hohn/codeql
1
0
Fork 0
mirror of https://github.com/github/codeql.git synced 2026-04-25 08:45:14 +02:00
Code Issues Packages Projects Releases Wiki Activity

JS: add xss test cases with unknownflags for replace using RegExp

Browse Source
This commit is contained in:
Napalys
2024-11-27 13:29:26 +01:00
parent fe28657c7d
commit dbae553146
4 changed files with 44 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

1
javascript/ql/test/query-tests/Security/CWE-079/DomBasedXss/ConsistencyDomBasedXss.expected
View File

@@ -0,0 +1 @@
| tst.js:510 | did not expect an alert, but found an alert for HtmlInjection | OK -- currently flagged, but might introduce a lot of false positives. | |

19
javascript/ql/test/query-tests/Security/CWE-079/DomBasedXss/Xss.expected
View File

@@ -1148,6 +1148,15 @@ nodes
| tst.js:501:33:501:63 | decodeU ... n.hash) |
| tst.js:501:43:501:62 | window.location.hash |
| tst.js:501:43:501:62 | window.location.hash |
| tst.js:508:7:508:39 | target |
| tst.js:508:16:508:39 | documen ... .search |
| tst.js:508:16:508:39 | documen ... .search |
| tst.js:509:18:509:23 | target |
| tst.js:509:18:509:54 | target. ... "), '') |
| tst.js:509:18:509:54 | target. ... "), '') |
| tst.js:510:18:510:23 | target |
| tst.js:510:18:510:70 | target. ... )), '') |
| tst.js:510:18:510:70 | target. ... )), '') |
| typeahead.js:20:13:20:45 | target |
| typeahead.js:20:22:20:45 | documen ... .search |
| typeahead.js:20:22:20:45 | documen ... .search |
@@ -2331,6 +2340,14 @@ edges
| tst.js:501:43:501:62 | window.location.hash | tst.js:501:33:501:63 | decodeU ... n.hash) |
| tst.js:501:43:501:62 | window.location.hash | tst.js:501:33:501:63 | decodeU ... n.hash) |
| tst.js:501:43:501:62 | window.location.hash | tst.js:501:33:501:63 | decodeU ... n.hash) |
| tst.js:508:7:508:39 | target | tst.js:509:18:509:23 | target |
| tst.js:508:7:508:39 | target | tst.js:510:18:510:23 | target |
| tst.js:508:16:508:39 | documen ... .search | tst.js:508:7:508:39 | target |
| tst.js:508:16:508:39 | documen ... .search | tst.js:508:7:508:39 | target |
| tst.js:509:18:509:23 | target | tst.js:509:18:509:54 | target. ... "), '') |
| tst.js:509:18:509:23 | target | tst.js:509:18:509:54 | target. ... "), '') |
| tst.js:510:18:510:23 | target | tst.js:510:18:510:70 | target. ... )), '') |
| tst.js:510:18:510:23 | target | tst.js:510:18:510:70 | target. ... )), '') |
| typeahead.js:20:13:20:45 | target | typeahead.js:21:12:21:17 | target |
| typeahead.js:20:22:20:45 | documen ... .search | typeahead.js:20:13:20:45 | target |
| typeahead.js:20:22:20:45 | documen ... .search | typeahead.js:20:13:20:45 | target |
@@ -2623,6 +2640,8 @@ edges
| tst.js:491:23:491:45 | locatio ... bstr(1) | tst.js:491:23:491:35 | location.hash | tst.js:491:23:491:45 | locatio ... bstr(1) | Cross-site scripting vulnerability due to $@. | tst.js:491:23:491:35 | location.hash | user-provided value |
| tst.js:494:18:494:40 | locatio ... bstr(1) | tst.js:494:18:494:30 | location.hash | tst.js:494:18:494:40 | locatio ... bstr(1) | Cross-site scripting vulnerability due to $@. | tst.js:494:18:494:30 | location.hash | user-provided value |
| tst.js:501:33:501:63 | decodeU ... n.hash) | tst.js:501:43:501:62 | window.location.hash | tst.js:501:33:501:63 | decodeU ... n.hash) | Cross-site scripting vulnerability due to $@. | tst.js:501:43:501:62 | window.location.hash | user-provided value |
| tst.js:509:18:509:54 | target. ... "), '') | tst.js:508:16:508:39 | documen ... .search | tst.js:509:18:509:54 | target. ... "), '') | Cross-site scripting vulnerability due to $@. | tst.js:508:16:508:39 | documen ... .search | user-provided value |
| tst.js:510:18:510:70 | target. ... )), '') | tst.js:508:16:508:39 | documen ... .search | tst.js:510:18:510:70 | target. ... )), '') | Cross-site scripting vulnerability due to $@. | tst.js:508:16:508:39 | documen ... .search | user-provided value |
| typeahead.js:25:18:25:20 | val | typeahead.js:20:22:20:45 | documen ... .search | typeahead.js:25:18:25:20 | val | Cross-site scripting vulnerability due to $@. | typeahead.js:20:22:20:45 | documen ... .search | user-provided value |
| v-html.vue:2:8:2:23 | v-html=tainted | v-html.vue:6:42:6:58 | document.location | v-html.vue:2:8:2:23 | v-html=tainted | Cross-site scripting vulnerability due to $@. | v-html.vue:6:42:6:58 | document.location | user-provided value |
| various-concat-obfuscations.js:4:4:4:31 | "<div>" ... </div>" | various-concat-obfuscations.js:2:16:2:39 | documen ... .search | various-concat-obfuscations.js:4:4:4:31 | "<div>" ... </div>" | Cross-site scripting vulnerability due to $@. | various-concat-obfuscations.js:2:16:2:39 | documen ... .search | user-provided value |

