JS: Do not flag semi-anchored regexps in .replace()

2026-05-02 12:15:17 +02:00 · 2019-10-22 16:44:32 +01:00
parent cae09a447b
commit e5f2f9e43e
2 changed files with 9 additions and 0 deletions
--- a/javascript/ql/test/query-tests/Security/CWE-020/tst-SemiAnchoredRegExp.js
+++ b/javascript/ql/test/query-tests/Security/CWE-020/tst-SemiAnchoredRegExp.js
@@ -127,3 +127,7 @@
 	/xxx_yyy=\w+|^$/;
 	/^(?:mouse|contextmenu)|click/;
 });
+
+function replaceTest(x) {
+	return x.replace(/^a|b/, ''); // OK - possibly replacing too much, but not obviously a problem
+}