hohn/codeql
1
0
Fork 0
mirror of https://github.com/github/codeql.git synced 2026-04-30 03:05:15 +02:00
Code Issues Packages Projects Releases Wiki Activity

autoformat

Browse Source
This commit is contained in:
Erik Krogh Kristensen
2019-12-16 13:33:49 +01:00
parent 3ca3fa7e9e
commit 7c931452d9
3 changed files with 212 additions and 212 deletions
Download Patch File Download Diff File Expand all files Collapse all files

2
javascript/ql/src/semmle/javascript/security/dataflow/ExceptionXss.qll
View File

@@ -72,7 +72,7 @@ module ExceptionXss {
exists(DataFlow::CallNode call | call.getLastArgument().getAFunctionValue() = this) and
this.getNumParameter() = 2 and
errorParameter = this.getParameter(0) and
exists(IfStmt ifStmt |
exists(IfStmt ifStmt |
ifStmt = this.getFunction().getBodyStmt(0) and
errorParameter.flowsToExpr(ifStmt.getCondition())
)

268
javascript/ql/test/query-tests/Security/CWE-079/ExceptionXss.expected
View File

@@ -1,93 +1,93 @@
nodes
| exception-xss.js:2:9:2:31 | foo |
| exception-xss.js:2:15:2:31 | document.location |
| exception-xss.js:2:15:2:31 | document.location |
| exception-xss.js:2:6:2:28 | foo |
| exception-xss.js:2:12:2:28 | document.location |
| exception-xss.js:2:12:2:28 | document.location |
| exception-xss.js:9:11:9:13 | foo |
| exception-xss.js:10:10:10:10 | e |
| exception-xss.js:10:11:10:11 | e |
| exception-xss.js:11:18:11:18 | e |
| exception-xss.js:11:18:11:18 | e |
| exception-xss.js:15:3:15:12 | exceptional return of inner(foo) |
| exception-xss.js:15:9:15:11 | foo |
| exception-xss.js:16:10:16:10 | e |
| exception-xss.js:16:11:16:11 | e |
| exception-xss.js:17:18:17:18 | e |
| exception-xss.js:17:18:17:18 | e |
| exception-xss.js:21:11:21:13 | foo |
| exception-xss.js:21:11:21:21 | foo + "bar" |
| exception-xss.js:22:10:22:10 | e |
| exception-xss.js:22:11:22:11 | e |
| exception-xss.js:23:18:23:18 | e |
| exception-xss.js:23:18:23:18 | e |
| exception-xss.js:33:11:33:22 | ["bar", foo] |
| exception-xss.js:33:19:33:21 | foo |
| exception-xss.js:34:10:34:10 | e |
| exception-xss.js:34:11:34:11 | e |
| exception-xss.js:35:18:35:18 | e |
| exception-xss.js:35:18:35:18 | e |
| exception-xss.js:46:3:46:19 | exceptional return of deep("bar" + foo) |
| exception-xss.js:46:8:46:18 | "bar" + foo |
| exception-xss.js:46:16:46:18 | foo |
| exception-xss.js:47:10:47:10 | e |
| exception-xss.js:47:11:47:11 | e |
| exception-xss.js:48:18:48:18 | e |
| exception-xss.js:48:18:48:18 | e |
| exception-xss.js:81:3:81:19 | exceptional return of myWeirdInner(foo) |
| exception-xss.js:81:16:81:18 | foo |
| exception-xss.js:82:10:82:10 | e |
| exception-xss.js:82:11:82:11 | e |
| exception-xss.js:83:18:83:18 | e |
| exception-xss.js:83:18:83:18 | e |
| exception-xss.js:89:11:89:13 | foo |
| exception-xss.js:89:11:89:26 | foo.match(/foo/) |
| exception-xss.js:90:10:90:10 | e |
| exception-xss.js:90:11:90:11 | e |
| exception-xss.js:91:18:91:18 | e |
| exception-xss.js:91:18:91:18 | e |
| exception-xss.js:95:11:95:22 | [foo, "bar"] |
| exception-xss.js:95:12:95:14 | foo |
| exception-xss.js:96:10:96:10 | e |
| exception-xss.js:96:11:96:11 | e |
| exception-xss.js:97:18:97:18 | e |
| exception-xss.js:97:18:97:18 | e |
| exception-xss.js:102:12:102:14 | foo |
| exception-xss.js:106:10:106:10 | e |
| exception-xss.js:106:11:106:11 | e |
| exception-xss.js:107:18:107:18 | e |
| exception-xss.js:107:18:107:18 | e |
| exception-xss.js:117:13:117:25 | req.params.id |
| exception-xss.js:117:13:117:25 | req.params.id |
| exception-xss.js:117:11:117:23 | req.params.id |
| exception-xss.js:117:11:117:23 | req.params.id |
| exception-xss.js:118:11:118:11 | e |
| exception-xss.js:119:14:119:30 | "Exception: " + e |
| exception-xss.js:119:14:119:30 | "Exception: " + e |
| exception-xss.js:119:30:119:30 | e |
| exception-xss.js:125:48:125:64 | document.location |
| exception-xss.js:125:48:125:64 | document.location |
| exception-xss.js:125:48:125:71 | documen ... .search |
| exception-xss.js:119:12:119:28 | "Exception: " + e |
| exception-xss.js:119:12:119:28 | "Exception: " + e |
| exception-xss.js:119:28:119:28 | e |
| exception-xss.js:125:45:125:61 | document.location |
| exception-xss.js:125:45:125:61 | document.location |