17
javascript/ql/test/query-tests/Security/CWE-079/DomBasedXss/XssWithAdditionalSources.expected
View File

@@ -1160,6 +1160,15 @@ nodes
| tst.js:501:33:501:63 | decodeU ... n.hash) |
| tst.js:501:43:501:62 | window.location.hash |
| tst.js:501:43:501:62 | window.location.hash |
| tst.js:508:7:508:39 | target |
| tst.js:508:16:508:39 | documen ... .search |
| tst.js:508:16:508:39 | documen ... .search |
| tst.js:509:18:509:23 | target |
| tst.js:509:18:509:54 | target. ... "), '') |
| tst.js:509:18:509:54 | target. ... "), '') |
| tst.js:510:18:510:23 | target |
| tst.js:510:18:510:70 | target. ... )), '') |
| tst.js:510:18:510:70 | target. ... )), '') |
| typeahead.js:9:28:9:30 | loc |
| typeahead.js:9:28:9:30 | loc |
| typeahead.js:9:28:9:30 | loc |
@@ -2393,6 +2402,14 @@ edges
| tst.js:501:43:501:62 | window.location.hash | tst.js:501:33:501:63 | decodeU ... n.hash) |
| tst.js:501:43:501:62 | window.location.hash | tst.js:501:33:501:63 | decodeU ... n.hash) |
| tst.js:501:43:501:62 | window.location.hash | tst.js:501:33:501:63 | decodeU ... n.hash) |
| tst.js:508:7:508:39 | target | tst.js:509:18:509:23 | target |
| tst.js:508:7:508:39 | target | tst.js:510:18:510:23 | target |
| tst.js:508:16:508:39 | documen ... .search | tst.js:508:7:508:39 | target |
| tst.js:508:16:508:39 | documen ... .search | tst.js:508:7:508:39 | target |
| tst.js:509:18:509:23 | target | tst.js:509:18:509:54 | target. ... "), '') |
| tst.js:509:18:509:23 | target | tst.js:509:18:509:54 | target. ... "), '') |
| tst.js:510:18:510:23 | target | tst.js:510:18:510:70 | target. ... )), '') |
| tst.js:510:18:510:23 | target | tst.js:510:18:510:70 | target. ... )), '') |
| typeahead.js:9:28:9:30 | loc | typeahead.js:10:16:10:18 | loc |
| typeahead.js:9:28:9:30 | loc | typeahead.js:10:16:10:18 | loc |
| typeahead.js:9:28:9:30 | loc | typeahead.js:10:16:10:18 | loc |

7
javascript/ql/test/query-tests/Security/CWE-079/DomBasedXss/tst.js
View File

@@ -503,3 +503,10 @@ function Foo() {
};
Object.assign(this, obj);
}
function nonGlobalSanitizer() {
var target = document.location.search
$("#foo").html(target.replace(new RegExp("<|>"), '')); // NOT OK
$("#foo").html(target.replace(new RegExp("<|>", unknownFlags()), '')); // OK -- currently flagged, but might introduce a lot of false positives.
$("#foo").html(target.replace(new RegExp("<|>", "g"), '')); // OK
}