add more attributes potentially vulnerable to xss-through-dom

2026-04-26 09:15:12 +02:00 · 2020-04-20 11:48:33 +02:00
parent 12f4ce8111
commit 73b0aa4004
1 changed files with 2 additions and 1 deletions
--- a/javascript/ql/src/semmle/javascript/security/dataflow/XssThroughDom.qll
+++ b/javascript/ql/src/semmle/javascript/security/dataflow/XssThroughDom.qll
@@ -44,7 +44,8 @@ module XssThroughDom {
  bindingset[result]
  string unsafeAttributeName() {
    result.regexpMatch("data-.*") or
-    result = ["name", "value"]
+    result.regexpMatch("aria-.*") or
+    result = ["name", "value", "title", "alt"]
  }

  /**