From ab1bc685bb8d64310a25b3a9f2b8e96c4e32c0a0 Mon Sep 17 00:00:00 2001 From: Erik Krogh Kristensen Date: Mon, 24 Jan 2022 11:01:17 +0100 Subject: [PATCH] add CWE-80 to queries that detect bad HTML sanitizers --- javascript/ql/src/Security/CWE-116/BadTagFilter.ql | 3 ++- .../Security/CWE-116/IncompleteMultiCharacterSanitization.ql | 3 ++- javascript/ql/src/Security/CWE-116/IncompleteSanitization.ql | 3 ++- 3 files changed, 6 insertions(+), 3 deletions(-) diff --git a/javascript/ql/src/Security/CWE-116/BadTagFilter.ql b/javascript/ql/src/Security/CWE-116/BadTagFilter.ql index 5eadd33ff40..29190c95e94 100644 --- a/javascript/ql/src/Security/CWE-116/BadTagFilter.ql +++ b/javascript/ql/src/Security/CWE-116/BadTagFilter.ql @@ -8,8 +8,9 @@ * @id js/bad-tag-filter * @tags correctness * security - * external/cwe/cwe-116 * external/cwe/cwe-020 + * external/cwe/cwe-080 + * external/cwe/cwe-116 * external/cwe/cwe-185 * external/cwe/cwe-186 */ diff --git a/javascript/ql/src/Security/CWE-116/IncompleteMultiCharacterSanitization.ql b/javascript/ql/src/Security/CWE-116/IncompleteMultiCharacterSanitization.ql index 0043183af47..3e4bb2bc182 100644 --- a/javascript/ql/src/Security/CWE-116/IncompleteMultiCharacterSanitization.ql +++ b/javascript/ql/src/Security/CWE-116/IncompleteMultiCharacterSanitization.ql @@ -8,8 +8,9 @@ * @id js/incomplete-multi-character-sanitization * @tags correctness * security - * external/cwe/cwe-116 * external/cwe/cwe-020 + * external/cwe/cwe-080 + * external/cwe/cwe-116 */ import javascript diff --git a/javascript/ql/src/Security/CWE-116/IncompleteSanitization.ql b/javascript/ql/src/Security/CWE-116/IncompleteSanitization.ql index 4e1a66ab22c..7e14a93e02a 100644 --- a/javascript/ql/src/Security/CWE-116/IncompleteSanitization.ql +++ b/javascript/ql/src/Security/CWE-116/IncompleteSanitization.ql @@ -9,8 +9,9 @@ * @id js/incomplete-sanitization * @tags correctness * security - * external/cwe/cwe-116 * external/cwe/cwe-020 + * external/cwe/cwe-080 + * external/cwe/cwe-116 */ import javascript