27:18:27:36 | path.split(unknown) |
| tainted-string-steps.js:27:18:27:21 | path | tainted-string-steps.js:27:18:27:36 | path.split(unknown) |
| tainted-string-steps.js:27:18:27:21 | path | tainted-string-steps.js:27:18:27:36 | path.split(unknown) |
| tainted-string-steps.js:27:18:27:21 | path | tainted-string-steps.js:27:18:27:36 | path.split(unknown) |
| tainted-string-steps.js:27:18:27:21 | path | tainted-string-steps.js:27:18:27:36 | path.split(unknown) |
| tainted-string-steps.js:27:18:27:21 | path | tainted-string-steps.js:27:18:27:36 | path.split(unknown) |
| tainted-string-steps.js:27:18:27:21 | path | tainted-string-steps.js:27:18:27:36 | path.split(unknown) |
| tainted-string-steps.js:27:18:27:21 | path | tainted-string-steps.js:27:18:27:36 | path.split(unknown) |
| tainted-string-steps.js:27:18:27:21 | path | tainted-string-steps.js:27:18:27:36 | path.split(unknown) |
| tainted-string-steps.js:27:18:27:21 | path | tainted-string-steps.js:27:18:27:36 | path.split(unknown) |
| tainted-string-steps.js:27:18:27:21 | path | tainted-string-steps.js:27:18:27:36 | path.split(unknown) |
| tainted-string-steps.js:27:18:27:21 | path | tainted-string-steps.js:27:18:27:36 | path.split(unknown) |
| tainted-string-steps.js:27:18:27:21 | path | tainted-string-steps.js:27:18:27:36 | path.split(unknown) |
| tainted-string-steps.js:27:18:27:21 | path | tainted-string-steps.js:27:18:27:36 | path.split(unknown) |
| tainted-string-steps.js:27:18:27:21 | path | tainted-string-steps.js:27:18:27:36 | path.split(unknown) |
| tainted-string-steps.js:27:18:27:21 | path | tainted-string-steps.js:27:18:27:36 | path.split(unknown) |
| tainted-string-steps.js:27:18:27:21 | path | tainted-string-steps.js:27:18:27:36 | path.split(unknown) |
| tainted-string-steps.js:27:18:27:21 | path | tainted-string-steps.js:27:18:27:36 | path.split(unknown) |
| tainted-string-steps.js:27:18:27:21 | path | tainted-string-steps.js:27:18:27:36 | path.split(unknown) |
| tainted-string-steps.js:27:18:27:21 | path | tainted-string-steps.js:27:18:27:36 | path.split(unknown) |
| tainted-string-steps.js:27:18:27:21 | path | tainted-string-steps.js:27:18:27:36 | path.split(unknown) |
| torrents.js:5:6:5:38 | name | torrents.js:6:24:6:27 | name |
| torrents.js:5:6:5:38 | name | torrents.js:6:24:6:27 | name |
| torrents.js:5:6:5:38 | name | torrents.js:6:24:6:27 | name |