Skip to content

Commit 1444ec5

Browse files
asgerfasgerf
committed
JS: Add similar test for hbs
1 parent 7045fb4 commit 1444ec5

File tree

5 files changed

+134
-0
lines changed

5 files changed

+134
-0
lines changed

‎javascript/ql/test/library-tests/frameworks/Templating/CodeInjection.expected

Lines changed: 30 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -5,6 +5,12 @@ nodes
55
| app.js:17:25:17:48 | req.que ... shSink1 |
66
| app.js:19:35:19:68 | req.que ... rString |
77
| app.js:19:35:19:68 | req.que ... rString |
8+
| app.js:34:30:34:58 | req.que ... tedCode |
9+
| app.js:34:30:34:58 | req.que ... tedCode |
10+
| app.js:36:25:36:48 | req.que ... shSink1 |
11+
| app.js:36:25:36:48 | req.que ... shSink1 |
12+
| app.js:38:35:38:68 | req.que ... rString |
13+
| app.js:38:35:38:68 | req.que ... rString |
814
| views/ejs_sinks.ejs:13:39:13:64 | <%= dataInGeneratedCode %> |
915
| views/ejs_sinks.ejs:13:39:13:64 | <%= dataInGeneratedCode %> |
1016
| views/ejs_sinks.ejs:13:43:13:61 | dataInGeneratedCode |
@@ -14,20 +20,44 @@ nodes
1420
| views/ejs_sinks.ejs:21:39:21:69 | <%= dataInEventHandlerString %> |
1521
| views/ejs_sinks.ejs:21:39:21:69 | <%= dataInEventHandlerString %> |
1622
| views/ejs_sinks.ejs:21:43:21:66 | dataInE ... rString |
23+
| views/hbs_sinks.hbs:13:39:13:63 | {{ dataInGeneratedCode }} |
24+
| views/hbs_sinks.hbs:13:39:13:63 | {{ dataInGeneratedCode }} |
25+
| views/hbs_sinks.hbs:13:42:13:60 | dataInGeneratedCode |
26+
| views/hbs_sinks.hbs:16:19:16:38 | {{ backslashSink1 }} |
27+
| views/hbs_sinks.hbs:16:19:16:38 | {{ backslashSink1 }} |
28+
| views/hbs_sinks.hbs:16:22:16:35 | backslashSink1 |
29+
| views/hbs_sinks.hbs:21:39:21:68 | {{ dataInEventHandlerString }} |
30+
| views/hbs_sinks.hbs:21:39:21:68 | {{ dataInEventHandlerString }} |
31+
| views/hbs_sinks.hbs:21:42:21:65 | dataInE ... rString |
1732
edges
1833
| app.js:15:30:15:58 | req.que ... tedCode | views/ejs_sinks.ejs:13:43:13:61 | dataInGeneratedCode |
1934
| app.js:15:30:15:58 | req.que ... tedCode | views/ejs_sinks.ejs:13:43:13:61 | dataInGeneratedCode |
2035
| app.js:17:25:17:48 | req.que ... shSink1 | views/ejs_sinks.ejs:16:23:16:36 | backslashSink1 |
2136
| app.js:17:25:17:48 | req.que ... shSink1 | views/ejs_sinks.ejs:16:23:16:36 | backslashSink1 |
2237
| app.js:19:35:19:68 | req.que ... rString | views/ejs_sinks.ejs:21:43:21:66 | dataInE ... rString |
2338
| app.js:19:35:19:68 | req.que ... rString | views/ejs_sinks.ejs:21:43:21:66 | dataInE ... rString |
39+
| app.js:34:30:34:58 | req.que ... tedCode | views/hbs_sinks.hbs:13:42:13:60 | dataInGeneratedCode |
40+
| app.js:34:30:34:58 | req.que ... tedCode | views/hbs_sinks.hbs:13:42:13:60 | dataInGeneratedCode |
41+
| app.js:36:25:36:48 | req.que ... shSink1 | views/hbs_sinks.hbs:16:22:16:35 | backslashSink1 |
42+
| app.js:36:25:36:48 | req.que ... shSink1 | views/hbs_sinks.hbs:16:22:16:35 | backslashSink1 |
43+
| app.js:38:35:38:68 | req.que ... rString | views/hbs_sinks.hbs:21:42:21:65 | dataInE ... rString |
44+
| app.js:38:35:38:68 | req.que ... rString | views/hbs_sinks.hbs:21:42:21:65 | dataInE ... rString |
2445
