Skip to content

Commit ae2a5da

Browse files
author
Max Schaefer
committed
JavaScript: Add new tests for recognising receiver of event handler as DOM element.
1 parent a4d7bfb commit ae2a5da

File tree

6 files changed

+34
-0
lines changed

6 files changed

+34
-0
lines changed

‎javascript/ql/test/library-tests/DOM/Customizations.expected

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,11 +1,15 @@
11
test_documentRef
22
| customization.js:2:13:2:31 | customGetDocument() |
3+
| event-handler-receiver.js:1:1:1:8 | document |
34
| nameditems.js:1:1:1:8 | document |
45
test_locationRef
56
| customization.js:3:3:3:14 | doc.location |
7+
| event-handler-receiver.js:2:49:2:56 | location |
68
test_domValueRef
79
| customization.js:4:3:4:20 | doc.getElementById |
810
| customization.js:4:3:4:28 | doc.get ... 'test') |
11+
| event-handler-receiver.js:1:1:1:23 | documen ... entById |
12+
| event-handler-receiver.js:1:1:1:32 | documen ... my-id') |
913
| nameditems.js:1:1:1:23 | documen ... entById |
1014
| nameditems.js:1:1:1:30 | documen ... ('foo') |
1115
| nameditems.js:1:1:2:19 | documen ... em('x') |

‎javascript/ql/test/library-tests/DOM/event-handler-receiver.html

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,6 @@
1+
<html>
2+
<head></head>
3+
<body>
4+
<button onclick="alert(this.tagName);">Click me</button>
5+
</body>
6+
</html>

‎javascript/ql/test/library-tests/DOM/event-handler-receiver.js

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,3 @@
1+
document.getElementById('my-id').onclick = function() {
2+
this.parentNode.innerHTML = '<h2><a href="' + location.href + '">A link</a></h2>'; // NOT OK
3+
};

