hohn/codeql
1
0
Fork 0
mirror of https://github.com/github/codeql.git synced 2026-05-03 20:58:03 +02:00
Code Issues Packages Projects Releases Wiki Activity

JS: Add more tests

Browse Source
This commit is contained in:
Asger Feldthaus
2021-07-27 10:47:23 +02:00
parent 4efea4316e
commit f1bcfa287b
3 changed files with 123 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

56
javascript/ql/test/query-tests/Security/CWE-079/DomBasedXss/Xss.expected
View File

@@ -222,6 +222,31 @@ nodes
| jquery.js:16:38:16:52 | window.location |
| jquery.js:16:38:16:52 | window.location |
| jquery.js:16:38:16:63 | window. ... tring() |
| jquery.js:18:7:18:33 | hash |
| jquery.js:18:14:18:33 | window.location.hash |
| jquery.js:18:14:18:33 | window.location.hash |
| jquery.js:21:5:21:8 | hash |
| jquery.js:21:5:21:21 | hash.substring(1) |
| jquery.js:21:5:21:21 | hash.substring(1) |
| jquery.js:22:5:22:8 | hash |
| jquery.js:22:5:22:25 | hash.su ... (1, 10) |
| jquery.js:22:5:22:25 | hash.su ... (1, 10) |
| jquery.js:23:5:23:8 | hash |
| jquery.js:23:5:23:18 | hash.substr(1) |
| jquery.js:23:5:23:18 | hash.substr(1) |
| jquery.js:24:5:24:8 | hash |
| jquery.js:24:5:24:17 | hash.slice(1) |
| jquery.js:24:5:24:17 | hash.slice(1) |
| jquery.js:27:5:27:8 | hash |
| jquery.js:27:5:27:25 | hash.re ... #', '') |
| jquery.js:27:5:27:25 | hash.re ... #', '') |
| jquery.js:28:5:28:26 | window. ... .search |
| jquery.js:28:5:28:26 | window. ... .search |
| jquery.js:28:5:28:43 | window. ... ?', '') |
| jquery.js:28:5:28:43 | window. ... ?', '') |
| jquery.js:34:5:34:25 | '<b>' + ... '</b>' |
| jquery.js:34:5:34:25 | '<b>' + ... '</b>' |
| jquery.js:34:13:34:16 | hash |
| jwt-server.js:7:9:7:35 | taint |
| jwt-server.js:7:17:7:35 | req.param("wobble") |
| jwt-server.js:7:17:7:35 | req.param("wobble") |
@@ -959,6 +984,30 @@ edges
| jquery.js:16:38:16:52 | window.location | jquery.js:16:38:16:63 | window. ... tring() |
| jquery.js:16:38:16:63 | window. ... tring() | jquery.js:16:19:16:64 | decodeU ... ring()) |
| jquery.js:16:38:16:63 | window. ... tring() | jquery.js:16:19:16:64 | decodeU ... ring()) |
| jquery.js:18:7:18:33 | hash | jquery.js:21:5:21:8 | hash |
| jquery.js:18:7:18:33 | hash | jquery.js:22:5:22:8 | hash |
| jquery.js:18:7:18:33 | hash | jquery.js:23:5:23:8 | hash |
| jquery.js:18:7:18:33 | hash | jquery.js:24:5:24:8 | hash |
| jquery.js:18:7:18:33 | hash | jquery.js:27:5:27:8 | hash |
| jquery.js:18:7:18:33 | hash | jquery.js:34:13:34:16 | hash |
| jquery.js:18:14:18:33 | window.location.hash | jquery.js:18:7:18:33 | hash |
| jquery.js:18:14:18:33 | window.location.hash | jquery.js:18:7:18:33 | hash |
| jquery.js:21:5:21:8 | hash | jquery.js:21:5:21:21 | hash.substring(1) |
| jquery.js:21:5:21:8 | hash | jquery.js:21:5:21:21 | hash.substring(1) |
| jquery.js:22:5:22:8 | hash | jquery.js:22:5:22:25 | hash.su ... (1, 10) |
| jquery.js:22:5:22:8 | hash | jquery.js:22:5:22:25 | hash.su ... (1, 10) |
| jquery.js:23:5:23:8 | hash | jquery.js:23:5:23:18 | hash.substr(1) |
| jquery.js:23:5:23:8 | hash | jquery.js:23:5:23:18 | hash.substr(1) |
| jquery.js:24:5:24:8 | hash | jquery.js:24:5:24:17 | hash.slice(1) |
| jquery.js:24:5:24:8 | hash | jquery.js:24:5:24:17 | hash.slice(1) |
| jquery.js:27:5:27:8 | hash | jquery.js:27:5:27:25 | hash.re ... #', '') |
| jquery.js:27:5:27:8 | hash | jquery.js:27:5:27:25 | hash.re ... #', '') |
| jquery.js:28:5:28:26 | window. ... .search | jquery.js:28:5:28:43 | window. ... ?', '') |
| jquery.js:28:5:28:26 | window. ... .search | jquery.js:28:5:28:43 | window. ... ?', '') |
| jquery.js:28:5:28:26 | window. ... .search | jquery.js:28:5:28:43 | window. ... ?', '') |
| jquery.js:28:5:28:26 | window. ... .search | jquery.js:28:5:28:43 | window. ... ?', '') |
