Skip to content

Commit cece307

Browse files
erik-krogherik-krogh
authored
Merge pull request github#12802 from erik-krogh/history-xss
JS: add browser history as XSS sink
2 parents 9169ddb + b195762 commit cece307

File tree

4 files changed

+22
-0
lines changed

4 files changed

+22
-0
lines changed

‎javascript/ql/lib/semmle/javascript/security/dataflow/ClientSideUrlRedirectCustomizations.qll

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -222,6 +222,8 @@ module ClientSideUrlRedirect {
222222
HistoryWriteUrlSink() {
223223
this = History::getBrowserHistory().getMember(["push", "replace"]).getACall().getArgument(0)
224224
}
225+
226+
override predicate isXssSink() { any() }
225227
}
226228

227229
/**

‎javascript/ql/test/query-tests/Security/CWE-079/DomBasedXss/Xss.expected

Lines changed: 9 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1115,6 +1115,10 @@ nodes
11151115
| tst.js:491:23:491:35 | location.hash |
11161116
| tst.js:491:23:491:45 | locatio ... bstr(1) |
11171117
| tst.js:491:23:491:45 | locatio ... bstr(1) |
1118+
| tst.js:494:18:494:30 | location.hash |
1119+
| tst.js:494:18:494:30 | location.hash |
1120+
| tst.js:494:18:494:40 | locatio ... bstr(1) |
1121+
| tst.js:494:18:494:40 | locatio ... bstr(1) |
11181122
| typeahead.js:20:13:20:45 | target |
11191123
| typeahead.js:20:22:20:45 | documen ... .search |
11201124
| typeahead.js:20:22:20:45 | documen ... .search |
@@ -2263,6 +2267,10 @@ edges
22632267
| tst.js:491:23:491:35 | location.hash | tst.js:491:23:491:45 | locatio ... bstr(1) |
22642268
| tst.js:491:23:491:35 | location.hash | tst.js:491:23:491:45 | locatio ... bstr(1) |
22652269
| tst.js:491:23:491:35 | location.hash | tst.js:491:23:491:45 | locatio ... bstr(1) |
2270+
| tst.js:494:18:494:30 | location.hash | tst.js:494:18:494:40 | locatio ... bstr(1) |
2271+
| tst.js:494:18:494:30 | location.hash | tst.js:494:18:494:40 | locatio ... bstr(1) |
2272+
| tst.js:494:18:494:30 | location.hash | tst.js:494:18:494:40 | locatio ... bstr(1) |
2273+
| tst.js:494:18:494:30 | location.hash | tst.js:494:18:494:40 | locatio ... bstr(1) |
22662274
| typeahead.js:20:13:20:45 | target | typeahead.js:21:12:21:17 | target |
22672275
| typeahead.js:20:22:20:45 | documen ... .search | typeahead.js:20:13:20:45 | target |
22682276
| typeahead.js:20:22:20:45 | documen ... .search | typeahead.js:20:13:20:45 | target |
@@ -2550,6 +2558,7 @@ edges
25502558
| tst.js:476:20:476:22 | url | tst.js:471:13:471:36 | documen ... .search | tst.js:476:20:476:22 | url | Cross-site scripting vulnerability due to $@. | tst.js:471:13:471:36 | documen ... .search | user-provided value |
25512559
| tst.js:486:22:486:24 | url | tst.js:471:13:471:36 | documen ... .search | tst.js:486:22:486:24 | url | Cross-site scripting vulnerability due to $@. | tst.js:471:13:471:36 | documen ... .search | user-provided value |
25522560
| tst.js:491:23:491:45 | locatio ... bstr(1) | tst.js:491:23:491:35 | location.hash | tst.js:491:23:491:45 | locatio ... bstr(1) | Cross-site scripting vulnerability due to $@. | tst.js:491:23:491:35 | location.hash | user-provided value |
2561+
| tst.js:494:18:494:40 | locatio ... bstr(1) | tst.js:494:18:494:30 | location.hash | tst.js:494:18:494:40 | locatio ... bstr(1) | Cross-site scripting vulnerability due to $@. | tst.js:494:18:494:30 | location.hash | user-provided value |
25532562
| typeahead.js:25:18:25:20 | val | typeahead.js:20:22:20:45 | documen ... .search | typeahead.js:25:18:25:20 | val | Cross-site scripting vulnerability due to $@. | typeahead.js:20:22:20:45 | documen ... .search | user-provided value |
25542563
| v-html.vue:2:8:2:23 | v-html=tainted | v-html.vue:6:42:6:58 | document.location | v-html.vue:2:8:2:23 | v-html=tainted | Cross-site scripting vulnerability due to $@. | v-html.vue:6:42:6:58 | document.location | user-provided value |
25552564
| various-concat-obfuscations.js:4:4:4:31 | "<div>" ... </div>" | various-concat-obfuscations.js:2:16:2:39 | documen ... .search | various-concat-obfuscations.js:4:4:4:31 | "<div>" ... </div>" | Cross-site scripting vulnerability due to $@. | various-concat-obfuscations.js:2:16:2:39 | documen ... .search | user-provided value |

