mirror of
https://github.com/github/codeql.git
synced 2026-04-25 16:55:19 +02:00
Merge branch 'main' into amammad-js-bombs
This commit is contained in:
GitHub Security Lab
@@ -65,4 +65,7 @@ function f() {
|
||||
<a href="{{ url_for('foo.html', 'foo')}}" target="_blank">Example</a>;
|
||||
|
||||
// OK, nunjucks template
|
||||
<a href="{{ url('foo', query={bla}) }}" target="_blank">Example</a>
|
||||
<a href="{{ url('foo', query={bla}) }}" target="_blank">Example</a>;
|
||||
|
||||
// OK, Django application with internal links
|
||||
<a href="{% url 'admin:auth_user_changelist' %}" target="_blank">Example</a>
|
||||
|
||||
@@ -1,3 +1,6 @@
|
||||
| bad1.js:0:0:0:0 | bad1.js | |
|
||||
| bad2.ts:0:0:0:0 | bad2.ts | |
|
||||
| bad3.html:0:0:0:0 | bad3.html | |
|
||||
| contains-template.js:0:0:0:0 | contains-template.js | |
|
||||
| good1.js:0:0:0:0 | good1.js | |
|
||||
| good2.ts:0:0:0:0 | good2.ts | |
|
||||
|
||||
@@ -1 +1 @@
|
||||
| tst.js:1:9:1:13 | 1<<40 | Shift out of range. |
|
||||
| tst.js:1:9:1:13 | 1<<40 | Shift out of range. |
|
||||
|
||||
@@ -1,2 +1,2 @@
|
||||
| tst.js:4:11:4:26 | arguments.callee | Avoid using arguments.caller and arguments.callee. |
|
||||
| tst.js:12:9:12:24 | arguments.caller | Avoid using arguments.caller and arguments.callee. |
|
||||
| tst.js:12:9:12:24 | arguments.caller | Avoid using arguments.caller and arguments.callee. |
|
||||
|
||||
@@ -1 +1 @@
|
||||
| debuggerStatement.js:2:3:2:11 | debugger; | Do not use 'debugger'. |
|
||||
| debuggerStatement.js:2:3:2:11 | debugger; | Do not use 'debugger'. |
|
||||
|
||||
@@ -1 +1 @@
|
||||
| eval.js:2:3:2:13 | eval("2+2") | Do not use eval or the Function constructor. |
|
||||
| eval.js:2:3:2:13 | eval("2+2") | Do not use eval or the Function constructor. |
|
||||
|
||||
@@ -27,4 +27,6 @@ var overlapsWithClass1 = /[0-9\d]/; // NOT OK
|
||||
var overlapsWithClass2 = /[\w,.-?:*+]/; // NOT OK
|
||||
|
||||
var tst2 = /^([ァ-ヾ]|[ｧ-ﾝﾞﾟ])+$/; // OK
|
||||
var tst3 = /[0-9０-９]/; // OK
|
||||
var tst3 = /[0-9０-９]/; // OK
|
||||
|
||||
var question = /[0-?]/; // OK. matches one of: 0123456789:;<=>?
|
||||
@@ -1535,6 +1535,76 @@ nodes
|
||||
| TaintedPath.js:214:35:214:38 | path |
|
||||
| TaintedPath.js:214:35:214:38 | path |
|
||||
| TaintedPath.js:214:35:214:38 | path |
|
||||
| examples/TaintedPath.js:8:7:8:52 | filePath |
|
||||
| examples/TaintedPath.js:8:7:8:52 | filePath |
|
||||
| examples/TaintedPath.js:8:7:8:52 | filePath |
|
||||
| examples/TaintedPath.js:8:7:8:52 | filePath |
|
||||
| examples/TaintedPath.js:8:7:8:52 | filePath |
|
||||
| examples/TaintedPath.js:8:7:8:52 | filePath |
|
||||
| examples/TaintedPath.js:8:7:8:52 | filePath |
|
||||
| examples/TaintedPath.js:8:7:8:52 | filePath |
|
||||
| examples/TaintedPath.js:8:7:8:52 | filePath |
|
||||
| examples/TaintedPath.js:8:7:8:52 | filePath |
|
||||
| examples/TaintedPath.js:8:7:8:52 | filePath |
|
||||
| examples/TaintedPath.js:8:7:8:52 | filePath |
|
||||
| examples/TaintedPath.js:8:18:8:41 | url.par ... , true) |
|
||||
| examples/TaintedPath.js:8:18:8:41 | url.par ... , true) |
|
||||
| examples/TaintedPath.js:8:18:8:41 | url.par ... , true) |
|
||||
| examples/TaintedPath.js:8:18:8:41 | url.par ... , true) |
|
||||
| examples/TaintedPath.js:8:18:8:41 | url.par ... , true) |
|
||||
| examples/TaintedPath.js:8:18:8:41 | url.par ... , true) |
|
||||
| examples/TaintedPath.js:8:18:8:41 | url.par ... , true) |
|
||||
| examples/TaintedPath.js:8:18:8:41 | url.par ... , true) |
|
||||
| examples/TaintedPath.js:8:18:8:41 | url.par ... , true) |
|
||||
| examples/TaintedPath.js:8:18:8:41 | url.par ... , true) |
|
||||
| examples/TaintedPath.js:8:18:8:41 | url.par ... , true) |
|
||||
| examples/TaintedPath.js:8:18:8:41 | url.par ... , true) |
|
||||
| examples/TaintedPath.js:8:18:8:47 | url.par ... ).query |
|
||||
| examples/TaintedPath.js:8:18:8:47 | url.par ... ).query |
|
||||
| examples/TaintedPath.js:8:18:8:47 | url.par ... ).query |
|
||||
| examples/TaintedPath.js:8:18:8:47 | url.par ... ).query |
|
||||
| examples/TaintedPath.js:8:18:8:47 | url.par ... ).query |
|
||||
| examples/TaintedPath.js:8:18:8:47 | url.par ... ).query |
|
||||
| examples/TaintedPath.js:8:18:8:47 | url.par ... ).query |
|
||||
| examples/TaintedPath.js:8:18:8:47 | url.par ... ).query |
|
||||
| examples/TaintedPath.js:8:18:8:47 | url.par ... ).query |
|
||||
| examples/TaintedPath.js:8:18:8:47 | url.par ... ).query |
|
||||
| examples/TaintedPath.js:8:18:8:47 | url.par ... ).query |
|
||||
| examples/TaintedPath.js:8:18:8:47 | url.par ... ).query |
|
||||
| examples/TaintedPath.js:8:18:8:52 | url.par ... ry.path |
|
||||
| examples/TaintedPath.js:8:18:8:52 | url.par ... ry.path |
|
||||
| examples/TaintedPath.js:8:18:8:52 | url.par ... ry.path |
|
||||
| examples/TaintedPath.js:8:18:8:52 | url.par ... ry.path |
|
||||
| examples/TaintedPath.js:8:18:8:52 | url.par ... ry.path |
|
||||
| examples/TaintedPath.js:8:18:8:52 | url.par ... ry.path |
|
||||
| examples/TaintedPath.js:8:18:8:52 | url.par ... ry.path |
|
||||
| examples/TaintedPath.js:8:18:8:52 | url.par ... ry.path |
|
||||
| examples/TaintedPath.js:8:18:8:52 | url.par ... ry.path |
|
||||
| examples/TaintedPath.js:8:18:8:52 | url.par ... ry.path |
|
||||
| examples/TaintedPath.js:8:18:8:52 | url.par ... ry.path |
|
||||
| examples/TaintedPath.js:8:18:8:52 | url.par ... ry.path |
|
||||
| examples/TaintedPath.js:8:28:8:34 | req.url |
|
||||
| examples/TaintedPath.js:8:28:8:34 | req.url |
|
||||
| examples/TaintedPath.js:8:28:8:34 | req.url |
|
||||
| examples/TaintedPath.js:8:28:8:34 | req.url |
|
||||
| examples/TaintedPath.js:8:28:8:34 | req.url |
|
||||
| examples/TaintedPath.js:11:29:11:43 | ROOT + filePath |
|
||||
| examples/TaintedPath.js:11:29:11:43 | ROOT + filePath |
|
||||
| examples/TaintedPath.js:11:29:11:43 | ROOT + filePath |
|
||||
| examples/TaintedPath.js:11:29:11:43 | ROOT + filePath |
|
||||
| examples/TaintedPath.js:11:29:11:43 | ROOT + filePath |
|
||||
| examples/TaintedPath.js:11:36:11:43 | filePath |
|
||||
| examples/TaintedPath.js:11:36:11:43 | filePath |
|
||||
| examples/TaintedPath.js:11:36:11:43 | filePath |
|
||||
| examples/TaintedPath.js:11:36:11:43 | filePath |
|
||||
| examples/TaintedPath.js:11:36:11:43 | filePath |
|
||||
| examples/TaintedPath.js:11:36:11:43 | filePath |
|
||||
| examples/TaintedPath.js:11:36:11:43 | filePath |
|
||||
| examples/TaintedPath.js:11:36:11:43 | filePath |
|
||||
| examples/TaintedPath.js:11:36:11:43 | filePath |
|
||||
| examples/TaintedPath.js:11:36:11:43 | filePath |
|
||||
| examples/TaintedPath.js:11:36:11:43 | filePath |
|
||||
| examples/TaintedPath.js:11:36:11:43 | filePath |
|
||||
| express.js:8:20:8:32 | req.query.bar |
|
||||
| express.js:8:20:8:32 | req.query.bar |
|
||||
| express.js:8:20:8:32 | req.query.bar |
|
||||
@@ -2163,6 +2233,28 @@ nodes
|
||||
| normalizedPaths.js:399:21:399:24 | path |
|
||||
| normalizedPaths.js:399:21:399:24 | path |
|
||||
| normalizedPaths.js:399:21:399:24 | path |
|
||||
| normalizedPaths.js:407:19:407:67 | pathMod ... t('/')) |
|
||||
| normalizedPaths.js:407:19:407:67 | pathMod ... t('/')) |
|
||||
| normalizedPaths.js:407:19:407:67 | pathMod ... t('/')) |
|
||||
| normalizedPaths.js:407:19:407:67 | pathMod ... t('/')) |
|
||||
| normalizedPaths.js:407:45:407:55 | req.query.x |
|
||||
| normalizedPaths.js:407:45:407:55 | req.query.x |
|
||||
| normalizedPaths.js:407:45:407:55 | req.query.x |
|
||||
| normalizedPaths.js:407:45:407:55 | req.query.x |
|
||||
| normalizedPaths.js:407:45:407:66 | req.que ... it('/') |
|
||||
| normalizedPaths.js:407:45:407:66 | req.que ... it('/') |
|
||||
| normalizedPaths.js:407:45:407:66 | req.que ... it('/') |
|
||||
| normalizedPaths.js:408:19:408:60 | pathMod ... t('/')) |
|
||||
| normalizedPaths.js:408:19:408:60 | pathMod ... t('/')) |
|
||||
| normalizedPaths.js:408:19:408:60 | pathMod ... t('/')) |
|
||||
| normalizedPaths.js:408:19:408:60 | pathMod ... t('/')) |
|
||||
| normalizedPaths.js:408:38:408:48 | req.query.x |
|
||||
| normalizedPaths.js:408:38:408:48 | req.query.x |
|
||||
| normalizedPaths.js:408:38:408:48 | req.query.x |
|
||||
| normalizedPaths.js:408:38:408:48 | req.query.x |
|
||||
| normalizedPaths.js:408:38:408:59 | req.que ... it('/') |
|
||||
| normalizedPaths.js:408:38:408:59 | req.que ... it('/') |
|
||||
| normalizedPaths.js:408:38:408:59 | req.que ... it('/') |
|
||||
| other-fs-libraries.js:9:7:9:48 | path |
|
||||
| other-fs-libraries.js:9:7:9:48 | path |
|
||||
| other-fs-libraries.js:9:7:9:48 | path |
|
||||
@@ -2813,6 +2905,92 @@ nodes
|
||||
| other-fs-libraries.js:72:15:72:18 | path |
|
||||
| other-fs-libraries.js:72:15:72:18 | path |
|
||||
| other-fs-libraries.js:72:15:72:18 | path |
|
||||
| other-fs-libraries.js:77:7:77:48 | path |
|
||||
| other-fs-libraries.js:77:7:77:48 | path |
|
||||
| other-fs-libraries.js:77:7:77:48 | path |
|
||||
| other-fs-libraries.js:77:7:77:48 | path |
|
||||
| other-fs-libraries.js:77:7:77:48 | path |
|
||||
| other-fs-libraries.js:77:7:77:48 | path |
|
||||
| other-fs-libraries.js:77:7:77:48 | path |
|
||||
| other-fs-libraries.js:77:7:77:48 | path |
|
||||
| other-fs-libraries.js:77:7:77:48 | path |
|
||||
| other-fs-libraries.js:77:7:77:48 | path |
|
||||
| other-fs-libraries.js:77:7:77:48 | path |
|
||||
| other-fs-libraries.js:77:7:77:48 | path |
|
||||
| other-fs-libraries.js:77:7:77:48 | path |
|
||||
| other-fs-libraries.js:77:7:77:48 | path |
|
||||
| other-fs-libraries.js:77:7:77:48 | path |
|
||||
| other-fs-libraries.js:77:7:77:48 | path |
|
||||
| other-fs-libraries.js:77:14:77:37 | url.par ... , true) |
|
||||
| other-fs-libraries.js:77:14:77:37 | url.par ... , true) |
|
||||
| other-fs-libraries.js:77:14:77:37 | url.par ... , true) |
|
||||
| other-fs-libraries.js:77:14:77:37 | url.par ... , true) |
|
||||
| other-fs-libraries.js:77:14:77:37 | url.par ... , true) |
|
||||
| other-fs-libraries.js:77:14:77:37 | url.par ... , true) |
|
||||
| other-fs-libraries.js:77:14:77:37 | url.par ... , true) |
|
||||
| other-fs-libraries.js:77:14:77:37 | url.par ... , true) |
|
||||
| other-fs-libraries.js:77:14:77:37 | url.par ... , true) |
|
||||
| other-fs-libraries.js:77:14:77:37 | url.par ... , true) |
|
||||
| other-fs-libraries.js:77:14:77:37 | url.par ... , true) |
|
||||
| other-fs-libraries.js:77:14:77:37 | url.par ... , true) |
|
||||
| other-fs-libraries.js:77:14:77:37 | url.par ... , true) |
|
||||
| other-fs-libraries.js:77:14:77:37 | url.par ... , true) |
|
||||
| other-fs-libraries.js:77:14:77:37 | url.par ... , true) |
|
||||
| other-fs-libraries.js:77:14:77:37 | url.par ... , true) |
|
||||
| other-fs-libraries.js:77:14:77:43 | url.par ... ).query |
|
||||
| other-fs-libraries.js:77:14:77:43 | url.par ... ).query |
|
||||
| other-fs-libraries.js:77:14:77:43 | url.par ... ).query |
|
||||
| other-fs-libraries.js:77:14:77:43 | url.par ... ).query |
|
||||
| other-fs-libraries.js:77:14:77:43 | url.par ... ).query |
|
||||
| other-fs-libraries.js:77:14:77:43 | url.par ... ).query |
|
||||
| other-fs-libraries.js:77:14:77:43 | url.par ... ).query |
|
||||
| other-fs-libraries.js:77:14:77:43 | url.par ... ).query |
|
||||
| other-fs-libraries.js:77:14:77:43 | url.par ... ).query |
|
||||
| other-fs-libraries.js:77:14:77:43 | url.par ... ).query |
|
||||
| other-fs-libraries.js:77:14:77:43 | url.par ... ).query |
|
||||
| other-fs-libraries.js:77:14:77:43 | url.par ... ).query |
|
||||
| other-fs-libraries.js:77:14:77:43 | url.par ... ).query |
|
||||
| other-fs-libraries.js:77:14:77:43 | url.par ... ).query |
|
||||
| other-fs-libraries.js:77:14:77:43 | url.par ... ).query |
|
||||
| other-fs-libraries.js:77:14:77:43 | url.par ... ).query |
|
||||
| other-fs-libraries.js:77:14:77:48 | url.par ... ry.path |
|
||||
| other-fs-libraries.js:77:14:77:48 | url.par ... ry.path |
|
||||
| other-fs-libraries.js:77:14:77:48 | url.par ... ry.path |
|
||||
| other-fs-libraries.js:77:14:77:48 | url.par ... ry.path |
|
||||
| other-fs-libraries.js:77:14:77:48 | url.par ... ry.path |
|
||||
| other-fs-libraries.js:77:14:77:48 | url.par ... ry.path |
|
||||
| other-fs-libraries.js:77:14:77:48 | url.par ... ry.path |
|
||||
| other-fs-libraries.js:77:14:77:48 | url.par ... ry.path |
|
||||
| other-fs-libraries.js:77:14:77:48 | url.par ... ry.path |
|
||||
| other-fs-libraries.js:77:14:77:48 | url.par ... ry.path |
|
||||
| other-fs-libraries.js:77:14:77:48 | url.par ... ry.path |
|
||||
| other-fs-libraries.js:77:14:77:48 | url.par ... ry.path |
|
||||
| other-fs-libraries.js:77:14:77:48 | url.par ... ry.path |
|
||||
| other-fs-libraries.js:77:14:77:48 | url.par ... ry.path |
|
||||
| other-fs-libraries.js:77:14:77:48 | url.par ... ry.path |
|
||||
| other-fs-libraries.js:77:14:77:48 | url.par ... ry.path |
|
||||
| other-fs-libraries.js:77:24:77:30 | req.url |
|
||||
| other-fs-libraries.js:77:24:77:30 | req.url |
|
||||
| other-fs-libraries.js:77:24:77:30 | req.url |
|
||||
| other-fs-libraries.js:77:24:77:30 | req.url |
|
||||
| other-fs-libraries.js:77:24:77:30 | req.url |
|
||||
| other-fs-libraries.js:79:16:79:19 | path |
|
||||
| other-fs-libraries.js:79:16:79:19 | path |
|
||||
| other-fs-libraries.js:79:16:79:19 | path |
|
||||
| other-fs-libraries.js:79:16:79:19 | path |
|
||||
| other-fs-libraries.js:79:16:79:19 | path |
|
||||
| other-fs-libraries.js:79:16:79:19 | path |
|
||||
| other-fs-libraries.js:79:16:79:19 | path |
|
||||
| other-fs-libraries.js:79:16:79:19 | path |
|
||||
| other-fs-libraries.js:79:16:79:19 | path |
|
||||
| other-fs-libraries.js:79:16:79:19 | path |
|
||||
| other-fs-libraries.js:79:16:79:19 | path |
|
||||
| other-fs-libraries.js:79:16:79:19 | path |
|
||||
| other-fs-libraries.js:79:16:79:19 | path |
|
||||
| other-fs-libraries.js:79:16:79:19 | path |
|
||||
| other-fs-libraries.js:79:16:79:19 | path |
|
||||
| other-fs-libraries.js:79:16:79:19 | path |
|
||||
| other-fs-libraries.js:79:16:79:19 | path |
|
||||
| prettier.js:6:11:6:28 | p |
|
||||
| prettier.js:6:11:6:28 | p |
|
||||
| prettier.js:6:11:6:28 | p |
|
||||
@@ -6527,6 +6705,102 @@ edges
|
||||
| TaintedPath.js:211:24:211:30 | req.url | TaintedPath.js:211:14:211:37 | url.par ... , true) |
|
||||
| TaintedPath.js:211:24:211:30 | req.url | TaintedPath.js:211:14:211:37 | url.par ... , true) |
|
||||
| TaintedPath.js:211:24:211:30 | req.url | TaintedPath.js:211:14:211:37 | url.par ... , true) |
|
||||
| examples/TaintedPath.js:8:7:8:52 | filePath | examples/TaintedPath.js:11:36:11:43 | filePath |
|
||||
| examples/TaintedPath.js:8:7:8:52 | filePath | examples/TaintedPath.js:11:36:11:43 | filePath |
|
||||
| examples/TaintedPath.js:8:7:8:52 | filePath | examples/TaintedPath.js:11:36:11:43 | filePath |
|
||||
| examples/TaintedPath.js:8:7:8:52 | filePath | examples/TaintedPath.js:11:36:11:43 | filePath |
|
||||
| examples/TaintedPath.js:8:7:8:52 | filePath | examples/TaintedPath.js:11:36:11:43 | filePath |
|
||||
| examples/TaintedPath.js:8:7:8:52 | filePath | examples/TaintedPath.js:11:36:11:43 | filePath |
|
||||
| examples/TaintedPath.js:8:7:8:52 | filePath | examples/TaintedPath.js:11:36:11:43 | filePath |
|
||||
| examples/TaintedPath.js:8:7:8:52 | filePath | examples/TaintedPath.js:11:36:11:43 | filePath |
|
||||
| examples/TaintedPath.js:8:7:8:52 | filePath | examples/TaintedPath.js:11:36:11:43 | filePath |
|
||||
| examples/TaintedPath.js:8:7:8:52 | filePath | examples/TaintedPath.js:11:36:11:43 | filePath |
|
||||
| examples/TaintedPath.js:8:7:8:52 | filePath | examples/TaintedPath.js:11:36:11:43 | filePath |
|
||||
| examples/TaintedPath.js:8:7:8:52 | filePath | examples/TaintedPath.js:11:36:11:43 | filePath |
|
||||
| examples/TaintedPath.js:8:18:8:41 | url.par ... , true) | examples/TaintedPath.js:8:18:8:47 | url.par ... ).query |
|
||||
| examples/TaintedPath.js:8:18:8:41 | url.par ... , true) | examples/TaintedPath.js:8:18:8:47 | url.par ... ).query |
|
||||