| exception-xss.js:125:45:125:68 | documen ... .search |
| exception-xss.js:128:11:128:52 | session ... ssion') |
| exception-xss.js:129:10:129:10 | e |
| exception-xss.js:129:11:129:11 | e |
| exception-xss.js:130:18:130:18 | e |
| exception-xss.js:130:18:130:18 | e |
| exception-xss.js:136:11:136:23 | req.params.id |
| exception-xss.js:136:11:136:23 | req.params.id |
| exception-xss.js:136:27:136:31 | error |
| exception-xss.js:136:10:136:22 | req.params.id |
| exception-xss.js:136:10:136:22 | req.params.id |
| exception-xss.js:136:26:136:30 | error |
| exception-xss.js:138:19:138:23 | error |
| exception-xss.js:138:19:138:23 | error |
| exception-xss.js:146:9:146:38 | foo |
| exception-xss.js:146:15:146:31 | document.location |
| exception-xss.js:146:15:146:31 | document.location |
| exception-xss.js:146:15:146:38 | documen ... .search |
| exception-xss.js:146:6:146:35 | foo |
| exception-xss.js:146:12:146:28 | document.location |
| exception-xss.js:146:12:146:28 | document.location |
| exception-xss.js:146:12:146:35 | documen ... .search |
| exception-xss.js:148:33:148:35 | foo |
| exception-xss.js:148:55:148:55 | e |
| exception-xss.js:149:22:149:22 | e |
| exception-xss.js:149:22:149:22 | e |
| exception-xss.js:153:9:153:11 | foo |
| exception-xss.js:154:13:154:13 | e |
| exception-xss.js:155:19:155:19 | e |
| exception-xss.js:155:19:155:19 | e |
| exception-xss.js:159:14:159:16 | foo |
| exception-xss.js:160:13:160:13 | e |
| exception-xss.js:161:19:161:19 | e |
| exception-xss.js:161:19:161:19 | e |
| exception-xss.js:149:18:149:18 | e |
| exception-xss.js:149:18:149:18 | e |
| exception-xss.js:153:8:153:10 | foo |
| exception-xss.js:154:11:154:11 | e |
| exception-xss.js:155:18:155:18 | e |
| exception-xss.js:155:18:155:18 | e |
| exception-xss.js:159:13:159:15 | foo |
| exception-xss.js:160:11:160:11 | e |
| exception-xss.js:161:18:161:18 | e |
| exception-xss.js:161:18:161:18 | e |
| exception-xss.js:174:25:174:43 | exceptional return of inner(foo, resolve) |
| exception-xss.js:174:31:174:33 | foo |
| exception-xss.js:174:53:174:53 | e |
| exception-xss.js:175:22:175:22 | e |
| exception-xss.js:175:22:175:22 | e |
| exception-xss.js:180:11:180:23 | req.params.id |
| exception-xss.js:180:11:180:23 | req.params.id |
| exception-xss.js:180:27:180:31 | error |
| exception-xss.js:175:18:175:18 | e |
| exception-xss.js:175:18:175:18 | e |
| exception-xss.js:180:10:180:22 | req.params.id |
| exception-xss.js:180:10:180:22 | req.params.id |
| exception-xss.js:180:26:180:30 | error |
| exception-xss.js:182:19:182:23 | error |
| exception-xss.js:182:19:182:23 | error |
| tst.js:304:9:304:16 | location |
@@ -101,91 +101,91 @@ nodes
| tst.js:314:20:314:20 | e |
| tst.js:314:20:314:20 | e |
edges
| exception-xss.js:2:9:2:31 | foo | exception-xss.js:9:11:9:13 | foo |
| exception-xss.js:2:9:2:31 | foo | exception-xss.js:15:9:15:11 | foo |
| exception-xss.js:2:9:2:31 | foo | exception-xss.js:21:11:21:13 | foo |
| exception-xss.js:2:9:2:31 | foo | exception-xss.js:33:19:33:21 | foo |
| exception-xss.js:2:9:2:31 | foo | exception-xss.js:46:16:46:18 | foo |
| exception-xss.js:2:9:2:31 | foo | exception-xss.js:81:16:81:18 | foo |
| exception-xss.js:2:9:2:31 | foo | exception-xss.js:89:11:89:13 | foo |
| exception-xss.js:2:9:2:31 | foo | exception-xss.js:95:12:95:14 | foo |
| exception-xss.js:2:9:2:31 | foo | exception-xss.js:102:12:102:14 | foo |
| exception-xss.js:2:15:2:31 | document.location | exception-xss.js:2:9:2:31 | foo |
| exception-xss.js:2:15:2:31 | document.location | exception-xss.js:2:9:2:31 | foo |
| exception-xss.js:9:11:9:13 | foo | exception-xss.js:10:10:10:10 | e |
| exception-xss.js:10:10:10:10 | e | exception-xss.js:11:18:11:18 | e |
| exception-xss.js:10:10:10:10 | e | exception-xss.js:11:18:11:18 | e |
| exception-xss.js:15:3:15:12 | exceptional return of inner(foo) | exception-xss.js:16:10:16:10 | e |
| exception-xss.js:2:6:2:28 | foo | exception-xss.js:9:11:9:13 | foo |
| exception-xss.js:2:6:2:28 | foo | exception-xss.js:15:9:15:11 | foo |
| exception-xss.js:2:6:2:28 | foo | exception-xss.js:21:11:21:13 | foo |
| exception-xss.js:2:6:2:28 | foo | exception-xss.js:33:19:33:21 | foo |
| exception-xss.js:2:6:2:28 | foo | exception-xss.js:46:16:46:18 | foo |