| views/ejs_sinks.ejs:13:43:13:61 | dataInGeneratedCode | views/ejs_sinks.ejs:13:39:13:64 | <%= dataInGeneratedCode %> |
2546
| views/ejs_sinks.ejs:13:43:13:61 | dataInGeneratedCode | views/ejs_sinks.ejs:13:39:13:64 | <%= dataInGeneratedCode %> |
2647
| views/ejs_sinks.ejs:16:23:16:36 | backslashSink1 | views/ejs_sinks.ejs:16:19:16:39 | <%= backslashSink1 %> |
2748
| views/ejs_sinks.ejs:16:23:16:36 | backslashSink1 | views/ejs_sinks.ejs:16:19:16:39 | <%= backslashSink1 %> |
2849
| views/ejs_sinks.ejs:21:43:21:66 | dataInE ... rString | views/ejs_sinks.ejs:21:39:21:69 | <%= dataInEventHandlerString %> |
2950
| views/ejs_sinks.ejs:21:43:21:66 | dataInE ... rString | views/ejs_sinks.ejs:21:39:21:69 | <%= dataInEventHandlerString %> |
51+
| views/hbs_sinks.hbs:13:42:13:60 | dataInGeneratedCode | views/hbs_sinks.hbs:13:39:13:63 | {{ dataInGeneratedCode }} |
52+
| views/hbs_sinks.hbs:13:42:13:60 | dataInGeneratedCode | views/hbs_sinks.hbs:13:39:13:63 | {{ dataInGeneratedCode }} |
53+
| views/hbs_sinks.hbs:16:22:16:35 | backslashSink1 | views/hbs_sinks.hbs:16:19:16:38 | {{ backslashSink1 }} |
54+
| views/hbs_sinks.hbs:16:22:16:35 | backslashSink1 | views/hbs_sinks.hbs:16:19:16:38 | {{ backslashSink1 }} |
55+
| views/hbs_sinks.hbs:21:42:21:65 | dataInE ... rString | views/hbs_sinks.hbs:21:39:21:68 | {{ dataInEventHandlerString }} |
56+
| views/hbs_sinks.hbs:21:42:21:65 | dataInE ... rString | views/hbs_sinks.hbs:21:39:21:68 | {{ dataInEventHandlerString }} |
3057
#select
3158
| views/ejs_sinks.ejs:13:39:13:64 | <%= dataInGeneratedCode %> | app.js:15:30:15:58 | req.que ... tedCode | views/ejs_sinks.ejs:13:39:13:64 | <%= dataInGeneratedCode %> | $@ flows to here and is interpreted as code. | app.js:15:30:15:58 | req.que ... tedCode | User-provided value |
3259
| views/ejs_sinks.ejs:16:19:16:39 | <%= backslashSink1 %> | app.js:17:25:17:48 | req.que ... shSink1 | views/ejs_sinks.ejs:16:19:16:39 | <%= backslashSink1 %> | $@ flows to here and is interpreted as code. | app.js:17:25:17:48 | req.que ... shSink1 | User-provided value |
3360
| views/ejs_sinks.ejs:21:39:21:69 | <%= dataInEventHandlerString %> | app.js:19:35:19:68 | req.que ... rString | views/ejs_sinks.ejs:21:39:21:69 | <%= dataInEventHandlerString %> | $@ flows to here and is interpreted as code. | app.js:19:35:19:68 | req.que ... rString | User-provided value |
61+
| views/hbs_sinks.hbs:13:39:13:63 | {{ dataInGeneratedCode }} | app.js:34:30:34:58 | req.que ... tedCode | views/hbs_sinks.hbs:13:39:13:63 | {{ dataInGeneratedCode }} | $@ flows to here and is interpreted as code. | app.js:34:30:34:58 | req.que ... tedCode | User-provided value |
62+
| views/hbs_sinks.hbs:16:19:16:38 | {{ backslashSink1 }} | app.js:36:25:36:48 | req.que ... shSink1 | views/hbs_sinks.hbs:16:19:16:38 | {{ backslashSink1 }} | $@ flows to here and is interpreted as code. | app.js:36:25:36:48 | req.que ... shSink1 | User-provided value |
63+
| views/hbs_sinks.hbs:21:39:21:68 | {{ dataInEventHandlerString }} | app.js:38:35:38:68 | req.que ... rString | views/hbs_sinks.hbs:21:39:21:68 | {{ dataInEventHandlerString }} | $@ flows to here and is interpreted as code. | app.js:38:35:38:68 | req.que ... rString | User-provided value |

