Skip to content

Commit b1cadc8

Browse files
asgerfasgerf
committed
JS: Add test for AngularJS sinks
1 parent e61d534 commit b1cadc8

File tree

6 files changed

+84
-0
lines changed

6 files changed

+84
-0
lines changed

‎javascript/ql/test/library-tests/frameworks/Templating/CodeInjection.expected

Lines changed: 36 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -23,6 +23,22 @@ nodes
2323
| app.js:58:35:58:68 | req.que ... rString |
2424
| app.js:59:38:59:74 | req.que ... ringRaw |
2525
| app.js:59:38:59:74 | req.que ... ringRaw |
26+
| app.js:65:22:65:42 | req.que ... pedHtml |
27+
| app.js:65:22:65:42 | req.que ... pedHtml |
28+
| app.js:66:18:66:34 | req.query.rawHtml |
29+
| app.js:66:18:66:34 | req.query.rawHtml |
30+
| views/angularjs_include.ejs:2:5:2:22 | <%= escapedHtml %> |
31+
| views/angularjs_include.ejs:2:5:2:22 | <%= escapedHtml %> |
32+
| views/angularjs_include.ejs:2:9:2:19 | escapedHtml |
33+
| views/angularjs_include.ejs:3:5:3:18 | <%- rawHtml %> |
34+
| views/angularjs_include.ejs:3:5:3:18 | <%- rawHtml %> |
35+
| views/angularjs_include.ejs:3:9:3:15 | rawHtml |
36+
| views/angularjs_sinks.ejs:3:9:3:26 | <%= escapedHtml %> |
37+
| views/angularjs_sinks.ejs:3:9:3:26 | <%= escapedHtml %> |
38+
| views/angularjs_sinks.ejs:3:13:3:23 | escapedHtml |
39+
| views/angularjs_sinks.ejs:4:9:4:22 | <%- rawHtml %> |
40+
| views/angularjs_sinks.ejs:4:9:4:22 | <%- rawHtml %> |
41+
| views/angularjs_sinks.ejs:4:13:4:19 | rawHtml |
2642
| views/ejs_sinks.ejs:13:39:13:64 | <%= dataInGeneratedCode %> |
2743
| views/ejs_sinks.ejs:13:39:13:64 | <%= dataInGeneratedCode %> |
2844
| views/ejs_sinks.ejs:13:43:13:61 | dataInGeneratedCode |
@@ -88,6 +104,22 @@ edges
88104
| app.js:58:35:58:68 | req.que ... rString | views/njk_sinks.njk:22:42:22:65 | dataInE ... rString |
89105
| app.js:59:38:59:74 | req.que ... ringRaw | views/njk_sinks.njk:23:42:23:68 | dataInE ... ringRaw |
90106
| app.js:59:38:59:74 | req.que ... ringRaw | views/njk_sinks.njk:23:42:23:68 | dataInE ... ringRaw |
107+
| app.js:65:22:65:42 | req.que ... pedHtml | views/angularjs_include.ejs:2:9:2:19 | escapedHtml |
108+
| app.js:65:22:65:42 | req.que ... pedHtml | views/angularjs_include.ejs:2:9:2:19 | escapedHtml |
109+
| app.js:65:22:65:42 | req.que ... pedHtml | views/angularjs_sinks.ejs:3:13:3:23 | escapedHtml |
110+
| app.js:65:22:65:42 | req.que ... pedHtml | views/angularjs_sinks.ejs:3:13:3:23 | escapedHtml |
111+
| app.js:66:18:66:34 | req.query.rawHtml | views/angularjs_include.ejs:3:9:3:15 | rawHtml |
112+
| app.js:66:18:66:34 | req.query.rawHtml | views/angularjs_include.ejs:3:9:3:15 | rawHtml |
113+
| app.js:66:18:66:34 | req.query.rawHtml | views/angularjs_sinks.ejs:4:13:4:19 | rawHtml |
114+
| app.js:66:18:66:34 | req.query.rawHtml | views/angularjs_sinks.ejs:4:13:4:19 | rawHtml |
115+
| views/angularjs_include.ejs:2:9:2:19 | escapedHtml | views/angularjs_include.ejs:2:5:2:22 | <%= escapedHtml %> |
116+
| views/angularjs_include.ejs:2:9:2:19 | escapedHtml | views/angularjs_include.ejs:2:5:2:22 | <%= escapedHtml %> |
117+
| views/angularjs_include.ejs:3:9:3:15 | rawHtml | views/angularjs_include.ejs:3:5:3:18 | <%- rawHtml %> |
118+
| views/angularjs_include.ejs:3:9:3:15 | rawHtml | views/angularjs_include.ejs:3:5:3:18 | <%- rawHtml %> |
