Skip to content

Commit f1bcfa2

Browse files
asgerfasgerf
committed
JS: Add more tests
1 parent 4efea43 commit f1bcfa2

File tree

3 files changed

+123
-0
lines changed

3 files changed

+123
-0
lines changed

‎javascript/ql/test/query-tests/Security/CWE-079/DomBasedXss/Xss.expected

Lines changed: 56 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -222,6 +222,31 @@ nodes
222222
| jquery.js:16:38:16:52 | window.location |
223223
| jquery.js:16:38:16:52 | window.location |
224224
| jquery.js:16:38:16:63 | window. ... tring() |
225+
| jquery.js:18:7:18:33 | hash |
226+
| jquery.js:18:14:18:33 | window.location.hash |
227+
| jquery.js:18:14:18:33 | window.location.hash |
228+
| jquery.js:21:5:21:8 | hash |
229+
| jquery.js:21:5:21:21 | hash.substring(1) |
230+
| jquery.js:21:5:21:21 | hash.substring(1) |
231+
| jquery.js:22:5:22:8 | hash |
232+
| jquery.js:22:5:22:25 | hash.su ... (1, 10) |
233+
| jquery.js:22:5:22:25 | hash.su ... (1, 10) |
234+
| jquery.js:23:5:23:8 | hash |
235+
| jquery.js:23:5:23:18 | hash.substr(1) |
236+
| jquery.js:23:5:23:18 | hash.substr(1) |
237+
| jquery.js:24:5:24:8 | hash |
238+
| jquery.js:24:5:24:17 | hash.slice(1) |
239+
| jquery.js:24:5:24:17 | hash.slice(1) |
240+
| jquery.js:27:5:27:8 | hash |
241+
| jquery.js:27:5:27:25 | hash.re ... #', '') |
242+
| jquery.js:27:5:27:25 | hash.re ... #', '') |
243+
| jquery.js:28:5:28:26 | window. ... .search |
244+
| jquery.js:28:5:28:26 | window. ... .search |
245+
| jquery.js:28:5:28:43 | window. ... ?', '') |
246+
| jquery.js:28:5:28:43 | window. ... ?', '') |
247+
| jquery.js:34:5:34:25 | '<b>' + ... '</b>' |
248+
| jquery.js:34:5:34:25 | '<b>' + ... '</b>' |
249+
| jquery.js:34:13:34:16 | hash |
225250
| jwt-server.js:7:9:7:35 | taint |
226251
| jwt-server.js:7:17:7:35 | req.param("wobble") |
227252
| jwt-server.js:7:17:7:35 | req.param("wobble") |
@@ -959,6 +984,30 @@ edges
959984
| jquery.js:16:38:16:52 | window.location | jquery.js:16:38:16:63 | window. ... tring() |
960985
| jquery.js:16:38:16:63 | window. ... tring() | jquery.js:16:19:16:64 | decodeU ... ring()) |
961986
| jquery.js:16:38:16:63 | window. ... tring() | jquery.js:16:19:16:64 | decodeU ... ring()) |
987+
| jquery.js:18:7:18:33 | hash | jquery.js:21:5:21:8 | hash |
988+
| jquery.js:18:7:18:33 | hash | jquery.js:22:5:22:8 | hash |
989+
| jquery.js:18:7:18:33 | hash | jquery.js:23:5:23:8 | hash |
990+
| jquery.js:18:7:18:33 | hash | jquery.js:24:5:24:8 | hash |
991+
| jquery.js:18:7:18:33 | hash | jquery.js:27:5:27:8 | hash |
992+
| jquery.js:18:7:18:33 | hash | jquery.js:34:13:34:16 | hash |
993+
| jquery.js:18:14:18:33 | window.location.hash | jquery.js:18:7:18:33 | hash |
994+
| jquery.js:18:14:18:33 | window.location.hash | jquery.js:18:7:18:33 | hash |
995+
| jquery.js:21:5:21:8 | hash | jquery.js:21:5:21:21 | hash.substring(1) |
996+
| jquery.js:21:5:21:8 | hash | jquery.js:21:5:21:21 | hash.substring(1) |
997+
| jquery.js:22:5:22:8 | hash | jquery.js:22:5:22:25 | hash.su ... (1, 10) |
998+
| jquery.js:22:5:22:8 | hash | jquery.js:22:5:22:25 | hash.su ... (1, 10) |
999+
| jquery.js:23:5:23:8 | hash | jquery.js:23:5:23:18 | hash.substr(1) |
1000+
| jquery.js:23:5:23:8 | hash | jquery.js:23:5:23:18 | hash.substr(1) |
1001+
| jquery.js:24:5:24:8 | hash | jquery.js:24:5:24:17 | hash.slice(1) |
1002+
| jquery.js:24:5:24:8 | hash | jquery.js:24:5:24:17 | hash.slice(1) |
1003+
| jquery.js:27:5:27:8 | hash | jquery.js:27:5:27:25 | hash.re ... #', '') |
1004+
| jquery.js:27:5:27:8 | hash | jquery.js:27:5:27:25 | hash.re ... #', '') |
1005+
| jquery.js:28:5:28:26 | window. ... .search | jquery.js:28:5:28:43 | window. ... ?', '') |
1006+
| jquery.js:28:5:28:26 | window. ... .search | jquery.js:28:5:28:43 | window. ... ?', '') |
1007+
| jquery.js:28:5:28:26 | window. ... .search | jquery.js:28:5:28:43 | window. ... ?', '') |
1008+
| jquery.js:28:5:28:26 | window. ... .search | jquery.js:28:5:28:43 | window. ... ?', '') |