‎javascript/ql/test/library-tests/frameworks/Templating/Xss.expected

Lines changed: 50 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -9,6 +9,16 @@ nodes
99
| app.js:16:33:16:64 | req.que ... CodeRaw |
1010
| app.js:20:38:20:74 | req.que ... ringRaw |
1111
| app.js:20:38:20:74 | req.que ... ringRaw |
12+
| app.js:27:18:27:34 | req.query.rawHtml |
13+
| app.js:27:18:27:34 | req.query.rawHtml |
14+
| app.js:30:26:30:46 | req.que ... tmlProp |
15+
| app.js:30:26:30:46 | req.que ... tmlProp |
16+
| app.js:33:33:33:64 | req.que ... eralRaw |
17+
| app.js:33:33:33:64 | req.que ... eralRaw |
18+
| app.js:35:33:35:64 | req.que ... CodeRaw |
19+
| app.js:35:33:35:64 | req.que ... CodeRaw |
20+
| app.js:39:38:39:74 | req.que ... ringRaw |
21+
| app.js:39:38:39:74 | req.que ... ringRaw |
1222
| views/ejs_sinks.ejs:4:9:4:22 | <%- rawHtml %> |
1323
| views/ejs_sinks.ejs:4:9:4:22 | <%- rawHtml %> |
1424
| views/ejs_sinks.ejs:4:13:4:19 | rawHtml |
@@ -24,6 +34,21 @@ nodes
2434
| views/ejs_sinks.ejs:22:39:22:72 | <%- dataInEventHandlerStringRaw %> |
2535
| views/ejs_sinks.ejs:22:39:22:72 | <%- dataInEventHandlerStringRaw %> |
2636
| views/ejs_sinks.ejs:22:43:22:69 | dataInE ... ringRaw |
37+
| views/hbs_sinks.hbs:4:9:4:23 | {{{ rawHtml }}} |
38+
| views/hbs_sinks.hbs:4:9:4:23 | {{{ rawHtml }}} |
39+
| views/hbs_sinks.hbs:4:13:4:19 | rawHtml |
40+
| views/hbs_sinks.hbs:7:9:7:34 | {{{ object.rawHtmlProp }}} |
41+
| views/hbs_sinks.hbs:7:9:7:34 | {{{ object.rawHtmlProp }}} |
42+
| views/hbs_sinks.hbs:7:13:7:30 | object.rawHtmlProp |
43+
| views/hbs_sinks.hbs:11:43:11:72 | {{{ dataInStringLiteralRaw }}} |
44+
| views/hbs_sinks.hbs:11:43:11:72 | {{{ dataInStringLiteralRaw }}} |
45+
| views/hbs_sinks.hbs:11:47:11:68 | dataInS ... eralRaw |
46+
| views/hbs_sinks.hbs:14:42:14:71 | {{{ dataInGeneratedCodeRaw }}} |
47+
| views/hbs_sinks.hbs:14:42:14:71 | {{{ dataInGeneratedCodeRaw }}} |
48+
| views/hbs_sinks.hbs:14:46:14:67 | dataInG ... CodeRaw |
49+
| views/hbs_sinks.hbs:22:39:22:73 | {{{ dataInEventHandlerStringRaw }}} |
50+
| views/hbs_sinks.hbs:22:39:22:73 | {{{ dataInEventHandlerStringRaw }}} |
51+
| views/hbs_sinks.hbs:22:43:22:69 | dataInE ... ringRaw |
2752
edges
2853
| app.js:8:18:8:34 | req.query.rawHtml | views/ejs_sinks.ejs:4:13:4:19 | rawHtml |
2954
| app.js:8:18:8:34 | req.query.rawHtml | views/ejs_sinks.ejs:4:13:4:19 | rawHtml |
@@ -35,6 +60,16 @@ edges
3560
| app.js:16:33:16:64 | req.que ... CodeRaw | views/ejs_sinks.ejs:14:46:14:67 | dataInG ... CodeRaw |
3661
| app.js:20:38:20:74 | req.que ... ringRaw | views/ejs_sinks.ejs:22:43:22:69 | dataInE ... ringRaw |
3762
| app.js:20:38:20:74 | req.que ... ringRaw | views/ejs_sinks.ejs:22:43:22:69 | dataInE ... ringRaw |
63+
| app.js:27:18:27:34 | req.query.rawHtml | views/hbs_sinks.hbs:4:13:4:19 | rawHtml |
64+
| app.js:27:18:27:34 | req.query.rawHtml | views/hbs_sinks.hbs:4:13:4:19 | rawHtml |