| exception-xss.js:2:6:2:28 | foo | exception-xss.js:81:16:81:18 | foo |
| exception-xss.js:2:6:2:28 | foo | exception-xss.js:89:11:89:13 | foo |
| exception-xss.js:2:6:2:28 | foo | exception-xss.js:95:12:95:14 | foo |
| exception-xss.js:2:6:2:28 | foo | exception-xss.js:102:12:102:14 | foo |
| exception-xss.js:2:12:2:28 | document.location | exception-xss.js:2:6:2:28 | foo |
| exception-xss.js:2:12:2:28 | document.location | exception-xss.js:2:6:2:28 | foo |
| exception-xss.js:9:11:9:13 | foo | exception-xss.js:10:11:10:11 | e |
| exception-xss.js:10:11:10:11 | e | exception-xss.js:11:18:11:18 | e |
| exception-xss.js:10:11:10:11 | e | exception-xss.js:11:18:11:18 | e |
| exception-xss.js:15:3:15:12 | exceptional return of inner(foo) | exception-xss.js:16:11:16:11 | e |
| exception-xss.js:15:9:15:11 | foo | exception-xss.js:15:3:15:12 | exceptional return of inner(foo) |
| exception-xss.js:16:10:16:10 | e | exception-xss.js:17:18:17:18 | e |
| exception-xss.js:16:10:16:10 | e | exception-xss.js:17:18:17:18 | e |
| exception-xss.js:16:11:16:11 | e | exception-xss.js:17:18:17:18 | e |
| exception-xss.js:16:11:16:11 | e | exception-xss.js:17:18:17:18 | e |
| exception-xss.js:21:11:21:13 | foo | exception-xss.js:21:11:21:21 | foo + "bar" |
| exception-xss.js:21:11:21:21 | foo + "bar" | exception-xss.js:22:10:22:10 | e |
| exception-xss.js:22:10:22:10 | e | exception-xss.js:23:18:23:18 | e |
| exception-xss.js:22:10:22:10 | e | exception-xss.js:23:18:23:18 | e |
| exception-xss.js:33:11:33:22 | ["bar", foo] | exception-xss.js:34:10:34:10 | e |
| exception-xss.js:21:11:21:21 | foo + "bar" | exception-xss.js:22:11:22:11 | e |
| exception-xss.js:22:11:22:11 | e | exception-xss.js:23:18:23:18 | e |
| exception-xss.js:22:11:22:11 | e | exception-xss.js:23:18:23:18 | e |
| exception-xss.js:33:11:33:22 | ["bar", foo] | exception-xss.js:34:11:34:11 | e |
| exception-xss.js:33:19:33:21 | foo | exception-xss.js:33:11:33:22 | ["bar", foo] |
| exception-xss.js:34:10:34:10 | e | exception-xss.js:35:18:35:18 | e |
| exception-xss.js:34:10:34:10 | e | exception-xss.js:35:18:35:18 | e |
| exception-xss.js:46:3:46:19 | exceptional return of deep("bar" + foo) | exception-xss.js:47:10:47:10 | e |
| exception-xss.js:34:11:34:11 | e | exception-xss.js:35:18:35:18 | e |
| exception-xss.js:34:11:34:11 | e | exception-xss.js:35:18:35:18 | e |
| exception-xss.js:46:3:46:19 | exceptional return of deep("bar" + foo) | exception-xss.js:47:11:47:11 | e |
| exception-xss.js:46:8:46:18 | "bar" + foo | exception-xss.js:46:3:46:19 | exceptional return of deep("bar" + foo) |
| exception-xss.js:46:16:46:18 | foo | exception-xss.js:46:8:46:18 | "bar" + foo |
| exception-xss.js:47:10:47:10 | e | exception-xss.js:48:18:48:18 | e |
| exception-xss.js:47:10:47:10 | e | exception-xss.js:48:18:48:18 | e |
| exception-xss.js:81:3:81:19 | exceptional return of myWeirdInner(foo) | exception-xss.js:82:10:82:10 | e |
| exception-xss.js:47:11:47:11 | e | exception-xss.js:48:18:48:18 | e |
| exception-xss.js:47:11:47:11 | e | exception-xss.js:48:18:48:18 | e |
| exception-xss.js:81:3:81:19 | exceptional return of myWeirdInner(foo) | exception-xss.js:82:11:82:11 | e |
| exception-xss.js:81:16:81:18 | foo | exception-xss.js:81:3:81:19 | exceptional return of myWeirdInner(foo) |
| exception-xss.js:82:10:82:10 | e | exception-xss.js:83:18:83:18 | e |
| exception-xss.js:82:10:82:10 | e | exception-xss.js:83:18:83:18 | e |
| exception-xss.js:82:11:82:11 | e | exception-xss.js:83:18:83:18 | e |
| exception-xss.js:82:11:82:11 | e | exception-xss.js:83:18:83:18 | e |
| exception-xss.js:89:11:89:13 | foo | exception-xss.js:89:11:89:26 | foo.match(/foo/) |
| exception-xss.js:89:11:89:26 | foo.match(/foo/) | exception-xss.js:90:10:90:10 | e |
| exception-xss.js:90:10:90:10 | e | exception-xss.js:91:18:91:18 | e |
| exception-xss.js:90:10:90:10 | e | exception-xss.js:91:18:91:18 | e |
| exception-xss.js:95:11:95:22 | [foo, "bar"] | exception-xss.js:96:10:96:10 | e |
| exception-xss.js:89:11:89:26 | foo.match(/foo/) | exception-xss.js:90:11:90:11 | e |
| exception-xss.js:90:11:90:11 | e | exception-xss.js:91:18:91:18 | e |
| exception-xss.js:90:11:90:11 | e | exception-xss.js:91:18:91:18 | e |
