mirror of
https://github.com/github/codeql.git
synced 2025-12-18 01:33:15 +01:00
109 lines
4.3 KiB
JavaScript
109 lines
4.3 KiB
JavaScript
(function(x){
|
|
|
|
if ("http://evil.com/?http://good.com".match("https?://good.com")) {} // NOT OK
|
|
if ("http://evil.com/?http://good.com".match(new RegExp("https?://good.com"))) {} // NOT OK
|
|
if ("http://evil.com/?http://good.com".match("^https?://good.com")) {} // NOT OK - missing post-anchor
|
|
if ("http://evil.com/?http://good.com".match(/^https?:\/\/good.com/)) {} // NOT OK - missing post-anchor
|
|
if ("http://evil.com/?http://good.com".match("(^https?://good1.com)|(^https?://good2.com)")) {} // NOT OK - missing post-anchor
|
|
if ("http://evil.com/?http://good.com".match("(https?://good.com)|(^https?://goodie.com)")) {} // NOT OK - missing post-anchor
|
|
|
|
/https?:\/\/good.com/.exec("http://evil.com/?http://good.com"); // NOT OK
|
|
new RegExp("https?://good.com").exec("http://evil.com/?http://good.com"); // NOT OK
|
|
|
|
"http://evil.com/?http://good.com".search("https?://good.com"); // NOT OK
|
|
|
|
new RegExp("https?://good.com").test("http://evil.com/?http://good.com"); // NOT OK
|
|
|
|
if ("something".match("other")) {} // OK
|
|
if ("something".match("x.commissary")) {} // OK
|
|
if ("http://evil.com/?http://good.com".match("https?://good.com")) {} // NOT OK
|
|
if ("http://evil.com/?http://good.com".match("https?://good.com:8080")) {} // NOT OK
|
|
|
|
let trustedUrls = [
|
|
"https?://good.com", // NOT OK, referenced below
|
|
/https?:\/\/good.com/, // NOT OK, referenced below
|
|
new RegExp("https?://good.com"), // NOT OK, referenced below
|
|
"^https?://good.com" // NOT OK - missing post-anchor
|
|
];
|
|
function isTrustedUrl(url) {
|
|
for (let trustedUrl of trustedUrls) {
|
|
if (url.match(trustedUrl)) return true;
|
|
}
|
|
return false;
|
|
}
|
|
|
|
/https?:\/\/good.com\/([0-9]+)/.exec(url); // NOT OK
|
|
"https://verygood.com/?id=" + /https?:\/\/good.com\/([0-9]+)/.exec(url)[0]; // OK
|
|
"http" + (secure? "s": "") + "://" + "verygood.com/?id=" + /https?:\/\/good.com\/([0-9]+)/.exec(url)[0]; // OK
|
|
"http" + (secure? "s": "") + "://" + ("verygood.com/?id=" + /https?:\/\/good.com\/([0-9]+)/.exec(url)[0]); // OK
|
|
|
|
// g or .replace?
|
|
file = file.replace(
|
|
/https:\/\/cdn\.ampproject\.org\/v0\/amp-story-0\.1\.js/g,
|
|
hostName + '/dist/v0/amp-story-1.0.max.js'
|
|
);
|
|
|
|
// missing context of use
|
|
const urlPatterns = [
|
|
{
|
|
regex: /youtube.com\/embed\/([a-z0-9\?&=\-_]+)/i, // OK
|
|
type: 'iframe', w: 560, h: 314,
|
|
url: '//www.youtube.com/embed/$1',
|
|
allowFullscreen: true
|
|
}];
|
|
|
|
// ditto
|
|
F.helpers.media = {
|
|
defaults : {
|
|
youtube : {
|
|
matcher : /(youtube\.com|youtu\.be)\/(watch\?v=|v\/|u\/|embed\/?)?(videoseries\?list=(.*)|[\w-]{11}|\?listType=(.*)&list=(.*)).*/i,
|
|
params : {
|
|
autoplay : 1,
|
|
autohide : 1,
|
|
fs : 1,
|
|
rel : 0,
|
|
hd : 1,
|
|
wmode : 'opaque',
|
|
enablejsapi : 1
|
|
},
|
|
type : 'iframe',
|
|
url : '//www.youtube.com/embed/$3'
|
|
}}}
|
|
|
|
// ditto
|
|
var urlPatterns = [
|
|
{regex: /youtu\.be\/([\w\-.]+)/, type: 'iframe', w: 425, h: 350, url: '//www.youtube.com/embed/$1'},
|
|
{regex: /youtube\.com(.+)v=([^&]+)/, type: 'iframe', w: 425, h: 350, url: '//www.youtube.com/embed/$2'},
|
|
{regex: /vimeo\.com\/([0-9]+)/, type: 'iframe', w: 425, h: 350, url: '//player.vimeo.com/video/$1?title=0&byline=0&portrait=0&color=8dc7dc'},
|
|
];
|
|
|
|
// check optional successsor to TLD
|
|
new RegExp("(Pingdom.com_bot_version_)(\\d+)\\.(\\d+)")
|
|
|
|
// replace and spaces
|
|
error.replace(/See https:\/\/github\.com\/Squirrel\/Squirrel\.Mac\/issues\/182 for more information/, 'See [this link](https://github.com/Microsoft/vscode/issues/7426#issuecomment-425093469) for more information');
|
|
|
|
// not a url
|
|
var sharedScript = /<script\s.*src="(app:\/\/.+\.gaiamobile\.org)?\/?(shared\/.+)".*>/;
|
|
|
|
// replace
|
|
const repo = repoURL.replace(/http(s)?:\/\/(\d+\.)?github.com\//gi, '')
|
|
|
|
// replace and space
|
|
cmp.replace(/<option value="http:\/\/codemirror.net\/">HEAD<\/option>/,
|
|
"<option value=\"http://codemirror.net/\">HEAD</option>\n <option value=\"http://marijnhaverbeke.nl/git/codemirror?a=blob_plain;hb=" + number + ";f=\">" + number + "</option>");
|
|
|
|
// replace and space
|
|
const helpMsg = /For help see https:\/\/nodejs.org\/en\/docs\/inspector\s*/;
|
|
msg = msg.replace(helpMsg, '');
|
|
|
|
// not a url
|
|
pkg.source.match(/<a:skin.*?\s+xmlns:a="http:\/\/ajax.org\/2005\/aml"/m)
|
|
|
|
// replace
|
|
path.replace(/engine.io/, "$&-client");
|
|
|
|
/\.com|\.org/; // OK, has no domain name
|
|
/example\.com|whatever/; // OK, the other disjunction doesn't match a hostname
|
|
});
|