| examples/TaintedPath.js:8:18:8:41 | url.par ... , true) | examples/TaintedPath.js:8:18:8:47 | url.par ... ).query |
|
||||
| examples/TaintedPath.js:8:18:8:41 | url.par ... , true) | examples/TaintedPath.js:8:18:8:47 | url.par ... ).query |
|
||||
| examples/TaintedPath.js:8:18:8:41 | url.par ... , true) | examples/TaintedPath.js:8:18:8:47 | url.par ... ).query |
|
||||
| examples/TaintedPath.js:8:18:8:41 | url.par ... , true) | examples/TaintedPath.js:8:18:8:47 | url.par ... ).query |
|
||||
| examples/TaintedPath.js:8:18:8:41 | url.par ... , true) | examples/TaintedPath.js:8:18:8:47 | url.par ... ).query |
|
||||
| examples/TaintedPath.js:8:18:8:41 | url.par ... , true) | examples/TaintedPath.js:8:18:8:47 | url.par ... ).query |
|
||||
| examples/TaintedPath.js:8:18:8:41 | url.par ... , true) | examples/TaintedPath.js:8:18:8:47 | url.par ... ).query |
|
||||
| examples/TaintedPath.js:8:18:8:41 | url.par ... , true) | examples/TaintedPath.js:8:18:8:47 | url.par ... ).query |
|
||||
| examples/TaintedPath.js:8:18:8:41 | url.par ... , true) | examples/TaintedPath.js:8:18:8:47 | url.par ... ).query |
|
||||
| examples/TaintedPath.js:8:18:8:41 | url.par ... , true) | examples/TaintedPath.js:8:18:8:47 | url.par ... ).query |
|
||||
| examples/TaintedPath.js:8:18:8:47 | url.par ... ).query | examples/TaintedPath.js:8:18:8:52 | url.par ... ry.path |
|
||||
| examples/TaintedPath.js:8:18:8:47 | url.par ... ).query | examples/TaintedPath.js:8:18:8:52 | url.par ... ry.path |
|
||||
| examples/TaintedPath.js:8:18:8:47 | url.par ... ).query | examples/TaintedPath.js:8:18:8:52 | url.par ... ry.path |
|
||||
| examples/TaintedPath.js:8:18:8:47 | url.par ... ).query | examples/TaintedPath.js:8:18:8:52 | url.par ... ry.path |
|
||||
| examples/TaintedPath.js:8:18:8:47 | url.par ... ).query | examples/TaintedPath.js:8:18:8:52 | url.par ... ry.path |
|
||||
| examples/TaintedPath.js:8:18:8:47 | url.par ... ).query | examples/TaintedPath.js:8:18:8:52 | url.par ... ry.path |
|
||||
| examples/TaintedPath.js:8:18:8:47 | url.par ... ).query | examples/TaintedPath.js:8:18:8:52 | url.par ... ry.path |
|
||||
| examples/TaintedPath.js:8:18:8:47 | url.par ... ).query | examples/TaintedPath.js:8:18:8:52 | url.par ... ry.path |
|
||||
| examples/TaintedPath.js:8:18:8:47 | url.par ... ).query | examples/TaintedPath.js:8:18:8:52 | url.par ... ry.path |
|
||||
| examples/TaintedPath.js:8:18:8:47 | url.par ... ).query | examples/TaintedPath.js:8:18:8:52 | url.par ... ry.path |
|
||||
| examples/TaintedPath.js:8:18:8:47 | url.par ... ).query | examples/TaintedPath.js:8:18:8:52 | url.par ... ry.path |
|
||||
| examples/TaintedPath.js:8:18:8:47 | url.par ... ).query | examples/TaintedPath.js:8:18:8:52 | url.par ... ry.path |
|
||||
| examples/TaintedPath.js:8:18:8:52 | url.par ... ry.path | examples/TaintedPath.js:8:7:8:52 | filePath |
|
||||
| examples/TaintedPath.js:8:18:8:52 | url.par ... ry.path | examples/TaintedPath.js:8:7:8:52 | filePath |
|
||||
| examples/TaintedPath.js:8:18:8:52 | url.par ... ry.path | examples/TaintedPath.js:8:7:8:52 | filePath |
|
||||
| examples/TaintedPath.js:8:18:8:52 | url.par ... ry.path | examples/TaintedPath.js:8:7:8:52 | filePath |
|
||||
| examples/TaintedPath.js:8:18:8:52 | url.par ... ry.path | examples/TaintedPath.js:8:7:8:52 | filePath |
|
||||
| examples/TaintedPath.js:8:18:8:52 | url.par ... ry.path | examples/TaintedPath.js:8:7:8:52 | filePath |
|
||||
| examples/TaintedPath.js:8:18:8:52 | url.par ... ry.path | examples/TaintedPath.js:8:7:8:52 | filePath |
|
||||
| examples/TaintedPath.js:8:18:8:52 | url.par ... ry.path | examples/TaintedPath.js:8:7:8:52 | filePath |
|
||||
| examples/TaintedPath.js:8:18:8:52 | url.par ... ry.path | examples/TaintedPath.js:8:7:8:52 | filePath |
|
||||
| examples/TaintedPath.js:8:18:8:52 | url.par ... ry.path | examples/TaintedPath.js:8:7:8:52 | filePath |
|
||||
| examples/TaintedPath.js:8:18:8:52 | url.par ... ry.path | examples/TaintedPath.js:8:7:8:52 | filePath |
|
||||
| examples/TaintedPath.js:8:18:8:52 | url.par ... ry.path | examples/TaintedPath.js:8:7:8:52 | filePath |
|
||||
| examples/TaintedPath.js:8:28:8:34 | req.url | examples/TaintedPath.js:8:18:8:41 | url.par ... , true) |
|
||||
| examples/TaintedPath.js:8:28:8:34 | req.url | examples/TaintedPath.js:8:18:8:41 | url.par ... , true) |
|
||||
| examples/TaintedPath.js:8:28:8:34 | req.url | examples/TaintedPath.js:8:18:8:41 | url.par ... , true) |
|
||||
| examples/TaintedPath.js:8:28:8:34 | req.url | examples/TaintedPath.js:8:18:8:41 | url.par ... , true) |
|
||||
| examples/TaintedPath.js:8:28:8:34 | req.url | examples/TaintedPath.js:8:18:8:41 | url.par ... , true) |
|
||||
| examples/TaintedPath.js:8:28:8:34 | req.url | examples/TaintedPath.js:8:18:8:41 | url.par ... , true) |
|
||||
| examples/TaintedPath.js:8:28:8:34 | req.url | examples/TaintedPath.js:8:18:8:41 | url.par ... , true) |
|
||||
| examples/TaintedPath.js:8:28:8:34 | req.url | examples/TaintedPath.js:8:18:8:41 | url.par ... , true) |
|
||||
| examples/TaintedPath.js:8:28:8:34 | req.url | examples/TaintedPath.js:8:18:8:41 | url.par ... , true) |
|
||||
| examples/TaintedPath.js:8:28:8:34 | req.url | examples/TaintedPath.js:8:18:8:41 | url.par ... , true) |
|
||||
| examples/TaintedPath.js:8:28:8:34 | req.url | examples/TaintedPath.js:8:18:8:41 | url.par ... , true) |
|
||||
| examples/TaintedPath.js:8:28:8:34 | req.url | examples/TaintedPath.js:8:18:8:41 | url.par ... , true) |
|
||||
| examples/TaintedPath.js:8:28:8:34 | req.url | examples/TaintedPath.js:8:18:8:41 | url.par ... , true) |
|
||||
| examples/TaintedPath.js:8:28:8:34 | req.url | examples/TaintedPath.js:8:18:8:41 | url.par ... , true) |
|
||||
| examples/TaintedPath.js:8:28:8:34 | req.url | examples/TaintedPath.js:8:18:8:41 | url.par ... , true) |
|
||||
| examples/TaintedPath.js:8:28:8:34 | req.url | examples/TaintedPath.js:8:18:8:41 | url.par ... , true) |
|
||||
| examples/TaintedPath.js:8:28:8:34 | req.url | examples/TaintedPath.js:8:18:8:41 | url.par ... , true) |
|
||||
| examples/TaintedPath.js:8:28:8:34 | req.url | examples/TaintedPath.js:8:18:8:41 | url.par ... , true) |
|
||||
| examples/TaintedPath.js:8:28:8:34 | req.url | examples/TaintedPath.js:8:18:8:41 | url.par ... , true) |
|
||||
| examples/TaintedPath.js:8:28:8:34 | req.url | examples/TaintedPath.js:8:18:8:41 | url.par ... , true) |
|
||||
| examples/TaintedPath.js:8:28:8:34 | req.url | examples/TaintedPath.js:8:18:8:41 | url.par ... , true) |
|
||||
| examples/TaintedPath.js:8:28:8:34 | req.url | examples/TaintedPath.js:8:18:8:41 | url.par ... , true) |
|
||||
| examples/TaintedPath.js:8:28:8:34 | req.url | examples/TaintedPath.js:8:18:8:41 | url.par ... , true) |
|
||||
| examples/TaintedPath.js:8:28:8:34 | req.url | examples/TaintedPath.js:8:18:8:41 | url.par ... , true) |
|
||||
| examples/TaintedPath.js:11:36:11:43 | filePath | examples/TaintedPath.js:11:29:11:43 | ROOT + filePath |
|
||||
| examples/TaintedPath.js:11:36:11:43 | filePath | examples/TaintedPath.js:11:29:11:43 | ROOT + filePath |
|
||||
| examples/TaintedPath.js:11:36:11:43 | filePath | examples/TaintedPath.js:11:29:11:43 | ROOT + filePath |
|
||||
| examples/TaintedPath.js:11:36:11:43 | filePath | examples/TaintedPath.js:11:29:11:43 | ROOT + filePath |
|
||||
| examples/TaintedPath.js:11:36:11:43 | filePath | examples/TaintedPath.js:11:29:11:43 | ROOT + filePath |
|
||||
| examples/TaintedPath.js:11:36:11:43 | filePath | examples/TaintedPath.js:11:29:11:43 | ROOT + filePath |
|
||||
| examples/TaintedPath.js:11:36:11:43 | filePath | examples/TaintedPath.js:11:29:11:43 | ROOT + filePath |
|
||||
| examples/TaintedPath.js:11:36:11:43 | filePath | examples/TaintedPath.js:11:29:11:43 | ROOT + filePath |
|
||||
| examples/TaintedPath.js:11:36:11:43 | filePath | examples/TaintedPath.js:11:29:11:43 | ROOT + filePath |
|
||||
| examples/TaintedPath.js:11:36:11:43 | filePath | examples/TaintedPath.js:11:29:11:43 | ROOT + filePath |
|
||||
| examples/TaintedPath.js:11:36:11:43 | filePath | examples/TaintedPath.js:11:29:11:43 | ROOT + filePath |
|
||||
| examples/TaintedPath.js:11:36:11:43 | filePath | examples/TaintedPath.js:11:29:11:43 | ROOT + filePath |
|
||||
| examples/TaintedPath.js:11:36:11:43 | filePath | examples/TaintedPath.js:11:29:11:43 | ROOT + filePath |
|
||||
| examples/TaintedPath.js:11:36:11:43 | filePath | examples/TaintedPath.js:11:29:11:43 | ROOT + filePath |
|
||||
| examples/TaintedPath.js:11:36:11:43 | filePath | examples/TaintedPath.js:11:29:11:43 | ROOT + filePath |
|
||||
| examples/TaintedPath.js:11:36:11:43 | filePath | examples/TaintedPath.js:11:29:11:43 | ROOT + filePath |
|
||||
| examples/TaintedPath.js:11:36:11:43 | filePath | examples/TaintedPath.js:11:29:11:43 | ROOT + filePath |
|
||||
| examples/TaintedPath.js:11:36:11:43 | filePath | examples/TaintedPath.js:11:29:11:43 | ROOT + filePath |
|
||||
| examples/TaintedPath.js:11:36:11:43 | filePath | examples/TaintedPath.js:11:29:11:43 | ROOT + filePath |
|
||||
| examples/TaintedPath.js:11:36:11:43 | filePath | examples/TaintedPath.js:11:29:11:43 | ROOT + filePath |
|
||||
| examples/TaintedPath.js:11:36:11:43 | filePath | examples/TaintedPath.js:11:29:11:43 | ROOT + filePath |
|
||||
| examples/TaintedPath.js:11:36:11:43 | filePath | examples/TaintedPath.js:11:29:11:43 | ROOT + filePath |
|
||||
| examples/TaintedPath.js:11:36:11:43 | filePath | examples/TaintedPath.js:11:29:11:43 | ROOT + filePath |
|
||||
| examples/TaintedPath.js:11:36:11:43 | filePath | examples/TaintedPath.js:11:29:11:43 | ROOT + filePath |
|
||||
| express.js:8:20:8:32 | req.query.bar | express.js:8:20:8:32 | req.query.bar |
|
||||
| handlebars.js:10:51:10:58 | filePath | handlebars.js:11:32:11:39 | filePath |
|
||||
| handlebars.js:10:51:10:58 | filePath | handlebars.js:11:32:11:39 | filePath |
|
||||
@@ -7264,6 +7538,30 @@ edges
|
||||
| normalizedPaths.js:385:35:385:45 | req.query.x | normalizedPaths.js:385:14:385:46 | pathMod ... uery.x) |
|
||||
| normalizedPaths.js:385:35:385:45 | req.query.x | normalizedPaths.js:385:14:385:46 | pathMod ... uery.x) |
|
||||
| normalizedPaths.js:385:35:385:45 | req.query.x | normalizedPaths.js:385:14:385:46 | pathMod ... uery.x) |
|
||||
| normalizedPaths.js:407:45:407:55 | req.query.x | normalizedPaths.js:407:45:407:66 | req.que ... it('/') |
|
||||
| normalizedPaths.js:407:45:407:55 | req.query.x | normalizedPaths.js:407:45:407:66 | req.que ... it('/') |
|
||||
| normalizedPaths.js:407:45:407:55 | req.query.x | normalizedPaths.js:407:45:407:66 | req.que ... it('/') |
|
||||
| normalizedPaths.js:407:45:407:55 | req.query.x | normalizedPaths.js:407:45:407:66 | req.que ... it('/') |
|
||||
| normalizedPaths.js:407:45:407:55 | req.query.x | normalizedPaths.js:407:45:407:66 | req.que ... it('/') |
|
||||
| normalizedPaths.js:407:45:407:55 | req.query.x | normalizedPaths.js:407:45:407:66 | req.que ... it('/') |
|
||||
| normalizedPaths.js:407:45:407:66 | req.que ... it('/') | normalizedPaths.js:407:19:407:67 | pathMod ... t('/')) |
|
||||
| normalizedPaths.js:407:45:407:66 | req.que ... it('/') | normalizedPaths.js:407:19:407:67 | pathMod ... t('/')) |
|
||||
| normalizedPaths.js:407:45:407:66 | req.que ... it('/') | normalizedPaths.js:407:19:407:67 | pathMod ... t('/')) |
|
||||
| normalizedPaths.js:407:45:407:66 | req.que ... it('/') | normalizedPaths.js:407:19:407:67 | pathMod ... t('/')) |
|
||||
| normalizedPaths.js:407:45:407:66 | req.que ... it('/') | normalizedPaths.js:407:19:407:67 | pathMod ... t('/')) |
|
||||
| normalizedPaths.js:407:45:407:66 | req.que ... it('/') | normalizedPaths.js:407:19:407:67 | pathMod ... t('/')) |
|
||||
| normalizedPaths.js:408:38:408:48 | req.query.x | normalizedPaths.js:408:38:408:59 | req.que ... it('/') |
|
||||
| normalizedPaths.js:408:38:408:48 | req.query.x | normalizedPaths.js:408:38:408:59 | req.que ... it('/') |
|
||||
| normalizedPaths.js:408:38:408:48 | req.query.x | normalizedPaths.js:408:38:408:59 | req.que ... it('/') |
|
||||
| normalizedPaths.js:408:38:408:48 | req.query.x | normalizedPaths.js:408:38:408:59 | req.que ... it('/') |
|
||||
| normalizedPaths.js:408:38:408:48 | req.query.x | normalizedPaths.js:408:38:408:59 | req.que ... it('/') |
|
||||
| normalizedPaths.js:408:38:408:48 | req.query.x | normalizedPaths.js:408:38:408:59 | req.que ... it('/') |
|
||||
| normalizedPaths.js:408:38:408:59 | req.que ... it('/') | normalizedPaths.js:408:19:408:60 | pathMod ... t('/')) |
|
||||
| normalizedPaths.js:408:38:408:59 | req.que ... it('/') | normalizedPaths.js:408:19:408:60 | pathMod ... t('/')) |
|
||||
| normalizedPaths.js:408:38:408:59 | req.que ... it('/') | normalizedPaths.js:408:19:408:60 | pathMod ... t('/')) |
|
||||
| normalizedPaths.js:408:38:408:59 | req.que ... it('/') | normalizedPaths.js:408:19:408:60 | pathMod ... t('/')) |
|
||||
| normalizedPaths.js:408:38:408:59 | req.que ... it('/') | normalizedPaths.js:408:19:408:60 | pathMod ... t('/')) |
|
||||
| normalizedPaths.js:408:38:408:59 | req.que ... it('/') | normalizedPaths.js:408:19:408:60 | pathMod ... t('/')) |
|
||||
| other-fs-libraries.js:9:7:9:48 | path | other-fs-libraries.js:11:19:11:22 | path |
|
||||
| other-fs-libraries.js:9:7:9:48 | path | other-fs-libraries.js:11:19:11:22 | path |
|
||||
| other-fs-libraries.js:9:7:9:48 | path | other-fs-libraries.js:11:19:11:22 | path |
|
||||
@@ -8288,6 +8586,118 @@ edges
|
||||
| other-fs-libraries.js:68:24:68:30 | req.url | other-fs-libraries.js:68:14:68:37 | url.par ... , true) |
|
||||
| other-fs-libraries.js:68:24:68:30 | req.url | other-fs-libraries.js:68:14:68:37 | url.par ... , true) |
|
||||
| other-fs-libraries.js:68:24:68:30 | req.url | other-fs-libraries.js:68:14:68:37 | url.par ... , true) |
|
||||
| other-fs-libraries.js:77:7:77:48 | path | other-fs-libraries.js:79:16:79:19 | path |
|
||||
| other-fs-libraries.js:77:7:77:48 | path | other-fs-libraries.js:79:16:79:19 | path |
|
||||
| other-fs-libraries.js:77:7:77:48 | path | other-fs-libraries.js:79:16:79:19 | path |
|
||||
| other-fs-libraries.js:77:7:77:48 | path | other-fs-libraries.js:79:16:79:19 | path |
|
||||
| other-fs-libraries.js:77:7:77:48 | path | other-fs-libraries.js:79:16:79:19 | path |
|
||||
| other-fs-libraries.js:77:7:77:48 | path | other-fs-libraries.js:79:16:79:19 | path |
|
||||
| other-fs-libraries.js:77:7:77:48 | path | other-fs-libraries.js:79:16:79:19 | path |
|
||||
| other-fs-libraries.js:77:7:77:48 | path | other-fs-libraries.js:79:16:79:19 | path |
|
||||
| other-fs-libraries.js:77:7:77:48 | path | other-fs-libraries.js:79:16:79:19 | path |
|
||||
| other-fs-libraries.js:77:7:77:48 | path | other-fs-libraries.js:79:16:79:19 | path |
|
||||
| other-fs-libraries.js:77:7:77:48 | path | other-fs-libraries.js:79:16:79:19 | path |
|
||||
| other-fs-libraries.js:77:7:77:48 | path | other-fs-libraries.js:79:16:79:19 | path |
|
||||
| other-fs-libraries.js:77:7:77:48 | path | other-fs-libraries.js:79:16:79:19 | path |
|
||||
| other-fs-libraries.js:77:7:77:48 | path | other-fs-libraries.js:79:16:79:19 | path |
|
||||
| other-fs-libraries.js:77:7:77:48 | path | other-fs-libraries.js:79:16:79:19 | path |
|
||||
| other-fs-libraries.js:77:7:77:48 | path | other-fs-libraries.js:79:16:79:19 | path |
|
||||
| other-fs-libraries.js:77:7:77:48 | path | other-fs-libraries.js:79:16:79:19 | path |
|
||||
| other-fs-libraries.js:77:7:77:48 | path | other-fs-libraries.js:79:16:79:19 | path |
|
||||
| other-fs-libraries.js:77:7:77:48 | path | other-fs-libraries.js:79:16:79:19 | path |
|
||||
| other-fs-libraries.js:77:7:77:48 | path | other-fs-libraries.js:79:16:79:19 | path |
|
||||
| other-fs-libraries.js:77:7:77:48 | path | other-fs-libraries.js:79:16:79:19 | path |
|
||||
| other-fs-libraries.js:77:7:77:48 | path | other-fs-libraries.js:79:16:79:19 | path |
|
||||
| other-fs-libraries.js:77:7:77:48 | path | other-fs-libraries.js:79:16:79:19 | path |
|
||||
| other-fs-libraries.js:77:7:77:48 | path | other-fs-libraries.js:79:16:79:19 | path |
|