| exception-xss.js:95:11:95:22 | [foo, "bar"] | exception-xss.js:96:11:96:11 | e |
| exception-xss.js:95:12:95:14 | foo | exception-xss.js:95:11:95:22 | [foo, "bar"] |
| exception-xss.js:96:10:96:10 | e | exception-xss.js:97:18:97:18 | e |
| exception-xss.js:96:10:96:10 | e | exception-xss.js:97:18:97:18 | e |
| exception-xss.js:102:12:102:14 | foo | exception-xss.js:106:10:106:10 | e |
| exception-xss.js:106:10:106:10 | e | exception-xss.js:107:18:107:18 | e |
| exception-xss.js:106:10:106:10 | e | exception-xss.js:107:18:107:18 | e |
| exception-xss.js:117:13:117:25 | req.params.id | exception-xss.js:118:11:118:11 | e |
| exception-xss.js:117:13:117:25 | req.params.id | exception-xss.js:118:11:118:11 | e |
| exception-xss.js:118:11:118:11 | e | exception-xss.js:119:30:119:30 | e |
| exception-xss.js:119:30:119:30 | e | exception-xss.js:119:14:119:30 | "Exception: " + e |
| exception-xss.js:119:30:119:30 | e | exception-xss.js:119:14:119:30 | "Exception: " + e |
| exception-xss.js:125:48:125:64 | document.location | exception-xss.js:125:48:125:71 | documen ... .search |
| exception-xss.js:125:48:125:64 | document.location | exception-xss.js:125:48:125:71 | documen ... .search |
| exception-xss.js:125:48:125:71 | documen ... .search | exception-xss.js:128:11:128:52 | session ... ssion') |
| exception-xss.js:128:11:128:52 | session ... ssion') | exception-xss.js:129:10:129:10 | e |
| exception-xss.js:129:10:129:10 | e | exception-xss.js:130:18:130:18 | e |
| exception-xss.js:129:10:129:10 | e | exception-xss.js:130:18:130:18 | e |
| exception-xss.js:136:11:136:23 | req.params.id | exception-xss.js:136:27:136:31 | error |
| exception-xss.js:136:11:136:23 | req.params.id | exception-xss.js:136:27:136:31 | error |
| exception-xss.js:136:27:136:31 | error | exception-xss.js:138:19:138:23 | error |
| exception-xss.js:136:27:136:31 | error | exception-xss.js:138:19:138:23 | error |
| exception-xss.js:146:9:146:38 | foo | exception-xss.js:148:33:148:35 | foo |
| exception-xss.js:146:9:146:38 | foo | exception-xss.js:153:9:153:11 | foo |
| exception-xss.js:146:9:146:38 | foo | exception-xss.js:159:14:159:16 | foo |
| exception-xss.js:146:9:146:38 | foo | exception-xss.js:174:31:174:33 | foo |
| exception-xss.js:146:15:146:31 | document.location | exception-xss.js:146:15:146:38 | documen ... .search |
| exception-xss.js:146:15:146:31 | document.location | exception-xss.js:146:15:146:38 | documen ... .search |
| exception-xss.js:146:15:146:38 | documen ... .search | exception-xss.js:146:9:146:38 | foo |
| exception-xss.js:96:11:96:11 | e | exception-xss.js:97:18:97:18 | e |
| exception-xss.js:96:11:96:11 | e | exception-xss.js:97:18:97:18 | e |
| exception-xss.js:102:12:102:14 | foo | exception-xss.js:106:11:106:11 | e |
| exception-xss.js:106:11:106:11 | e | exception-xss.js:107:18:107:18 | e |
| exception-xss.js:106:11:106:11 | e | exception-xss.js:107:18:107:18 | e |
| exception-xss.js:117:11:117:23 | req.params.id | exception-xss.js:118:11:118:11 | e |
| exception-xss.js:117:11:117:23 | req.params.id | exception-xss.js:118:11:118:11 | e |
| exception-xss.js:118:11:118:11 | e | exception-xss.js:119:28:119:28 | e |
| exception-xss.js:119:28:119:28 | e | exception-xss.js:119:12:119:28 | "Exception: " + e |
| exception-xss.js:119:28:119:28 | e | exception-xss.js:119:12:119:28 | "Exception: " + e |
| exception-xss.js:125:45:125:61 | document.location | exception-xss.js:125:45:125:68 | documen ... .search |
| exception-xss.js:125:45:125:61 | document.location | exception-xss.js:125:45:125:68 | documen ... .search |
| exception-xss.js:125:45:125:68 | documen ... .search | exception-xss.js:128:11:128:52 | session ... ssion') |
| exception-xss.js:128:11:128:52 | session ... ssion') | exception-xss.js:129:11:129:11 | e |
| exception-xss.js:129:11:129:11 | e | exception-xss.js:130:18:130:18 | e |
| exception-xss.js:129:11:129:11 | e | exception-xss.js:130:18:130:18 | e |
| exception-xss.js:136:10:136:22 | req.params.id | exception-xss.js:136:26:136:30 | error |
| exception-xss.js:136:10:136:22 | req.params.id | exception-xss.js:136:26:136:30 | error |
| exception-xss.js:136:26:136:30 | error | exception-xss.js:138:19:138:23 | error |
