Skip to content

Commit 6713b2c

Browse files
erik-krogherik-krogh
committed
add support for domNode.ondrop for drag-and-drop events
1 parent 121aad7 commit 6713b2c

File tree

4 files changed

+62
-1
lines changed

4 files changed

+62
-1
lines changed

‎javascript/ql/lib/semmle/javascript/frameworks/DragAndDrop.qll

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -32,6 +32,12 @@ private DataFlow::SourceNode dropEvent(DataFlow::TypeTracker t) {
3232
)
3333
or
3434
t.start() and
35+
exists(DataFlow::PropWrite pw | pw = DOM::domValueRef().getAPropertyWrite() |
36+
pw.getPropertyName() = "ondrop" and
37+
result = pw.getRhs().getABoundFunctionValue(0).getParameter(0)
38+
)
39+
or
40+
t.start() and
3541
result = jQueryDropEvent(DataFlow::TypeTracker::end()).getAPropertyRead("originalEvent")
3642
or
3743
exists(DataFlow::TypeTracker t2 | result = dropEvent(t2).track(t2, t))

‎javascript/ql/test/query-tests/Security/CWE-079/DomBasedXss/Xss.expected

Lines changed: 17 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -315,6 +315,14 @@ nodes
315315
| dragAndDrop.ts:33:19:33:67 | e.origi ... /html') |
316316
| dragAndDrop.ts:33:19:33:67 | e.origi ... /html') |
317317
| dragAndDrop.ts:33:19:33:67 | e.origi ... /html') |
318+
| dragAndDrop.ts:43:15:43:54 | html |
319+
| dragAndDrop.ts:43:15:43:54 | html |
320+
| dragAndDrop.ts:43:22:43:54 | dataTra ... /html') |
321+
| dragAndDrop.ts:43:22:43:54 | dataTra ... /html') |
322+
| dragAndDrop.ts:43:22:43:54 | dataTra ... /html') |
323+
| dragAndDrop.ts:50:29:50:32 | html |
324+
| dragAndDrop.ts:50:29:50:32 | html |
325+
| dragAndDrop.ts:50:29:50:32 | html |
318326
| event-handler-receiver.js:2:31:2:83 | '<h2><a ... ></h2>' |
319327
| event-handler-receiver.js:2:31:2:83 | '<h2><a ... ></h2>' |
320328
| event-handler-receiver.js:2:31:2:83 | '<h2><a ... ></h2>' |
@@ -1349,6 +1357,14 @@ edges
13491357
| dragAndDrop.ts:24:23:24:57 | e.dataT ... /html') | dragAndDrop.ts:24:23:24:57 | e.dataT ... /html') |
13501358
| dragAndDrop.ts:29:19:29:53 | e.dataT ... /html') | dragAndDrop.ts:29:19:29:53 | e.dataT ... /html') |
13511359
| dragAndDrop.ts:33:19:33:67 | e.origi ... /html') | dragAndDrop.ts:33:19:33:67 | e.origi ... /html') |
1360+
| dragAndDrop.ts:43:15:43:54 | html | dragAndDrop.ts:50:29:50:32 | html |
1361+
| dragAndDrop.ts:43:15:43:54 | html | dragAndDrop.ts:50:29:50:32 | html |
1362+
| dragAndDrop.ts:43:15:43:54 | html | dragAndDrop.ts:50:29:50:32 | html |
1363+
| dragAndDrop.ts:43:15:43:54 | html | dragAndDrop.ts:50:29:50:32 | html |
1364+
| dragAndDrop.ts:43:22:43:54 | dataTra ... /html') | dragAndDrop.ts:43:15:43:54 | html |
1365+
| dragAndDrop.ts:43:22:43:54 | dataTra ... /html') | dragAndDrop.ts:43:15:43:54 | html |