||||
| other-fs-libraries.js:77:7:77:48 | path | other-fs-libraries.js:79:16:79:19 | path |
|
||||
| other-fs-libraries.js:77:7:77:48 | path | other-fs-libraries.js:79:16:79:19 | path |
|
||||
| other-fs-libraries.js:77:7:77:48 | path | other-fs-libraries.js:79:16:79:19 | path |
|
||||
| other-fs-libraries.js:77:7:77:48 | path | other-fs-libraries.js:79:16:79:19 | path |
|
||||
| other-fs-libraries.js:77:7:77:48 | path | other-fs-libraries.js:79:16:79:19 | path |
|
||||
| other-fs-libraries.js:77:7:77:48 | path | other-fs-libraries.js:79:16:79:19 | path |
|
||||
| other-fs-libraries.js:77:7:77:48 | path | other-fs-libraries.js:79:16:79:19 | path |
|
||||
| other-fs-libraries.js:77:7:77:48 | path | other-fs-libraries.js:79:16:79:19 | path |
|
||||
| other-fs-libraries.js:77:14:77:37 | url.par ... , true) | other-fs-libraries.js:77:14:77:43 | url.par ... ).query |
|
||||
| other-fs-libraries.js:77:14:77:37 | url.par ... , true) | other-fs-libraries.js:77:14:77:43 | url.par ... ).query |
|
||||
| other-fs-libraries.js:77:14:77:37 | url.par ... , true) | other-fs-libraries.js:77:14:77:43 | url.par ... ).query |
|
||||
| other-fs-libraries.js:77:14:77:37 | url.par ... , true) | other-fs-libraries.js:77:14:77:43 | url.par ... ).query |
|
||||
| other-fs-libraries.js:77:14:77:37 | url.par ... , true) | other-fs-libraries.js:77:14:77:43 | url.par ... ).query |
|
||||
| other-fs-libraries.js:77:14:77:37 | url.par ... , true) | other-fs-libraries.js:77:14:77:43 | url.par ... ).query |
|
||||
| other-fs-libraries.js:77:14:77:37 | url.par ... , true) | other-fs-libraries.js:77:14:77:43 | url.par ... ).query |
|
||||
| other-fs-libraries.js:77:14:77:37 | url.par ... , true) | other-fs-libraries.js:77:14:77:43 | url.par ... ).query |
|
||||
| other-fs-libraries.js:77:14:77:37 | url.par ... , true) | other-fs-libraries.js:77:14:77:43 | url.par ... ).query |
|
||||
| other-fs-libraries.js:77:14:77:37 | url.par ... , true) | other-fs-libraries.js:77:14:77:43 | url.par ... ).query |
|
||||
| other-fs-libraries.js:77:14:77:37 | url.par ... , true) | other-fs-libraries.js:77:14:77:43 | url.par ... ).query |
|
||||
| other-fs-libraries.js:77:14:77:37 | url.par ... , true) | other-fs-libraries.js:77:14:77:43 | url.par ... ).query |
|
||||
| other-fs-libraries.js:77:14:77:37 | url.par ... , true) | other-fs-libraries.js:77:14:77:43 | url.par ... ).query |
|
||||
| other-fs-libraries.js:77:14:77:37 | url.par ... , true) | other-fs-libraries.js:77:14:77:43 | url.par ... ).query |
|
||||
| other-fs-libraries.js:77:14:77:37 | url.par ... , true) | other-fs-libraries.js:77:14:77:43 | url.par ... ).query |
|
||||
| other-fs-libraries.js:77:14:77:37 | url.par ... , true) | other-fs-libraries.js:77:14:77:43 | url.par ... ).query |
|
||||
| other-fs-libraries.js:77:14:77:43 | url.par ... ).query | other-fs-libraries.js:77:14:77:48 | url.par ... ry.path |
|
||||
| other-fs-libraries.js:77:14:77:43 | url.par ... ).query | other-fs-libraries.js:77:14:77:48 | url.par ... ry.path |
|
||||
| other-fs-libraries.js:77:14:77:43 | url.par ... ).query | other-fs-libraries.js:77:14:77:48 | url.par ... ry.path |
|
||||
| other-fs-libraries.js:77:14:77:43 | url.par ... ).query | other-fs-libraries.js:77:14:77:48 | url.par ... ry.path |
|
||||
| other-fs-libraries.js:77:14:77:43 | url.par ... ).query | other-fs-libraries.js:77:14:77:48 | url.par ... ry.path |
|
||||
| other-fs-libraries.js:77:14:77:43 | url.par ... ).query | other-fs-libraries.js:77:14:77:48 | url.par ... ry.path |
|
||||
| other-fs-libraries.js:77:14:77:43 | url.par ... ).query | other-fs-libraries.js:77:14:77:48 | url.par ... ry.path |
|
||||
| other-fs-libraries.js:77:14:77:43 | url.par ... ).query | other-fs-libraries.js:77:14:77:48 | url.par ... ry.path |
|
||||
| other-fs-libraries.js:77:14:77:43 | url.par ... ).query | other-fs-libraries.js:77:14:77:48 | url.par ... ry.path |
|
||||
| other-fs-libraries.js:77:14:77:43 | url.par ... ).query | other-fs-libraries.js:77:14:77:48 | url.par ... ry.path |
|
||||
| other-fs-libraries.js:77:14:77:43 | url.par ... ).query | other-fs-libraries.js:77:14:77:48 | url.par ... ry.path |
|
||||
| other-fs-libraries.js:77:14:77:43 | url.par ... ).query | other-fs-libraries.js:77:14:77:48 | url.par ... ry.path |
|
||||
| other-fs-libraries.js:77:14:77:43 | url.par ... ).query | other-fs-libraries.js:77:14:77:48 | url.par ... ry.path |
|
||||
| other-fs-libraries.js:77:14:77:43 | url.par ... ).query | other-fs-libraries.js:77:14:77:48 | url.par ... ry.path |
|
||||
| other-fs-libraries.js:77:14:77:43 | url.par ... ).query | other-fs-libraries.js:77:14:77:48 | url.par ... ry.path |
|
||||
| other-fs-libraries.js:77:14:77:43 | url.par ... ).query | other-fs-libraries.js:77:14:77:48 | url.par ... ry.path |
|
||||
| other-fs-libraries.js:77:14:77:48 | url.par ... ry.path | other-fs-libraries.js:77:7:77:48 | path |
|
||||
| other-fs-libraries.js:77:14:77:48 | url.par ... ry.path | other-fs-libraries.js:77:7:77:48 | path |
|
||||
| other-fs-libraries.js:77:14:77:48 | url.par ... ry.path | other-fs-libraries.js:77:7:77:48 | path |
|
||||
| other-fs-libraries.js:77:14:77:48 | url.par ... ry.path | other-fs-libraries.js:77:7:77:48 | path |
|
||||
| other-fs-libraries.js:77:14:77:48 | url.par ... ry.path | other-fs-libraries.js:77:7:77:48 | path |
|
||||
| other-fs-libraries.js:77:14:77:48 | url.par ... ry.path | other-fs-libraries.js:77:7:77:48 | path |
|
||||
| other-fs-libraries.js:77:14:77:48 | url.par ... ry.path | other-fs-libraries.js:77:7:77:48 | path |
|
||||
| other-fs-libraries.js:77:14:77:48 | url.par ... ry.path | other-fs-libraries.js:77:7:77:48 | path |
|
||||
| other-fs-libraries.js:77:14:77:48 | url.par ... ry.path | other-fs-libraries.js:77:7:77:48 | path |
|
||||
| other-fs-libraries.js:77:14:77:48 | url.par ... ry.path | other-fs-libraries.js:77:7:77:48 | path |
|
||||
| other-fs-libraries.js:77:14:77:48 | url.par ... ry.path | other-fs-libraries.js:77:7:77:48 | path |
|
||||
| other-fs-libraries.js:77:14:77:48 | url.par ... ry.path | other-fs-libraries.js:77:7:77:48 | path |
|
||||
| other-fs-libraries.js:77:14:77:48 | url.par ... ry.path | other-fs-libraries.js:77:7:77:48 | path |
|
||||
| other-fs-libraries.js:77:14:77:48 | url.par ... ry.path | other-fs-libraries.js:77:7:77:48 | path |
|
||||
| other-fs-libraries.js:77:14:77:48 | url.par ... ry.path | other-fs-libraries.js:77:7:77:48 | path |
|
||||
| other-fs-libraries.js:77:14:77:48 | url.par ... ry.path | other-fs-libraries.js:77:7:77:48 | path |
|
||||
| other-fs-libraries.js:77:24:77:30 | req.url | other-fs-libraries.js:77:14:77:37 | url.par ... , true) |
|
||||
| other-fs-libraries.js:77:24:77:30 | req.url | other-fs-libraries.js:77:14:77:37 | url.par ... , true) |
|
||||
| other-fs-libraries.js:77:24:77:30 | req.url | other-fs-libraries.js:77:14:77:37 | url.par ... , true) |
|
||||
| other-fs-libraries.js:77:24:77:30 | req.url | other-fs-libraries.js:77:14:77:37 | url.par ... , true) |
|
||||
| other-fs-libraries.js:77:24:77:30 | req.url | other-fs-libraries.js:77:14:77:37 | url.par ... , true) |
|
||||
| other-fs-libraries.js:77:24:77:30 | req.url | other-fs-libraries.js:77:14:77:37 | url.par ... , true) |
|
||||
| other-fs-libraries.js:77:24:77:30 | req.url | other-fs-libraries.js:77:14:77:37 | url.par ... , true) |
|
||||
| other-fs-libraries.js:77:24:77:30 | req.url | other-fs-libraries.js:77:14:77:37 | url.par ... , true) |
|
||||
| other-fs-libraries.js:77:24:77:30 | req.url | other-fs-libraries.js:77:14:77:37 | url.par ... , true) |
|
||||
| other-fs-libraries.js:77:24:77:30 | req.url | other-fs-libraries.js:77:14:77:37 | url.par ... , true) |
|
||||
| other-fs-libraries.js:77:24:77:30 | req.url | other-fs-libraries.js:77:14:77:37 | url.par ... , true) |
|
||||
| other-fs-libraries.js:77:24:77:30 | req.url | other-fs-libraries.js:77:14:77:37 | url.par ... , true) |
|
||||
| other-fs-libraries.js:77:24:77:30 | req.url | other-fs-libraries.js:77:14:77:37 | url.par ... , true) |
|
||||
| other-fs-libraries.js:77:24:77:30 | req.url | other-fs-libraries.js:77:14:77:37 | url.par ... , true) |
|
||||
| other-fs-libraries.js:77:24:77:30 | req.url | other-fs-libraries.js:77:14:77:37 | url.par ... , true) |
|
||||
| other-fs-libraries.js:77:24:77:30 | req.url | other-fs-libraries.js:77:14:77:37 | url.par ... , true) |
|
||||
| other-fs-libraries.js:77:24:77:30 | req.url | other-fs-libraries.js:77:14:77:37 | url.par ... , true) |
|
||||
| other-fs-libraries.js:77:24:77:30 | req.url | other-fs-libraries.js:77:14:77:37 | url.par ... , true) |
|
||||
| other-fs-libraries.js:77:24:77:30 | req.url | other-fs-libraries.js:77:14:77:37 | url.par ... , true) |
|
||||
| other-fs-libraries.js:77:24:77:30 | req.url | other-fs-libraries.js:77:14:77:37 | url.par ... , true) |
|
||||
| other-fs-libraries.js:77:24:77:30 | req.url | other-fs-libraries.js:77:14:77:37 | url.par ... , true) |
|
||||
| other-fs-libraries.js:77:24:77:30 | req.url | other-fs-libraries.js:77:14:77:37 | url.par ... , true) |
|
||||
| other-fs-libraries.js:77:24:77:30 | req.url | other-fs-libraries.js:77:14:77:37 | url.par ... , true) |
|
||||
| other-fs-libraries.js:77:24:77:30 | req.url | other-fs-libraries.js:77:14:77:37 | url.par ... , true) |
|
||||
| other-fs-libraries.js:77:24:77:30 | req.url | other-fs-libraries.js:77:14:77:37 | url.par ... , true) |
|
||||
| other-fs-libraries.js:77:24:77:30 | req.url | other-fs-libraries.js:77:14:77:37 | url.par ... , true) |
|
||||
| other-fs-libraries.js:77:24:77:30 | req.url | other-fs-libraries.js:77:14:77:37 | url.par ... , true) |
|
||||
| other-fs-libraries.js:77:24:77:30 | req.url | other-fs-libraries.js:77:14:77:37 | url.par ... , true) |
|
||||
| other-fs-libraries.js:77:24:77:30 | req.url | other-fs-libraries.js:77:14:77:37 | url.par ... , true) |
|
||||
| other-fs-libraries.js:77:24:77:30 | req.url | other-fs-libraries.js:77:14:77:37 | url.par ... , true) |
|
||||
| other-fs-libraries.js:77:24:77:30 | req.url | other-fs-libraries.js:77:14:77:37 | url.par ... , true) |
|
||||
| other-fs-libraries.js:77:24:77:30 | req.url | other-fs-libraries.js:77:14:77:37 | url.par ... , true) |
|
||||
| prettier.js:6:11:6:28 | p | prettier.js:7:28:7:28 | p |
|
||||
| prettier.js:6:11:6:28 | p | prettier.js:7:28:7:28 | p |
|
||||
| prettier.js:6:11:6:28 | p | prettier.js:7:28:7:28 | p |
|
||||
@@ -10101,6 +10511,7 @@ edges
|
||||
| TaintedPath.js:212:31:212:34 | path | TaintedPath.js:211:24:211:30 | req.url | TaintedPath.js:212:31:212:34 | path | This path depends on a $@. | TaintedPath.js:211:24:211:30 | req.url | user-provided value |
|
||||
| TaintedPath.js:213:45:213:48 | path | TaintedPath.js:211:24:211:30 | req.url | TaintedPath.js:213:45:213:48 | path | This path depends on a $@. | TaintedPath.js:211:24:211:30 | req.url | user-provided value |
|
||||
| TaintedPath.js:214:35:214:38 | path | TaintedPath.js:211:24:211:30 | req.url | TaintedPath.js:214:35:214:38 | path | This path depends on a $@. | TaintedPath.js:211:24:211:30 | req.url | user-provided value |
|
||||
| examples/TaintedPath.js:11:29:11:43 | ROOT + filePath | examples/TaintedPath.js:8:28:8:34 | req.url | examples/TaintedPath.js:11:29:11:43 | ROOT + filePath | This path depends on a $@. | examples/TaintedPath.js:8:28:8:34 | req.url | user-provided value |
|
||||
| express.js:8:20:8:32 | req.query.bar | express.js:8:20:8:32 | req.query.bar | express.js:8:20:8:32 | req.query.bar | This path depends on a $@. | express.js:8:20:8:32 | req.query.bar | user-provided value |
|
||||
| handlebars.js:11:32:11:39 | filePath | handlebars.js:29:46:29:60 | req.params.path | handlebars.js:11:32:11:39 | filePath | This path depends on a $@. | handlebars.js:29:46:29:60 | req.params.path | user-provided value |
|
||||
| handlebars.js:15:25:15:32 | filePath | handlebars.js:43:15:43:29 | req.params.path | handlebars.js:15:25:15:32 | filePath | This path depends on a $@. | handlebars.js:43:15:43:29 | req.params.path | user-provided value |
|
||||
@@ -10165,6 +10576,8 @@ edges
|
||||
| normalizedPaths.js:381:19:381:29 | slash(path) | normalizedPaths.js:377:14:377:27 | req.query.path | normalizedPaths.js:381:19:381:29 | slash(path) | This path depends on a $@. | normalizedPaths.js:377:14:377:27 | req.query.path | user-provided value |
|
||||
| normalizedPaths.js:388:19:388:22 | path | normalizedPaths.js:385:35:385:45 | req.query.x | normalizedPaths.js:388:19:388:22 | path | This path depends on a $@. | normalizedPaths.js:385:35:385:45 | req.query.x | user-provided value |
|
||||
| normalizedPaths.js:399:21:399:24 | path | normalizedPaths.js:385:35:385:45 | req.query.x | normalizedPaths.js:399:21:399:24 | path | This path depends on a $@. | normalizedPaths.js:385:35:385:45 | req.query.x | user-provided value |
|
||||
| normalizedPaths.js:407:19:407:67 | pathMod ... t('/')) | normalizedPaths.js:407:45:407:55 | req.query.x | normalizedPaths.js:407:19:407:67 | pathMod ... t('/')) | This path depends on a $@. | normalizedPaths.js:407:45:407:55 | req.query.x | user-provided value |
|
||||
| normalizedPaths.js:408:19:408:60 | pathMod ... t('/')) | normalizedPaths.js:408:38:408:48 | req.query.x | normalizedPaths.js:408:19:408:60 | pathMod ... t('/')) | This path depends on a $@. | normalizedPaths.js:408:38:408:48 | req.query.x | user-provided value |
|
||||
| other-fs-libraries.js:11:19:11:22 | path | other-fs-libraries.js:9:24:9:30 | req.url | other-fs-libraries.js:11:19:11:22 | path | This path depends on a $@. | other-fs-libraries.js:9:24:9:30 | req.url | user-provided value |
|
||||
| other-fs-libraries.js:12:27:12:30 | path | other-fs-libraries.js:9:24:9:30 | req.url | other-fs-libraries.js:12:27:12:30 | path | This path depends on a $@. | other-fs-libraries.js:9:24:9:30 | req.url | user-provided value |
|
||||
| other-fs-libraries.js:13:24:13:27 | path | other-fs-libraries.js:9:24:9:30 | req.url | other-fs-libraries.js:13:24:13:27 | path | This path depends on a $@. | other-fs-libraries.js:9:24:9:30 | req.url | user-provided value |
|
||||
@@ -10187,6 +10600,7 @@ edges
|
||||
| other-fs-libraries.js:70:19:70:22 | path | other-fs-libraries.js:68:24:68:30 | req.url | other-fs-libraries.js:70:19:70:22 | path | This path depends on a $@. | other-fs-libraries.js:68:24:68:30 | req.url | user-provided value |
|
||||
| other-fs-libraries.js:71:10:71:13 | path | other-fs-libraries.js:68:24:68:30 | req.url | other-fs-libraries.js:71:10:71:13 | path | This path depends on a $@. | other-fs-libraries.js:68:24:68:30 | req.url | user-provided value |
|
||||
| other-fs-libraries.js:72:15:72:18 | path | other-fs-libraries.js:68:24:68:30 | req.url | other-fs-libraries.js:72:15:72:18 | path | This path depends on a $@. | other-fs-libraries.js:68:24:68:30 | req.url | user-provided value |
|
||||
| other-fs-libraries.js:79:16:79:19 | path | other-fs-libraries.js:77:24:77:30 | req.url | other-fs-libraries.js:79:16:79:19 | path | This path depends on a $@. | other-fs-libraries.js:77:24:77:30 | req.url | user-provided value |
|
||||
| prettier.js:7:28:7:28 | p | prettier.js:6:13:6:13 | p | prettier.js:7:28:7:28 | p | This path depends on a $@. | prettier.js:6:13:6:13 | p | user-provided value |
|
||||
| prettier.js:11:44:11:44 | p | prettier.js:6:13:6:13 | p | prettier.js:11:44:11:44 | p | This path depends on a $@. | prettier.js:6:13:6:13 | p | user-provided value |
|
||||
| pupeteer.js:9:28:9:34 | tainted | pupeteer.js:5:28:5:53 | parseTo ... t).name | pupeteer.js:9:28:9:34 | tainted | This path depends on a $@. | pupeteer.js:5:28:5:53 | parseTo ... t).name | user-provided value |
|
||||
|
||||
@@ -0,0 +1,12 @@
|
||||
const fs = require('fs'),
|
||||
http = require('http'),
|
||||
url = require('url');
|
||||
|
||||
const ROOT = "/var/www/";
|
||||
|
||||
var server = http.createServer(function(req, res) {
|
||||
let filePath = url.parse(req.url, true).query.path;
|
||||
|
||||
// BAD: This function uses unsanitized input that can read any file on the file system.
