hohn/codeql
1
0
Fork 0
mirror of https://github.com/github/codeql.git synced 2026-05-05 21:55:19 +02:00
Code Issues Packages Projects Releases Wiki Activity

JavaScript: Remove a few other deprecated predicates and classes.

Browse Source
This commit is contained in:
Max Schaefer
2019-01-08 14:34:11 +00:00
parent db8e436046
commit 97e6c75b94
12 changed files with 0 additions and 220 deletions
Download Patch File Download Diff File Expand all files Collapse all files

14
javascript/ql/test/query-tests/Security/CWE-079/ReflectedXssWithCustomSanitizer_old.expected
View File

@@ -1,14 +0,0 @@
WARNING: Predicate flowsFrom has been deprecated and may be removed in future (ReflectedXssWithCustomSanitizer_old.ql:21,11-20)
WARNING: Type SanitizingGuard has been deprecated and may be removed in future (ReflectedXssWithCustomSanitizer_old.ql:8,34-64)
WARNING: Type XssDataFlowConfiguration has been deprecated and may be removed in future (ReflectedXssWithCustomSanitizer_old.ql:14,20-44)
WARNING: Type XssDataFlowConfiguration has been deprecated and may be removed in future (ReflectedXssWithCustomSanitizer_old.ql:20,6-30)
| ReflectedXss.js:8:14:8:45 | "Unknow ... rams.id | Cross-site scripting vulnerability due to $@. | ReflectedXss.js:8:33:8:45 | req.params.id | user-provided value |
| formatting.js:6:14:6:47 | util.fo ... , evil) | Cross-site scripting vulnerability due to $@. | formatting.js:4:16:4:29 | req.query.evil | user-provided value |
| formatting.js:7:14:7:53 | require ... , evil) | Cross-site scripting vulnerability due to $@. | formatting.js:4:16:4:29 | req.query.evil | user-provided value |
| partial.js:10:14:10:18 | x + y | Cross-site scripting vulnerability due to $@. | partial.js:13:42:13:48 | req.url | user-provided value |
| partial.js:19:14:19:18 | x + y | Cross-site scripting vulnerability due to $@. | partial.js:22:51:22:57 | req.url | user-provided value |
| partial.js:28:14:28:18 | x + y | Cross-site scripting vulnerability due to $@. | partial.js:31:47:31:53 | req.url | user-provided value |
| partial.js:37:14:37:18 | x + y | Cross-site scripting vulnerability due to $@. | partial.js:40:43:40:49 | req.url | user-provided value |
| promises.js:6:25:6:25 | x | Cross-site scripting vulnerability due to $@. | promises.js:5:44:5:57 | req.query.data | user-provided value |
| tst2.js:7:12:7:12 | p | Cross-site scripting vulnerability due to $@. | tst2.js:6:9:6:9 | p | user-provided value |
| tst2.js:8:12:8:12 | r | Cross-site scripting vulnerability due to $@. | tst2.js:6:12:6:15 | q: r | user-provided value |

23
javascript/ql/test/query-tests/Security/CWE-079/ReflectedXssWithCustomSanitizer_old.ql
View File

@@ -1,23 +0,0 @@
//
// This is a test for https://lgtm.com/blog/etherpad_CVE-2018-6835
//
import javascript
import semmle.javascript.security.dataflow.ReflectedXss
class IsVarNameSanitizer extends TaintTracking::SanitizingGuard, CallExpr {
IsVarNameSanitizer() {
getCalleeName() = "isVarName"
}
override predicate sanitizes(TaintTracking::Configuration cfg, boolean outcome, Expr e) {
cfg instanceof XssDataFlowConfiguration and
outcome = true and
e = getArgument(0)
}
}
from XssDataFlowConfiguration xss, DataFlow::Node source, DataFlow::Node sink
where xss.flowsFrom(sink, source)
select sink, "Cross-site scripting vulnerability due to $@.",
source, "user-provided value"