diff --git a/go/ql/test/query-tests/Security/CWE-079/ReflectedXss.expected b/go/ql/test/query-tests/Security/CWE-079/ReflectedXss.expected index b95abaa47c5..3e593f0c202 100644 --- a/go/ql/test/query-tests/Security/CWE-079/ReflectedXss.expected +++ b/go/ql/test/query-tests/Security/CWE-079/ReflectedXss.expected @@ -156,12 +156,3 @@ nodes | websocketXss.go:54:3:54:38 | ... := ...[1] | semmle.label | ... := ...[1] | | websocketXss.go:55:24:55:31 | gorilla3 | semmle.label | gorilla3 | subpaths -testFailures -| websocketXss.go:30:32:30:60 | comment | Missing result: Source[go/reflected-xss] | -| websocketXss.go:31:11:31:14 | xnet [postupdate] | Unexpected result: Source | -| websocketXss.go:34:30:34:58 | comment | Missing result: Source[go/reflected-xss] | -| websocketXss.go:35:21:35:25 | xnet2 [postupdate] | Unexpected result: Source | -| websocketXss.go:46:38:46:66 | comment | Missing result: Source[go/reflected-xss] | -| websocketXss.go:47:26:47:35 | gorillaMsg [postupdate] | Unexpected result: Source | -| websocketXss.go:50:33:50:61 | comment | Missing result: Source[go/reflected-xss] | -| websocketXss.go:51:17:51:24 | gorilla2 [postupdate] | Unexpected result: Source | diff --git a/go/ql/test/query-tests/Security/CWE-079/websocketXss.go b/go/ql/test/query-tests/Security/CWE-079/websocketXss.go index aa8bc8e41ad..eadc87b2c9f 100644 --- a/go/ql/test/query-tests/Security/CWE-079/websocketXss.go +++ b/go/ql/test/query-tests/Security/CWE-079/websocketXss.go @@ -27,12 +27,12 @@ func xss(w http.ResponseWriter, r *http.Request) { origin := "test" { ws, _ := websocket.Dial(uri, "", origin) - var xnet = make([]byte, 512) // $ Source[go/reflected-xss] - ws.Read(xnet) + var xnet = make([]byte, 512) + ws.Read(xnet) // $ Source[go/reflected-xss] fmt.Fprintf(w, "%v", xnet) // $ Alert[go/reflected-xss] codec := &websocket.Codec{Marshal: marshal, Unmarshal: unmarshal} - xnet2 := make([]byte, 512) // $ Source[go/reflected-xss] - codec.Receive(ws, xnet2) + xnet2 := make([]byte, 512) + codec.Receive(ws, xnet2) // $ Source[go/reflected-xss] fmt.Fprintf(w, "%v", xnet2) // $ Alert[go/reflected-xss] } { @@ -43,12 +43,12 @@ func xss(w http.ResponseWriter, r *http.Request) { { dialer := gorilla.Dialer{} conn, _, _ := dialer.Dial(uri, nil) - var gorillaMsg = make([]byte, 512) // $ Source[go/reflected-xss] - gorilla.ReadJSON(conn, gorillaMsg) - fmt.Fprintf(w, "%v", gorillaMsg) // $ Alert[go/reflected-xss] + var gorillaMsg = make([]byte, 512) + gorilla.ReadJSON(conn, gorillaMsg) // $ Source[go/reflected-xss] + fmt.Fprintf(w, "%v", gorillaMsg) // $ Alert[go/reflected-xss] - gorilla2 := make([]byte, 512) // $ Source[go/reflected-xss] - conn.ReadJSON(gorilla2) + gorilla2 := make([]byte, 512) + conn.ReadJSON(gorilla2) // $ Source[go/reflected-xss] fmt.Fprintf(w, "%v", gorilla2) // $ Alert[go/reflected-xss] _, gorilla3, _ := conn.ReadMessage() // $ Source[go/reflected-xss]