hohn/codeql
1
0
Fork 0
mirror of https://github.com/github/codeql.git synced 2026-05-03 12:45:27 +02:00
Code Issues Packages Projects Releases Wiki Activity

CWE-830 add support for setting attributes via setAttribute method

Browse Source
This commit is contained in:
Stephan Brandauer
2022-02-22 10:10:44 +01:00
parent d80cd1aeb5
commit 82330391c3
3 changed files with 29 additions and 10 deletions
Download Patch File Download Diff File Expand all files Collapse all files

7
javascript/ql/test/query-tests/Security/CWE-830/DynamicCreationOfUntrustedSourceUse.html
View File

@@ -33,6 +33,13 @@
var ifrm3 = document.createElement('iframe');
ifrm3.src = getUrl('v123');
// NOT OK (assignment of bad URL using setAttribute)
var ifrm4 = document.createElement('iframe');
ifrm4.setAttribute('src', 'http://www.example.local/page.html');
// OK (bad URL, but the attribute is not `src`)
var ifrm5 = document.createElement('iframe');
ifrm5.setAttribute('data-src', 'http://www.example.local/page.html');
})();
</script>
</head>

1
javascript/ql/test/query-tests/Security/CWE-830/FunctionalityFromUntrustedSource.expected
View File

@@ -1,6 +1,7 @@
| DynamicCreationOfUntrustedSourceUse.html:19:28:19:129 | ('https ... /ga.js' | HTML script element loaded using unencrypted connection. |
| DynamicCreationOfUntrustedSourceUse.html:23:26:23:50 | 'http:/ ... e.com/' | HTML iframe element loaded using unencrypted connection. |
| DynamicCreationOfUntrustedSourceUse.html:34:27:34:40 | getUrl('v123') | HTML iframe element loaded using unencrypted connection. |
| DynamicCreationOfUntrustedSourceUse.html:38:41:38:76 | 'http:/ ... e.html' | HTML iframe element loaded using unencrypted connection. |
| StaticCreationOfUntrustedSourceUse.html:6:9:6:56 | <script>...</> | HTML script element loaded using unencrypted connection. |
| StaticCreationOfUntrustedSourceUse.html:9:9:9:58 | <iframe>...</> | HTML iframe element loaded using unencrypted connection. |
| StaticCreationOfUntrustedSourceUse.html:21:9:21:155 | <script>...</> | Script loaded from content delivery network with no integrity check. |