hohn/codeql
1
0
Fork 0
mirror of https://github.com/github/codeql.git synced 2026-04-22 23:35:14 +02:00
Code Issues Packages Projects Releases Wiki Activity

JS: add test cases with unknown flags for double escaping, works as expected.

Browse Source
This commit is contained in:
Napalys
2024-11-27 13:16:34 +01:00
parent 98fd97799c
commit fe28657c7d
2 changed files with 19 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

1
javascript/ql/test/query-tests/Security/CWE-116/DoubleEscaping/DoubleEscaping.expected
View File

@@ -6,3 +6,4 @@
| tst.js:60:7:60:28 | s.repla ... '%25') | This replacement may double-escape '%' characters from $@. | tst.js:59:7:59:28 | s.repla ... '%26') | here |
| tst.js:68:10:70:38 | s.repla ... &") | This replacement may double-escape '&' characters from $@. | tst.js:68:10:69:39 | s.repla ... apos;") | here |
| tst.js:79:10:79:66 | s.repla ... &") | This replacement may double-escape '&' characters from $@. | tst.js:79:10:79:43 | s.repla ... epl[c]) | here |
| tst.js:99:10:101:49 | s.repla ... &") | This replacement may double-escape '&' characters from $@. | tst.js:99:10:100:51 | s.repla ... apos;") | here |

18
javascript/ql/test/query-tests/Security/CWE-116/DoubleEscaping/tst.js
View File

@@ -94,3 +94,21 @@ function testWithCapturedVar(x) {
function encodeDecodeEncode(s) {
return goodEncode(goodDecode(goodEncode(s)));
}
function badEncode(s) {
return s.replace(new RegExp("\"", "g"), """)
.replace(new RegExp("\'", "g"), "'")
.replace(new RegExp("&", "g"), "&"); // NOT OK
}
function goodEncode(s) {
return s.replace(new RegExp("\"", ""), """)
.replace(new RegExp("\'", ""), "'")
.replace(new RegExp("&", ""), "&"); // OK
}
function goodEncode(s) {
return s.replace(new RegExp("\"", unknownFlags()), """)
.replace(new RegExp("\'", unknownFlags()), "'")
.replace(new RegExp("&", unknownFlags()), "&"); // OK
}