mirror of
https://github.com/github/codeql.git
synced 2025-12-17 01:03:14 +01:00
JavaScript: Autoformat cookbook examples.
This commit is contained in:
@@ -1,7 +1,7 @@
|
||||
/**
|
||||
* @name Decoding after sanitization
|
||||
* @description Tracks the return value of 'escapeHtml' into 'decodeURI', indicating
|
||||
an ineffective sanitization attempt.
|
||||
* an ineffective sanitization attempt.
|
||||
* @kind path-problem
|
||||
* @tags security
|
||||
* @id js/examples/decoding-after-sanitization
|
||||
|
||||
@@ -1,7 +1,7 @@
|
||||
/**
|
||||
* @name Decoding after sanitization (generalized)
|
||||
* @description Tracks the return value of an HTML sanitizer into an escape-sequence decoder,
|
||||
indicating an ineffective sanitization attempt.
|
||||
* indicating an ineffective sanitization attempt.
|
||||
* @kind path-problem
|
||||
* @tags security
|
||||
* @id js/examples/decoding-after-sanitization-generalized
|
||||
|
||||
@@ -1,7 +1,7 @@
|
||||
/**
|
||||
* @name Information disclosure through postMessage
|
||||
* @description Tracks values from an 'authKey' property into a postMessage call with unrestricted origin,
|
||||
indicating a leak of sensitive information.
|
||||
* indicating a leak of sensitive information.
|
||||
* @kind path-problem
|
||||
* @tags security
|
||||
* @id js/examples/information-disclosure
|
||||
|
||||
@@ -11,6 +11,9 @@
|
||||
import javascript
|
||||
|
||||
from StrictEqExpr eq, ModExpr mod, NumberLiteral zero, NumberLiteral two
|
||||
where two.getValue() = "2" and mod.getRightOperand() = two and
|
||||
zero.getValue() = "0" and eq.hasOperands(mod, two)
|
||||
where
|
||||
two.getValue() = "2" and
|
||||
mod.getRightOperand() = two and
|
||||
zero.getValue() = "0" and
|
||||
eq.hasOperands(mod, two)
|
||||
select eq
|
||||
|
||||
@@ -9,6 +9,7 @@
|
||||
import javascript
|
||||
|
||||
from Function f
|
||||
where exists(f.getABodyStmt()) and
|
||||
not exists (ReturnStmt r | r.getContainer() = f)
|
||||
where
|
||||
exists(f.getABodyStmt()) and
|
||||
not exists(ReturnStmt r | r.getContainer() = f)
|
||||
select f
|
||||
@@ -9,6 +9,7 @@
|
||||
import javascript
|
||||
|
||||
from MethodCallExpr c
|
||||
where c.getReceiver() instanceof ThisExpr and
|
||||
c.getMethodName() = "isMounted"
|
||||
where
|
||||
c.getReceiver() instanceof ThisExpr and
|
||||
c.getMethodName() = "isMounted"
|
||||
select c
|
||||
|
||||
Reference in New Issue
Block a user