65+
| app.js:30:26:30:46 | req.que ... tmlProp | views/hbs_sinks.hbs:7:13:7:30 | object.rawHtmlProp |
66+
| app.js:30:26:30:46 | req.que ... tmlProp | views/hbs_sinks.hbs:7:13:7:30 | object.rawHtmlProp |
67+
| app.js:33:33:33:64 | req.que ... eralRaw | views/hbs_sinks.hbs:11:47:11:68 | dataInS ... eralRaw |
68+
| app.js:33:33:33:64 | req.que ... eralRaw | views/hbs_sinks.hbs:11:47:11:68 | dataInS ... eralRaw |
69+
| app.js:35:33:35:64 | req.que ... CodeRaw | views/hbs_sinks.hbs:14:46:14:67 | dataInG ... CodeRaw |
70+
| app.js:35:33:35:64 | req.que ... CodeRaw | views/hbs_sinks.hbs:14:46:14:67 | dataInG ... CodeRaw |
71+
| app.js:39:38:39:74 | req.que ... ringRaw | views/hbs_sinks.hbs:22:43:22:69 | dataInE ... ringRaw |
72+
| app.js:39:38:39:74 | req.que ... ringRaw | views/hbs_sinks.hbs:22:43:22:69 | dataInE ... ringRaw |
3873
| views/ejs_sinks.ejs:4:13:4:19 | rawHtml | views/ejs_sinks.ejs:4:9:4:22 | <%- rawHtml %> |
3974
| views/ejs_sinks.ejs:4:13:4:19 | rawHtml | views/ejs_sinks.ejs:4:9:4:22 | <%- rawHtml %> |
4075
| views/ejs_sinks.ejs:7:13:7:30 | object.rawHtmlProp | views/ejs_sinks.ejs:7:9:7:33 | <%- object.rawHtmlProp %> |
@@ -45,9 +80,24 @@ edges
4580
| views/ejs_sinks.ejs:14:46:14:67 | dataInG ... CodeRaw | views/ejs_sinks.ejs:14:42:14:70 | <%- dataInGeneratedCodeRaw %> |
4681
| views/ejs_sinks.ejs:22:43:22:69 | dataInE ... ringRaw | views/ejs_sinks.ejs:22:39:22:72 | <%- dataInEventHandlerStringRaw %> |
4782
| views/ejs_sinks.ejs:22:43:22:69 | dataInE ... ringRaw | views/ejs_sinks.ejs:22:39:22:72 | <%- dataInEventHandlerStringRaw %> |
83+
| views/hbs_sinks.hbs:4:13:4:19 | rawHtml | views/hbs_sinks.hbs:4:9:4:23 | {{{ rawHtml }}} |
84+
| views/hbs_sinks.hbs:4:13:4:19 | rawHtml | views/hbs_sinks.hbs:4:9:4:23 | {{{ rawHtml }}} |
85+
| views/hbs_sinks.hbs:7:13:7:30 | object.rawHtmlProp | views/hbs_sinks.hbs:7:9:7:34 | {{{ object.rawHtmlProp }}} |
86+
| views/hbs_sinks.hbs:7:13:7:30 | object.rawHtmlProp | views/hbs_sinks.hbs:7:9:7:34 | {{{ object.rawHtmlProp }}} |
87+
| views/hbs_sinks.hbs:11:47:11:68 | dataInS ... eralRaw | views/hbs_sinks.hbs:11:43:11:72 | {{{ dataInStringLiteralRaw }}} |
88+
| views/hbs_sinks.hbs:11:47:11:68 | dataInS ... eralRaw | views/hbs_sinks.hbs:11:43:11:72 | {{{ dataInStringLiteralRaw }}} |
89+
| views/hbs_sinks.hbs:14:46:14:67 | dataInG ... CodeRaw | views/hbs_sinks.hbs:14:42:14:71 | {{{ dataInGeneratedCodeRaw }}} |
90+
| views/hbs_sinks.hbs:14:46:14:67 | dataInG ... CodeRaw | views/hbs_sinks.hbs:14:42:14:71 | {{{ dataInGeneratedCodeRaw }}} |
91+
| views/hbs_sinks.hbs:22:43:22:69 | dataInE ... ringRaw | views/hbs_sinks.hbs:22:39:22:73 | {{{ dataInEventHandlerStringRaw }}} |
92+
| views/hbs_sinks.hbs:22:43:22:69 | dataInE ... ringRaw | views/hbs_sinks.hbs:22:39:22:73 | {{{ dataInEventHandlerStringRaw }}} |
4893
#select
4994