1009+
| jquery.js:34:13:34:16 | hash | jquery.js:34:5:34:25 | '<b>' + ... '</b>' |
1010+
| jquery.js:34:13:34:16 | hash | jquery.js:34:5:34:25 | '<b>' + ... '</b>' |
9621011
| jwt-server.js:7:9:7:35 | taint | jwt-server.js:9:16:9:20 | taint |
9631012
| jwt-server.js:7:17:7:35 | req.param("wobble") | jwt-server.js:7:9:7:35 | taint |
9641013
| jwt-server.js:7:17:7:35 | req.param("wobble") | jwt-server.js:7:9:7:35 | taint |
@@ -1493,6 +1542,13 @@ edges
14931542
| jquery.js:14:19:14:58 | decodeU ... n.hash) | jquery.js:14:38:14:57 | window.location.hash | jquery.js:14:19:14:58 | decodeU ... n.hash) | Cross-site scripting vulnerability due to $@. | jquery.js:14:38:14:57 | window.location.hash | user-provided value |
14941543
| jquery.js:15:19:15:60 | decodeU ... search) | jquery.js:15:38:15:59 | window. ... .search | jquery.js:15:19:15:60 | decodeU ... search) | Cross-site scripting vulnerability due to $@. | jquery.js:15:38:15:59 | window. ... .search | user-provided value |
14951544
| jquery.js:16:19:16:64 | decodeU ... ring()) | jquery.js:16:38:16:52 | window.location | jquery.js:16:19:16:64 | decodeU ... ring()) | Cross-site scripting vulnerability due to $@. | jquery.js:16:38:16:52 | window.location | user-provided value |
1545+
| jquery.js:21:5:21:21 | hash.substring(1) | jquery.js:18:14:18:33 | window.location.hash | jquery.js:21:5:21:21 | hash.substring(1) | Cross-site scripting vulnerability due to $@. | jquery.js:18:14:18:33 | window.location.hash | user-provided value |
1546+
| jquery.js:22:5:22:25 | hash.su ... (1, 10) | jquery.js:18:14:18:33 | window.location.hash | jquery.js:22:5:22:25 | hash.su ... (1, 10) | Cross-site scripting vulnerability due to $@. | jquery.js:18:14:18:33 | window.location.hash | user-provided value |
1547+
| jquery.js:23:5:23:18 | hash.substr(1) | jquery.js:18:14:18:33 | window.location.hash | jquery.js:23:5:23:18 | hash.substr(1) | Cross-site scripting vulnerability due to $@. | jquery.js:18:14:18:33 | window.location.hash | user-provided value |
1548+
| jquery.js:24:5:24:17 | hash.slice(1) | jquery.js:18:14:18:33 | window.location.hash | jquery.js:24:5:24:17 | hash.slice(1) | Cross-site scripting vulnerability due to $@. | jquery.js:18:14:18:33 | window.location.hash | user-provided value |
1549+
| jquery.js:27:5:27:25 | hash.re ... #', '') | jquery.js:18:14:18:33 | window.location.hash | jquery.js:27:5:27:25 | hash.re ... #', '') | Cross-site scripting vulnerability due to $@. | jquery.js:18:14:18:33 | window.location.hash | user-provided value |
1550+
| jquery.js:28:5:28:43 | window. ... ?', '') | jquery.js:28:5:28:26 | window. ... .search | jquery.js:28:5:28:43 | window. ... ?', '') | Cross-site scripting vulnerability due to $@. | jquery.js:28:5:28:26 | window. ... .search | user-provided value |
1551+
| jquery.js:34:5:34:25 | '<b>' + ... '</b>' | jquery.js:18:14:18:33 | window.location.hash | jquery.js:34:5:34:25 | '<b>' + ... '</b>' | Cross-site scripting vulnerability due to $@. | jquery.js:18:14:18:33 | window.location.hash | user-provided value |
14961552
| jwt-server.js:11:19:11:29 | decoded.foo | jwt-server.js:7:17:7:35 | req.param("wobble") | jwt-server.js:11:19:11:29 | decoded.foo | Cross-site scripting vulnerability due to $@. | jwt-server.js:7:17:7:35 | req.param("wobble") | user-provided value |
14971553
| nodemailer.js:13:11:13:69 | `Hi, yo ... sage}.` | nodemailer.js:13:50:13:66 | req.query.message | nodemailer.js:13:11:13:69 | `Hi, yo ... sage}.` | HTML injection vulnerability due to $@. | nodemailer.js:13:50:13:66 | req.query.message | user-provided value |
14981554
| optionalSanitizer.js:6:18:6:23 | target | optionalSanitizer.js:2:16:2:39 | documen ... .search | optionalSanitizer.js:6:18:6:23 | target | Cross-site scripting vulnerability due to $@. | optionalSanitizer.js:2:16:2:39 | documen ... .search | user-provided value |

