Skip to content

Commit 2e2d4c6

Browse files
author
bananabr
committed
updated tests to consider document.getSelection()
1 parent 880e3e1 commit 2e2d4c6

File tree

2 files changed

+29
-14
lines changed

2 files changed

+29
-14
lines changed

‎javascript/ql/test/query-tests/Security/CWE-079/XssThroughDom/XssThroughDom.expected

Lines changed: 25 additions & 12 deletions
Original file line numberDiff line numberDiff line change
@@ -139,12 +139,17 @@ nodes
139139
| xss-through-dom.js:122:53:122:67 | ev.target.files |
140140
| xss-through-dom.js:122:53:122:67 | ev.target.files |
141141
| xss-through-dom.js:122:53:122:70 | ev.target.files[0] |
142-
| xss-through-dom.js:129:6:129:42 | linkText |
143-
| xss-through-dom.js:129:17:129:36 | selection.toString() |
144-
| xss-through-dom.js:129:17:129:36 | selection.toString() |
145-
| xss-through-dom.js:129:17:129:42 | selecti ... ) \|\| '' |
146-
| xss-through-dom.js:130:19:130:26 | linkText |
147-
| xss-through-dom.js:130:19:130:26 | linkText |
142+
| xss-through-dom.js:130:6:130:68 | linkText |
143+
| xss-through-dom.js:130:17:130:37 | wSelect ... tring() |
144+
| xss-through-dom.js:130:17:130:37 | wSelect ... tring() |
145+
| xss-through-dom.js:130:17:130:62 | wSelect ... tring() |
146+
| xss-through-dom.js:130:17:130:68 | wSelect ... ) \|\| '' |
147+
| xss-through-dom.js:130:42:130:62 | dSelect ... tring() |
148+
| xss-through-dom.js:130:42:130:62 | dSelect ... tring() |
149+
| xss-through-dom.js:131:19:131:26 | linkText |
150+
| xss-through-dom.js:131:19:131:26 | linkText |
151+
| xss-through-dom.js:132:16:132:23 | linkText |
152+
| xss-through-dom.js:132:16:132:23 | linkText |
148153
edges
149154
| forms.js:8:23:8:28 | values | forms.js:9:31:9:36 | values |
150155
| forms.js:8:23:8:28 | values | forms.js:9:31:9:36 | values |
@@ -231,11 +236,16 @@ edges
231236
| xss-through-dom.js:122:53:122:67 | ev.target.files | xss-through-dom.js:122:53:122:70 | ev.target.files[0] |
232237
| xss-through-dom.js:122:53:122:70 | ev.target.files[0] | xss-through-dom.js:122:33:122:71 | URL.cre ... les[0]) |
233238
| xss-through-dom.js:122:53:122:70 | ev.target.files[0] | xss-through-dom.js:122:33:122:71 | URL.cre ... les[0]) |
234-
| xss-through-dom.js:129:6:129:42 | linkText | xss-through-dom.js:130:19:130:26 | linkText |
235-
| xss-through-dom.js:129:6:129:42 | linkText | xss-through-dom.js:130:19:130:26 | linkText |
236-
| xss-through-dom.js:129:17:129:36 | selection.toString() | xss-through-dom.js:129:17:129:42 | selecti ... ) \|\| '' |
237-
| xss-through-dom.js:129:17:129:36 | selection.toString() | xss-through-dom.js:129:17:129:42 | selecti ... ) \|\| '' |
238-
| xss-through-dom.js:129:17:129:42 | selecti ... ) \|\| '' | xss-through-dom.js:129:6:129:42 | linkText |
239+
| xss-through-dom.js:130:6:130:68 | linkText | xss-through-dom.js:131:19:131:26 | linkText |
240+
| xss-through-dom.js:130:6:130:68 | linkText | xss-through-dom.js:131:19:131:26 | linkText |
241+
| xss-through-dom.js:130:6:130:68 | linkText | xss-through-dom.js:132:16:132:23 | linkText |
242+
| xss-through-dom.js:130:6:130:68 | linkText | xss-through-dom.js:132:16:132:23 | linkText |
243+
| xss-through-dom.js:130:17:130:37 | wSelect ... tring() | xss-through-dom.js:130:17:130:62 | wSelect ... tring() |
244+
| xss-through-dom.js:130:17:130:37 | wSelect ... tring() | xss-through-dom.js:130:17:130:62 | wSelect ... tring() |
245+
| xss-through-dom.js:130:17:130:62 | wSelect ... tring() | xss-through-dom.js:130:17:130:68 | wSelect ... ) \|\| '' |
246+
| xss-through-dom.js:130:17:130:68 | wSelect ... ) \|\| '' | xss-through-dom.js:130:6:130:68 | linkText |
247+