‎javascript/ql/test/library-tests/DOM/tests.expected

Lines changed: 17 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,5 @@
11
test_AttributeDefinition
2+
| event-handler-receiver.html:4:11:4:40 | onclick=alert(this.tagName); |
23
| tst.html:3:6:3:30 | href=https://semmle.com |
34
| tst.html:3:32:3:46 | target=_blank |
45
| tst.js:2:22:2:37 | target: "_blank" |
@@ -13,12 +14,17 @@ test_AttributeDefinition
1314
| tst.jsx:4:40:4:48 | rel={rel} |
1415
| tst.jsx:4:50:4:64 | {...otherAttrs} |
1516
test_ElementDefinition_getAttribute
17+
| event-handler-receiver.html:4:3:4:58 | <button>...</> | 0 | event-handler-receiver.html:4:11:4:40 | onclick=alert(this.tagName); |
1618
| tst.html:3:3:3:57 | <a>...</> | 0 | tst.html:3:6:3:30 | href=https://semmle.com |
1719
| tst.html:3:3:3:57 | <a>...</> | 1 | tst.html:3:32:3:46 | target=_blank |
1820
| tst.jsx:4:11:4:75 | <a href ... mle</a> | 0 | tst.jsx:4:14:4:38 | href="h ... le.com" |
1921
| tst.jsx:4:11:4:75 | <a href ... mle</a> | 1 | tst.jsx:4:40:4:48 | rel={rel} |
2022
| tst.jsx:4:11:4:75 | <a href ... mle</a> | 2 | tst.jsx:4:50:4:64 | {...otherAttrs} |
2123
test_ElementDefinition_getRoot
24+
| event-handler-receiver.html:1:1:6:7 | <html>...</> | event-handler-receiver.html:1:1:6:7 | <html>...</> |
25+
| event-handler-receiver.html:2:1:2:13 | <head>...</> | event-handler-receiver.html:1:1:6:7 | <html>...</> |
26+
| event-handler-receiver.html:3:1:5:7 | <body>...</> | event-handler-receiver.html:1:1:6:7 | <html>...</> |
27+
| event-handler-receiver.html:4:3:4:58 | <button>...</> | event-handler-receiver.html:1:1:6:7 | <html>...</> |
2228
| tst.html:1:1:5:7 | <html>...</> | tst.html:1:1:5:7 | <html>...</> |
2329
| tst.html:2:1:4:7 | <body>...</> | tst.html:1:1:5:7 | <html>...</> |
2430
| tst.html:3:3:3:57 | <a>...</> | tst.html:1:1:5:7 | <html>...</> |
@@ -36,6 +42,7 @@ test_WebStorageWrite
3642
| tst.js:17:24:17:30 | "value" |
3743
| tst.js:18:33:18:39 | "value" |
3844
test_ElementDefinition_getAttributeByName
45+
| event-handler-receiver.html:4:3:4:58 | <button>...</> | onclick | event-handler-receiver.html:4:11:4:40 | onclick=alert(this.tagName); |
3946
| tst.html:3:3:3:57 | <a>...</> | href | tst.html:3:6:3:30 | href=https://semmle.com |
4047
| tst.html:3:3:3:57 | <a>...</> | target | tst.html:3:32:3:46 | target=_blank |
4148
| tst.js:3:11:3:31 | $("<a/> ... rAttrs) | data-bind | tst.js:6:5:6:24 | "data-bind": "stuff" |
@@ -49,6 +56,7 @@ test_ElementDefinition_getAttributeByName
4956
| tst.jsx:4:11:4:75 | <a href ... mle</a> | href | tst.jsx:4:14:4:38 | href="h ... le.com" |
5057
| tst.jsx:4:11:4:75 | <a href ... mle</a> | rel | tst.jsx:4:40:4:48 | rel={rel} |
5158
test_AttributeDefinition_getStringValue
59+
| event-handler-receiver.html:4:11:4:40 | onclick=alert(this.tagName); | alert(this.tagName); |
5260
| tst.html:3:6:3:30 | href=https://semmle.com | https://semmle.com |
5361
| tst.html:3:32:3:46 | target=_blank | _blank |
5462
| tst.js:2:22:2:37 | target: "_blank" | _blank |
@@ -61,6 +69,7 @@ test_AttributeDefinition_getStringValue
6169
| tst.js:13:3:13:28 | $.prop( ... d", "") | |
6270
| tst.jsx:4:14:4:38 | href="h ... le.com" | https://semmle.com |
6371
test_AttributeDefinition_getName
72+
| event-handler-receiver.html:4:11:4:40 | onclick=alert(this.tagName); | onclick |
6473
| tst.html:3:6:3:30 | href=https://semmle.com | href |
6574
| tst.html:3:32:3:46 | target=_blank | target |
6675
| tst.js:2:22:2:37 | target: "_blank" | target |
@@ -74,6 +83,10 @@ test_AttributeDefinition_getName
7483
| tst.jsx:4:14:4:38 | href="h ... le.com" | href |
7584
| tst.jsx:4:40:4:48 | rel={rel} | rel |
7685
test_Element
86+
| event-handler-receiver.html:1:1:6:7 | <html>...</> | event-handler-receiver.html:1:1:6:7 | <html>...</> |
87+
| event-handler-receiver.html:2:1:2:13 | <head>...</> | event-handler-receiver.html:2:1:2:13 | <head>...</> |
88+
| event-handler-receiver.html:3:1:5:7 | <body>...</> | event-handler-receiver.html:3:1:5:7 | <body>...</> |
89+
| event-handler-receiver.html:4:3:4:58 | <button>...</> | event-handler-receiver.html:4:3:4:58 | <button>...</> |
7790
| tst.html:1:1:5:7 | <html>...</> | tst.html:1:1:5:7 | <html>...</> |
7891
| tst.html:2:1:4:7 | <body>...</> | tst.html:2:1:4:7 | <body>...</> |
7992
| tst.html:3:3:3:57 | <a>...</> | tst.html:3:3:3:57 | <a>...</> |
@@ -110,6 +123,10 @@ test_AttributeDefinition_getValueNode
110123
| tst.jsx:4:40:4:48 | rel={rel} | tst.jsx:4:45:4:47 | rel |
111124
| tst.jsx:4:50:4:64 | {...otherAttrs} | tst.jsx:4:50:4:64 | ...otherAttrs |
112125
test_ElementDefinition
126+
| event-handler-receiver.html:1:1:6:7 | <html>...</> | html |
127+
| event-handler-receiver.html:2:1:2:13 | <head>...</> | head |
128+
| event-handler-receiver.html:3:1:5:7 | <body>...</> | body |
129+
| event-handler-receiver.html:4:3:4:58 | <button>...</> | button |
113130
| tst.html:1:1:5:7 | <html>...</> | html |
114131
| tst.html:2:1:4:7 | <body>...</> | body |
115132
| tst.html:3:3:3:57 | <a>...</> | a |

‎javascript/ql/test/query-tests/Security/CWE-079/DomBasedXss/ConsistencyDomBasedXss.expected

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1 @@
1+
| query-tests/Security/CWE-079/DomBasedXss/event-handler-receiver.js:2 | expected an alert, but found none | NOT OK | |

‎javascript/ql/test/query-tests/Security/CWE-079/DomBasedXss/event-handler-receiver.js

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,3 @@
1+
document.getElementById('my-id').onclick = function() {
2+
this.parentNode.innerHTML = '<h2><a href="' + location.href + '">A link</a></h2>'; // NOT OK
3+
};

0 commit comments

Comments
 (0)