| exception-xss.js:136:26:136:30 | error | exception-xss.js:138:19:138:23 | error |
| exception-xss.js:146:6:146:35 | foo | exception-xss.js:148:33:148:35 | foo |
| exception-xss.js:146:6:146:35 | foo | exception-xss.js:153:8:153:10 | foo |
| exception-xss.js:146:6:146:35 | foo | exception-xss.js:159:13:159:15 | foo |
| exception-xss.js:146:6:146:35 | foo | exception-xss.js:174:31:174:33 | foo |
| exception-xss.js:146:12:146:28 | document.location | exception-xss.js:146:12:146:35 | documen ... .search |
| exception-xss.js:146:12:146:28 | document.location | exception-xss.js:146:12:146:35 | documen ... .search |
| exception-xss.js:146:12:146:35 | documen ... .search | exception-xss.js:146:6:146:35 | foo |
| exception-xss.js:148:33:148:35 | foo | exception-xss.js:148:55:148:55 | e |
| exception-xss.js:148:55:148:55 | e | exception-xss.js:149:22:149:22 | e |
| exception-xss.js:148:55:148:55 | e | exception-xss.js:149:22:149:22 | e |
| exception-xss.js:153:9:153:11 | foo | exception-xss.js:154:13:154:13 | e |
| exception-xss.js:154:13:154:13 | e | exception-xss.js:155:19:155:19 | e |
| exception-xss.js:154:13:154:13 | e | exception-xss.js:155:19:155:19 | e |
| exception-xss.js:159:14:159:16 | foo | exception-xss.js:160:13:160:13 | e |
| exception-xss.js:160:13:160:13 | e | exception-xss.js:161:19:161:19 | e |
| exception-xss.js:160:13:160:13 | e | exception-xss.js:161:19:161:19 | e |
| exception-xss.js:148:55:148:55 | e | exception-xss.js:149:18:149:18 | e |
| exception-xss.js:148:55:148:55 | e | exception-xss.js:149:18:149:18 | e |
| exception-xss.js:153:8:153:10 | foo | exception-xss.js:154:11:154:11 | e |
| exception-xss.js:154:11:154:11 | e | exception-xss.js:155:18:155:18 | e |
| exception-xss.js:154:11:154:11 | e | exception-xss.js:155:18:155:18 | e |
| exception-xss.js:159:13:159:15 | foo | exception-xss.js:160:11:160:11 | e |
| exception-xss.js:160:11:160:11 | e | exception-xss.js:161:18:161:18 | e |
| exception-xss.js:160:11:160:11 | e | exception-xss.js:161:18:161:18 | e |
| exception-xss.js:174:25:174:43 | exceptional return of inner(foo, resolve) | exception-xss.js:174:53:174:53 | e |
| exception-xss.js:174:31:174:33 | foo | exception-xss.js:174:25:174:43 | exceptional return of inner(foo, resolve) |
| exception-xss.js:174:53:174:53 | e | exception-xss.js:175:22:175:22 | e |
| exception-xss.js:174:53:174:53 | e | exception-xss.js:175:22:175:22 | e |
| exception-xss.js:180:11:180:23 | req.params.id | exception-xss.js:180:27:180:31 | error |
| exception-xss.js:180:11:180:23 | req.params.id | exception-xss.js:180:27:180:31 | error |
| exception-xss.js:180:27:180:31 | error | exception-xss.js:182:19:182:23 | error |
| exception-xss.js:180:27:180:31 | error | exception-xss.js:182:19:182:23 | error |
| exception-xss.js:174:53:174:53 | e | exception-xss.js:175:18:175:18 | e |
| exception-xss.js:174:53:174:53 | e | exception-xss.js:175:18:175:18 | e |
| exception-xss.js:180:10:180:22 | req.params.id | exception-xss.js:180:26:180:30 | error |
| exception-xss.js:180:10:180:22 | req.params.id | exception-xss.js:180:26:180:30 | error |
| exception-xss.js:180:26:180:30 | error | exception-xss.js:182:19:182:23 | error |
| exception-xss.js:180:26:180:30 | error | exception-xss.js:182:19:182:23 | error |
| tst.js:304:9:304:16 | location | tst.js:305:10:305:10 | e |
| tst.js:304:9:304:16 | location | tst.js:305:10:305:10 | e |
| tst.js:305:10:305:10 | e | tst.js:306:20:306:20 | e |
@@ -195,22 +195,22 @@ edges
| tst.js:313:10:313:10 | e | tst.js:314:20:314:20 | e |
| tst.js:313:10:313:10 | e | tst.js:314:20:314:20 | e |
#select
| exception-xss.js:11:18:11:18 | e | exception-xss.js:2:15:2:31 | document.location | exception-xss.js:11:18:11:18 | e | Cross-site scripting vulnerability due to $@. | exception-xss.js:2:15:2:31 | document.location | user-provided value |
| exception-xss.js:17:18:17:18 | e | exception-xss.js:2:15:2:31 | document.location | exception-xss.js:17:18:17:18 | e | Cross-site scripting vulnerability due to $@. | exception-xss.js:2:15:2:31 | document.location | user-provided value |
| exception-xss.js:23:18:23:18 | e | exception-xss.js:2:15:2:31 | document.location | exception-xss.js:23:18:23:18 | e | Cross-site scripting vulnerability due to $@. | exception-xss.js:2:15:2:31 | document.location | user-provided value |