| jquery.js:34:13:34:16 | hash | jquery.js:34:5:34:25 | '<b>' + ... '</b>' |
| jquery.js:34:13:34:16 | hash | jquery.js:34:5:34:25 | '<b>' + ... '</b>' |
| jwt-server.js:7:9:7:35 | taint | jwt-server.js:9:16:9:20 | taint |
| jwt-server.js:7:17:7:35 | req.param("wobble") | jwt-server.js:7:9:7:35 | taint |
| jwt-server.js:7:17:7:35 | req.param("wobble") | jwt-server.js:7:9:7:35 | taint |
@@ -1493,6 +1542,13 @@ edges
| jquery.js:14:19:14:58 | decodeU ... n.hash) | jquery.js:14:38:14:57 | window.location.hash | jquery.js:14:19:14:58 | decodeU ... n.hash) | Cross-site scripting vulnerability due to $@. | jquery.js:14:38:14:57 | window.location.hash | user-provided value |
| jquery.js:15:19:15:60 | decodeU ... search) | jquery.js:15:38:15:59 | window. ... .search | jquery.js:15:19:15:60 | decodeU ... search) | Cross-site scripting vulnerability due to $@. | jquery.js:15:38:15:59 | window. ... .search | user-provided value |
| jquery.js:16:19:16:64 | decodeU ... ring()) | jquery.js:16:38:16:52 | window.location | jquery.js:16:19:16:64 | decodeU ... ring()) | Cross-site scripting vulnerability due to $@. | jquery.js:16:38:16:52 | window.location | user-provided value |
| jquery.js:21:5:21:21 | hash.substring(1) | jquery.js:18:14:18:33 | window.location.hash | jquery.js:21:5:21:21 | hash.substring(1) | Cross-site scripting vulnerability due to $@. | jquery.js:18:14:18:33 | window.location.hash | user-provided value |
| jquery.js:22:5:22:25 | hash.su ... (1, 10) | jquery.js:18:14:18:33 | window.location.hash | jquery.js:22:5:22:25 | hash.su ... (1, 10) | Cross-site scripting vulnerability due to $@. | jquery.js:18:14:18:33 | window.location.hash | user-provided value |
| jquery.js:23:5:23:18 | hash.substr(1) | jquery.js:18:14:18:33 | window.location.hash | jquery.js:23:5:23:18 | hash.substr(1) | Cross-site scripting vulnerability due to $@. | jquery.js:18:14:18:33 | window.location.hash | user-provided value |
| jquery.js:24:5:24:17 | hash.slice(1) | jquery.js:18:14:18:33 | window.location.hash | jquery.js:24:5:24:17 | hash.slice(1) | Cross-site scripting vulnerability due to $@. | jquery.js:18:14:18:33 | window.location.hash | user-provided value |
| jquery.js:27:5:27:25 | hash.re ... #', '') | jquery.js:18:14:18:33 | window.location.hash | jquery.js:27:5:27:25 | hash.re ... #', '') | Cross-site scripting vulnerability due to $@. | jquery.js:18:14:18:33 | window.location.hash | user-provided value |
| jquery.js:28:5:28:43 | window. ... ?', '') | jquery.js:28:5:28:26 | window. ... .search | jquery.js:28:5:28:43 | window. ... ?', '') | Cross-site scripting vulnerability due to $@. | jquery.js:28:5:28:26 | window. ... .search | user-provided value |
| jquery.js:34:5:34:25 | '<b>' + ... '</b>' | jquery.js:18:14:18:33 | window.location.hash | jquery.js:34:5:34:25 | '<b>' + ... '</b>' | Cross-site scripting vulnerability due to $@. | jquery.js:18:14:18:33 | window.location.hash | user-provided value |
| jwt-server.js:11:19:11:29 | decoded.foo | jwt-server.js:7:17:7:35 | req.param("wobble") | jwt-server.js:11:19:11:29 | decoded.foo | Cross-site scripting vulnerability due to $@. | jwt-server.js:7:17:7:35 | req.param("wobble") | user-provided value |
| nodemailer.js:13:11:13:69 | `Hi, yo ... sage}.` | nodemailer.js:13:50:13:66 | req.query.message | nodemailer.js:13:11:13:69 | `Hi, yo ... sage}.` | HTML injection vulnerability due to $@. | nodemailer.js:13:50:13:66 | req.query.message | user-provided value |
| optionalSanitizer.js:6:18:6:23 | target | optionalSanitizer.js:2:16:2:39 | documen ... .search | optionalSanitizer.js:6:18:6:23 | target | Cross-site scripting vulnerability due to $@. | optionalSanitizer.js:2:16:2:39 | documen ... .search | user-provided value |