119+
| views/angularjs_sinks.ejs:3:13:3:23 | escapedHtml | views/angularjs_sinks.ejs:3:9:3:26 | <%= escapedHtml %> |
120+
| views/angularjs_sinks.ejs:3:13:3:23 | escapedHtml | views/angularjs_sinks.ejs:3:9:3:26 | <%= escapedHtml %> |
121+
| views/angularjs_sinks.ejs:4:13:4:19 | rawHtml | views/angularjs_sinks.ejs:4:9:4:22 | <%- rawHtml %> |
122+
| views/angularjs_sinks.ejs:4:13:4:19 | rawHtml | views/angularjs_sinks.ejs:4:9:4:22 | <%- rawHtml %> |
91123
| views/ejs_sinks.ejs:13:43:13:61 | dataInGeneratedCode | views/ejs_sinks.ejs:13:39:13:64 | <%= dataInGeneratedCode %> |
92124
| views/ejs_sinks.ejs:13:43:13:61 | dataInGeneratedCode | views/ejs_sinks.ejs:13:39:13:64 | <%= dataInGeneratedCode %> |
93125
| views/ejs_sinks.ejs:16:23:16:36 | backslashSink1 | views/ejs_sinks.ejs:16:19:16:39 | <%= backslashSink1 %> |
@@ -117,6 +149,10 @@ edges
117149
| views/njk_sinks.njk:23:42:23:75 | dataInE ... \| safe | views/njk_sinks.njk:23:39:23:78 | {{ dataInEventHandlerStringRaw \| safe }} |
118150
| views/njk_sinks.njk:23:42:23:75 | dataInE ... \| safe | views/njk_sinks.njk:23:39:23:78 | {{ dataInEventHandlerStringRaw \| safe }} |
119151
#select
152+
| views/angularjs_include.ejs:2:5:2:22 | <%= escapedHtml %> | app.js:65:22:65:42 | req.que ... pedHtml | views/angularjs_include.ejs:2:5:2:22 | <%= escapedHtml %> | $@ flows to here and is interpreted by AngularJS, which may evaluate it as code. | app.js:65:22:65:42 | req.que ... pedHtml | User-provided value |
153+
| views/angularjs_include.ejs:3:5:3:18 | <%- rawHtml %> | app.js:66:18:66:34 | req.query.rawHtml | views/angularjs_include.ejs:3:5:3:18 | <%- rawHtml %> | $@ flows to here and is interpreted by AngularJS, which may evaluate it as code. | app.js:66:18:66:34 | req.query.rawHtml | User-provided value |
154+
| views/angularjs_sinks.ejs:3:9:3:26 | <%= escapedHtml %> | app.js:65:22:65:42 | req.que ... pedHtml | views/angularjs_sinks.ejs:3:9:3:26 | <%= escapedHtml %> | $@ flows to here and is interpreted by AngularJS, which may evaluate it as code. | app.js:65:22:65:42 | req.que ... pedHtml | User-provided value |
155+
| views/angularjs_sinks.ejs:4:9:4:22 | <%- rawHtml %> | app.js:66:18:66:34 | req.query.rawHtml | views/angularjs_sinks.ejs:4:9:4:22 | <%- rawHtml %> | $@ flows to here and is interpreted by AngularJS, which may evaluate it as code. | app.js:66:18:66:34 | req.query.rawHtml | User-provided value |
120156
| views/ejs_sinks.ejs:13:39:13:64 | <%= dataInGeneratedCode %> | app.js:15:30:15:58 | req.que ... tedCode | views/ejs_sinks.ejs:13:39:13:64 | <%= dataInGeneratedCode %> | $@ flows to here and is interpreted as code. | app.js:15:30:15:58 | req.que ... tedCode | User-provided value |
121157
| views/ejs_sinks.ejs:16:19:16:39 | <%= backslashSink1 %> | app.js:17:25:17:48 | req.que ... shSink1 | views/ejs_sinks.ejs:16:19:16:39 | <%= backslashSink1 %> | $@ flows to here and is interpreted as code. | app.js:17:25:17:48 | req.que ... shSink1 | User-provided value |
122158
| views/ejs_sinks.ejs:21:39:21:69 | <%= dataInEventHandlerString %> | app.js:19:35:19:68 | req.que ... rString | views/ejs_sinks.ejs:21:39:21:69 | <%= dataInEventHandlerString %> | $@ flows to here and is interpreted as code. | app.js:19:35:19:68 | req.que ... rString | User-provided value |