|
||||
res.write(fs.readFileSync(ROOT + filePath, 'utf8'));
|
||||
});
|
||||
@@ -0,0 +1,19 @@
|
||||
const fs = require('fs'),
|
||||
http = require('http'),
|
||||
path = require('path'),
|
||||
url = require('url');
|
||||
|
||||
const ROOT = "/var/www/";
|
||||
|
||||
var server = http.createServer(function(req, res) {
|
||||
let filePath = url.parse(req.url, true).query.path;
|
||||
|
||||
// GOOD: Verify that the file path is under the root directory
|
||||
filePath = fs.realpathSync(path.resolve(ROOT, filePath));
|
||||
if (!filePath.startsWith(ROOT)) {
|
||||
res.statusCode = 403;
|
||||
res.end();
|
||||
return;
|
||||
}
|
||||
res.write(fs.readFileSync(filePath, 'utf8'));
|
||||
});
|
||||
@@ -45,4 +45,12 @@ var fs = {};
|
||||
*/
|
||||
fs.readFileSync = function(filename, encoding) {};
|
||||
|
||||
/**
|
||||
* @param {string} filename
|
||||
* @param {string} encoding
|
||||
* @param {(function(NodeJS.ErrnoException, string): void)} callback
|
||||
* @return {void}
|
||||
*/
|
||||
fs.readFile = function(filename, encoding, callback) {};
|
||||
|
||||
module.exports = fs;
|
||||
|
||||
@@ -32,17 +32,17 @@ app.get('/normalize-notAbsolute', (req, res) => {
|
||||
|
||||
if (pathModule.isAbsolute(path))
|
||||
return;
|
||||
|
||||
|
||||
fs.readFileSync(path); // NOT OK
|
||||
|
||||
if (!path.startsWith("."))
|
||||
fs.readFileSync(path); // OK
|
||||
else
|
||||
fs.readFileSync(path); // NOT OK - wrong polarity
|
||||
|
||||
|
||||
if (!path.startsWith(".."))
|
||||
fs.readFileSync(path); // OK
|
||||
|
||||
|
||||
if (!path.startsWith("../"))
|
||||
fs.readFileSync(path); // OK
|
||||
|
||||
@@ -52,7 +52,7 @@ app.get('/normalize-notAbsolute', (req, res) => {
|
||||
|
||||
app.get('/normalize-noInitialDotDot', (req, res) => {
|
||||
let path = pathModule.normalize(req.query.path);
|
||||
|
||||
|
||||
if (path.startsWith(".."))
|
||||
return;
|
||||
|
||||
@@ -80,7 +80,7 @@ app.get('/prepend-normalize', (req, res) => {
|
||||
|
||||
app.get('/absolute', (req, res) => {
|
||||
let path = req.query.path;
|
||||
|
||||
|
||||
if (!pathModule.isAbsolute(path))
|
||||
return;
|
||||
|
||||
@@ -92,10 +92,10 @@ app.get('/absolute', (req, res) => {
|
||||
|
||||
app.get('/normalized-absolute', (req, res) => {
|
||||
let path = pathModule.normalize(req.query.path);
|
||||
|
||||
|
||||
if (!pathModule.isAbsolute(path))
|
||||
return;
|
||||
|
||||
|
||||
res.write(fs.readFileSync(path)); // NOT OK
|
||||
|
||||
if (path.startsWith('/home/user/www'))
|
||||
@@ -104,7 +104,7 @@ app.get('/normalized-absolute', (req, res) => {
|
||||
|
||||
app.get('/combined-check', (req, res) => {
|
||||
let path = pathModule.normalize(req.query.path);
|
||||
|
||||
|
||||
// Combined absoluteness and folder check in one startsWith call
|
||||
if (path.startsWith("/home/user/www"))
|
||||
fs.readFileSync(path); // OK
|
||||
@@ -121,7 +121,7 @@ app.get('/realpath', (req, res) => {
|
||||
|
||||
if (path.startsWith("/home/user/www"))
|
||||
fs.readFileSync(path); // OK - both absolute and normalized before check
|
||||
|
||||
|
||||
fs.readFileSync(pathModule.join('.', path)); // OK - normalized and coerced to relative
|
||||
fs.readFileSync(pathModule.join('/home/user/www', path)); // OK
|
||||
});
|
||||
@@ -212,7 +212,7 @@ app.get('/join-regression', (req, res) => {
|
||||
|
||||
app.get('/decode-after-normalization', (req, res) => {
|
||||
let path = pathModule.normalize(req.query.path);
|
||||
|
||||
|
||||
if (!pathModule.isAbsolute(path) && !path.startsWith('..'))
|
||||
fs.readFileSync(path); // OK
|
||||
|
||||
@@ -238,7 +238,7 @@ app.get('/resolve-path', (req, res) => {
|
||||
fs.readFileSync(path); // NOT OK
|
||||
|
||||
var self = something();
|
||||
|
||||
|
||||
if (path.substring(0, self.dir.length) === self.dir)
|
||||
fs.readFileSync(path); // OK
|
||||
else
|
||||
@@ -256,12 +256,12 @@ app.get('/relative-startswith', (req, res) => {
|
||||
fs.readFileSync(path); // NOT OK
|
||||
|
||||
var self = something();
|
||||
|
||||
|
||||
var relative = pathModule.relative(self.webroot, path);
|
||||
if(relative.startsWith(".." + pathModule.sep) || relative == "..") {
|
||||
fs.readFileSync(path); // NOT OK!
|
||||
fs.readFileSync(path); // NOT OK!
|
||||
} else {
|
||||
fs.readFileSync(path); // OK!
|
||||
fs.readFileSync(path); // OK!
|
||||
}
|
||||
|
||||
let newpath = pathModule.normalize(path);
|
||||
@@ -277,7 +277,7 @@ app.get('/relative-startswith', (req, res) => {
|
||||
if (relativePath.indexOf('../') === 0) {
|
||||
fs.readFileSync(newpath); // NOT OK!
|
||||
} else {
|
||||
fs.readFileSync(newpath); // OK!
|
||||
fs.readFileSync(newpath); // OK!
|
||||
}
|
||||
|
||||
let newpath = pathModule.normalize(path);
|
||||
@@ -285,7 +285,7 @@ app.get('/relative-startswith', (req, res) => {
|
||||
if (pathModule.normalize(relativePath).indexOf('../') === 0) {
|
||||
fs.readFileSync(newpath); // NOT OK!
|
||||
} else {
|
||||
fs.readFileSync(newpath); // OK!
|
||||
fs.readFileSync(newpath); // OK!
|
||||
}
|
||||
|
||||
let newpath = pathModule.normalize(path);
|
||||
@@ -293,7 +293,7 @@ app.get('/relative-startswith', (req, res) => {
|
||||
if (pathModule.normalize(relativePath).indexOf('../')) {
|
||||
fs.readFileSync(newpath); // OK!
|
||||
} else {
|
||||
fs.readFileSync(newpath); // NOT OK!
|
||||
fs.readFileSync(newpath); // NOT OK!
|
||||
}
|
||||
});
|
||||
|
||||
@@ -340,7 +340,7 @@ app.get('/yet-another-prefix', (req, res) => {
|
||||
|
||||
fs.readFileSync(path); // NOT OK
|
||||
|
||||
var abs = pathModule.resolve(path);
|
||||
var abs = pathModule.resolve(path);
|
||||
|
||||
if (abs.indexOf(root) !== 0) {
|
||||
fs.readFileSync(path); // NOT OK
|
||||
@@ -402,3 +402,8 @@ app.get('/dotdot-regexp', (req, res) => {
|
||||
fs.readFileSync(path); // OK
|
||||
}
|
||||
});
|
||||
|
||||
app.get('/join-spread', (req, res) => {
|
||||
fs.readFileSync(pathModule.join('foo', ...req.query.x.split('/'))); // NOT OK
|
||||
fs.readFileSync(pathModule.join(...req.query.x.split('/'))); // NOT OK
|
||||
});
|
||||
|
||||
@@ -71,3 +71,10 @@ http.createServer(function(req, res) {
|
||||
mkdirp(path); // NOT OK
|
||||
mkdirp.sync(path); // NOT OK
|
||||
});
|
||||
|
||||
const fsp = require("fs/promises");
|
||||
http.createServer(function(req, res) {
|
||||
var path = url.parse(req.url, true).query.path;
|
||||
|
||||
fsp.readFile(path); // NOT OK
|
||||
});
|
||||
|
||||
@@ -706,6 +706,18 @@ nodes
|
||||
| tooltip.jsx:11:25:11:30 | source |
|
||||
| tooltip.jsx:11:25:11:30 | source |
|
||||
| tooltip.jsx:11:25:11:30 | source |
|
||||
| tooltip.jsx:18:51:18:59 | provide() |
|
||||
| tooltip.jsx:18:51:18:59 | provide() |
|
||||
| tooltip.jsx:18:51:18:59 | provide() |
|
||||
| tooltip.jsx:18:51:18:59 | provide() |
|
||||
| tooltip.jsx:18:51:18:59 | provide() |
|
||||
| tooltip.jsx:22:11:22:30 | source |
|
||||
| tooltip.jsx:22:11:22:30 | source |
|
||||
| tooltip.jsx:22:20:22:30 | window.name |
|
||||
| tooltip.jsx:22:20:22:30 | window.name |
|
||||
| tooltip.jsx:22:20:22:30 | window.name |
|
||||
| tooltip.jsx:23:38:23:43 | source |
|
||||
| tooltip.jsx:23:38:23:43 | source |
|
||||
| translate.js:6:7:6:39 | target |
|
||||
| translate.js:6:16:6:39 | documen ... .search |
|
||||
| translate.js:6:16:6:39 | documen ... .search |
|
||||
@@ -1882,6 +1894,20 @@ edges
|
||||
| tooltip.jsx:6:20:6:30 | window.name | tooltip.jsx:6:11:6:30 | source |
|
||||
| tooltip.jsx:6:20:6:30 | window.name | tooltip.jsx:6:11:6:30 | source |
|
||||
| tooltip.jsx:6:20:6:30 | window.name | tooltip.jsx:6:11:6:30 | source |
|
||||
| tooltip.jsx:22:11:22:30 | source | tooltip.jsx:18:51:18:59 | provide() |
|
||||
| tooltip.jsx:22:11:22:30 | source | tooltip.jsx:18:51:18:59 | provide() |
|
||||
| tooltip.jsx:22:11:22:30 | source | tooltip.jsx:18:51:18:59 | provide() |
|
||||
| tooltip.jsx:22:11:22:30 | source | tooltip.jsx:18:51:18:59 | provide() |
|
||||
| tooltip.jsx:22:11:22:30 | source | tooltip.jsx:23:38:23:43 | source |
|
||||
| tooltip.jsx:22:11:22:30 | source | tooltip.jsx:23:38:23:43 | source |
|
||||
| tooltip.jsx:22:20:22:30 | window.name | tooltip.jsx:22:11:22:30 | source |
|
||||
| tooltip.jsx:22:20:22:30 | window.name | tooltip.jsx:22:11:22:30 | source |
|
||||
| tooltip.jsx:22:20:22:30 | window.name | tooltip.jsx:22:11:22:30 | source |
|
||||
| tooltip.jsx:22:20:22:30 | window.name | tooltip.jsx:22:11:22:30 | source |
|
||||
| tooltip.jsx:23:38:23:43 | source | tooltip.jsx:18:51:18:59 | provide() |
|
||||
| tooltip.jsx:23:38:23:43 | source | tooltip.jsx:18:51:18:59 | provide() |
|
||||
| tooltip.jsx:23:38:23:43 | source | tooltip.jsx:18:51:18:59 | provide() |
|
||||
| tooltip.jsx:23:38:23:43 | source | tooltip.jsx:18:51:18:59 | provide() |
|
||||
| translate.js:6:7:6:39 | target | translate.js:7:42:7:47 | target |
|
||||
| translate.js:6:16:6:39 | documen ... .search | translate.js:6:7:6:39 | target |
|
||||
| translate.js:6:16:6:39 | documen ... .search | translate.js:6:7:6:39 | target |
|
||||
@@ -2486,6 +2512,7 @@ edges
|
||||
| string-manipulations.js:10:16:10:45 | String( ... n.href) | string-manipulations.js:10:23:10:44 | documen ... on.href | string-manipulations.js:10:16:10:45 | String( ... n.href) | Cross-site scripting vulnerability due to $@. | string-manipulations.js:10:23:10:44 | documen ... on.href | user-provided value |
|
||||
| tooltip.jsx:10:25:10:30 | source | tooltip.jsx:6:20:6:30 | window.name | tooltip.jsx:10:25:10:30 | source | Cross-site scripting vulnerability due to $@. | tooltip.jsx:6:20:6:30 | window.name | user-provided value |
|
||||
| tooltip.jsx:11:25:11:30 | source | tooltip.jsx:6:20:6:30 | window.name | tooltip.jsx:11:25:11:30 | source | Cross-site scripting vulnerability due to $@. | tooltip.jsx:6:20:6:30 | window.name | user-provided value |
|
||||
| tooltip.jsx:18:51:18:59 | provide() | tooltip.jsx:22:20:22:30 | window.name | tooltip.jsx:18:51:18:59 | provide() | Cross-site scripting vulnerability due to $@. | tooltip.jsx:22:20:22:30 | window.name | user-provided value |
|
||||
| translate.js:9:27:9:50 | searchP ... 'term') | translate.js:6:16:6:39 | documen ... .search | translate.js:9:27:9:50 | searchP ... 'term') | Cross-site scripting vulnerability due to $@. | translate.js:6:16:6:39 | documen ... .search | user-provided value |
|
||||
| trusted-types-lib.js:2:12:2:12 | x | trusted-types.js:13:20:13:30 | window.name | trusted-types-lib.js:2:12:2:12 | x | Cross-site scripting vulnerability due to $@. | trusted-types.js:13:20:13:30 | window.name | user-provided value |
|
||||
| trusted-types.js:3:67:3:67 | x | trusted-types.js:4:20:4:30 | window.name | trusted-types.js:3:67:3:67 | x | Cross-site scripting vulnerability due to $@. | trusted-types.js:4:20:4:30 | window.name | user-provided value |
|
||||
|
||||
@@ -718,6 +718,18 @@ nodes
|
||||
| tooltip.jsx:11:25:11:30 | source |
|
||||
| tooltip.jsx:11:25:11:30 | source |
|
||||
| tooltip.jsx:11:25:11:30 | source |
|
||||
| tooltip.jsx:18:51:18:59 | provide() |
|
||||
| tooltip.jsx:18:51:18:59 | provide() |
|
||||
| tooltip.jsx:18:51:18:59 | provide() |
|
||||
| tooltip.jsx:18:51:18:59 | provide() |
|
||||
| tooltip.jsx:18:51:18:59 | provide() |
|
||||
| tooltip.jsx:22:11:22:30 | source |
|
||||
| tooltip.jsx:22:11:22:30 | source |
|
||||
| tooltip.jsx:22:20:22:30 | window.name |
|
||||
| tooltip.jsx:22:20:22:30 | window.name |
|
||||
| tooltip.jsx:22:20:22:30 | window.name |
|
||||
| tooltip.jsx:23:38:23:43 | source |
|
||||
| tooltip.jsx:23:38:23:43 | source |
|
||||
| translate.js:6:7:6:39 | target |
|
||||
| translate.js:6:16:6:39 | documen ... .search |
|
||||
| translate.js:6:16:6:39 | documen ... .search |
|
||||
@@ -1944,6 +1956,20 @@ edges
|
||||
| tooltip.jsx:6:20:6:30 | window.name | tooltip.jsx:6:11:6:30 | source |
|
||||
| tooltip.jsx:6:20:6:30 | window.name | tooltip.jsx:6:11:6:30 | source |
|
||||
| tooltip.jsx:6:20:6:30 | window.name | tooltip.jsx:6:11:6:30 | source |
|
||||
| tooltip.jsx:22:11:22:30 | source | tooltip.jsx:18:51:18:59 | provide() |
|
||||
| tooltip.jsx:22:11:22:30 | source | tooltip.jsx:18:51:18:59 | provide() |
|
||||
| tooltip.jsx:22:11:22:30 | source | tooltip.jsx:18:51:18:59 | provide() |
|
||||
| tooltip.jsx:22:11:22:30 | source | tooltip.jsx:18:51:18:59 | provide() |
|
||||
| tooltip.jsx:22:11:22:30 | source | tooltip.jsx:23:38:23:43 | source |
|
||||
| tooltip.jsx:22:11:22:30 | source | tooltip.jsx:23:38:23:43 | source |
|
||||
| tooltip.jsx:22:20:22:30 | window.name | tooltip.jsx:22:11:22:30 | source |
|
||||
| tooltip.jsx:22:20:22:30 | window.name | tooltip.jsx:22:11:22:30 | source |
|
||||
| tooltip.jsx:22:20:22:30 | window.name | tooltip.jsx:22:11:22:30 | source |
|
||||
| tooltip.jsx:22:20:22:30 | window.name | tooltip.jsx:22:11:22:30 | source |
|
||||
| tooltip.jsx:23:38:23:43 | source | tooltip.jsx:18:51:18:59 | provide() |
|
||||
| tooltip.jsx:23:38:23:43 | source | tooltip.jsx:18:51:18:59 | provide() |
|
||||
| tooltip.jsx:23:38:23:43 | source | tooltip.jsx:18:51:18:59 | provide() |
|
||||
| tooltip.jsx:23:38:23:43 | source | tooltip.jsx:18:51:18:59 | provide() |
|
||||
| translate.js:6:7:6:39 | target | translate.js:7:42:7:47 | target |
|
||||
| translate.js:6:16:6:39 | documen ... .search | translate.js:6:7:6:39 | target |
|
||||
| translate.js:6:16:6:39 | documen ... .search | translate.js:6:7:6:39 | target |
|
||||
|
||||
@@ -11,4 +11,14 @@ function tooltips() {
|
||||
<span data-tip={source} data-html={true} /> // NOT OK
|
||||
<ReactTooltip />
|
||||
</span>
|
||||
}
|
||||
|
||||
function MyElement(props) {
|
||||
const provide = props.provide;
|
||||
return <div dangerouslySetInnerHTML={{__html: provide()}} />; // NOT OK
|
||||
}
|
||||
|
||||
function useMyElement() {
|
||||
const source = window.name;
|
||||
return <MyElement provide={() => source} />;
|
||||
}
|
||||
@@ -112,37 +112,37 @@ nodes
|
||||
| react.js:10:56:10:77 | documen ... on.hash |
|
||||
| react.js:10:56:10:77 | documen ... on.hash |
|
||||
| react.js:10:56:10:77 | documen ... on.hash |
|
||||
| template-sinks.js:17:9:17:31 | tainted |
|
||||
| template-sinks.js:17:19:17:31 | req.query.foo |
|
||||
| template-sinks.js:17:19:17:31 | req.query.foo |
|
||||
| template-sinks.js:19:17:19:23 | tainted |
|
||||
| template-sinks.js:19:17:19:23 | tainted |
|
||||
| template-sinks.js:20:16:20:22 | tainted |
|
||||
| template-sinks.js:20:16:20:22 | tainted |
|
||||
| template-sinks.js:21:18:21:24 | tainted |
|
||||
| template-sinks.js:21:18:21:24 | tainted |
|
||||
| template-sinks.js:22:17:22:23 | tainted |
|
||||
| template-sinks.js:22:17:22:23 | tainted |
|
||||
| template-sinks.js:23:18:23:24 | tainted |
|
||||
| template-sinks.js:23:18:23:24 | tainted |
|
||||
| template-sinks.js:24:16:24:22 | tainted |
|
||||
| template-sinks.js:24:16:24:22 | tainted |
|
||||
| template-sinks.js:25:27:25:33 | tainted |
|
||||
| template-sinks.js:25:27:25:33 | tainted |
|
||||
| template-sinks.js:26:21:26:27 | tainted |
|
||||
| template-sinks.js:26:21:26:27 | tainted |
|
||||
| template-sinks.js:27:17:27:23 | tainted |
|
||||