| views/ejs_sinks.ejs:4:9:4:22 | <%- rawHtml %> | app.js:8:18:8:34 | req.query.rawHtml | views/ejs_sinks.ejs:4:9:4:22 | <%- rawHtml %> | Cross-site scripting vulnerability due to $@. | app.js:8:18:8:34 | req.query.rawHtml | user-provided value |
5095
| views/ejs_sinks.ejs:7:9:7:33 | <%- object.rawHtmlProp %> | app.js:11:26:11:46 | req.que ... tmlProp | views/ejs_sinks.ejs:7:9:7:33 | <%- object.rawHtmlProp %> | Cross-site scripting vulnerability due to $@. | app.js:11:26:11:46 | req.que ... tmlProp | user-provided value |
5196
| views/ejs_sinks.ejs:11:43:11:71 | <%- dataInStringLiteralRaw %> | app.js:14:33:14:64 | req.que ... eralRaw | views/ejs_sinks.ejs:11:43:11:71 | <%- dataInStringLiteralRaw %> | Cross-site scripting vulnerability due to $@. | app.js:14:33:14:64 | req.que ... eralRaw | user-provided value |
5297
| views/ejs_sinks.ejs:14:42:14:70 | <%- dataInGeneratedCodeRaw %> | app.js:16:33:16:64 | req.que ... CodeRaw | views/ejs_sinks.ejs:14:42:14:70 | <%- dataInGeneratedCodeRaw %> | Cross-site scripting vulnerability due to $@. | app.js:16:33:16:64 | req.que ... CodeRaw | user-provided value |
5398
| views/ejs_sinks.ejs:22:39:22:72 | <%- dataInEventHandlerStringRaw %> | app.js:20:38:20:74 | req.que ... ringRaw | views/ejs_sinks.ejs:22:39:22:72 | <%- dataInEventHandlerStringRaw %> | Cross-site scripting vulnerability due to $@. | app.js:20:38:20:74 | req.que ... ringRaw | user-provided value |
99+
| views/hbs_sinks.hbs:4:9:4:23 | {{{ rawHtml }}} | app.js:27:18:27:34 | req.query.rawHtml | views/hbs_sinks.hbs:4:9:4:23 | {{{ rawHtml }}} | Cross-site scripting vulnerability due to $@. | app.js:27:18:27:34 | req.query.rawHtml | user-provided value |
100+
| views/hbs_sinks.hbs:7:9:7:34 | {{{ object.rawHtmlProp }}} | app.js:30:26:30:46 | req.que ... tmlProp | views/hbs_sinks.hbs:7:9:7:34 | {{{ object.rawHtmlProp }}} | Cross-site scripting vulnerability due to $@. | app.js:30:26:30:46 | req.que ... tmlProp | user-provided value |
101+
| views/hbs_sinks.hbs:11:43:11:72 | {{{ dataInStringLiteralRaw }}} | app.js:33:33:33:64 | req.que ... eralRaw | views/hbs_sinks.hbs:11:43:11:72 | {{{ dataInStringLiteralRaw }}} | Cross-site scripting vulnerability due to $@. | app.js:33:33:33:64 | req.que ... eralRaw | user-provided value |
102+
| views/hbs_sinks.hbs:14:42:14:71 | {{{ dataInGeneratedCodeRaw }}} | app.js:35:33:35:64 | req.que ... CodeRaw | views/hbs_sinks.hbs:14:42:14:71 | {{{ dataInGeneratedCodeRaw }}} | Cross-site scripting vulnerability due to $@. | app.js:35:33:35:64 | req.que ... CodeRaw | user-provided value |
103+
| views/hbs_sinks.hbs:22:39:22:73 | {{{ dataInEventHandlerStringRaw }}} | app.js:39:38:39:74 | req.que ... ringRaw | views/hbs_sinks.hbs:22:39:22:73 | {{{ dataInEventHandlerStringRaw }}} | Cross-site scripting vulnerability due to $@. | app.js:39:38:39:74 | req.que ... ringRaw | user-provided value |