‎javascript/ql/test/library-tests/frameworks/Templating/Xss.expected

Lines changed: 18 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -31,6 +31,8 @@ nodes
3131
| app.js:55:37:55:72 | req.que ... JsonRaw |
3232
| app.js:59:38:59:74 | req.que ... ringRaw |
3333
| app.js:59:38:59:74 | req.que ... ringRaw |
34+
| app.js:66:18:66:34 | req.query.rawHtml |
35+
| app.js:66:18:66:34 | req.query.rawHtml |
3436
| projectA/src/index.js:7:16:7:30 | req.query.sinkA |
3537
| projectA/src/index.js:7:16:7:30 | req.query.sinkA |
3638
| projectA/src/index.js:12:16:12:30 | req.query.sinkA |
@@ -69,6 +71,12 @@ nodes
6971
| projectB/views/subfolder/other.ejs:3:1:3:12 | <%- sinkB %> |
7072
| projectB/views/subfolder/other.ejs:3:1:3:12 | <%- sinkB %> |
7173
| projectB/views/subfolder/other.ejs:3:5:3:9 | sinkB |
74+
| views/angularjs_include.ejs:3:5:3:18 | <%- rawHtml %> |
75+
| views/angularjs_include.ejs:3:5:3:18 | <%- rawHtml %> |
76+
| views/angularjs_include.ejs:3:9:3:15 | rawHtml |
77+
| views/angularjs_sinks.ejs:4:9:4:22 | <%- rawHtml %> |
78+
| views/angularjs_sinks.ejs:4:9:4:22 | <%- rawHtml %> |
79+
| views/angularjs_sinks.ejs:4:13:4:19 | rawHtml |
7280
| views/ejs_sinks.ejs:4:9:4:22 | <%- rawHtml %> |
7381
| views/ejs_sinks.ejs:4:9:4:22 | <%- rawHtml %> |
7482
| views/ejs_sinks.ejs:4:13:4:19 | rawHtml |
@@ -155,6 +163,10 @@ edges
155163
| app.js:59:38:59:74 | req.que ... ringRaw | views/njk_sinks.njk:23:42:23:68 | dataInE ... ringRaw |
156164
| app.js:59:38:59:74 | req.que ... ringRaw | views/njk_sinks.njk:23:42:23:68 | dataInE ... ringRaw |
157165
| app.js:59:38:59:74 | req.que ... ringRaw | views/njk_sinks.njk:23:42:23:68 | dataInE ... ringRaw |
166+
| app.js:66:18:66:34 | req.query.rawHtml | views/angularjs_include.ejs:3:9:3:15 | rawHtml |
167+
| app.js:66:18:66:34 | req.query.rawHtml | views/angularjs_include.ejs:3:9:3:15 | rawHtml |
168+
| app.js:66:18:66:34 | req.query.rawHtml | views/angularjs_sinks.ejs:4:13:4:19 | rawHtml |
169+
| app.js:66:18:66:34 | req.query.rawHtml | views/angularjs_sinks.ejs:4:13:4:19 | rawHtml |
158170
| projectA/src/index.js:7:16:7:30 | req.query.sinkA | projectA/views/main.ejs:2:5:2:9 | sinkA |
159171
| projectA/src/index.js:7:16:7:30 | req.query.sinkA | projectA/views/main.ejs:2:5:2:9 | sinkA |
160172
| projectA/src/index.js:12:16:12:30 | req.query.sinkA | projectA/views/main.ejs:2:5:2:9 | sinkA |
@@ -187,6 +199,10 @@ edges
187199
| projectB/views/subfolder/index.ejs:3:5:3:9 | sinkB | projectB/views/subfolder/index.ejs:3:1:3:12 | <%- sinkB %> |
188200
| projectB/views/subfolder/other.ejs:3:5:3:9 | sinkB | projectB/views/subfolder/other.ejs:3:1:3:12 | <%- sinkB %> |
189201
| projectB/views/subfolder/other.ejs:3:5:3:9 | sinkB | projectB/views/subfolder/other.ejs:3:1:3:12 | <%- sinkB %> |
202+
| views/angularjs_include.ejs:3:9:3:15 | rawHtml | views/angularjs_include.ejs:3:5:3:18 | <%- rawHtml %> |
203+