49
javascript/ql/test/query-tests/Security/CWE-079/DomBasedXss/XssWithAdditionalSources.expected
View File

@@ -222,6 +222,31 @@ nodes
| jquery.js:16:38:16:52 | window.location |
| jquery.js:16:38:16:52 | window.location |
| jquery.js:16:38:16:63 | window. ... tring() |
| jquery.js:18:7:18:33 | hash |
| jquery.js:18:14:18:33 | window.location.hash |
| jquery.js:18:14:18:33 | window.location.hash |
| jquery.js:21:5:21:8 | hash |
| jquery.js:21:5:21:21 | hash.substring(1) |
| jquery.js:21:5:21:21 | hash.substring(1) |
| jquery.js:22:5:22:8 | hash |
| jquery.js:22:5:22:25 | hash.su ... (1, 10) |
| jquery.js:22:5:22:25 | hash.su ... (1, 10) |
| jquery.js:23:5:23:8 | hash |
| jquery.js:23:5:23:18 | hash.substr(1) |
| jquery.js:23:5:23:18 | hash.substr(1) |
| jquery.js:24:5:24:8 | hash |
| jquery.js:24:5:24:17 | hash.slice(1) |
| jquery.js:24:5:24:17 | hash.slice(1) |
| jquery.js:27:5:27:8 | hash |
| jquery.js:27:5:27:25 | hash.re ... #', '') |
| jquery.js:27:5:27:25 | hash.re ... #', '') |
| jquery.js:28:5:28:26 | window. ... .search |
| jquery.js:28:5:28:26 | window. ... .search |
| jquery.js:28:5:28:43 | window. ... ?', '') |
| jquery.js:28:5:28:43 | window. ... ?', '') |
| jquery.js:34:5:34:25 | '<b>' + ... '</b>' |
| jquery.js:34:5:34:25 | '<b>' + ... '</b>' |
| jquery.js:34:13:34:16 | hash |
| jwt-server.js:7:9:7:35 | taint |
| jwt-server.js:7:17:7:35 | req.param("wobble") |
| jwt-server.js:7:17:7:35 | req.param("wobble") |
@@ -977,6 +1002,30 @@ edges
| jquery.js:16:38:16:52 | window.location | jquery.js:16:38:16:63 | window. ... tring() |
| jquery.js:16:38:16:63 | window. ... tring() | jquery.js:16:19:16:64 | decodeU ... ring()) |
| jquery.js:16:38:16:63 | window. ... tring() | jquery.js:16:19:16:64 | decodeU ... ring()) |
| jquery.js:18:7:18:33 | hash | jquery.js:21:5:21:8 | hash |
| jquery.js:18:7:18:33 | hash | jquery.js:22:5:22:8 | hash |
| jquery.js:18:7:18:33 | hash | jquery.js:23:5:23:8 | hash |
| jquery.js:18:7:18:33 | hash | jquery.js:24:5:24:8 | hash |
| jquery.js:18:7:18:33 | hash | jquery.js:27:5:27:8 | hash |
| jquery.js:18:7:18:33 | hash | jquery.js:34:13:34:16 | hash |
| jquery.js:18:14:18:33 | window.location.hash | jquery.js:18:7:18:33 | hash |
| jquery.js:18:14:18:33 | window.location.hash | jquery.js:18:7:18:33 | hash |