‎javascript/ql/test/query-tests/Security/CWE-079/DomBasedXss/XssWithAdditionalSources.expected

Lines changed: 49 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -222,6 +222,31 @@ nodes
222222
| jquery.js:16:38:16:52 | window.location |
223223
| jquery.js:16:38:16:52 | window.location |
224224
| jquery.js:16:38:16:63 | window. ... tring() |
225+
| jquery.js:18:7:18:33 | hash |
226+
| jquery.js:18:14:18:33 | window.location.hash |
227+
| jquery.js:18:14:18:33 | window.location.hash |
228+
| jquery.js:21:5:21:8 | hash |
229+
| jquery.js:21:5:21:21 | hash.substring(1) |
230+
| jquery.js:21:5:21:21 | hash.substring(1) |
231+
| jquery.js:22:5:22:8 | hash |
232+
| jquery.js:22:5:22:25 | hash.su ... (1, 10) |
233+
| jquery.js:22:5:22:25 | hash.su ... (1, 10) |
234+
| jquery.js:23:5:23:8 | hash |
235+
| jquery.js:23:5:23:18 | hash.substr(1) |
236+
| jquery.js:23:5:23:18 | hash.substr(1) |
237+
| jquery.js:24:5:24:8 | hash |
238+
| jquery.js:24:5:24:17 | hash.slice(1) |
239+
| jquery.js:24:5:24:17 | hash.slice(1) |
240+
| jquery.js:27:5:27:8 | hash |
241+
| jquery.js:27:5:27:25 | hash.re ... #', '') |
242+
| jquery.js:27:5:27:25 | hash.re ... #', '') |
243+
| jquery.js:28:5:28:26 | window. ... .search |
244+
| jquery.js:28:5:28:26 | window. ... .search |
245+
| jquery.js:28:5:28:43 | window. ... ?', '') |
246+
| jquery.js:28:5:28:43 | window. ... ?', '') |
247+
| jquery.js:34:5:34:25 | '<b>' + ... '</b>' |
248+
| jquery.js:34:5:34:25 | '<b>' + ... '</b>' |
249+
| jquery.js:34:13:34:16 | hash |
225250
| jwt-server.js:7:9:7:35 | taint |
226251
| jwt-server.js:7:17:7:35 | req.param("wobble") |
227252
| jwt-server.js:7:17:7:35 | req.param("wobble") |
@@ -977,6 +1002,30 @@ edges
9771002
| jquery.js:16:38:16:52 | window.location | jquery.js:16:38:16:63 | window. ... tring() |
9781003
| jquery.js:16:38:16:63 | window. ... tring() | jquery.js:16:19:16:64 | decodeU ... ring()) |
9791004
| jquery.js:16:38:16:63 | window. ... tring() | jquery.js:16:19:16:64 | decodeU ... ring()) |
1005+
| jquery.js:18:7:18:33 | hash | jquery.js:21:5:21:8 | hash |
1006+
| jquery.js:18:7:18:33 | hash | jquery.js:22:5:22:8 | hash |
1007+
| jquery.js:18:7:18:33 | hash | jquery.js:23:5:23:8 | hash |
1008+
| jquery.js:18:7:18:33 | hash | jquery.js:24:5:24:8 | hash |
1009+
| jquery.js:18:7:18:33 | hash | jquery.js:27:5:27:8 | hash |
1010+
| jquery.js:18:7:18:33 | hash | jquery.js:34:13:34:16 | hash |
1011+
| jquery.js:18:14:18:33 | window.location.hash | jquery.js:18:7:18:33 | hash |
1012+
| jquery.js:18:14:18:33 | window.location.hash | jquery.js:18:7:18:33 | hash |
1013+