‎javascript/ql/test/library-tests/frameworks/Templating/app.js

Lines changed: 19 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -20,3 +20,22 @@ app.get('/ejs', (req, res) => {
2020
dataInEventHandlerStringRaw: req.query.dataInEventHandlerStringRaw,
2121
});
2222
});
23+
24+
app.get('/hbs', (req, res) => {
25+
res.render('hbs_sinks', {
26+
escapedHtml: req.query.escapedHtml,
27+
rawHtml: req.query.rawHtml,
28+
rawHtmlSafeValue: 'safe',
29+
object: {
30+
rawHtmlProp: req.query.rawHtmlProp
31+
},
32+
dataInStringLiteral: req.query.dataInStringLiteral,
33+
dataInStringLiteralRaw: req.query.dataInStringLiteralRaw,
34+
dataInGeneratedCode: req.query.dataInGeneratedCode,
35+
dataInGeneratedCodeRaw: req.query.dataInGeneratedCodeRaw,
36+
backslashSink1: req.query.backslashSink1,
37+
backslashSink2: req.query.backslashSink2,
38+
dataInEventHandlerString: req.query.dataInEventHandlerString,
39+
dataInEventHandlerStringRaw: req.query.dataInEventHandlerStringRaw,
40+
});
41+
});

‎javascript/ql/test/library-tests/frameworks/Templating/test.expected

Lines changed: 11 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -3,10 +3,12 @@ getTemplateInstantiationSyntax
33
| consolidate.js:4:1:4:90 | consoli ... => {}) | mustache |
44
getLikelyTemplateSyntax
55
| views/ejs_sinks.ejs:0:0:0:0 | views/ejs_sinks.ejs | ejs |
6+
| views/hbs_sinks.hbs:0:0:0:0 | views/hbs_sinks.hbs | mustache |
67
| views/instantiated_as_ejs.html:0:0:0:0 | views/instantiated_as_ejs.html | ejs |
78
| views/instantiated_as_hbs.html:0:0:0:0 | views/instantiated_as_hbs.html | mustache |
89
getTargetFile
910
| app.js:6:5:21:6 | res.ren ... \\n }) | views/ejs_sinks.ejs:0:0:0:0 | views/ejs_sinks.ejs |
11+
| app.js:25:5:40:6 | res.ren ... \\n }) | views/hbs_sinks.hbs:0:0:0:0 | views/hbs_sinks.hbs |
1012
| consolidate.js:3:1:3:83 | consoli ... => {}) | views/instantiated_as_ejs.html:0:0:0:0 | views/instantiated_as_ejs.html |
1113
| consolidate.js:4:1:4:90 | consoli ... => {}) | views/instantiated_as_hbs.html:0:0:0:0 | views/instantiated_as_hbs.html |
1214
xssSink
@@ -16,9 +18,18 @@ xssSink
1618