| exception-xss.js:35:18:35:18 | e | exception-xss.js:2:15:2:31 | document.location | exception-xss.js:35:18:35:18 | e | Cross-site scripting vulnerability due to $@. | exception-xss.js:2:15:2:31 | document.location | user-provided value |
| exception-xss.js:48:18:48:18 | e | exception-xss.js:2:15:2:31 | document.location | exception-xss.js:48:18:48:18 | e | Cross-site scripting vulnerability due to $@. | exception-xss.js:2:15:2:31 | document.location | user-provided value |
| exception-xss.js:83:18:83:18 | e | exception-xss.js:2:15:2:31 | document.location | exception-xss.js:83:18:83:18 | e | Cross-site scripting vulnerability due to $@. | exception-xss.js:2:15:2:31 | document.location | user-provided value |
| exception-xss.js:91:18:91:18 | e | exception-xss.js:2:15:2:31 | document.location | exception-xss.js:91:18:91:18 | e | Cross-site scripting vulnerability due to $@. | exception-xss.js:2:15:2:31 | document.location | user-provided value |
| exception-xss.js:97:18:97:18 | e | exception-xss.js:2:15:2:31 | document.location | exception-xss.js:97:18:97:18 | e | Cross-site scripting vulnerability due to $@. | exception-xss.js:2:15:2:31 | document.location | user-provided value |
| exception-xss.js:107:18:107:18 | e | exception-xss.js:2:15:2:31 | document.location | exception-xss.js:107:18:107:18 | e | Cross-site scripting vulnerability due to $@. | exception-xss.js:2:15:2:31 | document.location | user-provided value |
| exception-xss.js:119:14:119:30 | "Exception: " + e | exception-xss.js:117:13:117:25 | req.params.id | exception-xss.js:119:14:119:30 | "Exception: " + e | Cross-site scripting vulnerability due to $@. | exception-xss.js:117:13:117:25 | req.params.id | user-provided value |
| exception-xss.js:130:18:130:18 | e | exception-xss.js:125:48:125:64 | document.location | exception-xss.js:130:18:130:18 | e | Cross-site scripting vulnerability due to $@. | exception-xss.js:125:48:125:64 | document.location | user-provided value |
| exception-xss.js:138:19:138:23 | error | exception-xss.js:136:11:136:23 | req.params.id | exception-xss.js:138:19:138:23 | error | Cross-site scripting vulnerability due to $@. | exception-xss.js:136:11:136:23 | req.params.id | user-provided value |
| exception-xss.js:149:22:149:22 | e | exception-xss.js:146:15:146:31 | document.location | exception-xss.js:149:22:149:22 | e | Cross-site scripting vulnerability due to $@. | exception-xss.js:146:15:146:31 | document.location | user-provided value |
| exception-xss.js:155:19:155:19 | e | exception-xss.js:146:15:146:31 | document.location | exception-xss.js:155:19:155:19 | e | Cross-site scripting vulnerability due to $@. | exception-xss.js:146:15:146:31 | document.location | user-provided value |
| exception-xss.js:161:19:161:19 | e | exception-xss.js:146:15:146:31 | document.location | exception-xss.js:161:19:161:19 | e | Cross-site scripting vulnerability due to $@. | exception-xss.js:146:15:146:31 | document.location | user-provided value |
| exception-xss.js:175:22:175:22 | e | exception-xss.js:146:15:146:31 | document.location | exception-xss.js:175:22:175:22 | e | Cross-site scripting vulnerability due to $@. | exception-xss.js:146:15:146:31 | document.location | user-provided value |
| exception-xss.js:182:19:182:23 | error | exception-xss.js:180:11:180:23 | req.params.id | exception-xss.js:182:19:182:23 | error | Cross-site scripting vulnerability due to $@. | exception-xss.js:180:11:180:23 | req.params.id | user-provided value |
| exception-xss.js:11:18:11:18 | e | exception-xss.js:2:12:2:28 | document.location | exception-xss.js:11:18:11:18 | e | Cross-site scripting vulnerability due to $@. | exception-xss.js:2:12:2:28 | document.location | user-provided value |
| exception-xss.js:17:18:17:18 | e | exception-xss.js:2:12:2:28 | document.location | exception-xss.js:17:18:17:18 | e | Cross-site scripting vulnerability due to $@. | exception-xss.js:2:12:2:28 | document.location | user-provided value |
| exception-xss.js:23:18:23:18 | e | exception-xss.js:2:12:2:28 | document.location | exception-xss.js:23:18:23:18 | e | Cross-site scripting vulnerability due to $@. | exception-xss.js:2:12:2:28 | document.location | user-provided value |