‎javascript/ql/test/query-tests/Security/CWE-079/DomBasedXss/XssWithAdditionalSources.expected

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1127,6 +1127,10 @@ nodes
11271127
| tst.js:491:23:491:35 | location.hash |
11281128
| tst.js:491:23:491:45 | locatio ... bstr(1) |
11291129
| tst.js:491:23:491:45 | locatio ... bstr(1) |
1130+
| tst.js:494:18:494:30 | location.hash |
1131+
| tst.js:494:18:494:30 | location.hash |
1132+
| tst.js:494:18:494:40 | locatio ... bstr(1) |
1133+
| tst.js:494:18:494:40 | locatio ... bstr(1) |
11301134
| typeahead.js:9:28:9:30 | loc |
11311135
| typeahead.js:9:28:9:30 | loc |
11321136
| typeahead.js:9:28:9:30 | loc |
@@ -2325,6 +2329,10 @@ edges
23252329
| tst.js:491:23:491:35 | location.hash | tst.js:491:23:491:45 | locatio ... bstr(1) |
23262330
| tst.js:491:23:491:35 | location.hash | tst.js:491:23:491:45 | locatio ... bstr(1) |
23272331
| tst.js:491:23:491:35 | location.hash | tst.js:491:23:491:45 | locatio ... bstr(1) |
2332+
| tst.js:494:18:494:30 | location.hash | tst.js:494:18:494:40 | locatio ... bstr(1) |
2333+
| tst.js:494:18:494:30 | location.hash | tst.js:494:18:494:40 | locatio ... bstr(1) |
2334+
| tst.js:494:18:494:30 | location.hash | tst.js:494:18:494:40 | locatio ... bstr(1) |
2335+
| tst.js:494:18:494:30 | location.hash | tst.js:494:18:494:40 | locatio ... bstr(1) |
23282336
| typeahead.js:9:28:9:30 | loc | typeahead.js:10:16:10:18 | loc |
23292337
| typeahead.js:9:28:9:30 | loc | typeahead.js:10:16:10:18 | loc |
23302338
| typeahead.js:9:28:9:30 | loc | typeahead.js:10:16:10:18 | loc |

‎javascript/ql/test/query-tests/Security/CWE-079/DomBasedXss/tst.js

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -489,4 +489,7 @@ function urlStuff() {
489489
window.open(location.hash.substr(1)); // OK - any JavaScript is executed in another context
490490

491491
navigation.navigate(location.hash.substr(1)); // NOT OK
492+
493+
const myHistory = require('history').createBrowserHistory();
494+
myHistory.push(location.hash.substr(1)); // NOT OK
492495
}

0 commit comments

Comments
 (0)