| template-sinks.js:27:17:27:23 | tainted |
|
||||
| template-sinks.js:28:24:28:30 | tainted |
|
||||
| template-sinks.js:28:24:28:30 | tainted |
|
||||
| template-sinks.js:29:21:29:27 | tainted |
|
||||
| template-sinks.js:29:21:29:27 | tainted |
|
||||
| template-sinks.js:30:19:30:25 | tainted |
|
||||
| template-sinks.js:30:19:30:25 | tainted |
|
||||
| template-sinks.js:31:16:31:22 | tainted |
|
||||
| template-sinks.js:31:16:31:22 | tainted |
|
||||
| template-sinks.js:32:17:32:23 | tainted |
|
||||
| template-sinks.js:32:17:32:23 | tainted |
|
||||
| template-sinks.js:18:9:18:31 | tainted |
|
||||
| template-sinks.js:18:19:18:31 | req.query.foo |
|
||||
| template-sinks.js:18:19:18:31 | req.query.foo |
|
||||
| template-sinks.js:20:17:20:23 | tainted |
|
||||
| template-sinks.js:20:17:20:23 | tainted |
|
||||
| template-sinks.js:21:16:21:22 | tainted |
|
||||
| template-sinks.js:21:16:21:22 | tainted |
|
||||
| template-sinks.js:22:18:22:24 | tainted |
|
||||
| template-sinks.js:22:18:22:24 | tainted |
|
||||
| template-sinks.js:23:17:23:23 | tainted |
|
||||
| template-sinks.js:23:17:23:23 | tainted |
|
||||
| template-sinks.js:24:18:24:24 | tainted |
|
||||
| template-sinks.js:24:18:24:24 | tainted |
|
||||
| template-sinks.js:25:16:25:22 | tainted |
|
||||
| template-sinks.js:25:16:25:22 | tainted |
|
||||
| template-sinks.js:26:27:26:33 | tainted |
|
||||
| template-sinks.js:26:27:26:33 | tainted |
|
||||
| template-sinks.js:27:21:27:27 | tainted |
|
||||
| template-sinks.js:27:21:27:27 | tainted |
|
||||
| template-sinks.js:28:17:28:23 | tainted |
|
||||
| template-sinks.js:28:17:28:23 | tainted |
|
||||
| template-sinks.js:29:24:29:30 | tainted |
|
||||
| template-sinks.js:29:24:29:30 | tainted |
|
||||
| template-sinks.js:30:21:30:27 | tainted |
|
||||
| template-sinks.js:30:21:30:27 | tainted |
|
||||
| template-sinks.js:31:19:31:25 | tainted |
|
||||
| template-sinks.js:31:19:31:25 | tainted |
|
||||
| template-sinks.js:32:16:32:22 | tainted |
|
||||
| template-sinks.js:32:16:32:22 | tainted |
|
||||
| template-sinks.js:33:17:33:23 | tainted |
|
||||
| template-sinks.js:33:17:33:23 | tainted |
|
||||
| tst.js:2:6:2:27 | documen ... on.href |
|
||||
| tst.js:2:6:2:27 | documen ... on.href |
|
||||
| tst.js:2:6:2:83 | documen ... t=")+8) |
|
||||
@@ -181,6 +181,24 @@ nodes
|
||||
| tst.js:35:28:35:33 | source |
|
||||
| tst.js:37:33:37:38 | source |
|
||||
| tst.js:37:33:37:38 | source |
|
||||
| webix/webix.html:3:16:3:37 | documen ... on.hash |
|
||||
| webix/webix.html:3:16:3:37 | documen ... on.hash |
|
||||
| webix/webix.html:3:16:3:37 | documen ... on.hash |
|
||||
| webix/webix.html:4:26:4:47 | documen ... on.hash |
|
||||
| webix/webix.html:4:26:4:47 | documen ... on.hash |
|
||||
| webix/webix.html:4:26:4:47 | documen ... on.hash |
|
||||
| webix/webix.html:5:47:5:68 | documen ... on.hash |
|
||||
| webix/webix.html:5:47:5:68 | documen ... on.hash |
|
||||
| webix/webix.html:5:47:5:68 | documen ... on.hash |
|
||||
| webix/webix.js:3:12:3:33 | documen ... on.hash |
|
||||
| webix/webix.js:3:12:3:33 | documen ... on.hash |
|
||||
| webix/webix.js:3:12:3:33 | documen ... on.hash |
|
||||
| webix/webix.js:4:22:4:43 | documen ... on.hash |
|
||||
| webix/webix.js:4:22:4:43 | documen ... on.hash |
|
||||
| webix/webix.js:4:22:4:43 | documen ... on.hash |
|
||||
| webix/webix.js:5:43:5:64 | documen ... on.hash |
|
||||
| webix/webix.js:5:43:5:64 | documen ... on.hash |
|
||||
| webix/webix.js:5:43:5:64 | documen ... on.hash |
|
||||
edges
|
||||
| NoSQLCodeInjection.js:18:24:18:31 | req.body | NoSQLCodeInjection.js:18:24:18:37 | req.body.query |
|
||||
| NoSQLCodeInjection.js:18:24:18:31 | req.body | NoSQLCodeInjection.js:18:24:18:37 | req.body.query |
|
||||
@@ -246,36 +264,36 @@ edges
|
||||
| react-native.js:7:17:7:33 | req.param("code") | react-native.js:7:7:7:33 | tainted |
|
||||
| react-native.js:7:17:7:33 | req.param("code") | react-native.js:7:7:7:33 | tainted |
|
||||
| react.js:10:56:10:77 | documen ... on.hash | react.js:10:56:10:77 | documen ... on.hash |
|
||||
| template-sinks.js:17:9:17:31 | tainted | template-sinks.js:19:17:19:23 | tainted |
|
||||
| template-sinks.js:17:9:17:31 | tainted | template-sinks.js:19:17:19:23 | tainted |
|
||||
| template-sinks.js:17:9:17:31 | tainted | template-sinks.js:20:16:20:22 | tainted |
|
||||
| template-sinks.js:17:9:17:31 | tainted | template-sinks.js:20:16:20:22 | tainted |
|
||||
| template-sinks.js:17:9:17:31 | tainted | template-sinks.js:21:18:21:24 | tainted |
|
||||
| template-sinks.js:17:9:17:31 | tainted | template-sinks.js:21:18:21:24 | tainted |
|
||||
| template-sinks.js:17:9:17:31 | tainted | template-sinks.js:22:17:22:23 | tainted |
|
||||
| template-sinks.js:17:9:17:31 | tainted | template-sinks.js:22:17:22:23 | tainted |
|
||||
| template-sinks.js:17:9:17:31 | tainted | template-sinks.js:23:18:23:24 | tainted |
|
||||
| template-sinks.js:17:9:17:31 | tainted | template-sinks.js:23:18:23:24 | tainted |
|
||||
| template-sinks.js:17:9:17:31 | tainted | template-sinks.js:24:16:24:22 | tainted |
|
||||
| template-sinks.js:17:9:17:31 | tainted | template-sinks.js:24:16:24:22 | tainted |
|
||||
| template-sinks.js:17:9:17:31 | tainted | template-sinks.js:25:27:25:33 | tainted |
|
||||
| template-sinks.js:17:9:17:31 | tainted | template-sinks.js:25:27:25:33 | tainted |
|
||||
| template-sinks.js:17:9:17:31 | tainted | template-sinks.js:26:21:26:27 | tainted |
|
||||
| template-sinks.js:17:9:17:31 | tainted | template-sinks.js:26:21:26:27 | tainted |
|
||||
| template-sinks.js:17:9:17:31 | tainted | template-sinks.js:27:17:27:23 | tainted |
|
||||
| template-sinks.js:17:9:17:31 | tainted | template-sinks.js:27:17:27:23 | tainted |
|
||||
| template-sinks.js:17:9:17:31 | tainted | template-sinks.js:28:24:28:30 | tainted |
|
||||
| template-sinks.js:17:9:17:31 | tainted | template-sinks.js:28:24:28:30 | tainted |
|
||||
| template-sinks.js:17:9:17:31 | tainted | template-sinks.js:29:21:29:27 | tainted |
|
||||
| template-sinks.js:17:9:17:31 | tainted | template-sinks.js:29:21:29:27 | tainted |
|
||||
| template-sinks.js:17:9:17:31 | tainted | template-sinks.js:30:19:30:25 | tainted |
|
||||
| template-sinks.js:17:9:17:31 | tainted | template-sinks.js:30:19:30:25 | tainted |
|
||||
| template-sinks.js:17:9:17:31 | tainted | template-sinks.js:31:16:31:22 | tainted |
|
||||
| template-sinks.js:17:9:17:31 | tainted | template-sinks.js:31:16:31:22 | tainted |
|
||||
| template-sinks.js:17:9:17:31 | tainted | template-sinks.js:32:17:32:23 | tainted |
|
||||
| template-sinks.js:17:9:17:31 | tainted | template-sinks.js:32:17:32:23 | tainted |
|
||||
| template-sinks.js:17:19:17:31 | req.query.foo | template-sinks.js:17:9:17:31 | tainted |
|
||||
| template-sinks.js:17:19:17:31 | req.query.foo | template-sinks.js:17:9:17:31 | tainted |
|
||||
| template-sinks.js:18:9:18:31 | tainted | template-sinks.js:20:17:20:23 | tainted |
|
||||
| template-sinks.js:18:9:18:31 | tainted | template-sinks.js:20:17:20:23 | tainted |
|
||||
| template-sinks.js:18:9:18:31 | tainted | template-sinks.js:21:16:21:22 | tainted |
|
||||
| template-sinks.js:18:9:18:31 | tainted | template-sinks.js:21:16:21:22 | tainted |
|
||||
| template-sinks.js:18:9:18:31 | tainted | template-sinks.js:22:18:22:24 | tainted |
|
||||
| template-sinks.js:18:9:18:31 | tainted | template-sinks.js:22:18:22:24 | tainted |
|
||||
| template-sinks.js:18:9:18:31 | tainted | template-sinks.js:23:17:23:23 | tainted |
|
||||
| template-sinks.js:18:9:18:31 | tainted | template-sinks.js:23:17:23:23 | tainted |
|
||||
| template-sinks.js:18:9:18:31 | tainted | template-sinks.js:24:18:24:24 | tainted |
|
||||
| template-sinks.js:18:9:18:31 | tainted | template-sinks.js:24:18:24:24 | tainted |
|
||||
| template-sinks.js:18:9:18:31 | tainted | template-sinks.js:25:16:25:22 | tainted |
|
||||
| template-sinks.js:18:9:18:31 | tainted | template-sinks.js:25:16:25:22 | tainted |
|
||||
| template-sinks.js:18:9:18:31 | tainted | template-sinks.js:26:27:26:33 | tainted |
|
||||
| template-sinks.js:18:9:18:31 | tainted | template-sinks.js:26:27:26:33 | tainted |
|
||||
| template-sinks.js:18:9:18:31 | tainted | template-sinks.js:27:21:27:27 | tainted |
|
||||
| template-sinks.js:18:9:18:31 | tainted | template-sinks.js:27:21:27:27 | tainted |
|
||||
| template-sinks.js:18:9:18:31 | tainted | template-sinks.js:28:17:28:23 | tainted |
|
||||
| template-sinks.js:18:9:18:31 | tainted | template-sinks.js:28:17:28:23 | tainted |
|
||||
| template-sinks.js:18:9:18:31 | tainted | template-sinks.js:29:24:29:30 | tainted |
|
||||
| template-sinks.js:18:9:18:31 | tainted | template-sinks.js:29:24:29:30 | tainted |
|
||||
| template-sinks.js:18:9:18:31 | tainted | template-sinks.js:30:21:30:27 | tainted |
|
||||
| template-sinks.js:18:9:18:31 | tainted | template-sinks.js:30:21:30:27 | tainted |
|
||||
| template-sinks.js:18:9:18:31 | tainted | template-sinks.js:31:19:31:25 | tainted |
|
||||
| template-sinks.js:18:9:18:31 | tainted | template-sinks.js:31:19:31:25 | tainted |
|
||||
| template-sinks.js:18:9:18:31 | tainted | template-sinks.js:32:16:32:22 | tainted |
|
||||
| template-sinks.js:18:9:18:31 | tainted | template-sinks.js:32:16:32:22 | tainted |
|
||||
| template-sinks.js:18:9:18:31 | tainted | template-sinks.js:33:17:33:23 | tainted |
|
||||
| template-sinks.js:18:9:18:31 | tainted | template-sinks.js:33:17:33:23 | tainted |
|
||||
| template-sinks.js:18:19:18:31 | req.query.foo | template-sinks.js:18:9:18:31 | tainted |
|
||||
| template-sinks.js:18:19:18:31 | req.query.foo | template-sinks.js:18:9:18:31 | tainted |
|
||||
| tst.js:2:6:2:27 | documen ... on.href | tst.js:2:6:2:83 | documen ... t=")+8) |
|
||||
| tst.js:2:6:2:27 | documen ... on.href | tst.js:2:6:2:83 | documen ... t=")+8) |
|
||||
| tst.js:2:6:2:27 | documen ... on.href | tst.js:2:6:2:83 | documen ... t=")+8) |
|
||||
@@ -306,6 +324,12 @@ edges
|
||||
| tst.js:29:18:29:41 | documen ... .search | tst.js:29:18:29:82 | documen ... , "$1") |
|
||||
| tst.js:29:18:29:41 | documen ... .search | tst.js:29:18:29:82 | documen ... , "$1") |
|
||||
| tst.js:29:18:29:82 | documen ... , "$1") | tst.js:29:9:29:82 | source |
|
||||
| webix/webix.html:3:16:3:37 | documen ... on.hash | webix/webix.html:3:16:3:37 | documen ... on.hash |
|
||||
| webix/webix.html:4:26:4:47 | documen ... on.hash | webix/webix.html:4:26:4:47 | documen ... on.hash |
|
||||
| webix/webix.html:5:47:5:68 | documen ... on.hash | webix/webix.html:5:47:5:68 | documen ... on.hash |
|
||||
| webix/webix.js:3:12:3:33 | documen ... on.hash | webix/webix.js:3:12:3:33 | documen ... on.hash |
|
||||
| webix/webix.js:4:22:4:43 | documen ... on.hash | webix/webix.js:4:22:4:43 | documen ... on.hash |
|
||||
| webix/webix.js:5:43:5:64 | documen ... on.hash | webix/webix.js:5:43:5:64 | documen ... on.hash |
|
||||
#select
|
||||
| NoSQLCodeInjection.js:18:24:18:37 | req.body.query | NoSQLCodeInjection.js:18:24:18:31 | req.body | NoSQLCodeInjection.js:18:24:18:37 | req.body.query | This code execution depends on a $@. | NoSQLCodeInjection.js:18:24:18:31 | req.body | user-provided value |
|
||||
| NoSQLCodeInjection.js:19:24:19:48 | "name = ... dy.name | NoSQLCodeInjection.js:19:36:19:43 | req.body | NoSQLCodeInjection.js:19:24:19:48 | "name = ... dy.name | This code execution depends on a $@. | NoSQLCodeInjection.js:19:36:19:43 | req.body | user-provided value |
|
||||
@@ -340,20 +364,20 @@ edges
|
||||
| react-native.js:8:32:8:38 | tainted | react-native.js:7:17:7:33 | req.param("code") | react-native.js:8:32:8:38 | tainted | This code execution depends on a $@. | react-native.js:7:17:7:33 | req.param("code") | user-provided value |
|
||||
| react-native.js:10:23:10:29 | tainted | react-native.js:7:17:7:33 | req.param("code") | react-native.js:10:23:10:29 | tainted | This code execution depends on a $@. | react-native.js:7:17:7:33 | req.param("code") | user-provided value |
|
||||
| react.js:10:56:10:77 | documen ... on.hash | react.js:10:56:10:77 | documen ... on.hash | react.js:10:56:10:77 | documen ... on.hash | This code execution depends on a $@. | react.js:10:56:10:77 | documen ... on.hash | user-provided value |
|
||||
| template-sinks.js:19:17:19:23 | tainted | template-sinks.js:17:19:17:31 | req.query.foo | template-sinks.js:19:17:19:23 | tainted | Template, which may contain code, depends on a $@. | template-sinks.js:17:19:17:31 | req.query.foo | user-provided value |
|
||||
| template-sinks.js:20:16:20:22 | tainted | template-sinks.js:17:19:17:31 | req.query.foo | template-sinks.js:20:16:20:22 | tainted | Template, which may contain code, depends on a $@. | template-sinks.js:17:19:17:31 | req.query.foo | user-provided value |
|
||||
| template-sinks.js:21:18:21:24 | tainted | template-sinks.js:17:19:17:31 | req.query.foo | template-sinks.js:21:18:21:24 | tainted | Template, which may contain code, depends on a $@. | template-sinks.js:17:19:17:31 | req.query.foo | user-provided value |
|
||||
| template-sinks.js:22:17:22:23 | tainted | template-sinks.js:17:19:17:31 | req.query.foo | template-sinks.js:22:17:22:23 | tainted | Template, which may contain code, depends on a $@. | template-sinks.js:17:19:17:31 | req.query.foo | user-provided value |
|
||||
| template-sinks.js:23:18:23:24 | tainted | template-sinks.js:17:19:17:31 | req.query.foo | template-sinks.js:23:18:23:24 | tainted | Template, which may contain code, depends on a $@. | template-sinks.js:17:19:17:31 | req.query.foo | user-provided value |
|
||||
| template-sinks.js:24:16:24:22 | tainted | template-sinks.js:17:19:17:31 | req.query.foo | template-sinks.js:24:16:24:22 | tainted | Template, which may contain code, depends on a $@. | template-sinks.js:17:19:17:31 | req.query.foo | user-provided value |
|
||||
| template-sinks.js:25:27:25:33 | tainted | template-sinks.js:17:19:17:31 | req.query.foo | template-sinks.js:25:27:25:33 | tainted | Template, which may contain code, depends on a $@. | template-sinks.js:17:19:17:31 | req.query.foo | user-provided value |
|
||||
| template-sinks.js:26:21:26:27 | tainted | template-sinks.js:17:19:17:31 | req.query.foo | template-sinks.js:26:21:26:27 | tainted | Template, which may contain code, depends on a $@. | template-sinks.js:17:19:17:31 | req.query.foo | user-provided value |
|
||||
| template-sinks.js:27:17:27:23 | tainted | template-sinks.js:17:19:17:31 | req.query.foo | template-sinks.js:27:17:27:23 | tainted | Template, which may contain code, depends on a $@. | template-sinks.js:17:19:17:31 | req.query.foo | user-provided value |
|
||||
| template-sinks.js:28:24:28:30 | tainted | template-sinks.js:17:19:17:31 | req.query.foo | template-sinks.js:28:24:28:30 | tainted | Template, which may contain code, depends on a $@. | template-sinks.js:17:19:17:31 | req.query.foo | user-provided value |
|
||||
| template-sinks.js:29:21:29:27 | tainted | template-sinks.js:17:19:17:31 | req.query.foo | template-sinks.js:29:21:29:27 | tainted | Template, which may contain code, depends on a $@. | template-sinks.js:17:19:17:31 | req.query.foo | user-provided value |
