mirror of
https://github.com/github/codeql.git
synced 2025-12-18 18:10:39 +01:00
6cba2fe4f8
Since HttpResponse is not *only* used for XSS, it is still valuable to know the content is send as part of the response. The *proper* solution to this problem of not all HttpResponses being vulnerable to XSS is probably to define a new abstract class in Http.qll called HttpResponseXSSVulnerableSink (or similar). I would like to model a few more libraries/frameworks before fully comitting to an approach though.
32 lines
2.6 KiB
Plaintext
32 lines
2.6 KiB
Plaintext
| views_1x.py:8:25:8:63 | django.Response(...) | externally controlled string |
|
|
| views_1x.py:12:25:12:52 | django.Response(...) | externally controlled string |
|
|
| views_1x.py:16:25:16:53 | django.Response(...) | externally controlled string |
|
|
| views_1x.py:21:15:21:42 | django.Response.write(...) | externally controlled string |
|
|
| views_1x.py:30:29:30:60 | django.Response(...) | externally controlled string |
|
|
| views_1x.py:36:29:36:65 | django.Response(...) | externally controlled string |
|
|
| views_1x.py:41:25:41:63 | django.Response(...) | externally controlled string |
|
|
| views_1x.py:45:25:45:70 | django.Response(...) | externally controlled string |
|
|
| views_1x.py:66:25:66:55 | django.Response(...) | externally controlled string |
|
|
| views_1x.py:75:25:75:33 | django.Response(...) | externally controlled string |
|
|
| views_1x.py:90:25:90:33 | django.Response(...) | externally controlled string |
|
|
| views_1x.py:94:25:94:58 | django.Response(...) | externally controlled string |
|
|
| views_1x.py:103:33:103:55 | django.Response(...) | externally controlled string |
|
|
| views_1x.py:107:25:107:47 | django.Response(...) | externally controlled string |
|
|
| views_2x_3x.py:8:25:8:63 | django.Response(...) | externally controlled string |
|
|
| views_2x_3x.py:12:25:12:52 | django.Response(...) | externally controlled string |
|
|
| views_2x_3x.py:16:25:16:53 | django.Response(...) | externally controlled string |
|
|
| views_2x_3x.py:21:15:21:42 | django.Response.write(...) | externally controlled string |
|
|
| views_2x_3x.py:30:29:30:60 | django.Response(...) | externally controlled string |
|
|
| views_2x_3x.py:36:29:36:65 | django.Response(...) | externally controlled string |
|
|
| views_2x_3x.py:41:25:41:63 | django.Response(...) | externally controlled string |
|
|
| views_2x_3x.py:45:25:45:70 | django.Response(...) | externally controlled string |
|
|
| views_2x_3x.py:66:25:66:40 | django.Response(...) | externally controlled string |
|
|
| views_2x_3x.py:79:25:79:61 | django.Response(...) | externally controlled string |
|
|
| views_2x_3x.py:82:25:82:69 | django.Response(...) | externally controlled string |
|
|
| views_2x_3x.py:85:25:85:64 | django.Response(...) | externally controlled string |
|
|
| views_2x_3x.py:88:25:88:32 | django.Response(...) | externally controlled string |
|
|
| views_2x_3x.py:111:25:111:33 | django.Response(...) | externally controlled string |
|
|
| views_2x_3x.py:115:25:115:58 | django.Response(...) | externally controlled string |
|
|
| views_2x_3x.py:124:33:124:55 | django.Response(...) | externally controlled string |
|
|
| views_2x_3x.py:128:25:128:47 | django.Response(...) | externally controlled string |
|