| xss-through-dom.js:130:42:130:62 | dSelect ... tring() | xss-through-dom.js:130:17:130:62 | wSelect ... tring() |
248+
| xss-through-dom.js:130:42:130:62 | dSelect ... tring() | xss-through-dom.js:130:17:130:62 | wSelect ... tring() |
239249
#select
240250
| forms.js:9:31:9:40 | values.foo | forms.js:8:23:8:28 | values | forms.js:9:31:9:40 | values.foo | $@ is reinterpreted as HTML without escaping meta-characters. | forms.js:8:23:8:28 | values | DOM text |
241251
| forms.js:12:31:12:40 | values.bar | forms.js:11:24:11:29 | values | forms.js:12:31:12:40 | values.bar | $@ is reinterpreted as HTML without escaping meta-characters. | forms.js:11:24:11:29 | values | DOM text |
@@ -273,4 +283,7 @@ edges
273283
| xss-through-dom.js:115:16:115:18 | src | xss-through-dom.js:114:17:114:52 | documen ... k").src | xss-through-dom.js:115:16:115:18 | src | $@ is reinterpreted as HTML without escaping meta-characters. | xss-through-dom.js:114:17:114:52 | documen ... k").src | DOM text |
274284
| xss-through-dom.js:120:23:120:45 | ev.targ ... 0].name | xss-through-dom.js:120:23:120:37 | ev.target.files | xss-through-dom.js:120:23:120:45 | ev.targ ... 0].name | $@ is reinterpreted as HTML without escaping meta-characters. | xss-through-dom.js:120:23:120:37 | ev.target.files | DOM text |
275285
| xss-through-dom.js:122:33:122:71 | URL.cre ... les[0]) | xss-through-dom.js:122:53:122:67 | ev.target.files | xss-through-dom.js:122:33:122:71 | URL.cre ... les[0]) | $@ is reinterpreted as HTML without escaping meta-characters. | xss-through-dom.js:122:53:122:67 | ev.target.files | DOM text |
276-
| xss-through-dom.js:130:19:130:26 | linkText | xss-through-dom.js:129:17:129:36 | selection.toString() | xss-through-dom.js:130:19:130:26 | linkText | $@ is reinterpreted as HTML without escaping meta-characters. | xss-through-dom.js:129:17:129:36 | selection.toString() | DOM text |
286+
| xss-through-dom.js:131:19:131:26 | linkText | xss-through-dom.js:130:17:130:37 | wSelect ... tring() | xss-through-dom.js:131:19:131:26 | linkText | $@ is reinterpreted as HTML without escaping meta-characters. | xss-through-dom.js:130:17:130:37 | wSelect ... tring() | DOM text |
287+
| xss-through-dom.js:131:19:131:26 | linkText | xss-through-dom.js:130:42:130:62 | dSelect ... tring() | xss-through-dom.js:131:19:131:26 | linkText | $@ is reinterpreted as HTML without escaping meta-characters. | xss-through-dom.js:130:42:130:62 | dSelect ... tring() | DOM text |
288+
| xss-through-dom.js:132:16:132:23 | linkText | xss-through-dom.js:130:17:130:37 | wSelect ... tring() | xss-through-dom.js:132:16:132:23 | linkText | $@ is reinterpreted as HTML without escaping meta-characters. | xss-through-dom.js:130:17:130:37 | wSelect ... tring() | DOM text |
289+
| xss-through-dom.js:132:16:132:23 | linkText | xss-through-dom.js:130:42:130:62 | dSelect ... tring() | xss-through-dom.js:132:16:132:23 | linkText | $@ is reinterpreted as HTML without escaping meta-characters. | xss-through-dom.js:130:42:130:62 | dSelect ... tring() | DOM text |

‎javascript/ql/test/query-tests/Security/CWE-079/XssThroughDom/xss-through-dom.js

Lines changed: 4 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -125,8 +125,10 @@ class Sub extends Super {
125125

126126
(function () {
127127
let elem = document.createElement('a');
128-
const selection = getSelection();
129-
let linkText = selection.toString() || '';
128+
const wSelection = getSelection();
129+
const dSelection = document.getSelection();
130+
let linkText = wSelection.toString() || dSelection.toString() || '';
130131
elem.innerHTML = linkText; // NOT OK
132+
$("#id").html(linkText); // NOT OK
131133
elem.innerText = linkText; // OK
132134
})();

0 commit comments

Comments
 (0)