Files
codeql/javascript/ql/test/query-tests/Security/CWE-094/CodeInjection/tst.js
2019-09-06 14:42:07 +01:00

27 lines
570 B
JavaScript

// NOT OK
eval(document.location.href.substring(document.location.href.indexOf("default=")+8))
// NOT OK
setTimeout(document.location.hash);
// OK
setTimeout(document.location.protocol);
// OK
$('. ' + document.location.hostname);
// NOT OK
Function(document.location.search.replace(/.*\bfoo\s*=\s*([^;]*).*/, "$1"));
// NOT OK
WebAssembly.compile(document.location.hash);
// NOT OK
WebAssembly.compileStreaming(document.location.hash);
// NOT OK
eval(atob(document.location.hash.substring(1)));
// NOT OK
$('<a>').attr("onclick", location.search.substring(1));