File tree Expand file tree Collapse file tree 3 files changed +4
-4
lines changed
src/queries/Security/CWE-094
test/query-tests/Security/CWE-094 Expand file tree Collapse file tree 3 files changed +4
-4
lines changed Original file line number Diff line number Diff line change @@ -3,4 +3,4 @@ let remoteData = try String(contentsOf: URL(string: "http://example.com/evil.jso
3
3
4
4
...
5
5
6
- _ = try await webview. evaluateJavaScript ( " alert (" + remoteData + " ) " ) // BAD
6
+ _ = try await webview. evaluateJavaScript ( " console.log (" + remoteData + " ) " ) // BAD
Original file line number Diff line number Diff line change @@ -4,7 +4,7 @@ let remoteData = try String(contentsOf: URL(string: "http://example.com/evil.jso
4
4
...
5
5
6
6
_ = try await webview. callAsyncJavaScript (
7
- " alert(JSON.parse (data) )" ,
7
+ " console.log (data)" ,
8
8
arguments: [ " data " : remoteData] , // GOOD
9
9
contentWorld: . page
10
10
)
Original file line number Diff line number Diff line change @@ -317,10 +317,10 @@ func testQHelpExamples() {
317
317
let webview = WKWebView ( )
318
318
let remoteData = try String ( contentsOf: URL ( string: " http://example.com/evil.json " ) !)
319
319
320
- _ = try await webview. evaluateJavaScript ( " alert (" + remoteData + " ) " ) // BAD [NOT DETECTED - TODO: extract Callables of @MainActor method calls]
320
+ _ = try await webview. evaluateJavaScript ( " console.log (" + remoteData + " ) " ) // BAD [NOT DETECTED - TODO: extract Callables of @MainActor method calls]
321
321
322
322
_ = try await webview. callAsyncJavaScript (
323
- " alert(JSON.parse (data) )" ,
323
+ " console.log (data)" ,
324
324
arguments: [ " data " : remoteData] , // GOOD
325
325
contentWorld: . page
326
326
)
You can’t perform that action at this time.
0 commit comments