|
||||
| template-sinks.js:30:19:30:25 | tainted | template-sinks.js:17:19:17:31 | req.query.foo | template-sinks.js:30:19:30:25 | tainted | Template, which may contain code, depends on a $@. | template-sinks.js:17:19:17:31 | req.query.foo | user-provided value |
|
||||
| template-sinks.js:31:16:31:22 | tainted | template-sinks.js:17:19:17:31 | req.query.foo | template-sinks.js:31:16:31:22 | tainted | Template, which may contain code, depends on a $@. | template-sinks.js:17:19:17:31 | req.query.foo | user-provided value |
|
||||
| template-sinks.js:32:17:32:23 | tainted | template-sinks.js:17:19:17:31 | req.query.foo | template-sinks.js:32:17:32:23 | tainted | Template, which may contain code, depends on a $@. | template-sinks.js:17:19:17:31 | req.query.foo | user-provided value |
|
||||
| template-sinks.js:20:17:20:23 | tainted | template-sinks.js:18:19:18:31 | req.query.foo | template-sinks.js:20:17:20:23 | tainted | Template, which may contain code, depends on a $@. | template-sinks.js:18:19:18:31 | req.query.foo | user-provided value |
|
||||
| template-sinks.js:21:16:21:22 | tainted | template-sinks.js:18:19:18:31 | req.query.foo | template-sinks.js:21:16:21:22 | tainted | Template, which may contain code, depends on a $@. | template-sinks.js:18:19:18:31 | req.query.foo | user-provided value |
|
||||
| template-sinks.js:22:18:22:24 | tainted | template-sinks.js:18:19:18:31 | req.query.foo | template-sinks.js:22:18:22:24 | tainted | Template, which may contain code, depends on a $@. | template-sinks.js:18:19:18:31 | req.query.foo | user-provided value |
|
||||
| template-sinks.js:23:17:23:23 | tainted | template-sinks.js:18:19:18:31 | req.query.foo | template-sinks.js:23:17:23:23 | tainted | Template, which may contain code, depends on a $@. | template-sinks.js:18:19:18:31 | req.query.foo | user-provided value |
|
||||
| template-sinks.js:24:18:24:24 | tainted | template-sinks.js:18:19:18:31 | req.query.foo | template-sinks.js:24:18:24:24 | tainted | Template, which may contain code, depends on a $@. | template-sinks.js:18:19:18:31 | req.query.foo | user-provided value |
|
||||
| template-sinks.js:25:16:25:22 | tainted | template-sinks.js:18:19:18:31 | req.query.foo | template-sinks.js:25:16:25:22 | tainted | Template, which may contain code, depends on a $@. | template-sinks.js:18:19:18:31 | req.query.foo | user-provided value |
|
||||
| template-sinks.js:26:27:26:33 | tainted | template-sinks.js:18:19:18:31 | req.query.foo | template-sinks.js:26:27:26:33 | tainted | Template, which may contain code, depends on a $@. | template-sinks.js:18:19:18:31 | req.query.foo | user-provided value |
|
||||
| template-sinks.js:27:21:27:27 | tainted | template-sinks.js:18:19:18:31 | req.query.foo | template-sinks.js:27:21:27:27 | tainted | Template, which may contain code, depends on a $@. | template-sinks.js:18:19:18:31 | req.query.foo | user-provided value |
|
||||
| template-sinks.js:28:17:28:23 | tainted | template-sinks.js:18:19:18:31 | req.query.foo | template-sinks.js:28:17:28:23 | tainted | Template, which may contain code, depends on a $@. | template-sinks.js:18:19:18:31 | req.query.foo | user-provided value |
|
||||
| template-sinks.js:29:24:29:30 | tainted | template-sinks.js:18:19:18:31 | req.query.foo | template-sinks.js:29:24:29:30 | tainted | Template, which may contain code, depends on a $@. | template-sinks.js:18:19:18:31 | req.query.foo | user-provided value |
|
||||
| template-sinks.js:30:21:30:27 | tainted | template-sinks.js:18:19:18:31 | req.query.foo | template-sinks.js:30:21:30:27 | tainted | Template, which may contain code, depends on a $@. | template-sinks.js:18:19:18:31 | req.query.foo | user-provided value |
|
||||
| template-sinks.js:31:19:31:25 | tainted | template-sinks.js:18:19:18:31 | req.query.foo | template-sinks.js:31:19:31:25 | tainted | Template, which may contain code, depends on a $@. | template-sinks.js:18:19:18:31 | req.query.foo | user-provided value |
|
||||
| template-sinks.js:32:16:32:22 | tainted | template-sinks.js:18:19:18:31 | req.query.foo | template-sinks.js:32:16:32:22 | tainted | Template, which may contain code, depends on a $@. | template-sinks.js:18:19:18:31 | req.query.foo | user-provided value |
|
||||
| template-sinks.js:33:17:33:23 | tainted | template-sinks.js:18:19:18:31 | req.query.foo | template-sinks.js:33:17:33:23 | tainted | Template, which may contain code, depends on a $@. | template-sinks.js:18:19:18:31 | req.query.foo | user-provided value |
|
||||
| tst.js:2:6:2:83 | documen ... t=")+8) | tst.js:2:6:2:27 | documen ... on.href | tst.js:2:6:2:83 | documen ... t=")+8) | This code execution depends on a $@. | tst.js:2:6:2:27 | documen ... on.href | user-provided value |
|
||||
| tst.js:5:12:5:33 | documen ... on.hash | tst.js:5:12:5:33 | documen ... on.hash | tst.js:5:12:5:33 | documen ... on.hash | This code execution depends on a $@. | tst.js:5:12:5:33 | documen ... on.hash | user-provided value |
|
||||
| tst.js:14:10:14:74 | documen ... , "$1") | tst.js:14:10:14:33 | documen ... .search | tst.js:14:10:14:74 | documen ... , "$1") | This code execution depends on a $@. | tst.js:14:10:14:33 | documen ... .search | user-provided value |
|
||||
@@ -365,3 +389,9 @@ edges
|
||||
| tst.js:33:14:33:19 | source | tst.js:29:18:29:41 | documen ... .search | tst.js:33:14:33:19 | source | This code execution depends on a $@. | tst.js:29:18:29:41 | documen ... .search | user-provided value |
|
||||
| tst.js:35:28:35:33 | source | tst.js:29:18:29:41 | documen ... .search | tst.js:35:28:35:33 | source | This code execution depends on a $@. | tst.js:29:18:29:41 | documen ... .search | user-provided value |
|
||||
| tst.js:37:33:37:38 | source | tst.js:29:18:29:41 | documen ... .search | tst.js:37:33:37:38 | source | This code execution depends on a $@. | tst.js:29:18:29:41 | documen ... .search | user-provided value |
|
||||
| webix/webix.html:3:16:3:37 | documen ... on.hash | webix/webix.html:3:16:3:37 | documen ... on.hash | webix/webix.html:3:16:3:37 | documen ... on.hash | This code execution depends on a $@. | webix/webix.html:3:16:3:37 | documen ... on.hash | user-provided value |
|
||||
| webix/webix.html:4:26:4:47 | documen ... on.hash | webix/webix.html:4:26:4:47 | documen ... on.hash | webix/webix.html:4:26:4:47 | documen ... on.hash | Template, which may contain code, depends on a $@. | webix/webix.html:4:26:4:47 | documen ... on.hash | user-provided value |
|
||||
| webix/webix.html:5:47:5:68 | documen ... on.hash | webix/webix.html:5:47:5:68 | documen ... on.hash | webix/webix.html:5:47:5:68 | documen ... on.hash | Template, which may contain code, depends on a $@. | webix/webix.html:5:47:5:68 | documen ... on.hash | user-provided value |
|
||||
| webix/webix.js:3:12:3:33 | documen ... on.hash | webix/webix.js:3:12:3:33 | documen ... on.hash | webix/webix.js:3:12:3:33 | documen ... on.hash | This code execution depends on a $@. | webix/webix.js:3:12:3:33 | documen ... on.hash | user-provided value |
|
||||
| webix/webix.js:4:22:4:43 | documen ... on.hash | webix/webix.js:4:22:4:43 | documen ... on.hash | webix/webix.js:4:22:4:43 | documen ... on.hash | Template, which may contain code, depends on a $@. | webix/webix.js:4:22:4:43 | documen ... on.hash | user-provided value |
|
||||
| webix/webix.js:5:43:5:64 | documen ... on.hash | webix/webix.js:5:43:5:64 | documen ... on.hash | webix/webix.js:5:43:5:64 | documen ... on.hash | Template, which may contain code, depends on a $@. | webix/webix.js:5:43:5:64 | documen ... on.hash | user-provided value |
|
||||
|
||||
@@ -116,37 +116,37 @@ nodes
|
||||
| react.js:10:56:10:77 | documen ... on.hash |
|
||||
| react.js:10:56:10:77 | documen ... on.hash |
|
||||
| react.js:10:56:10:77 | documen ... on.hash |
|
||||
| template-sinks.js:17:9:17:31 | tainted |
|
||||
| template-sinks.js:17:19:17:31 | req.query.foo |
|
||||
| template-sinks.js:17:19:17:31 | req.query.foo |
|
||||
| template-sinks.js:19:17:19:23 | tainted |
|
||||
| template-sinks.js:19:17:19:23 | tainted |
|
||||
| template-sinks.js:20:16:20:22 | tainted |
|
||||
| template-sinks.js:20:16:20:22 | tainted |
|
||||
| template-sinks.js:21:18:21:24 | tainted |
|
||||
| template-sinks.js:21:18:21:24 | tainted |
|
||||
| template-sinks.js:22:17:22:23 | tainted |
|
||||
| template-sinks.js:22:17:22:23 | tainted |
|
||||
| template-sinks.js:23:18:23:24 | tainted |
|
||||
| template-sinks.js:23:18:23:24 | tainted |
|
||||
| template-sinks.js:24:16:24:22 | tainted |
|
||||
| template-sinks.js:24:16:24:22 | tainted |
|
||||
| template-sinks.js:25:27:25:33 | tainted |
|
||||
| template-sinks.js:25:27:25:33 | tainted |
|
||||
| template-sinks.js:26:21:26:27 | tainted |
|
||||
| template-sinks.js:26:21:26:27 | tainted |
|
||||
| template-sinks.js:27:17:27:23 | tainted |
|
||||
| template-sinks.js:27:17:27:23 | tainted |
|
||||
| template-sinks.js:28:24:28:30 | tainted |
|
||||
| template-sinks.js:28:24:28:30 | tainted |
|
||||
| template-sinks.js:29:21:29:27 | tainted |
|
||||
| template-sinks.js:29:21:29:27 | tainted |
|
||||
| template-sinks.js:30:19:30:25 | tainted |
|
||||
| template-sinks.js:30:19:30:25 | tainted |
|
||||
| template-sinks.js:31:16:31:22 | tainted |
|
||||
| template-sinks.js:31:16:31:22 | tainted |
|
||||
| template-sinks.js:32:17:32:23 | tainted |
|
||||
| template-sinks.js:32:17:32:23 | tainted |
|
||||
| template-sinks.js:18:9:18:31 | tainted |
|
||||
| template-sinks.js:18:19:18:31 | req.query.foo |
|
||||
| template-sinks.js:18:19:18:31 | req.query.foo |
|
||||
| template-sinks.js:20:17:20:23 | tainted |
|
||||
| template-sinks.js:20:17:20:23 | tainted |
|
||||
| template-sinks.js:21:16:21:22 | tainted |
|
||||
| template-sinks.js:21:16:21:22 | tainted |
|
||||
| template-sinks.js:22:18:22:24 | tainted |
|
||||
| template-sinks.js:22:18:22:24 | tainted |
|
||||
| template-sinks.js:23:17:23:23 | tainted |
|
||||
| template-sinks.js:23:17:23:23 | tainted |
|
||||
| template-sinks.js:24:18:24:24 | tainted |
|
||||
| template-sinks.js:24:18:24:24 | tainted |
|
||||
| template-sinks.js:25:16:25:22 | tainted |
|
||||
| template-sinks.js:25:16:25:22 | tainted |
|
||||
| template-sinks.js:26:27:26:33 | tainted |
|
||||
| template-sinks.js:26:27:26:33 | tainted |
|
||||
| template-sinks.js:27:21:27:27 | tainted |
|
||||
| template-sinks.js:27:21:27:27 | tainted |
|
||||
| template-sinks.js:28:17:28:23 | tainted |
|
||||
| template-sinks.js:28:17:28:23 | tainted |
|
||||
| template-sinks.js:29:24:29:30 | tainted |
|
||||
| template-sinks.js:29:24:29:30 | tainted |
|
||||
| template-sinks.js:30:21:30:27 | tainted |
|
||||
| template-sinks.js:30:21:30:27 | tainted |
|
||||
| template-sinks.js:31:19:31:25 | tainted |
|
||||
| template-sinks.js:31:19:31:25 | tainted |
|
||||
| template-sinks.js:32:16:32:22 | tainted |
|
||||
| template-sinks.js:32:16:32:22 | tainted |
|
||||
| template-sinks.js:33:17:33:23 | tainted |
|
||||
| template-sinks.js:33:17:33:23 | tainted |
|
||||
| tst.js:2:6:2:27 | documen ... on.href |
|
||||
| tst.js:2:6:2:27 | documen ... on.href |
|
||||
| tst.js:2:6:2:83 | documen ... t=")+8) |
|
||||
@@ -185,6 +185,24 @@ nodes
|
||||
| tst.js:35:28:35:33 | source |
|
||||
| tst.js:37:33:37:38 | source |
|
||||
| tst.js:37:33:37:38 | source |
|
||||
| webix/webix.html:3:16:3:37 | documen ... on.hash |
|
||||
| webix/webix.html:3:16:3:37 | documen ... on.hash |
|
||||
| webix/webix.html:3:16:3:37 | documen ... on.hash |
|
||||
| webix/webix.html:4:26:4:47 | documen ... on.hash |
|
||||
| webix/webix.html:4:26:4:47 | documen ... on.hash |
|
||||
| webix/webix.html:4:26:4:47 | documen ... on.hash |
|
||||
| webix/webix.html:5:47:5:68 | documen ... on.hash |
|
||||
| webix/webix.html:5:47:5:68 | documen ... on.hash |
|
||||
| webix/webix.html:5:47:5:68 | documen ... on.hash |
|
||||
| webix/webix.js:3:12:3:33 | documen ... on.hash |
|
||||
| webix/webix.js:3:12:3:33 | documen ... on.hash |
|
||||
| webix/webix.js:3:12:3:33 | documen ... on.hash |
|
||||
| webix/webix.js:4:22:4:43 | documen ... on.hash |
|
||||
| webix/webix.js:4:22:4:43 | documen ... on.hash |
|
||||
| webix/webix.js:4:22:4:43 | documen ... on.hash |
|
||||
| webix/webix.js:5:43:5:64 | documen ... on.hash |
|
||||
| webix/webix.js:5:43:5:64 | documen ... on.hash |
|
||||
| webix/webix.js:5:43:5:64 | documen ... on.hash |
|
||||
edges
|
||||
| NoSQLCodeInjection.js:18:24:18:31 | req.body | NoSQLCodeInjection.js:18:24:18:37 | req.body.query |
|
||||
| NoSQLCodeInjection.js:18:24:18:31 | req.body | NoSQLCodeInjection.js:18:24:18:37 | req.body.query |
|
||||
@@ -254,36 +272,36 @@ edges
|
||||
| react-native.js:7:17:7:33 | req.param("code") | react-native.js:7:7:7:33 | tainted |
|
||||
| react-native.js:7:17:7:33 | req.param("code") | react-native.js:7:7:7:33 | tainted |
|
||||
| react.js:10:56:10:77 | documen ... on.hash | react.js:10:56:10:77 | documen ... on.hash |
|
||||
| template-sinks.js:17:9:17:31 | tainted | template-sinks.js:19:17:19:23 | tainted |
|
||||
| template-sinks.js:17:9:17:31 | tainted | template-sinks.js:19:17:19:23 | tainted |
|
||||
| template-sinks.js:17:9:17:31 | tainted | template-sinks.js:20:16:20:22 | tainted |
|
||||
| template-sinks.js:17:9:17:31 | tainted | template-sinks.js:20:16:20:22 | tainted |
|
||||
| template-sinks.js:17:9:17:31 | tainted | template-sinks.js:21:18:21:24 | tainted |
|
||||
| template-sinks.js:17:9:17:31 | tainted | template-sinks.js:21:18:21:24 | tainted |
|
||||
| template-sinks.js:17:9:17:31 | tainted | template-sinks.js:22:17:22:23 | tainted |
|
||||
| template-sinks.js:17:9:17:31 | tainted | template-sinks.js:22:17:22:23 | tainted |
|
||||
| template-sinks.js:17:9:17:31 | tainted | template-sinks.js:23:18:23:24 | tainted |
|
||||
| template-sinks.js:17:9:17:31 | tainted | template-sinks.js:23:18:23:24 | tainted |
|
||||
| template-sinks.js:17:9:17:31 | tainted | template-sinks.js:24:16:24:22 | tainted |
|
||||
| template-sinks.js:17:9:17:31 | tainted | template-sinks.js:24:16:24:22 | tainted |
|
||||
| template-sinks.js:17:9:17:31 | tainted | template-sinks.js:25:27:25:33 | tainted |
|
||||
| template-sinks.js:17:9:17:31 | tainted | template-sinks.js:25:27:25:33 | tainted |
|
||||
| template-sinks.js:17:9:17:31 | tainted | template-sinks.js:26:21:26:27 | tainted |
|
||||
| template-sinks.js:17:9:17:31 | tainted | template-sinks.js:26:21:26:27 | tainted |
|
||||
| template-sinks.js:17:9:17:31 | tainted | template-sinks.js:27:17:27:23 | tainted |
|
||||
| template-sinks.js:17:9:17:31 | tainted | template-sinks.js:27:17:27:23 | tainted |
|
||||
| template-sinks.js:17:9:17:31 | tainted | template-sinks.js:28:24:28:30 | tainted |
|
||||
| template-sinks.js:17:9:17:31 | tainted | template-sinks.js:28:24:28:30 | tainted |
|
||||
| template-sinks.js:17:9:17:31 | tainted | template-sinks.js:29:21:29:27 | tainted |
|
||||
| template-sinks.js:17:9:17:31 | tainted | template-sinks.js:29:21:29:27 | tainted |
|
||||
| template-sinks.js:17:9:17:31 | tainted | template-sinks.js:30:19:30:25 | tainted |
