Files
codeql/javascript/ql/test/query-tests/Security/CWE-079/DomBasedXss/d3.js
2025-02-28 13:29:30 +01:00

23 lines
468 B
JavaScript

const d3 = require('d3');
function getTaint() {
return window.name; // $ Source
}
function doSomething() {
d3.select('#main')
.attr('width', 100)
.style('color', 'red')
.html(getTaint()) // $ Alert
.html(d => getTaint()) // $ Alert
.call(otherFunction)
.html(d => getTaint()); // $ Alert
}
function otherFunction(selection) {
selection
.attr('foo', 'bar')
.html(getTaint()); // $ Alert
}