| jquery.js:21:5:21:8 | hash | jquery.js:21:5:21:21 | hash.substring(1) |
1014+
| jquery.js:21:5:21:8 | hash | jquery.js:21:5:21:21 | hash.substring(1) |
1015+
| jquery.js:22:5:22:8 | hash | jquery.js:22:5:22:25 | hash.su ... (1, 10) |
1016+
| jquery.js:22:5:22:8 | hash | jquery.js:22:5:22:25 | hash.su ... (1, 10) |
1017+
| jquery.js:23:5:23:8 | hash | jquery.js:23:5:23:18 | hash.substr(1) |
1018+
| jquery.js:23:5:23:8 | hash | jquery.js:23:5:23:18 | hash.substr(1) |
1019+
| jquery.js:24:5:24:8 | hash | jquery.js:24:5:24:17 | hash.slice(1) |
1020+
| jquery.js:24:5:24:8 | hash | jquery.js:24:5:24:17 | hash.slice(1) |
1021+
| jquery.js:27:5:27:8 | hash | jquery.js:27:5:27:25 | hash.re ... #', '') |
1022+
| jquery.js:27:5:27:8 | hash | jquery.js:27:5:27:25 | hash.re ... #', '') |
1023+
| jquery.js:28:5:28:26 | window. ... .search | jquery.js:28:5:28:43 | window. ... ?', '') |
1024+
| jquery.js:28:5:28:26 | window. ... .search | jquery.js:28:5:28:43 | window. ... ?', '') |
1025+
| jquery.js:28:5:28:26 | window. ... .search | jquery.js:28:5:28:43 | window. ... ?', '') |
1026+
| jquery.js:28:5:28:26 | window. ... .search | jquery.js:28:5:28:43 | window. ... ?', '') |
1027+
| jquery.js:34:13:34:16 | hash | jquery.js:34:5:34:25 | '<b>' + ... '</b>' |
1028+
| jquery.js:34:13:34:16 | hash | jquery.js:34:5:34:25 | '<b>' + ... '</b>' |
9801029
| jwt-server.js:7:9:7:35 | taint | jwt-server.js:9:16:9:20 | taint |
9811030
| jwt-server.js:7:17:7:35 | req.param("wobble") | jwt-server.js:7:9:7:35 | taint |
9821031
| jwt-server.js:7:17:7:35 | req.param("wobble") | jwt-server.js:7:9:7:35 | taint |

‎javascript/ql/test/query-tests/Security/CWE-079/DomBasedXss/jquery.js

Lines changed: 18 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -14,4 +14,22 @@ function test() {
1414
elm.innerHTML = decodeURIComponent(window.location.hash); // NOT OK
1515
elm.innerHTML = decodeURIComponent(window.location.search); // NOT OK
1616
elm.innerHTML = decodeURIComponent(window.location.toString()); // NOT OK
17+
18+
let hash = window.location.hash;
19+
$(hash); // OK - start with '#'
20+
21+
$(hash.substring(1)); // NOT OK
22+
$(hash.substring(1, 10)); // NOT OK
23+
$(hash.substr(1)); // NOT OK
24+
$(hash.slice(1)); // NOT OK
25+
$(hash.substring(0, 10)); // OK
26+
27+
$(hash.replace('#', '')); // NOT OK
28+
$(window.location.search.replace('?', '')); // NOT OK
29+
$(hash.replace('!', '')); // OK
30+
$(hash.replace('blah', '')); // OK
31+
32+
$(hash + 'blah'); // OK
33+
$('blah' + hash); // OK - does not start with '<'
34+
$('<b>' + hash + '</b>'); // NOT OK
1735
}

0 commit comments

Comments
 (0)