| jquery.js:21:5:21:8 | hash | jquery.js:21:5:21:21 | hash.substring(1) |
| jquery.js:21:5:21:8 | hash | jquery.js:21:5:21:21 | hash.substring(1) |
| jquery.js:22:5:22:8 | hash | jquery.js:22:5:22:25 | hash.su ... (1, 10) |
| jquery.js:22:5:22:8 | hash | jquery.js:22:5:22:25 | hash.su ... (1, 10) |
| jquery.js:23:5:23:8 | hash | jquery.js:23:5:23:18 | hash.substr(1) |
| jquery.js:23:5:23:8 | hash | jquery.js:23:5:23:18 | hash.substr(1) |
| jquery.js:24:5:24:8 | hash | jquery.js:24:5:24:17 | hash.slice(1) |
| jquery.js:24:5:24:8 | hash | jquery.js:24:5:24:17 | hash.slice(1) |
| jquery.js:27:5:27:8 | hash | jquery.js:27:5:27:25 | hash.re ... #', '') |
| jquery.js:27:5:27:8 | hash | jquery.js:27:5:27:25 | hash.re ... #', '') |
| jquery.js:28:5:28:26 | window. ... .search | jquery.js:28:5:28:43 | window. ... ?', '') |
| jquery.js:28:5:28:26 | window. ... .search | jquery.js:28:5:28:43 | window. ... ?', '') |
| jquery.js:28:5:28:26 | window. ... .search | jquery.js:28:5:28:43 | window. ... ?', '') |
| jquery.js:28:5:28:26 | window. ... .search | jquery.js:28:5:28:43 | window. ... ?', '') |
| jquery.js:34:13:34:16 | hash | jquery.js:34:5:34:25 | '<b>' + ... '</b>' |
| jquery.js:34:13:34:16 | hash | jquery.js:34:5:34:25 | '<b>' + ... '</b>' |
| jwt-server.js:7:9:7:35 | taint | jwt-server.js:9:16:9:20 | taint |
| jwt-server.js:7:17:7:35 | req.param("wobble") | jwt-server.js:7:9:7:35 | taint |
| jwt-server.js:7:17:7:35 | req.param("wobble") | jwt-server.js:7:9:7:35 | taint |

18
javascript/ql/test/query-tests/Security/CWE-079/DomBasedXss/jquery.js vendored
View File

@@ -14,4 +14,22 @@ function test() {
elm.innerHTML = decodeURIComponent(window.location.hash); // NOT OK
elm.innerHTML = decodeURIComponent(window.location.search); // NOT OK
elm.innerHTML = decodeURIComponent(window.location.toString()); // NOT OK
let hash = window.location.hash;
$(hash); // OK - start with '#'
$(hash.substring(1)); // NOT OK
$(hash.substring(1, 10)); // NOT OK
$(hash.substr(1)); // NOT OK
$(hash.slice(1)); // NOT OK
$(hash.substring(0, 10)); // OK
$(hash.replace('#', '')); // NOT OK
$(window.location.search.replace('?', '')); // NOT OK
$(hash.replace('!', '')); // OK
$(hash.replace('blah', '')); // OK
$(hash + 'blah'); // OK
$('blah' + hash); // OK - does not start with '<'
$('<b>' + hash + '</b>'); // NOT OK
}