| exception-xss.js:35:18:35:18 | e | exception-xss.js:2:12:2:28 | document.location | exception-xss.js:35:18:35:18 | e | Cross-site scripting vulnerability due to $@. | exception-xss.js:2:12:2:28 | document.location | user-provided value |
| exception-xss.js:48:18:48:18 | e | exception-xss.js:2:12:2:28 | document.location | exception-xss.js:48:18:48:18 | e | Cross-site scripting vulnerability due to $@. | exception-xss.js:2:12:2:28 | document.location | user-provided value |
| exception-xss.js:83:18:83:18 | e | exception-xss.js:2:12:2:28 | document.location | exception-xss.js:83:18:83:18 | e | Cross-site scripting vulnerability due to $@. | exception-xss.js:2:12:2:28 | document.location | user-provided value |
| exception-xss.js:91:18:91:18 | e | exception-xss.js:2:12:2:28 | document.location | exception-xss.js:91:18:91:18 | e | Cross-site scripting vulnerability due to $@. | exception-xss.js:2:12:2:28 | document.location | user-provided value |
| exception-xss.js:97:18:97:18 | e | exception-xss.js:2:12:2:28 | document.location | exception-xss.js:97:18:97:18 | e | Cross-site scripting vulnerability due to $@. | exception-xss.js:2:12:2:28 | document.location | user-provided value |
| exception-xss.js:107:18:107:18 | e | exception-xss.js:2:12:2:28 | document.location | exception-xss.js:107:18:107:18 | e | Cross-site scripting vulnerability due to $@. | exception-xss.js:2:12:2:28 | document.location | user-provided value |
| exception-xss.js:119:12:119:28 | "Exception: " + e | exception-xss.js:117:11:117:23 | req.params.id | exception-xss.js:119:12:119:28 | "Exception: " + e | Cross-site scripting vulnerability due to $@. | exception-xss.js:117:11:117:23 | req.params.id | user-provided value |
| exception-xss.js:130:18:130:18 | e | exception-xss.js:125:45:125:61 | document.location | exception-xss.js:130:18:130:18 | e | Cross-site scripting vulnerability due to $@. | exception-xss.js:125:45:125:61 | document.location | user-provided value |
| exception-xss.js:138:19:138:23 | error | exception-xss.js:136:10:136:22 | req.params.id | exception-xss.js:138:19:138:23 | error | Cross-site scripting vulnerability due to $@. | exception-xss.js:136:10:136:22 | req.params.id | user-provided value |
| exception-xss.js:149:18:149:18 | e | exception-xss.js:146:12:146:28 | document.location | exception-xss.js:149:18:149:18 | e | Cross-site scripting vulnerability due to $@. | exception-xss.js:146:12:146:28 | document.location | user-provided value |
| exception-xss.js:155:18:155:18 | e | exception-xss.js:146:12:146:28 | document.location | exception-xss.js:155:18:155:18 | e | Cross-site scripting vulnerability due to $@. | exception-xss.js:146:12:146:28 | document.location | user-provided value |
| exception-xss.js:161:18:161:18 | e | exception-xss.js:146:12:146:28 | document.location | exception-xss.js:161:18:161:18 | e | Cross-site scripting vulnerability due to $@. | exception-xss.js:146:12:146:28 | document.location | user-provided value |
| exception-xss.js:175:18:175:18 | e | exception-xss.js:146:12:146:28 | document.location | exception-xss.js:175:18:175:18 | e | Cross-site scripting vulnerability due to $@. | exception-xss.js:146:12:146:28 | document.location | user-provided value |
| exception-xss.js:182:19:182:23 | error | exception-xss.js:180:10:180:22 | req.params.id | exception-xss.js:182:19:182:23 | error | Cross-site scripting vulnerability due to $@. | exception-xss.js:180:10:180:22 | req.params.id | user-provided value |
| tst.js:306:20:306:20 | e | tst.js:304:9:304:16 | location | tst.js:306:20:306:20 | e | Cross-site scripting vulnerability due to $@. | tst.js:304:9:304:16 | location | user-provided value |
| tst.js:314:20:314:20 | e | tst.js:311:10:311:17 | location | tst.js:314:20:314:20 | e | Cross-site scripting vulnerability due to $@. | tst.js:311:10:311:17 | location | user-provided value |

154
javascript/ql/test/query-tests/Security/CWE-079/exception-xss.js
View File

@@ -1,99 +1,99 @@
(function() {
var foo = document.location;
function inner(x) {
unknown(x);
(function () {
var foo = document.location;
function inner(x) {
unknown(x);
}
try {
unknown(foo);
} catch(e) {
} catch (e) {
$('myId').html(e); // NOT OK!
