hohn/codeql
1
0
Fork 0
mirror of https://github.com/github/codeql.git synced 2026-04-22 15:25:18 +02:00
Code Issues Packages Projects Releases Wiki Activity

JS: Fix alert location and use RelatedLocation in InsecureUrlWhitelist

Browse Source
This commit is contained in:
Asger F
2025-02-26 11:21:41 +01:00
parent a1c13f02be
commit dc28bb527b
1 changed files with 7 additions and 7 deletions
Download Patch File Download Diff File Expand all files Collapse all files

14
javascript/ql/test/query-tests/AngularJS/InsecureUrlWhitelist/tst.js
View File

@@ -1,11 +1,11 @@
angular.module('myApp', [])
.config(function($sceDelegateProvider) {
$sceDelegateProvider.resourceUrlWhitelist([
"**://example.com/*", // $ Alert - (exploit: http://evil.com/?ignore=://example.org/a or javascript:alert(1);://example.org/a)
"*://example.org/*", // $ Alert - (exploit: javascript://example.org/a%0A%0Dalert(1) using a linebreak to end the comment starting with "//"!)
"https://**.example.com/*", // $ Alert - exploit: https://evil.com/?ignore=://example.com/a
"https://example.**", // $ Alert - exploit: https://example.evil.com or http://example.:foo@evil.com
"https://example.*", // $ Alert - exploit: https://example.UnexpectedTLD
"**://example.com/*", // $ RelatedLocation - (exploit: http://evil.com/?ignore=://example.org/a or javascript:alert(1);://example.org/a)
"*://example.org/*", // $ RelatedLocation - (exploit: javascript://example.org/a%0A%0Dalert(1) using a linebreak to end the comment starting with "//"!)
"https://**.example.com/*", // $ RelatedLocation - exploit: https://evil.com/?ignore=://example.com/a
"https://example.**", // $ RelatedLocation - exploit: https://example.evil.com or http://example.:foo@evil.com
"https://example.*", // $ RelatedLocation - exploit: https://example.UnexpectedTLD
"https://example.com",
"https://example.com/**",
@@ -19,6 +19,6 @@ angular.module('myApp', [])
"https://*.example.com",
// not flagged:
/http:\/\/www.example.org/g // $ Alert - (exploit http://wwwaexample.org (dots are not escaped))
]);
/http:\/\/www.example.org/g // $ MISSING: RelatedLocation - (exploit http://wwwaexample.org (dots are not escaped))
]); // $ Alert
});