hohn/codeql
1
0
Fork 0
mirror of https://github.com/github/codeql.git synced 2026-04-30 11:15:13 +02:00
Code Issues Packages Projects Releases Wiki Activity

use more API nodes in XmlParsers, and recognize more results from parsing XML

Browse Source
This commit is contained in:
Erik Krogh Kristensen
2021-04-14 11:47:15 +02:00
parent 3b6cd0f681
commit fd23e0bdda
4 changed files with 139 additions and 47 deletions
Download Patch File Download Diff File Expand all files Collapse all files

4
javascript/ql/test/library-tests/TaintTracking/BasicTaintTracking.expected
View File

@@ -166,3 +166,7 @@ typeInferenceMismatch
| xml.js:23:18:23:25 | source() | xml.js:20:14:20:17 | attr |
| xml.js:26:27:26:34 | source() | xml.js:26:10:26:39 | convert ... (), {}) |
| xml.js:34:18:34:25 | source() | xml.js:31:18:31:21 | name |
| xml.js:41:15:41:22 | source() | xml.js:44:10:44:22 | gchild.text() |
| xml.js:41:15:41:22 | source() | xml.js:49:10:49:34 | child.a ... value() |
| xml.js:41:15:41:22 | source() | xml.js:52:10:52:34 | child2. ... .name() |
| xml.js:41:15:41:22 | source() | xml.js:58:12:58:14 | str |

25
javascript/ql/test/library-tests/TaintTracking/xml.js
View File

@@ -34,4 +34,27 @@
parser.write(source());
parser.end();
})();
})();
(function () {
var libxml = require("libxmljs");
var xml = source();
var xmlDoc = libxml.parseXmlString(xml);
var gchild = xmlDoc.get('//grandchild');
sink(gchild.text()); // NOT OK
var children = xmlDoc.root().childNodes();
var child = children[0];
sink(child.attr('foo').value()); // NOT OK
var child2 = xmlDoc.root().child()
sink(child2.attr('foo').name()); // NOT OK
const SaxPushParser = libxml.SaxPushParser;
var parser = new SaxPushParser();
parser.push(xml);
parser.on('characters', function (str) {
sink(str); // NOT OK
})
});