| views/angularjs_include.ejs:3:9:3:15 | rawHtml | views/angularjs_include.ejs:3:5:3:18 | <%- rawHtml %> |
204+
| views/angularjs_sinks.ejs:4:13:4:19 | rawHtml | views/angularjs_sinks.ejs:4:9:4:22 | <%- rawHtml %> |
205+
| views/angularjs_sinks.ejs:4:13:4:19 | rawHtml | views/angularjs_sinks.ejs:4:9:4:22 | <%- rawHtml %> |
190206
| views/ejs_sinks.ejs:4:13:4:19 | rawHtml | views/ejs_sinks.ejs:4:9:4:22 | <%- rawHtml %> |
191207
| views/ejs_sinks.ejs:4:13:4:19 | rawHtml | views/ejs_sinks.ejs:4:9:4:22 | <%- rawHtml %> |
192208
| views/ejs_sinks.ejs:7:13:7:30 | object.rawHtmlProp | views/ejs_sinks.ejs:7:9:7:33 | <%- object.rawHtmlProp %> |
@@ -220,6 +236,8 @@ edges
220236
| projectB/views/subfolder/index.ejs:3:1:3:12 | <%- sinkB %> | projectB/src/index.js:18:16:18:30 | req.query.sinkB | projectB/views/subfolder/index.ejs:3:1:3:12 | <%- sinkB %> | Cross-site scripting vulnerability due to $@. | projectB/src/index.js:18:16:18:30 | req.query.sinkB | user-provided value |
221237
| projectB/views/subfolder/other.ejs:3:1:3:12 | <%- sinkB %> | projectB/src/index.js:33:16:33:30 | req.query.sinkB | projectB/views/subfolder/other.ejs:3:1:3:12 | <%- sinkB %> | Cross-site scripting vulnerability due to $@. | projectB/src/index.js:33:16:33:30 | req.query.sinkB | user-provided value |
222238
| projectB/views/subfolder/other.ejs:3:1:3:12 | <%- sinkB %> | projectB/src/index.js:38:16:38:30 | req.query.sinkB | projectB/views/subfolder/other.ejs:3:1:3:12 | <%- sinkB %> | Cross-site scripting vulnerability due to $@. | projectB/src/index.js:38:16:38:30 | req.query.sinkB | user-provided value |
239+
| views/angularjs_include.ejs:3:5:3:18 | <%- rawHtml %> | app.js:66:18:66:34 | req.query.rawHtml | views/angularjs_include.ejs:3:5:3:18 | <%- rawHtml %> | Cross-site scripting vulnerability due to $@. | app.js:66:18:66:34 | req.query.rawHtml | user-provided value |
240+
| views/angularjs_sinks.ejs:4:9:4:22 | <%- rawHtml %> | app.js:66:18:66:34 | req.query.rawHtml | views/angularjs_sinks.ejs:4:9:4:22 | <%- rawHtml %> | Cross-site scripting vulnerability due to $@. | app.js:66:18:66:34 | req.query.rawHtml | user-provided value |
223241
| views/ejs_sinks.ejs:4:9:4:22 | <%- rawHtml %> | app.js:8:18:8:34 | req.query.rawHtml | views/ejs_sinks.ejs:4:9:4:22 | <%- rawHtml %> | Cross-site scripting vulnerability due to $@. | app.js:8:18:8:34 | req.query.rawHtml | user-provided value |
224242
| views/ejs_sinks.ejs:7:9:7:33 | <%- object.rawHtmlProp %> | app.js:11:26:11:46 | req.que ... tmlProp | views/ejs_sinks.ejs:7:9:7:33 | <%- object.rawHtmlProp %> | Cross-site scripting vulnerability due to $@. | app.js:11:26:11:46 | req.que ... tmlProp | user-provided value |
225243
| views/ejs_sinks.ejs:11:43:11:71 | <%- dataInStringLiteralRaw %> | app.js:14:33:14:64 | req.que ... eralRaw | views/ejs_sinks.ejs:11:43:11:71 | <%- dataInStringLiteralRaw %> | Cross-site scripting vulnerability due to $@. | app.js:14:33:14:64 | req.que ... eralRaw | user-provided value |