|
||||
| template-sinks.js:17:9:17:31 | tainted | template-sinks.js:30:19:30:25 | tainted |
|
||||
| template-sinks.js:17:9:17:31 | tainted | template-sinks.js:31:16:31:22 | tainted |
|
||||
| template-sinks.js:17:9:17:31 | tainted | template-sinks.js:31:16:31:22 | tainted |
|
||||
| template-sinks.js:17:9:17:31 | tainted | template-sinks.js:32:17:32:23 | tainted |
|
||||
| template-sinks.js:17:9:17:31 | tainted | template-sinks.js:32:17:32:23 | tainted |
|
||||
| template-sinks.js:17:19:17:31 | req.query.foo | template-sinks.js:17:9:17:31 | tainted |
|
||||
| template-sinks.js:17:19:17:31 | req.query.foo | template-sinks.js:17:9:17:31 | tainted |
|
||||
| template-sinks.js:18:9:18:31 | tainted | template-sinks.js:20:17:20:23 | tainted |
|
||||
| template-sinks.js:18:9:18:31 | tainted | template-sinks.js:20:17:20:23 | tainted |
|
||||
| template-sinks.js:18:9:18:31 | tainted | template-sinks.js:21:16:21:22 | tainted |
|
||||
| template-sinks.js:18:9:18:31 | tainted | template-sinks.js:21:16:21:22 | tainted |
|
||||
| template-sinks.js:18:9:18:31 | tainted | template-sinks.js:22:18:22:24 | tainted |
|
||||
| template-sinks.js:18:9:18:31 | tainted | template-sinks.js:22:18:22:24 | tainted |
|
||||
| template-sinks.js:18:9:18:31 | tainted | template-sinks.js:23:17:23:23 | tainted |
|
||||
| template-sinks.js:18:9:18:31 | tainted | template-sinks.js:23:17:23:23 | tainted |
|
||||
| template-sinks.js:18:9:18:31 | tainted | template-sinks.js:24:18:24:24 | tainted |
|
||||
| template-sinks.js:18:9:18:31 | tainted | template-sinks.js:24:18:24:24 | tainted |
|
||||
| template-sinks.js:18:9:18:31 | tainted | template-sinks.js:25:16:25:22 | tainted |
|
||||
| template-sinks.js:18:9:18:31 | tainted | template-sinks.js:25:16:25:22 | tainted |
|
||||
| template-sinks.js:18:9:18:31 | tainted | template-sinks.js:26:27:26:33 | tainted |
|
||||
| template-sinks.js:18:9:18:31 | tainted | template-sinks.js:26:27:26:33 | tainted |
|
||||
| template-sinks.js:18:9:18:31 | tainted | template-sinks.js:27:21:27:27 | tainted |
|
||||
| template-sinks.js:18:9:18:31 | tainted | template-sinks.js:27:21:27:27 | tainted |
|
||||
| template-sinks.js:18:9:18:31 | tainted | template-sinks.js:28:17:28:23 | tainted |
|
||||
| template-sinks.js:18:9:18:31 | tainted | template-sinks.js:28:17:28:23 | tainted |
|
||||
| template-sinks.js:18:9:18:31 | tainted | template-sinks.js:29:24:29:30 | tainted |
|
||||
| template-sinks.js:18:9:18:31 | tainted | template-sinks.js:29:24:29:30 | tainted |
|
||||
| template-sinks.js:18:9:18:31 | tainted | template-sinks.js:30:21:30:27 | tainted |
|
||||
| template-sinks.js:18:9:18:31 | tainted | template-sinks.js:30:21:30:27 | tainted |
|
||||
| template-sinks.js:18:9:18:31 | tainted | template-sinks.js:31:19:31:25 | tainted |
|
||||
| template-sinks.js:18:9:18:31 | tainted | template-sinks.js:31:19:31:25 | tainted |
|
||||
| template-sinks.js:18:9:18:31 | tainted | template-sinks.js:32:16:32:22 | tainted |
|
||||
| template-sinks.js:18:9:18:31 | tainted | template-sinks.js:32:16:32:22 | tainted |
|
||||
| template-sinks.js:18:9:18:31 | tainted | template-sinks.js:33:17:33:23 | tainted |
|
||||
| template-sinks.js:18:9:18:31 | tainted | template-sinks.js:33:17:33:23 | tainted |
|
||||
| template-sinks.js:18:19:18:31 | req.query.foo | template-sinks.js:18:9:18:31 | tainted |
|
||||
| template-sinks.js:18:19:18:31 | req.query.foo | template-sinks.js:18:9:18:31 | tainted |
|
||||
| tst.js:2:6:2:27 | documen ... on.href | tst.js:2:6:2:83 | documen ... t=")+8) |
|
||||
| tst.js:2:6:2:27 | documen ... on.href | tst.js:2:6:2:83 | documen ... t=")+8) |
|
||||
| tst.js:2:6:2:27 | documen ... on.href | tst.js:2:6:2:83 | documen ... t=")+8) |
|
||||
@@ -314,5 +332,11 @@ edges
|
||||
| tst.js:29:18:29:41 | documen ... .search | tst.js:29:18:29:82 | documen ... , "$1") |
|
||||
| tst.js:29:18:29:41 | documen ... .search | tst.js:29:18:29:82 | documen ... , "$1") |
|
||||
| tst.js:29:18:29:82 | documen ... , "$1") | tst.js:29:9:29:82 | source |
|
||||
| webix/webix.html:3:16:3:37 | documen ... on.hash | webix/webix.html:3:16:3:37 | documen ... on.hash |
|
||||
| webix/webix.html:4:26:4:47 | documen ... on.hash | webix/webix.html:4:26:4:47 | documen ... on.hash |
|
||||
| webix/webix.html:5:47:5:68 | documen ... on.hash | webix/webix.html:5:47:5:68 | documen ... on.hash |
|
||||
| webix/webix.js:3:12:3:33 | documen ... on.hash | webix/webix.js:3:12:3:33 | documen ... on.hash |
|
||||
| webix/webix.js:4:22:4:43 | documen ... on.hash | webix/webix.js:4:22:4:43 | documen ... on.hash |
|
||||
| webix/webix.js:5:43:5:64 | documen ... on.hash | webix/webix.js:5:43:5:64 | documen ... on.hash |
|
||||
#select
|
||||
| eslint-escope-build.js:21:16:21:16 | c | eslint-escope-build.js:20:22:20:22 | c | eslint-escope-build.js:21:16:21:16 | c | $@ flows to here and is interpreted as code. | eslint-escope-build.js:20:22:20:22 | c | User-provided value |
|
||||
|
||||
@@ -10,10 +10,11 @@ import * as mustache from 'mustache';
|
||||
const Hogan = require("hogan.js");
|
||||
import * as Eta from 'eta';
|
||||
import * as Sqrl from 'squirrelly'
|
||||
import * as webix from "webix";
|
||||
|
||||
var app = express();
|
||||
|
||||
app.get('/some/path', function(req, res) {
|
||||
app.get('/some/path', function (req, res) {
|
||||
let tainted = req.query.foo;
|
||||
|
||||
pug.compile(tainted); // NOT OK
|
||||
|
||||
@@ -0,0 +1,6 @@
|
||||
<script src="path/to/webix.js" type="text/javascript" charset="utf-8"></script>
|
||||
<script>
|
||||
webix.exec(document.location.hash); // NOT OK
|
||||
webix.ui({ template: document.location.hash }); // NOT OK
|
||||
webix.ui({ template: function () { return document.location.hash } }); // NOT OK
|
||||
</script>
|
||||
@@ -0,0 +1,5 @@
|
||||
import * as webix from 'webix';
|
||||
|
||||
webix.exec(document.location.hash); // NOT OK
|
||||
webix.ui({ template: document.location.hash }); // NOT OK
|
||||
webix.ui({ template: function () { return document.location.hash } }); // NOT OK
|
||||
@@ -152,4 +152,6 @@
|
||||
n.cloneNode(false).outerHTML.replace(/<\/?[\w:\-]+ ?|=[\"][^\"]+\"|=\'[^\']+\'|=[\w\-]+|>/gi, '').replace(/[\w:\-]+/gi, function(a) { // NOT OK
|
||||
o.push({specified : 1, nodeName : a});
|
||||
});
|
||||
|
||||
content = content.replace(/.+?(?=\s)/, ''); // OK
|
||||
});
|
||||
@@ -9,12 +9,15 @@ nodes
|
||||
| build-leaks.js:14:18:14:20 | env |
|
||||
| build-leaks.js:15:24:15:34 | process.env |
|
||||
| build-leaks.js:15:24:15:34 | process.env |
|
||||
| build-leaks.js:15:24:15:39 | process.env[key] |
|
||||
| build-leaks.js:16:20:16:22 | env |
|
||||
| build-leaks.js:21:11:26:5 | stringifed |
|
||||
| build-leaks.js:21:24:26:5 | {\\n ... )\\n } |
|
||||
| build-leaks.js:22:24:25:14 | Object. ... }, {}) |
|
||||
| build-leaks.js:22:49:22:51 | env |
|
||||
| build-leaks.js:23:24:23:47 | JSON.st ... w[key]) |
|
||||
| build-leaks.js:23:39:23:41 | raw |
|
||||
| build-leaks.js:23:39:23:46 | raw[key] |
|
||||
| build-leaks.js:24:20:24:22 | env |
|
||||
| build-leaks.js:30:22:30:31 | stringifed |
|
||||
| build-leaks.js:34:26:34:57 | getEnv( ... ngified |
|
||||
@@ -36,13 +39,19 @@ edges
|
||||
| build-leaks.js:14:18:14:20 | env | build-leaks.js:16:20:16:22 | env |
|
||||
| build-leaks.js:15:24:15:34 | process.env | build-leaks.js:14:18:14:20 | env |
|
||||
| build-leaks.js:15:24:15:34 | process.env | build-leaks.js:14:18:14:20 | env |
|
||||
| build-leaks.js:15:24:15:34 | process.env | build-leaks.js:15:24:15:39 | process.env[key] |
|
||||
| build-leaks.js:15:24:15:34 | process.env | build-leaks.js:15:24:15:39 | process.env[key] |
|
||||
| build-leaks.js:15:24:15:39 | process.env[key] | build-leaks.js:14:18:14:20 | env |
|
||||
| build-leaks.js:16:20:16:22 | env | build-leaks.js:13:17:19:10 | Object. ... }) |
|
||||
| build-leaks.js:16:20:16:22 | env | build-leaks.js:14:18:14:20 | env |
|
||||
| build-leaks.js:21:11:26:5 | stringifed | build-leaks.js:30:22:30:31 | stringifed |
|
||||
| build-leaks.js:21:24:26:5 | {\\n ... )\\n } | build-leaks.js:21:11:26:5 | stringifed |
|
||||
| build-leaks.js:22:24:25:14 | Object. ... }, {}) | build-leaks.js:21:24:26:5 | {\\n ... )\\n } |
|
||||
| build-leaks.js:22:49:22:51 | env | build-leaks.js:24:20:24:22 | env |
|
||||
| build-leaks.js:23:24:23:47 | JSON.st ... w[key]) | build-leaks.js:22:49:22:51 | env |
|
||||
| build-leaks.js:23:39:23:41 | raw | build-leaks.js:22:49:22:51 | env |
|
||||
| build-leaks.js:23:39:23:41 | raw | build-leaks.js:23:39:23:46 | raw[key] |
|
||||
| build-leaks.js:23:39:23:46 | raw[key] | build-leaks.js:23:24:23:47 | JSON.st ... w[key]) |
|
||||
| build-leaks.js:24:20:24:22 | env | build-leaks.js:22:24:25:14 | Object. ... }, {}) |
|
||||
| build-leaks.js:24:20:24:22 | env | build-leaks.js:22:49:22:51 | env |
|
||||
| build-leaks.js:30:22:30:31 | stringifed | build-leaks.js:34:26:34:57 | getEnv( ... ngified |
|
||||
|
||||
@@ -26,8 +26,8 @@ edges
|
||||
| tst.js:19:17:19:24 | password | tst.js:19:17:19:24 | password |
|
||||
| tst.js:22:21:22:30 | secretText | tst.js:22:21:22:30 | secretText |
|
||||
#select
|
||||
| tst.js:11:17:11:26 | secretText | tst.js:3:18:3:24 | trusted | tst.js:11:17:11:26 | secretText | A broken or weak cryptographic algorithm depends on $@. | tst.js:3:18:3:24 | trusted | sensitive data from an access to trusted |
|
||||
| tst.js:11:17:11:26 | secretText | tst.js:11:17:11:26 | secretText | tst.js:11:17:11:26 | secretText | A broken or weak cryptographic algorithm depends on $@. | tst.js:11:17:11:26 | secretText | sensitive data from an access to secretText |
|
||||
| tst.js:17:17:17:25 | o.trusted | tst.js:17:17:17:25 | o.trusted | tst.js:17:17:17:25 | o.trusted | A broken or weak cryptographic algorithm depends on $@. | tst.js:17:17:17:25 | o.trusted | sensitive data from an access to trusted |
|
||||
| tst.js:22:21:22:30 | secretText | tst.js:3:18:3:24 | trusted | tst.js:22:21:22:30 | secretText | A broken or weak cryptographic algorithm depends on $@. | tst.js:3:18:3:24 | trusted | sensitive data from an access to trusted |
|
||||
| tst.js:22:21:22:30 | secretText | tst.js:22:21:22:30 | secretText | tst.js:22:21:22:30 | secretText | A broken or weak cryptographic algorithm depends on $@. | tst.js:22:21:22:30 | secretText | sensitive data from an access to secretText |
|
||||
| tst.js:11:17:11:26 | secretText | tst.js:3:18:3:24 | trusted | tst.js:11:17:11:26 | secretText | $@ depends on $@. | tst.js:5:19:5:49 | crypto. ... ', key) | A broken or weak cryptographic algorithm | tst.js:3:18:3:24 | trusted | sensitive data from an access to trusted |
|
||||
| tst.js:11:17:11:26 | secretText | tst.js:11:17:11:26 | secretText | tst.js:11:17:11:26 | secretText | $@ depends on $@. | tst.js:5:19:5:49 | crypto. ... ', key) | A broken or weak cryptographic algorithm | tst.js:11:17:11:26 | secretText | sensitive data from an access to secretText |
|
||||
| tst.js:17:17:17:25 | o.trusted | tst.js:17:17:17:25 | o.trusted | tst.js:17:17:17:25 | o.trusted | $@ depends on $@. | tst.js:5:19:5:49 | crypto. ... ', key) | A broken or weak cryptographic algorithm | tst.js:17:17:17:25 | o.trusted | sensitive data from an access to trusted |
|
||||
| tst.js:22:21:22:30 | secretText | tst.js:3:18:3:24 | trusted | tst.js:22:21:22:30 | secretText | $@ depends on $@. | tst.js:21:22:21:60 | crypto. ... ', key) | A broken or weak cryptographic algorithm | tst.js:3:18:3:24 | trusted | sensitive data from an access to trusted |
|
||||
| tst.js:22:21:22:30 | secretText | tst.js:22:21:22:30 | secretText | tst.js:22:21:22:30 | secretText | $@ depends on $@. | tst.js:21:22:21:60 | crypto. ... ', key) | A broken or weak cryptographic algorithm | tst.js:22:21:22:30 | secretText | sensitive data from an access to secretText |
|
||||
|
||||
@@ -445,7 +445,7 @@
|
||||
| tst.js:146:15:146:21 | (\\d\|5)* | Strings with many repetitions of '0' can start matching anywhere after the start of the preceeding ((\\d\|5)*)" |
|
||||
| tst.js:149:15:149:24 | (\\s\|[\\f])* | Strings with many repetitions of '\\t' can start matching anywhere after the start of the preceeding ((\\s\|[\\f])*)" |
|
||||
| tst.js:152:15:152:28 | (\\s\|[\\v]\|\\\\v)* | Strings with many repetitions of '\\t' can start matching anywhere after the start of the preceeding ((\\s\|[\\v]\|\\\\v)*)" |
|
||||
| tst.js:155:15:155:24 | (\\f\|[\\f])* | Strings with many repetitions of '\u000c' can start matching anywhere after the start of the preceeding ((\\f\|[\\f])*)" |
|
||||
| tst.js:155:15:155:24 | (\\f\|[\\f])* | Strings with many repetitions of '\\u000c' can start matching anywhere after the start of the preceeding ((\\f\|[\\f])*)" |
|
||||
| tst.js:158:15:158:22 | (\\W\|\\D)* | Strings with many repetitions of '/' can start matching anywhere after the start of the preceeding ((\\W\|\\D)*)" |
|
||||
| tst.js:161:15:161:22 | (\\S\|\\w)* | Strings with many repetitions of '!' can start matching anywhere after the start of the preceeding ((\\S\|\\w)*)" |
|
||||
| tst.js:164:15:164:24 | (\\S\|[\\w])* | Strings with many repetitions of '!' can start matching anywhere after the start of the preceeding ((\\S\|[\\w])*)" |
|
||||
|
||||
@@ -123,9 +123,9 @@
|
||||
| tst.js:137:15:137:21 | (\\w\|G)* | This part of the regular expression may cause exponential backtracking on strings containing many repetitions of 'G'. |
|
||||
| tst.js:143:15:143:22 | (\\d\|\\w)* | This part of the regular expression may cause exponential backtracking on strings containing many repetitions of '0'. |
|
||||
| tst.js:146:15:146:21 | (\\d\|5)* | This part of the regular expression may cause exponential backtracking on strings containing many repetitions of '5'. |
|
||||
| tst.js:149:15:149:24 | (\\s\|[\\f])* | This part of the regular expression may cause exponential backtracking on strings containing many repetitions of '\u000c'. |
|
||||
| tst.js:152:15:152:28 | (\\s\|[\\v]\|\\\\v)* | This part of the regular expression may cause exponential backtracking on strings containing many repetitions of '\u000b'. |
|
||||
| tst.js:155:15:155:24 | (\\f\|[\\f])* | This part of the regular expression may cause exponential backtracking on strings containing many repetitions of '\u000c'. |
|
||||
| tst.js:149:15:149:24 | (\\s\|[\\f])* | This part of the regular expression may cause exponential backtracking on strings containing many repetitions of '\\u000c'. |
|
||||
| tst.js:152:15:152:28 | (\\s\|[\\v]\|\\\\v)* | This part of the regular expression may cause exponential backtracking on strings containing many repetitions of '\\u000b'. |
|
||||
| tst.js:155:15:155:24 | (\\f\|[\\f])* | This part of the regular expression may cause exponential backtracking on strings containing many repetitions of '\\u000c'. |
|
||||
| tst.js:158:15:158:22 | (\\W\|\\D)* | This part of the regular expression may cause exponential backtracking on strings containing many repetitions of '/'. |
|
||||
| tst.js:161:15:161:22 | (\\S\|\\w)* | This part of the regular expression may cause exponential backtracking on strings containing many repetitions of '0'. |