| views/ejs_sinks.ejs:11:43:11:71 | <%- dataInStringLiteralRaw %> |
1719
| views/ejs_sinks.ejs:14:42:14:70 | <%- dataInGeneratedCodeRaw %> |
1820
| views/ejs_sinks.ejs:22:39:22:72 | <%- dataInEventHandlerStringRaw %> |
21+
| views/hbs_sinks.hbs:4:9:4:23 | {{{ rawHtml }}} |
22+
| views/hbs_sinks.hbs:5:9:5:32 | {{{ rawHtmlSafeValue }}} |
23+
| views/hbs_sinks.hbs:7:9:7:34 | {{{ object.rawHtmlProp }}} |
24+
| views/hbs_sinks.hbs:11:43:11:72 | {{{ dataInStringLiteralRaw }}} |
25+
| views/hbs_sinks.hbs:14:42:14:71 | {{{ dataInGeneratedCodeRaw }}} |
26+
| views/hbs_sinks.hbs:22:39:22:73 | {{{ dataInEventHandlerStringRaw }}} |
1927
| views/instantiated_as_ejs.html:4:9:4:23 | <%- xss_sink %> |
2028
| views/instantiated_as_hbs.html:7:9:7:24 | {{{ xss_sink }}} |
2129
codeInjectionSink
2230
| views/ejs_sinks.ejs:13:39:13:64 | <%= dataInGeneratedCode %> |
2331
| views/ejs_sinks.ejs:16:19:16:39 | <%= backslashSink1 %> |
2432
| views/ejs_sinks.ejs:21:39:21:69 | <%= dataInEventHandlerString %> |
33+
| views/hbs_sinks.hbs:13:39:13:63 | {{ dataInGeneratedCode }} |
34+
| views/hbs_sinks.hbs:16:19:16:38 | {{ backslashSink1 }} |
35+
| views/hbs_sinks.hbs:21:39:21:68 | {{ dataInEventHandlerString }} |

‎javascript/ql/test/library-tests/frameworks/Templating/views/hbs_sinks.hbs

Lines changed: 24 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,24 @@
1+
<html>
2+
<body>
3+
{{ escapedHtml }}
4+
{{{ rawHtml }}}
5+
{{{ rawHtmlSafeValue }}}
6+
7+
{{{ object.rawHtmlProp }}}
8+
9+
<script>
10+
var dataInStringLiteral = "{{ dataInStringLiteral }}";
11+
var dataInStringLiteralRaw = "{{{ dataInStringLiteralRaw }}}";
12+
13+
var dataInGeneratedCode = {{ dataInGeneratedCode }};
14+
var dataInGeneratedCodeRaw = {{{ dataInGeneratedCodeRaw }}};
15+
16+
init("{{ backslashSink1 }}", "{{ backslashSink2 }}");
17+
18+
var ejs = "<%= rawHtml %>";
19+
</script>
20+
21+
<button onclick="doSomething('{{ dataInEventHandlerString }}')">Click me</button>
22+
<button onclick="doSomething('{{{ dataInEventHandlerStringRaw }}}')">Click me</button>
23+
</body>
24+
</html>

0 commit comments

Comments
 (0)