mirror of
https://github.com/github/codeql.git
synced 2026-04-30 03:05:15 +02:00
4568967a76
Tainted URL suffix steps are added as configuration-specific additional steps, which means implicit reads may occur before any of these steps. These steps accidentally included the legacy taint steps which include a step from 'arguments' to all positional parameters. Combined with the implicit read, arguments could escape their array index and flow to any parameter while in the tainted-url flow state.
14 lines
274 B
JavaScript
14 lines
274 B
JavaScript
import 'dummy';
|
|
|
|
function foo(x, y, z) {
|
|
arguments; // ensure 'arguments' are used
|
|
document.writeln(x); // OK
|
|
document.writeln(y); // NOT OK
|
|
document.writeln(z); // OK
|
|
}
|
|
|
|
function bar() {
|
|
const url = window.location.href;
|
|
foo('safe', url, 'safe');
|
|
}
|