1366+
| dragAndDrop.ts:43:22:43:54 | dataTra ... /html') | dragAndDrop.ts:43:15:43:54 | html |
1367+
| dragAndDrop.ts:43:22:43:54 | dataTra ... /html') | dragAndDrop.ts:43:15:43:54 | html |
13521368
| event-handler-receiver.js:2:49:2:61 | location.href | event-handler-receiver.js:2:31:2:83 | '<h2><a ... ></h2>' |
13531369
| event-handler-receiver.js:2:49:2:61 | location.href | event-handler-receiver.js:2:31:2:83 | '<h2><a ... ></h2>' |
13541370
| event-handler-receiver.js:2:49:2:61 | location.href | event-handler-receiver.js:2:31:2:83 | '<h2><a ... ></h2>' |
@@ -2117,6 +2133,7 @@ edges
21172133
| dragAndDrop.ts:24:23:24:57 | e.dataT ... /html') | dragAndDrop.ts:24:23:24:57 | e.dataT ... /html') | dragAndDrop.ts:24:23:24:57 | e.dataT ... /html') | Cross-site scripting vulnerability due to $@. | dragAndDrop.ts:24:23:24:57 | e.dataT ... /html') | user-provided value |
21182134
| dragAndDrop.ts:29:19:29:53 | e.dataT ... /html') | dragAndDrop.ts:29:19:29:53 | e.dataT ... /html') | dragAndDrop.ts:29:19:29:53 | e.dataT ... /html') | Cross-site scripting vulnerability due to $@. | dragAndDrop.ts:29:19:29:53 | e.dataT ... /html') | user-provided value |
21192135
| dragAndDrop.ts:33:19:33:67 | e.origi ... /html') | dragAndDrop.ts:33:19:33:67 | e.origi ... /html') | dragAndDrop.ts:33:19:33:67 | e.origi ... /html') | Cross-site scripting vulnerability due to $@. | dragAndDrop.ts:33:19:33:67 | e.origi ... /html') | user-provided value |
2136+
| dragAndDrop.ts:50:29:50:32 | html | dragAndDrop.ts:43:22:43:54 | dataTra ... /html') | dragAndDrop.ts:50:29:50:32 | html | Cross-site scripting vulnerability due to $@. | dragAndDrop.ts:43:22:43:54 | dataTra ... /html') | user-provided value |
21202137
| event-handler-receiver.js:2:31:2:83 | '<h2><a ... ></h2>' | event-handler-receiver.js:2:49:2:61 | location.href | event-handler-receiver.js:2:31:2:83 | '<h2><a ... ></h2>' | Cross-site scripting vulnerability due to $@. | event-handler-receiver.js:2:49:2:61 | location.href | user-provided value |
21212138
| express.js:7:15:7:33 | req.param("wobble") | express.js:7:15:7:33 | req.param("wobble") | express.js:7:15:7:33 | req.param("wobble") | Cross-site scripting vulnerability due to $@. | express.js:7:15:7:33 | req.param("wobble") | user-provided value |
21222139
| jquery.js:7:5:7:34 | "<div i ... + "\\">" | jquery.js:2:17:2:40 | documen ... .search | jquery.js:7:5:7:34 | "<div i ... + "\\">" | Cross-site scripting vulnerability due to $@. | jquery.js:2:17:2:40 | documen ... .search | user-provided value |

‎javascript/ql/test/query-tests/Security/CWE-079/DomBasedXss/XssWithAdditionalSources.expected