‎javascript/ql/test/library-tests/frameworks/Templating/app.js

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -59,3 +59,10 @@ app.get('/njk', (req, res) => {
5959
dataInEventHandlerStringRaw: req.query.dataInEventHandlerStringRaw,
6060
});
6161
});
62+
63+
app.get('/angularjs', (req, res) => {
64+
res.render('angularjs_sinks', {
65+
escapedHtml: req.query.escapedHtml,
66+
rawHtml: req.query.rawHtml,
67+
});
68+
});

‎javascript/ql/test/library-tests/frameworks/Templating/test.expected

Lines changed: 10 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -8,6 +8,8 @@ getLikelyTemplateSyntax
88
| projectB/views/main.ejs:0:0:0:0 | projectB/views/main.ejs | ejs |
99
| projectB/views/subfolder/index.ejs:0:0:0:0 | projectB/views/subfolder/index.ejs | ejs |
1010
| projectB/views/subfolder/other.ejs:0:0:0:0 | projectB/views/subfolder/other.ejs | ejs |
11+
| views/angularjs_include.ejs:0:0:0:0 | views/angularjs_include.ejs | ejs |
12+
| views/angularjs_sinks.ejs:0:0:0:0 | views/angularjs_sinks.ejs | ejs |
1113
| views/ejs_sinks.ejs:0:0:0:0 | views/ejs_sinks.ejs | ejs |
1214
| views/hbs_sinks.hbs:0:0:0:0 | views/hbs_sinks.hbs | mustache |
1315
| views/instantiated_as_ejs.html:0:0:0:0 | views/instantiated_as_ejs.html | ejs |
@@ -17,6 +19,7 @@ getTargetFile
1719
| app.js:6:5:21:6 | res.ren ... \\n }) | views/ejs_sinks.ejs:0:0:0:0 | views/ejs_sinks.ejs |
1820
| app.js:25:5:40:6 | res.ren ... \\n }) | views/hbs_sinks.hbs:0:0:0:0 | views/hbs_sinks.hbs |
1921
| app.js:44:5:60:6 | res.ren ... \\n }) | views/njk_sinks.njk:0:0:0:0 | views/njk_sinks.njk |
22+
| app.js:64:5:67:6 | res.ren ... \\n }) | views/angularjs_sinks.ejs:0:0:0:0 | views/angularjs_sinks.ejs |
2023
| consolidate.js:3:1:3:83 | consoli ... => {}) | views/instantiated_as_ejs.html:0:0:0:0 | views/instantiated_as_ejs.html |
2124
| consolidate.js:4:1:4:90 | consoli ... => {}) | views/instantiated_as_hbs.html:0:0:0:0 | views/instantiated_as_hbs.html |
2225
| projectA/src/index.js:6:5:9:6 | res.ren ... \\n }) | projectA/views/main.ejs:0:0:0:0 | projectA/views/main.ejs |
@@ -36,6 +39,8 @@ xssSink
3639
| projectB/views/main.ejs:3:1:3:12 | <%- sinkB %> |
3740
| projectB/views/subfolder/index.ejs:3:1:3:12 | <%- sinkB %> |
3841
| projectB/views/subfolder/other.ejs:3:1:3:12 | <%- sinkB %> |
42+
| views/angularjs_include.ejs:3:5:3:18 | <%- rawHtml %> |
43+
| views/angularjs_sinks.ejs:4:9:4:22 | <%- rawHtml %> |
3944
| views/ejs_sinks.ejs:4:9:4:22 | <%- rawHtml %> |
4045
| views/ejs_sinks.ejs:5:9:5:31 | <%- rawHtmlSafeValue %> |
4146
| views/ejs_sinks.ejs:7:9:7:33 | <%- object.rawHtmlProp %> |
@@ -58,6 +63,11 @@ xssSink
5863
| views/njk_sinks.njk:15:49:15:81 | dataInG ... \| json |
5964
| views/njk_sinks.njk:23:42:23:68 | dataInE ... ringRaw |
6065
codeInjectionSink
66+
| views/angularjs_include.ejs:2:5:2:22 | <%= escapedHtml %> |
67+
| views/angularjs_include.ejs:3:5:3:18 | <%- rawHtml %> |
68+
| views/angularjs_sinks.ejs:3:9:3:26 | <%= escapedHtml %> |
69+
| views/angularjs_sinks.ejs:4:9:4:22 | <%- rawHtml %> |
70+
| views/angularjs_sinks.ejs:6:9:6:39 | <% include angularjs_include %> |
6171
| views/ejs_sinks.ejs:13:39:13:64 | <%= dataInGeneratedCode %> |
6272
| views/ejs_sinks.ejs:16:19:16:39 | <%= backslashSink1 %> |
6373
| views/ejs_sinks.ejs:21:39:21:69 | <%= dataInEventHandlerString %> |

‎javascript/ql/test/library-tests/frameworks/Templating/views/angularjs_include.ejs

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,5 @@
1+
<div>
2+
<%= escapedHtml %>
3+
<%- rawHtml %>
4+
</div>
5+
<div ng-click="blah()"></div>

‎javascript/ql/test/library-tests/frameworks/Templating/views/angularjs_sinks.ejs

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,8 @@
1+
<html>
2+
<body ng-app="foo">
3+
<%= escapedHtml %>
4+
<%- rawHtml %>
5+
6+
<% include angularjs_include %>
7+
</body>
8+
</html>

0 commit comments

Comments
 (0)