mirror of
https://github.com/github/codeql.git
synced 2026-04-14 11:34:00 +02:00
1df69ec1d2
Preserving tainted-url-suffix into array element 0 seemed like a good idea, but didn't work out so well.
23 lines
869 B
JavaScript
23 lines
869 B
JavaScript
import 'dummy';
|
|
|
|
function t1() {
|
|
const href = window.location.href;
|
|
|
|
sink(href); // $ flow=tainted-url-suffix
|
|
|
|
sink(href.split('#')[0]); // could be 'tainted-url-suffix', but omitted due to FPs from URI-encoding
|
|
sink(href.split('#')[1]); // $ flow=taint
|
|
sink(href.split('#').pop()); // $ flow=taint
|
|
sink(href.split('#')[2]); // $ MISSING: flow=taint // currently the split() summary only propagates to index 1
|
|
|
|
sink(href.split('?')[0]);
|
|
sink(href.split('?')[1]); // $ flow=taint
|
|
sink(href.split('?').pop()); // $ flow=taint
|
|
sink(href.split('?')[2]); // $ MISSING: flow=taint
|
|
|
|
sink(href.split(blah())[0]); // $ flow=tainted-url-suffix
|
|
sink(href.split(blah())[1]); // $ flow=tainted-url-suffix
|
|
sink(href.split(blah()).pop()); // $ flow=tainted-url-suffix
|
|
sink(href.split(blah())[2]); // $ flow=tainted-url-suffix
|
|
}
|