codeql/javascript/ql/test/query-tests/Security/CWE-116/IncompleteSanitization/IncompleteMultiCharacterSanitization.expected

problems
| tst-multi-character-sanitization.js:3:13:3:57 | content ... gi, "") | This string may still contain $@, which may cause an HTML element injection vulnerability. | tst-multi-character-sanitization.js:3:30:3:30 | < | <script |
| tst-multi-character-sanitization.js:4:13:4:47 | content ... /g, "") | This string may still contain $@, which may cause an HTML attribute injection vulnerability. | tst-multi-character-sanitization.js:4:30:4:40 |  on\\w+=".*" | on |
| tst-multi-character-sanitization.js:5:13:5:49 | content ... /g, "") | This string may still contain $@, which may cause an HTML attribute injection vulnerability. | tst-multi-character-sanitization.js:5:30:5:42 |  on\\w+=\\'.*\\' | on |
| tst-multi-character-sanitization.js:9:13:9:47 | content ... gi, "") | This string may still contain $@, which may cause an HTML element injection vulnerability. | tst-multi-character-sanitization.js:9:30:9:30 | < | <script |
| tst-multi-character-sanitization.js:10:13:10:49 | content ... /g, "") | This string may still contain $@, which may cause an HTML attribute injection vulnerability. | tst-multi-character-sanitization.js:10:30:10:42 | .on\\w+=.*".*" | on |
| tst-multi-character-sanitization.js:11:13:11:51 | content ... /g, "") | This string may still contain $@, which may cause an HTML attribute injection vulnerability. | tst-multi-character-sanitization.js:11:30:11:44 | .on\\w+=.*\\'.*\\' | on |
| tst-multi-character-sanitization.js:19:3:19:35 | respons ... pt, "") | This string may still contain $@, which may cause an HTML element injection vulnerability. | tst-multi-character-sanitization.js:18:18:18:24 | <script | <script |
| tst-multi-character-sanitization.js:25:10:25:40 | text.re ... /g, "") | This string may still contain $@, which may cause an HTML element injection vulnerability. | tst-multi-character-sanitization.js:25:24:25:27 | <!-- | <!-- |
| tst-multi-character-sanitization.js:49:13:49:43 | req.url ... EL, "") | This string may still contain $@, which may cause a path injection vulnerability. | tst-multi-character-sanitization.js:48:22:48:23 | \\/ | /.. |
| tst-multi-character-sanitization.js:49:13:49:43 | req.url ... EL, "") | This string may still contain $@, which may cause a path injection vulnerability. | tst-multi-character-sanitization.js:48:26:48:27 | \\. | ../ |
| tst-multi-character-sanitization.js:64:7:64:73 | x.repla ... /g, "") | This string may still contain $@, which may cause an HTML element injection vulnerability. | tst-multi-character-sanitization.js:64:18:64:24 | <script | <script |
| tst-multi-character-sanitization.js:66:7:66:56 | x.repla ... /g, "") | This string may still contain $@, which may cause an HTML attribute injection vulnerability. | tst-multi-character-sanitization.js:66:18:66:49 | (\\/\|\\s)on\\w+=(\\'\|")?[^"]*(\\'\|")? | on |
| tst-multi-character-sanitization.js:75:7:75:37 | x.repla ... gm, "") | This string may still contain $@, which may cause an HTML element injection vulnerability. | tst-multi-character-sanitization.js:75:18:75:21 | <!-- | <!-- |
| tst-multi-character-sanitization.js:76:7:76:35 | x.repla ... +/, "") | This string may still contain $@, which may cause an HTML attribute injection vulnerability. | tst-multi-character-sanitization.js:76:18:76:29 | \\sng-[a-z-]+ | ng- |
| tst-multi-character-sanitization.js:77:7:77:36 | x.repla ... /g, "") | This string may still contain $@, which may cause an HTML attribute injection vulnerability. | tst-multi-character-sanitization.js:77:18:77:29 | \\sng-[a-z-]+ | ng- |
| tst-multi-character-sanitization.js:81:7:81:58 | x.repla ... /g, "") | This string may still contain $@, which may cause an HTML attribute injection vulnerability. | tst-multi-character-sanitization.js:81:36:81:39 | only | on |
| tst-multi-character-sanitization.js:81:7:81:58 | x.repla ... /g, "") | This string may still contain $@, which may cause an HTML element injection vulnerability. | tst-multi-character-sanitization.js:81:18:81:24 | <script | <script |
| tst-multi-character-sanitization.js:83:7:83:63 | x.repla ... gi, "") | This string may still contain $@, which may cause an HTML element injection vulnerability. | tst-multi-character-sanitization.js:83:18:83:21 | <!-- | <!-- |
| tst-multi-character-sanitization.js:85:7:85:48 | x.repla ... /g, "") | This string may still contain $@, which may cause a path injection vulnerability. | tst-multi-character-sanitization.js:85:18:85:21 | \\x2E | ../ |
