JavaScript: Autoformat cookbook examples.

This commit is contained in:
Anders Schack-Mulligen
2019-08-02 15:33:40 +02:00
parent 40f2cec0de
commit 59fb59d109
33 changed files with 45 additions and 40 deletions

View File

@@ -1,7 +1,7 @@
/**
* @name Decoding after sanitization
* @description Tracks the return value of 'escapeHtml' into 'decodeURI', indicating
an ineffective sanitization attempt.
* an ineffective sanitization attempt.
* @kind path-problem
* @tags security
* @id js/examples/decoding-after-sanitization

View File

@@ -1,7 +1,7 @@
/**
* @name Decoding after sanitization (generalized)
* @description Tracks the return value of an HTML sanitizer into an escape-sequence decoder,
indicating an ineffective sanitization attempt.
* indicating an ineffective sanitization attempt.
* @kind path-problem
* @tags security
* @id js/examples/decoding-after-sanitization-generalized

View File

@@ -1,7 +1,7 @@
/**
* @name Information disclosure through postMessage
* @description Tracks values from an 'authKey' property into a postMessage call with unrestricted origin,
indicating a leak of sensitive information.
* indicating a leak of sensitive information.
* @kind path-problem
* @tags security
* @id js/examples/information-disclosure

View File

@@ -11,6 +11,9 @@
import javascript
from StrictEqExpr eq, ModExpr mod, NumberLiteral zero, NumberLiteral two
where two.getValue() = "2" and mod.getRightOperand() = two and
zero.getValue() = "0" and eq.hasOperands(mod, two)
where
two.getValue() = "2" and
mod.getRightOperand() = two and
zero.getValue() = "0" and
eq.hasOperands(mod, two)
select eq

View File

@@ -9,6 +9,7 @@
import javascript
from Function f
where exists(f.getABodyStmt()) and
not exists (ReturnStmt r | r.getContainer() = f)
where
exists(f.getABodyStmt()) and
not exists(ReturnStmt r | r.getContainer() = f)
select f

View File

@@ -9,6 +9,7 @@
import javascript
from MethodCallExpr c
where c.getReceiver() instanceof ThisExpr and
c.getMethodName() = "isMounted"
where
c.getReceiver() instanceof ThisExpr and
c.getMethodName() = "isMounted"
select c