Skip to content

Commit aafa8dd

Browse files
erik-krogherik-krogh
committed
add support for domNode.onpaste for copy-paste events
1 parent 6713b2c commit aafa8dd

File tree

4 files changed

+62
-1
lines changed

4 files changed

+62
-1
lines changed

‎javascript/ql/lib/semmle/javascript/frameworks/Clipboard.qll

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -32,6 +32,12 @@ private DataFlow::SourceNode pasteEvent(DataFlow::TypeTracker t) {
3232
)
3333
or
3434
t.start() and
35+
exists(DataFlow::PropWrite pw | pw = DOM::domValueRef().getAPropertyWrite() |
36+
pw.getPropertyName() = "onpaste" and
37+
result = pw.getRhs().getABoundFunctionValue(0).getParameter(0)
38+
)
39+
or
40+
t.start() and
3541
result = jQueryPasteEvent(DataFlow::TypeTracker::end()).getAPropertyRead("originalEvent")
3642
or
3743
exists(DataFlow::TypeTracker t2 | result = pasteEvent(t2).track(t2, t))

‎javascript/ql/test/query-tests/Security/CWE-079/DomBasedXss/Xss.expected

Lines changed: 17 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -136,6 +136,14 @@ nodes
136136
| clipboard.ts:33:19:33:68 | e.origi ... /html') |
137137
| clipboard.ts:33:19:33:68 | e.origi ... /html') |
138138
| clipboard.ts:33:19:33:68 | e.origi ... /html') |
139+
| clipboard.ts:43:15:43:55 | html |
140+
| clipboard.ts:43:15:43:55 | html |
141+
| clipboard.ts:43:22:43:55 | clipboa ... /html') |
142+
| clipboard.ts:43:22:43:55 | clipboa ... /html') |
143+
| clipboard.ts:43:22:43:55 | clipboa ... /html') |
144+
| clipboard.ts:50:29:50:32 | html |
145+
| clipboard.ts:50:29:50:32 | html |
146+
| clipboard.ts:50:29:50:32 | html |
139147
| d3.js:4:12:4:22 | window.name |
140148
| d3.js:4:12:4:22 | window.name |
141149
| d3.js:4:12:4:22 | window.name |
@@ -1158,6 +1166,14 @@ edges
11581166
| clipboard.ts:24:23:24:58 | e.clipb ... /html') | clipboard.ts:24:23:24:58 | e.clipb ... /html') |
11591167
| clipboard.ts:29:19:29:54 | e.clipb ... /html') | clipboard.ts:29:19:29:54 | e.clipb ... /html') |
11601168
| clipboard.ts:33:19:33:68 | e.origi ... /html') | clipboard.ts:33:19:33:68 | e.origi ... /html') |
1169+
| clipboard.ts:43:15:43:55 | html | clipboard.ts:50:29:50:32 | html |
1170+
| clipboard.ts:43:15:43:55 | html | clipboard.ts:50:29:50:32 | html |
1171+
| clipboard.ts:43:15:43:55 | html | clipboard.ts:50:29:50:32 | html |
1172+
| clipboard.ts:43:15:43:55 | html | clipboard.ts:50:29:50:32 | html |
1173+
| clipboard.ts:43:22:43:55 | clipboa ... /html') | clipboard.ts:43:15:43:55 | html |
1174+
| clipboard.ts:43:22:43:55 | clipboa ... /html') | clipboard.ts:43:15:43:55 | html |
1175+
| clipboard.ts:43:22:43:55 | clipboa ... /html') | clipboard.ts:43:15:43:55 | html |
1176+
| clipboard.ts:43:22:43:55 | clipboa ... /html') | clipboard.ts:43:15:43:55 | html |
11611177
| d3.js:4:12:4:22 | window.name | d3.js:11:15:11:24 | getTaint() |
11621178
| d3.js:4:12:4:22 | window.name | d3.js:11:15:11:24 | getTaint() |
11631179
| d3.js:4:12:4:22 | window.name | d3.js:11:15:11:24 | getTaint() |
@@ -2109,6 +2125,7 @@ edges
21092125
| clipboard.ts:24:23:24:58 | e.clipb ... /html') | clipboard.ts:24:23:24:58 | e.clipb ... /html') | clipboard.ts:24:23:24:58 | e.clipb ... /html') | Cross-site scripting vulnerability due to $@. | clipboard.ts:24:23:24:58 | e.clipb ... /html') | user-provided value |
21102126
| clipboard.ts:29:19:29:54 | e.clipb ... /html') | clipboard.ts:29:19:29:54 | e.clipb ... /html') | clipboard.ts:29:19:29:54 | e.clipb ... /html') | Cross-site scripting vulnerability due to $@. | clipboard.ts:29:19:29:54 | e.clipb ... /html') | user-provided value |
21112127
| clipboard.ts:33:19:33:68 | e.origi ... /html') | clipboard.ts:33:19:33:68 | e.origi ... /html') | clipboard.ts:33:19:33:68 | e.origi ... /html') | Cross-site scripting vulnerability due to $@. | clipboard.ts:33:19:33:68 | e.origi ... /html') | user-provided value |
2128+
| clipboard.ts:50:29:50:32 | html | clipboard.ts:43:22:43:55 | clipboa ... /html') | clipboard.ts:50:29:50:32 | html | Cross-site scripting vulnerability due to $@. | clipboard.ts:43:22:43:55 | clipboa ... /html') | user-provided value |
21122129
| d3.js:11:15:11:24 | getTaint() | d3.js:4:12:4:22 | window.name | d3.js:11:15:11:24 | getTaint() | Cross-site scripting vulnerability due to $@. | d3.js:4:12:4:22 | window.name | user-provided value |
21132130
| d3.js:12:20:12:29 | getTaint() | d3.js:4:12:4:22 | window.name | d3.js:12:20:12:29 | getTaint() | Cross-site scripting vulnerability due to $@. | d3.js:4:12:4:22 | window.name | user-provided value |
21142131
| d3.js:14:20:14:29 | getTaint() | d3.js:4:12:4:22 | window.name | d3.js:14:20:14:29 | getTaint() | Cross-site scripting vulnerability due to $@. | d3.js:4:12:4:22 | window.name | user-provided value |