| tst-multi-character-sanitization.js:87:7:87:47 | x.repla ... gi, "") | This string may still contain $@, which may cause an HTML element injection vulnerability. | tst-multi-character-sanitization.js:87:18:87:24 | <script | <script |
| tst-multi-character-sanitization.js:91:7:95:4 | x.repla ... ";\\n  }) | This string may still contain $@, which may cause an HTML element injection vulnerability. | tst-multi-character-sanitization.js:91:18:91:24 | <script | <script |
| tst-multi-character-sanitization.js:100:7:100:30 | x.repla ... /g, "") | This string may still contain $@, which may cause a path injection vulnerability. | tst-multi-character-sanitization.js:100:18:100:19 | \\. | ../ |
| tst-multi-character-sanitization.js:101:7:101:30 | x.repla ... /g, "") | This string may still contain $@, which may cause a path injection vulnerability. | tst-multi-character-sanitization.js:101:18:101:19 | \\/ | /.. |
| tst-multi-character-sanitization.js:103:7:103:58 | x.repla ... gi, "") | This string may still contain $@, which may cause an HTML element injection vulnerability. | tst-multi-character-sanitization.js:103:18:103:24 | <script | <script |
| tst-multi-character-sanitization.js:105:7:105:64 | x.repla ... gi, "") | This string may still contain $@, which may cause an HTML element injection vulnerability. | tst-multi-character-sanitization.js:105:18:105:18 | < | <script |
| tst-multi-character-sanitization.js:106:7:106:62 | x.repla ... /g, "") | This string may still contain $@, which may cause an HTML element injection vulnerability. | tst-multi-character-sanitization.js:106:18:106:19 | \\< | <script |
| tst-multi-character-sanitization.js:107:7:107:75 | x.repla ... gm, "") | This string may still contain $@, which may cause an HTML element injection vulnerability. | tst-multi-character-sanitization.js:107:18:107:18 | < | <script |
| tst-multi-character-sanitization.js:108:7:108:58 | x.repla ... gi, "") | This string may still contain $@, which may cause an HTML element injection vulnerability. | tst-multi-character-sanitization.js:108:18:108:24 | <script | <script |
| tst-multi-character-sanitization.js:109:7:109:50 | x.repla ... gi, "") | This string may still contain $@, which may cause an HTML element injection vulnerability. | tst-multi-character-sanitization.js:109:18:109:24 | <script | <script |
| tst-multi-character-sanitization.js:110:7:110:32 | x.repla ... /g, "") | This string may still contain $@, which may cause an HTML element injection vulnerability. | tst-multi-character-sanitization.js:110:20:110:23 | <!-- | <!-- |
| tst-multi-character-sanitization.js:125:7:128:34 | x\\n    . ... //, "") | This string may still contain $@, which may cause a path injection vulnerability. | tst-multi-character-sanitization.js:128:21:128:22 | \\/ | /.. |
| tst-multi-character-sanitization.js:134:2:134:44 | content ... gi, "") | This string may still contain $@, which may cause an HTML element injection vulnerability. | tst-multi-character-sanitization.js:134:19:134:25 | <script | <script |
| tst-multi-character-sanitization.js:135:2:135:46 | content ... gi, "") | This string may still contain $@, which may cause an HTML element injection vulnerability. | tst-multi-character-sanitization.js:135:19:135:19 | < | <script |
| tst-multi-character-sanitization.js:136:2:136:48 | content ... gi, "") | This string may still contain $@, which may cause an HTML element injection vulnerability. | tst-multi-character-sanitization.js:136:19:136:20 | .+ | <script |
| tst-multi-character-sanitization.js:137:2:137:48 | content ... gi, "") | This string may still contain $@, which may cause an HTML element injection vulnerability. | tst-multi-character-sanitization.js:137:21:137:21 | < | <script |
| tst-multi-character-sanitization.js:141:13:141:62 | content ... gi, "") | This string may still contain $@, which may cause an HTML element injection vulnerability. | tst-multi-character-sanitization.js:141:30:141:36 | <script | <script |
| tst-multi-character-sanitization.js:142:13:142:56 | content ... /g, '') | This string may still contain $@, which may cause an HTML element injection vulnerability. | tst-multi-character-sanitization.js:142:30:142:30 | < | <script |
| tst-multi-character-sanitization.js:143:13:143:91 | content ... /g, '') | This string may still contain $@, which may cause an HTML element injection vulnerability. | tst-multi-character-sanitization.js:143:30:143:30 | < | <script |