Lines changed: 16 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -315,6 +315,14 @@ nodes
315315
| dragAndDrop.ts:33:19:33:67 | e.origi ... /html') |
316316
| dragAndDrop.ts:33:19:33:67 | e.origi ... /html') |
317317
| dragAndDrop.ts:33:19:33:67 | e.origi ... /html') |
318+
| dragAndDrop.ts:43:15:43:54 | html |
319+
| dragAndDrop.ts:43:15:43:54 | html |
320+
| dragAndDrop.ts:43:22:43:54 | dataTra ... /html') |
321+
| dragAndDrop.ts:43:22:43:54 | dataTra ... /html') |
322+
| dragAndDrop.ts:43:22:43:54 | dataTra ... /html') |
323+
| dragAndDrop.ts:50:29:50:32 | html |
324+
| dragAndDrop.ts:50:29:50:32 | html |
325+
| dragAndDrop.ts:50:29:50:32 | html |
318326
| event-handler-receiver.js:2:31:2:83 | '<h2><a ... ></h2>' |
319327
| event-handler-receiver.js:2:31:2:83 | '<h2><a ... ></h2>' |
320328
| event-handler-receiver.js:2:31:2:83 | '<h2><a ... ></h2>' |
@@ -1399,6 +1407,14 @@ edges
13991407
| dragAndDrop.ts:24:23:24:57 | e.dataT ... /html') | dragAndDrop.ts:24:23:24:57 | e.dataT ... /html') |
14001408
| dragAndDrop.ts:29:19:29:53 | e.dataT ... /html') | dragAndDrop.ts:29:19:29:53 | e.dataT ... /html') |
14011409
| dragAndDrop.ts:33:19:33:67 | e.origi ... /html') | dragAndDrop.ts:33:19:33:67 | e.origi ... /html') |
1410+
| dragAndDrop.ts:43:15:43:54 | html | dragAndDrop.ts:50:29:50:32 | html |
1411+
| dragAndDrop.ts:43:15:43:54 | html | dragAndDrop.ts:50:29:50:32 | html |
1412+
| dragAndDrop.ts:43:15:43:54 | html | dragAndDrop.ts:50:29:50:32 | html |
1413+
| dragAndDrop.ts:43:15:43:54 | html | dragAndDrop.ts:50:29:50:32 | html |
1414+
| dragAndDrop.ts:43:22:43:54 | dataTra ... /html') | dragAndDrop.ts:43:15:43:54 | html |
1415+
| dragAndDrop.ts:43:22:43:54 | dataTra ... /html') | dragAndDrop.ts:43:15:43:54 | html |
1416+
| dragAndDrop.ts:43:22:43:54 | dataTra ... /html') | dragAndDrop.ts:43:15:43:54 | html |
1417+
| dragAndDrop.ts:43:22:43:54 | dataTra ... /html') | dragAndDrop.ts:43:15:43:54 | html |
14021418
| event-handler-receiver.js:2:49:2:61 | location.href | event-handler-receiver.js:2:31:2:83 | '<h2><a ... ></h2>' |
14031419
| event-handler-receiver.js:2:49:2:61 | location.href | event-handler-receiver.js:2:31:2:83 | '<h2><a ... ></h2>' |
14041420
| event-handler-receiver.js:2:49:2:61 | location.href | event-handler-receiver.js:2:31:2:83 | '<h2><a ... ></h2>' |

‎javascript/ql/test/query-tests/Security/CWE-079/DomBasedXss/dragAndDrop.ts

Lines changed: 23 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -31,4 +31,26 @@ document.addEventListener('drop', (e) => {
3131

3232
$("#foo").bind('drop', (e) => {
3333
$("#id").html(e.originalEvent.dataTransfer.getData('text/html')); // NOT OK
34-
});
34+
});
35+
36+
(function () {
37+
let div = document.createElement("div");
38+
div.ondrop = function (e: DragEvent) {
39+
const { dataTransfer } = e;
40+
if (!dataTransfer) return;
41+
42+
const text = dataTransfer.getData('text/plain');
43+
const html = dataTransfer.getData('text/html');
44+
if (!text && !html) return;
45+
46+
e.preventDefault();
47+
48+
const div = document.createElement('div');
49+
if (html) {
50+
div.innerHTML = html; // NOT OK
51+
} else {
52+
div.textContent = text;
53+
}
54+
document.body.append(div);
55+
}
56+
})();

0 commit comments

Comments
 (0)