}
try {
inner(foo);
} catch(e) {
} catch (e) {
$('myId').html(e); // NOT OK!
}
try {
unknown(foo + "bar");
} catch(e) {
} catch (e) {
$('myId').html(e); // NOT OK!
}
try {
unknown({prop: foo});
} catch(e) {
unknown({ prop: foo });
} catch (e) {
$('myId').html(e); // NOT OK!
}
try {
unknown(["bar", foo]);
} catch(e) {
} catch (e) {
$('myId').html(e); // NOT OK!
}
function deep(x) {
deep2(x);
}
function deep2(x) {
inner(x);
}
try {
deep("bar" + foo);
} catch(e) {
} catch (e) {
$('myId').html(e); // NOT OK!
}
try {
var tmp = "bar" + foo;
} catch(e) {
} catch (e) {
$('myId').html(e); // OK
}
function safe(x) {
var foo = x + "bar";
}
try {
safe(foo);
} catch(e) {
} catch (e) {
$('myId').html(e); // OK
}
try {
safe.call(null, foo);
} catch(e) {
} catch (e) {
$('myId').html(e); // OK
}
var myWeirdInner;
try {
myWeirdInner = function (x) {
inner(x);
}
} catch(e) {
}
} catch (e) {
$('myId').html(e); // OK
}
try {
myWeirdInner(foo);
} catch(e) {
} catch (e) {
$('myId').html(e); // NOT OK!
}
$('myId').html(foo); // Direct leak, reported by other query.
try {
unknown(foo.match(/foo/));
} catch(e) {
} catch (e) {
$('myId').html(e); // NOT OK!
}
try {
unknown([foo, "bar"]);
} catch(e) {
} catch (e) {
$('myId').html(e); // NOT OK!
}
@@ -103,7 +103,7 @@
} finally {
// nothing
}
} catch(e) {
} catch (e) {
$('myId').html(e); // NOT OK!
}
});
@@ -112,75 +112,75 @@ var express = require('express');
var app = express();
app.get('/user/:id', function(req, res) {
try {
unknown(req.params.id);
} catch(e) {
res.send("Exception: " + e); // NOT OK!
}
app.get('/user/:id', function (req, res) {
try {
unknown(req.params.id);
} catch (e) {
res.send("Exception: " + e); // NOT OK!
}
});
(function () {
sessionStorage.setItem('exceptionSession', document.location.search);
sessionStorage.setItem('exceptionSession', document.location.search);
try {
unknown(sessionStorage.getItem('exceptionSession'));
} catch(e) {
} catch (e) {
$('myId').html(e); // NOT OK
}
})();
app.get('/user/:id', function(req, res) {
unknown(req.params.id, (error, res) => {
if (error) {
$('myId').html(error); // NOT OK
return;
}
$('myId').html(res); // OK (for now?)
});
app.get('/user/:id', function (req, res) {
unknown(req.params.id, (error, res) => {
if (error) {
$('myId').html(error); // NOT OK
return;
}
$('myId').html(res); // OK (for now?)
});
});
(function () {
var foo = document.location.search;
var foo = document.location.search;
new Promise(resolve => unknown(foo, resolve)).catch((e) => {
$('myId').html(e); // NOT OK
});
$('myId').html(e); // NOT OK
});
try {
null[foo];
} catch(e) {
$('myId').html(e); // NOT OK
}
try {
unknown()[foo];
} catch(e) {
$('myId').html(e); // NOT OK
null[foo];
} catch (e) {
$('myId').html(e); // NOT OK
}
try {
"foo"[foo]
} catch(e) {
$('myId').html(e); // OK
unknown()[foo];
} catch (e) {
$('myId').html(e); // NOT OK
}
try {
"foo"[foo]
} catch (e) {
$('myId').html(e); // OK
}
function inner(tainted, resolve) {
unknown(tainted, resolve);
}
new Promise(resolve => inner(foo, resolve)).catch((e) => {
$('myId').html(e); // NOT OK
});
$('myId').html(e); // NOT OK
});
})();
app.get('/user/:id', function(req, res) {
unknown(req.params.id, (error, res) => {
if (error) {
$('myId').html(error); // OK (falls through to the next statement)
}
$('myId').html(res); // NOT OK!
});
app.get('/user/:id', function (req, res) {
unknown(req.params.id, (error, res) => {
if (error) {
$('myId').html(error); // OK (falls through to the next statement)
}
$('myId').html(res); // NOT OK!
});
});