| tst-multi-character-sanitization.js:144:13:144:90 | content ... /g, '') | This string may still contain $@, which may cause an HTML element injection vulnerability. | tst-multi-character-sanitization.js:144:30:144:30 | < | <script |
| tst-multi-character-sanitization.js:147:3:147:99 | n.clone ... gi, '') | This string may still contain $@, which may cause an HTML element injection vulnerability. | tst-multi-character-sanitization.js:147:41:147:41 | < | <script |
| tst-multi-character-sanitization.js:151:3:151:99 | n.clone ... gi, '') | This string may still contain $@, which may cause an HTML element injection vulnerability. | tst-multi-character-sanitization.js:151:41:151:41 | < | <script |
| tst.js:341:9:341:44 | p.repla ... "), "") | This string may still contain $@, which may cause a path injection vulnerability. | tst.js:341:31:341:33 | \\. | ../ |
testFailures
| UnsafeHtmlExpansion.js:9:5:9:14 | // $ Alert | Missing result: Alert |
| UnsafeHtmlExpansion.js:10:71:10:80 | // $ Alert | Missing result: Alert |
| UnsafeHtmlExpansion.js:16:5:16:14 | // $ Alert | Missing result: Alert |
| UnsafeHtmlExpansion.js:17:51:17:60 | // $ Alert | Missing result: Alert |
| UnsafeHtmlExpansion.js:23:5:23:14 | // $ Alert | Missing result: Alert |
| UnsafeHtmlExpansion.js:24:52:24:61 | // $ Alert | Missing result: Alert |
| UnsafeHtmlExpansion.js:26:42:26:51 | // $ Alert | Missing result: Alert |
| UnsafeHtmlExpansion.js:30:40:30:49 | // $ Alert | Missing result: Alert |
| UnsafeHtmlExpansion.js:35:47:35:96 | // $ Al ...  string | Missing result: Alert |
| tst-multi-character-sanitization.js:91:7:95:4 | This string may still contain $@, which may cause an HTML element injection vulnerability. | Unexpected result: Alert |
| tst-multi-character-sanitization.js:91:81:91:90 | // $ Alert | Missing result: Alert |
| tst.js:5:30:5:39 | // $ Alert | Missing result: Alert |
| tst.js:9:30:9:39 | // $ Alert | Missing result: Alert |
| tst.js:13:34:13:43 | // $ Alert | Missing result: Alert |
| tst.js:17:35:17:44 | // $ Alert | Missing result: Alert |
| tst.js:21:38:21:47 | // $ Alert | Missing result: Alert |
| tst.js:25:40:25:49 | // $ Alert | Missing result: Alert |
| tst.js:29:39:29:48 | // $ Alert | Missing result: Alert |
| tst.js:33:31:33:40 | // $ Alert | Missing result: Alert |
| tst.js:37:36:37:45 | // $ Alert | Missing result: Alert |
| tst.js:41:33:41:42 | // $ Alert | Missing result: Alert |
| tst.js:45:33:45:42 | // $ Alert | Missing result: Alert |
| tst.js:49:30:49:39 | // $ Alert | Missing result: Alert |
| tst.js:53:30:53:39 | // $ Alert | Missing result: Alert |
| tst.js:57:30:57:39 | // $ Alert | Missing result: Alert |
| tst.js:61:35:61:44 | // $ Alert | Missing result: Alert |
| tst.js:65:35:65:44 | // $ Alert | Missing result: Alert |
| tst.js:69:40:69:49 | // $ Alert | Missing result: Alert |
| tst.js:133:39:133:85 | // $ Al ... nitizer | Missing result: Alert |
| tst.js:135:45:135:54 | // $ Alert | Missing result: Alert |
| tst.js:136:45:136:54 | // $ Alert | Missing result: Alert |
| tst.js:140:39:140:121 | // $ Al ... ntended | Missing result: Alert |
| tst.js:148:37:148:46 | // $ Alert | Missing result: Alert |
| tst.js:149:37:149:46 | // $ Alert | Missing result: Alert |
| tst.js:193:34:193:43 | // $ Alert | Missing result: Alert |
| tst.js:202:33:202:42 | // $ Alert | Missing result: Alert |
| tst.js:206:27:206:36 | // $ Alert | Missing result: Alert |
| tst.js:207:29:207:38 | // $ Alert | Missing result: Alert |
| tst.js:208:29:208:38 | // $ Alert | Missing result: Alert |
| tst.js:209:43:209:52 | // $ Alert | Missing result: Alert |
| tst.js:210:61:210:70 | // $ Alert | Missing result: Alert |
| tst.js:211:61:211:70 | // $ Alert | Missing result: Alert |
| tst.js:212:61:212:70 | // $ Alert | Missing result: Alert |
| tst.js:215:28:215:37 | // $ Alert | Missing result: Alert |
| tst.js:283:25:283:98 | // $ Al ... d below | Missing result: Alert |
| tst.js:292:25:292:98 | // $ Al ... d below | Missing result: Alert |
| tst.js:309:51:309:60 | // $ Alert | Missing result: Alert |
| tst.js:333:43:333:52 | // $ Alert | Missing result: Alert |
| tst.js:337:49:337:58 | // $ Alert | Missing result: Alert |
| tst.js:345:50:345:59 | // $ Alert | Missing result: Alert |
| tst.js:349:46:349:55 | // $ Alert | Missing result: Alert |
| tst.js:353:62:353:71 | // $ Alert | Missing result: Alert |
| tst.js:362:49:362:58 | // $ Alert | Missing result: Alert |
| tst.js:363:49:363:58 | // $ Alert | Missing result: Alert |