hohn/codeql
1
0
Fork 0
mirror of https://github.com/github/codeql.git synced 2025-12-18 01:33:15 +01:00
Code Issues Packages Projects Releases Wiki Activity

add global replacements using inverted char classes as a sanitizer for DOM based XSS

Browse Source
This commit is contained in:
Erik Krogh Kristensen
2021-04-27 10:33:19 +02:00
parent 310baab73f
commit e60628d463
2 changed files with 12 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files

9
javascript/ql/src/semmle/javascript/security/dataflow/Xss.qll
View File

@@ -34,7 +34,14 @@ module Shared {
class MetacharEscapeSanitizer extends Sanitizer, StringReplaceCall {
MetacharEscapeSanitizer() {
isGlobal() and
RegExp::alwaysMatchesMetaCharacter(getRegExp().getRoot(), ["<", "'", "\""])
(
RegExp::alwaysMatchesMetaCharacter(getRegExp().getRoot(), ["<", "'", "\""])
or
// or it's a global inverted char class.
getRegExp().getRoot().(RegExpCharacterClass).isInverted()
or
getRegExp().getRoot().(RegExpQuantifier).getAChild().(RegExpCharacterClass).isInverted()
)
}
}