|
||||
| tst.js:164:15:164:24 | (\\S\|[\\w])* | This part of the regular expression may cause exponential backtracking on strings containing many repetitions of '0'. |
|
||||
@@ -199,3 +199,5 @@
|
||||
| tst.js:404:6:405:7 | (g\|gg)* | This part of the regular expression may cause exponential backtracking on strings containing many repetitions of 'gg'. |
|
||||
| tst.js:407:125:407:127 | \\s* | This part of the regular expression may cause exponential backtracking on strings starting with '0/*' and containing many repetitions of ' ;0'. |
|
||||
| tst.js:411:15:411:19 | a{1,} | This part of the regular expression may cause exponential backtracking on strings containing many repetitions of 'a'. |
|
||||
| tst.js:413:25:413:35 | (\\u0000\|.)+ | This part of the regular expression may cause exponential backtracking on strings starting with '\\n\\u0000' and containing many repetitions of '\\u0000'. |
|
||||
| tst.js:415:44:415:57 | (\ud83d\ude80\|.)+ | This part of the regular expression may cause exponential backtracking on strings starting with '\\n\\u{1f680}' and containing many repetitions of '\\u{1f680}'. |
|
||||
|
||||
@@ -408,4 +408,8 @@ var bad98 = /^(?:\*\/\*|[a-zA-Z0-9][a-zA-Z0-9!\#\$&\-\^_\.\+]{0,126}\/(?:\*|[a-z
|
||||
|
||||
var good48 = /(\/(?:\/[\w.-]*)*){0,1}:([\w.-]+)/;
|
||||
|
||||
var bad99 = /(a{1,})*b/;
|
||||
var bad99 = /(a{1,})*b/;
|
||||
|
||||
var unicode = /^\n\u0000(\u0000|.)+$/;
|
||||
|
||||
var largeUnicode = new RegExp("^\n\u{1F680}(\u{1F680}|.)+X$");
|
||||
@@ -1,4 +1,7 @@
|
||||
nodes
|
||||
| ServerSideUrlRedirect.js:5:16:5:34 | req.query["target"] |
|
||||
| ServerSideUrlRedirect.js:5:16:5:34 | req.query["target"] |
|
||||
| ServerSideUrlRedirect.js:5:16:5:34 | req.query["target"] |
|
||||
| express.js:7:16:7:34 | req.param("target") |
|
||||
| express.js:7:16:7:34 | req.param("target") |
|
||||
| express.js:7:16:7:34 | req.param("target") |
|
||||
@@ -114,6 +117,7 @@ nodes
|
||||
| react-native.js:9:26:9:32 | tainted |
|
||||
| react-native.js:9:26:9:32 | tainted |
|
||||
edges
|
||||
| ServerSideUrlRedirect.js:5:16:5:34 | req.query["target"] | ServerSideUrlRedirect.js:5:16:5:34 | req.query["target"] |
|
||||
| express.js:7:16:7:34 | req.param("target") | express.js:7:16:7:34 | req.param("target") |
|
||||
| express.js:12:26:12:44 | req.param("target") | express.js:12:26:12:44 | req.param("target") |
|
||||
| express.js:27:7:27:34 | target | express.js:33:18:33:23 | target |
|
||||
@@ -211,6 +215,7 @@ edges
|
||||
| react-native.js:7:17:7:33 | req.param("code") | react-native.js:7:7:7:33 | tainted |
|
||||
| react-native.js:7:17:7:33 | req.param("code") | react-native.js:7:7:7:33 | tainted |
|
||||
#select
|
||||
| ServerSideUrlRedirect.js:5:16:5:34 | req.query["target"] | ServerSideUrlRedirect.js:5:16:5:34 | req.query["target"] | ServerSideUrlRedirect.js:5:16:5:34 | req.query["target"] | Untrusted URL redirection depends on a $@. | ServerSideUrlRedirect.js:5:16:5:34 | req.query["target"] | user-provided value |
|
||||
| express.js:7:16:7:34 | req.param("target") | express.js:7:16:7:34 | req.param("target") | express.js:7:16:7:34 | req.param("target") | Untrusted URL redirection depends on a $@. | express.js:7:16:7:34 | req.param("target") | user-provided value |
|
||||
| express.js:12:26:12:44 | req.param("target") | express.js:12:26:12:44 | req.param("target") | express.js:12:26:12:44 | req.param("target") | Untrusted URL redirection depends on a $@. | express.js:12:26:12:44 | req.param("target") | user-provided value |
|
||||
| express.js:33:18:33:23 | target | express.js:27:16:27:34 | req.param("target") | express.js:33:18:33:23 | target | Untrusted URL redirection depends on a $@. | express.js:27:16:27:34 | req.param("target") | user-provided value |
|
||||
|
||||
@@ -0,0 +1,6 @@
|
||||
const app = require("express")();
|
||||
|
||||
app.get("/redirect", function (req, res) {
|
||||
// BAD: a request parameter is incorporated without validation into a URL redirect
|
||||
res.redirect(req.query["target"]);
|
||||
});
|
||||
@@ -0,0 +1,13 @@
|
||||
const app = require("express")();
|
||||
|
||||
const VALID_REDIRECT = "http://cwe.mitre.org/data/definitions/601.html";
|
||||
|
||||
app.get("/redirect", function (req, res) {
|
||||
// GOOD: the request parameter is validated against a known fixed string
|
||||
let target = req.query["target"];
|
||||
if (VALID_REDIRECT === target) {
|
||||
res.redirect(target);
|
||||
} else {
|
||||
res.redirect("/");
|
||||
}
|
||||
});
|
||||
@@ -0,0 +1,22 @@
|
||||
const app = require("express")();
|
||||
|
||||
function isLocalUrl(path) {
|
||||
try {
|
||||
return (
|
||||
// TODO: consider substituting your own domain for example.com
|
||||
new URL(path, "https://example.com").origin === "https://example.com"
|
||||
);
|
||||
} catch (e) {
|
||||
return false;
|
||||
}
|
||||
}
|
||||
|
||||
app.get("/redirect", function (req, res) {
|
||||
// GOOD: check that we don't redirect to a different host
|
||||
let target = req.query["target"];
|
||||
if (isLocalUrl(target)) {
|
||||
res.redirect(target);
|
||||
} else {
|
||||
res.redirect("/");
|
||||
}
|
||||
});
|
||||
@@ -1,3 +1,11 @@
|
||||
| MissingRateLimiting.js:4:19:8:1 | functio ... ath);\\n} | This route handler performs $@, but is not rate-limited. | MissingRateLimiting.js:7:5:7:22 | res.sendFile(path) | a file system access |
|
||||
| MissingRateLimiting.js:25:19:25:20 | f1 | This route handler performs $@, but is not rate-limited. | MissingRateLimiting.js:13:5:13:22 | res.sendFile(path) | a file system access |
|
||||
| MissingRateLimiting.js:25:27:25:28 | f3 | This route handler performs $@, but is not rate-limited. | MissingRateLimiting.js:22:5:22:22 | res.sendFile(path) | a file system access |
|
||||
| tst.js:22:24:22:40 | expensiveHandler1 | This route handler performs $@, but is not rate-limited. | tst.js:14:40:14:46 | login() | authorization |
|
||||
| tst.js:35:20:35:36 | expensiveHandler1 | This route handler performs $@, but is not rate-limited. | tst.js:14:40:14:46 | login() | authorization |
|
||||
| tst.js:36:20:36:36 | expensiveHandler2 | This route handler performs $@, but is not rate-limited. | tst.js:15:40:15:73 | fs.writ ... quest") | a file system access |
|
||||
| tst.js:37:20:37:36 | expensiveHandler3 | This route handler performs $@, but is not rate-limited. | tst.js:16:40:16:70 | child_p ... /true") | a system command |
|
||||
| tst.js:38:20:38:36 | expensiveHandler4 | This route handler performs $@, but is not rate-limited. | tst.js:17:40:17:83 | connect ... ution') | a database access |
|
||||
| tst.js:64:25:64:63 | functio ... req); } | This route handler performs $@, but is not rate-limited. | tst.js:64:46:64:60 | verifyUser(req) | authorization |
|
||||
| tst.js:76:25:76:53 | catchAs ... ndler1) | This route handler performs $@, but is not rate-limited. | tst.js:14:40:14:46 | login() | authorization |
|
||||
| tst.js:88:24:88:40 | expensiveHandler1 | This route handler performs $@, but is not rate-limited. | tst.js:14:40:14:46 | login() | authorization |
|
||||
|
||||
@@ -0,0 +1,10 @@
|
||||
import express from "express";
|
||||
import { rateLimit } from "express-rate-limit";
|
||||
|
||||
const app = express();
|
||||
|
||||
const limiter = rateLimit();
|
||||
app.use(limiter)
|
||||
|
||||
function expensiveHandler(req, res) { login(); }
|
||||
app.get('/:path', expensiveHandler); // OK
|
||||
@@ -0,0 +1,10 @@
|
||||
import express from "express";
|
||||
import rateLimit from "express-rate-limit";
|
||||
|
||||
const app = express();
|
||||
|
||||
const limiter = rateLimit();
|
||||
app.use(limiter)
|
||||
|
||||
function expensiveHandler(req, res) { login(); }
|
||||
app.get('/:path', expensiveHandler); // OK
|
||||
@@ -17,6 +17,26 @@ nodes
|
||||
| src-vulnerable-lodash/tst.js:17:17:19:5 | {\\n ... K\\n } |
|
||||
| src-vulnerable-lodash/tst.js:17:17:19:5 | {\\n ... K\\n } |
|
||||
| src-vulnerable-lodash/tst.js:18:16:18:25 | opts.thing |
|
||||
| webix/webix.html:3:34:3:38 | event |
|
||||
| webix/webix.html:3:34:3:38 | event |
|
||||
| webix/webix.html:4:26:4:47 | JSON.pa ... t.data) |
|
||||
| webix/webix.html:4:26:4:47 | JSON.pa ... t.data) |
|
||||
| webix/webix.html:4:37:4:41 | event |
|
||||
| webix/webix.html:4:37:4:46 | event.data |
|
||||
| webix/webix.html:5:24:5:45 | JSON.pa ... t.data) |
|
||||
| webix/webix.html:5:24:5:45 | JSON.pa ... t.data) |
|
||||
| webix/webix.html:5:35:5:39 | event |
|
||||
| webix/webix.html:5:35:5:44 | event.data |
|
||||
| webix/webix.js:3:30:3:34 | event |
|
||||
| webix/webix.js:3:30:3:34 | event |
|
||||
| webix/webix.js:4:22:4:43 | JSON.pa ... t.data) |
|
||||
| webix/webix.js:4:22:4:43 | JSON.pa ... t.data) |
|
||||
| webix/webix.js:4:33:4:37 | event |
|
||||
| webix/webix.js:4:33:4:42 | event.data |
|
||||
| webix/webix.js:5:20:5:41 | JSON.pa ... t.data) |
|
||||
| webix/webix.js:5:20:5:41 | JSON.pa ... t.data) |
|
||||
| webix/webix.js:5:31:5:35 | event |
|
||||
| webix/webix.js:5:31:5:40 | event.data |
|
||||
edges
|
||||
| angularmerge.js:1:30:1:34 | event | angularmerge.js:2:32:2:36 | event |
|
||||
| angularmerge.js:1:30:1:34 | event | angularmerge.js:2:32:2:36 | event |
|
||||
@@ -32,8 +52,32 @@ edges
|
||||
| src-vulnerable-lodash/tst.js:15:14:15:28 | req.query.value | src-vulnerable-lodash/tst.js:18:16:18:25 | opts.thing |
|
||||
| src-vulnerable-lodash/tst.js:18:16:18:25 | opts.thing | src-vulnerable-lodash/tst.js:17:17:19:5 | {\\n ... K\\n } |
|
||||
| src-vulnerable-lodash/tst.js:18:16:18:25 | opts.thing | src-vulnerable-lodash/tst.js:17:17:19:5 | {\\n ... K\\n } |
|
||||
| webix/webix.html:3:34:3:38 | event | webix/webix.html:4:37:4:41 | event |
|
||||
| webix/webix.html:3:34:3:38 | event | webix/webix.html:4:37:4:41 | event |
|
||||
| webix/webix.html:3:34:3:38 | event | webix/webix.html:5:35:5:39 | event |
|
||||
| webix/webix.html:3:34:3:38 | event | webix/webix.html:5:35:5:39 | event |
|
||||
| webix/webix.html:4:37:4:41 | event | webix/webix.html:4:37:4:46 | event.data |
|
||||
| webix/webix.html:4:37:4:46 | event.data | webix/webix.html:4:26:4:47 | JSON.pa ... t.data) |
|
||||
| webix/webix.html:4:37:4:46 | event.data | webix/webix.html:4:26:4:47 | JSON.pa ... t.data) |
|
||||
| webix/webix.html:5:35:5:39 | event | webix/webix.html:5:35:5:44 | event.data |
|
||||
| webix/webix.html:5:35:5:44 | event.data | webix/webix.html:5:24:5:45 | JSON.pa ... t.data) |
|
||||
| webix/webix.html:5:35:5:44 | event.data | webix/webix.html:5:24:5:45 | JSON.pa ... t.data) |
|
||||
| webix/webix.js:3:30:3:34 | event | webix/webix.js:4:33:4:37 | event |
|
||||
| webix/webix.js:3:30:3:34 | event | webix/webix.js:4:33:4:37 | event |
|
||||
| webix/webix.js:3:30:3:34 | event | webix/webix.js:5:31:5:35 | event |
|
||||
| webix/webix.js:3:30:3:34 | event | webix/webix.js:5:31:5:35 | event |
|
||||
| webix/webix.js:4:33:4:37 | event | webix/webix.js:4:33:4:42 | event.data |
|
||||
| webix/webix.js:4:33:4:42 | event.data | webix/webix.js:4:22:4:43 | JSON.pa ... t.data) |
|
||||
| webix/webix.js:4:33:4:42 | event.data | webix/webix.js:4:22:4:43 | JSON.pa ... t.data) |
|
||||
| webix/webix.js:5:31:5:35 | event | webix/webix.js:5:31:5:40 | event.data |
|
||||
| webix/webix.js:5:31:5:40 | event.data | webix/webix.js:5:20:5:41 | JSON.pa ... t.data) |
|
||||
| webix/webix.js:5:31:5:40 | event.data | webix/webix.js:5:20:5:41 | JSON.pa ... t.data) |
|
||||
#select
|
||||
| angularmerge.js:2:21:2:42 | JSON.pa ... t.data) | angularmerge.js:1:30:1:34 | event | angularmerge.js:2:21:2:42 | JSON.pa ... t.data) | Prototype pollution caused by merging a $@ using a vulnerable version of $@. | angularmerge.js:1:30:1:34 | event | user-controlled value | angularmerge.js:2:3:2:43 | angular ... .data)) | angular |
|
||||
| src-vulnerable-lodash/tst.js:7:17:7:29 | req.query.foo | src-vulnerable-lodash/tst.js:7:17:7:29 | req.query.foo | src-vulnerable-lodash/tst.js:7:17:7:29 | req.query.foo | Prototype pollution caused by merging a $@ using a vulnerable version of $@. | src-vulnerable-lodash/tst.js:7:17:7:29 | req.query.foo | user-controlled value | src-vulnerable-lodash/package.json:3:19:3:26 | "4.17.4" | lodash |
|
||||
| src-vulnerable-lodash/tst.js:10:17:12:5 | {\\n ... K\\n } | src-vulnerable-lodash/tst.js:11:16:11:30 | req.query.value | src-vulnerable-lodash/tst.js:10:17:12:5 | {\\n ... K\\n } | Prototype pollution caused by merging a $@ using a vulnerable version of $@. | src-vulnerable-lodash/tst.js:11:16:11:30 | req.query.value | user-controlled value | src-vulnerable-lodash/package.json:3:19:3:26 | "4.17.4" | lodash |
|
||||
| src-vulnerable-lodash/tst.js:17:17:19:5 | {\\n ... K\\n } | src-vulnerable-lodash/tst.js:15:14:15:28 | req.query.value | src-vulnerable-lodash/tst.js:17:17:19:5 | {\\n ... K\\n } | Prototype pollution caused by merging a $@ using a vulnerable version of $@. | src-vulnerable-lodash/tst.js:15:14:15:28 | req.query.value | user-controlled value | src-vulnerable-lodash/package.json:3:19:3:26 | "4.17.4" | lodash |
|
||||
| webix/webix.html:4:26:4:47 | JSON.pa ... t.data) | webix/webix.html:3:34:3:38 | event | webix/webix.html:4:26:4:47 | JSON.pa ... t.data) | Prototype pollution caused by merging a $@ using a vulnerable version of $@. | webix/webix.html:3:34:3:38 | event | user-controlled value | webix/webix.html:4:9:4:48 | webix.e ... .data)) | webix |
|
||||
| webix/webix.html:5:24:5:45 | JSON.pa ... t.data) | webix/webix.html:3:34:3:38 | event | webix/webix.html:5:24:5:45 | JSON.pa ... t.data) | Prototype pollution caused by merging a $@ using a vulnerable version of $@. | webix/webix.html:3:34:3:38 | event | user-controlled value | webix/webix.html:5:9:5:46 | webix.c ... .data)) | webix |
|
||||
| webix/webix.js:4:22:4:43 | JSON.pa ... t.data) | webix/webix.js:3:30:3:34 | event | webix/webix.js:4:22:4:43 | JSON.pa ... t.data) | Prototype pollution caused by merging a $@ using a vulnerable version of $@. | webix/webix.js:3:30:3:34 | event | user-controlled value | webix/webix.js:4:5:4:44 | webix.e ... .data)) | webix |
|
||||
| webix/webix.js:5:20:5:41 | JSON.pa ... t.data) | webix/webix.js:3:30:3:34 | event | webix/webix.js:5:20:5:41 | JSON.pa ... t.data) | Prototype pollution caused by merging a $@ using a vulnerable version of $@. | webix/webix.js:3:30:3:34 | event | user-controlled value | webix/webix.js:5:5:5:42 | webix.c ... .data)) | webix |
|
||||
|
||||
@@ -0,0 +1,7 @@
|
||||
<script src="path/to/webix.js" type="text/javascript" charset="utf-8"></script>
|
||||
<script>
|
||||
addEventListener("message", (event) => {
|
||||
webix.extend({}, JSON.parse(event.data)); // NOT OK
|
||||
webix.copy({}, JSON.parse(event.data)); // NOT OK
|
||||
});
|
||||
</script>
|
||||
@@ -0,0 +1,6 @@
|
||||
import * as webix from "webix";
|
||||
|
||||
addEventListener("message", (event) => {
|
||||
webix.extend({}, JSON.parse(event.data)); // NOT OK
|
||||
webix.copy({}, JSON.parse(event.data)); // NOT OK
|
||||
});
|
||||
Reference in New Issue
Block a user