hohn/codeql
1
0
Fork 0
mirror of https://github.com/github/codeql.git synced 2026-04-25 00:35:20 +02:00
Code Issues Packages Projects Releases Wiki Activity

JS: fixup documentation

Browse Source
This commit is contained in:
Esben Sparre Andreasen
2020-04-24 10:56:53 +02:00
parent f0a05f6a6c
commit 58b5bd5cfd
4 changed files with 11 additions and 7 deletions
Download Patch File Download Diff File Expand all files Collapse all files

12
javascript/ql/src/Security/CWE-116/IncompleteHtmlAttributeSanitization.qhelp
View File

@@ -30,8 +30,13 @@
<recommendation>
Sanitize all relevant HTML meta-characters when constructing
HTML dynamically, pay special attention to where the sanitized value is used.
<p>
Sanitize all relevant HTML meta-characters when
constructing HTML dynamically, and pay special attention to where the
sanitized value is used.
</p>
</recommendation>
@@ -75,8 +80,7 @@
</li>
<li>
OWASP
<a href="https://www.owasp.org/index.php/Types_of_Cross-Site_Scripting">Types of Cross-Site
Scripting</a>.
<a href="https://owasp.org/www-community/Types_of_Cross-Site_Scripting">Types of Cross-Site</a>.
</li>
<li>
Wikipedia: <a href="http://en.wikipedia.org/wiki/Cross-site_scripting">Cross-site scripting</a>.

2
javascript/ql/src/Security/CWE-116/IncompleteHtmlAttributeSanitization.ql
View File

@@ -1,7 +1,7 @@
/**
* @name Incomplete HTML attribute sanitization
* @description Writing incompletely sanitized values to HTML
* attribute strings can lead to a cross-site
* attribute strings can lead to a cross-site
* scripting vulnerability.
* @kind path-problem
* @problem.severity warning

2
javascript/ql/src/Security/CWE-116/examples/IncompleteHtmlAttributeSanitization.js
View File

@@ -3,7 +3,7 @@ var app = require('express')();
app.get('/user/:id', function(req, res) {
let id = req.params.id;
id = id.replace(/<|>/g, ""); // BAD
let userHtml = `<div data-id="${id}">${getUserName(id)} || Unknown name</div>`;
let userHtml = `<div data-id="${id}">${getUserName(id) || "Unknown name"}</div>`;
// ...
res.send(prefix + userHtml + suffix);
});

2
javascript/ql/src/Security/CWE-116/examples/IncompleteHtmlAttributeSanitizationGood.js
View File

@@ -3,7 +3,7 @@ var app = require('express')();
app.get('/user/:id', function(req, res) {
let id = req.params.id;
id = id.replace(/<|>|&|"/g, ""); // GOOD
let userHtml = `<div data-id="${id}">${getUserName(id)} || Unknown name</div>`;
let userHtml = `<div data-id="${id}">${getUserName(id) || "Unknown name"}</div>`;
// ...
res.send(prefix + userHtml + suffix);
});