mirror of
https://github.com/github/codeql.git
synced 2025-12-18 01:33:15 +01:00
10a7294327
This adds Alert annotations for alerts that seem intentional by the test but has not been annotated with 'NOT OK', or the comment was in the wrong place. In a few cases I included 'Source' expectations to make it easier to see what happened. Other 'Source' expectations will be added in bulk a later commit.
39 lines
1.5 KiB
HTML
39 lines
1.5 KiB
HTML
<!DOCTYPE html>
|
|
<html>
|
|
<head>
|
|
</head>
|
|
<body>
|
|
<h1>OK</h1>
|
|
<a href="http://example.com" target="_blank" rel="noopener noreferrer">Example</a>
|
|
<a href="http://example.com" target="_blank" rel="noreferrer">Example</a>
|
|
<a href="http://example.com" target="_blank" rel="noopener">Example</a>
|
|
<a data-ng-href="https://example.com" target="_blank" rel="noopener">Example</a>
|
|
|
|
<h1>OK, because of constant URL</h1>
|
|
<a href="http://example.com" target="_blank">Example</a>
|
|
<a href="http://example.com" target="_blank" rel="nopoener">Example</a>
|
|
<a data-ng-href="https://example.com" target="_blank">Example</a>
|
|
|
|
<h1>OK, because of constant prefix</h1>
|
|
<a href="http://example.com/{{X}}" target="_blank">Example</a>
|
|
<a href="http://example.com/{{X}}" target="_blank" rel="nopoener">Example</a>
|
|
<a data-ng-href="https://example.com/{{X}}" target="_blank">Example</a>
|
|
|
|
<h1>NOT OK, because of dynamic URL</h1>
|
|
<a href="http://example.com{{X}}" target="_blank">Example</a> <!-- $ Alert -->
|
|
<a href="{{target}}" target="_blank">Example</a> <!-- $ Alert -->
|
|
<a href="{{target}}" target="_blank"> <!-- $ Alert -->
|
|
Example
|
|
</a>
|
|
|
|
<h1>NOT OK: mailto is not fine.</h1>
|
|
<a target="_blank" href="mailto:{{var:mail}}">mail somone</a> <!-- $ Alert -->
|
|
|
|
<h1>OK: template elements after # or ? are fine.</h1>
|
|
<a href="file.extension?#[% row.href %]" target="_blank">Example</a>
|
|
<a href="file.extension?[% row.href %]" target="_blank">Example</a>
|
|
<a href="file.extension#[% row.href %]" target="_blank">Example</a>
|
|
|
|
</body>
|
|
</html>
|