‎javascript/ql/test/query-tests/Security/CWE-079/DomBasedXss/XssWithAdditionalSources.expected

Lines changed: 16 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -136,6 +136,14 @@ nodes
136136
| clipboard.ts:33:19:33:68 | e.origi ... /html') |
137137
| clipboard.ts:33:19:33:68 | e.origi ... /html') |
138138
| clipboard.ts:33:19:33:68 | e.origi ... /html') |
139+
| clipboard.ts:43:15:43:55 | html |
140+
| clipboard.ts:43:15:43:55 | html |
141+
| clipboard.ts:43:22:43:55 | clipboa ... /html') |
142+
| clipboard.ts:43:22:43:55 | clipboa ... /html') |
143+
| clipboard.ts:43:22:43:55 | clipboa ... /html') |
144+
| clipboard.ts:50:29:50:32 | html |
145+
| clipboard.ts:50:29:50:32 | html |
146+
| clipboard.ts:50:29:50:32 | html |
139147
| d3.js:4:12:4:22 | window.name |
140148
| d3.js:4:12:4:22 | window.name |
141149
| d3.js:4:12:4:22 | window.name |
@@ -1208,6 +1216,14 @@ edges
12081216
| clipboard.ts:24:23:24:58 | e.clipb ... /html') | clipboard.ts:24:23:24:58 | e.clipb ... /html') |
12091217
| clipboard.ts:29:19:29:54 | e.clipb ... /html') | clipboard.ts:29:19:29:54 | e.clipb ... /html') |
12101218
| clipboard.ts:33:19:33:68 | e.origi ... /html') | clipboard.ts:33:19:33:68 | e.origi ... /html') |
1219+
| clipboard.ts:43:15:43:55 | html | clipboard.ts:50:29:50:32 | html |
1220+
| clipboard.ts:43:15:43:55 | html | clipboard.ts:50:29:50:32 | html |
1221+
| clipboard.ts:43:15:43:55 | html | clipboard.ts:50:29:50:32 | html |
1222+
| clipboard.ts:43:15:43:55 | html | clipboard.ts:50:29:50:32 | html |
1223+
| clipboard.ts:43:22:43:55 | clipboa ... /html') | clipboard.ts:43:15:43:55 | html |
1224+
| clipboard.ts:43:22:43:55 | clipboa ... /html') | clipboard.ts:43:15:43:55 | html |
1225+
| clipboard.ts:43:22:43:55 | clipboa ... /html') | clipboard.ts:43:15:43:55 | html |
1226+
| clipboard.ts:43:22:43:55 | clipboa ... /html') | clipboard.ts:43:15:43:55 | html |
12111227
| d3.js:4:12:4:22 | window.name | d3.js:11:15:11:24 | getTaint() |
12121228
| d3.js:4:12:4:22 | window.name | d3.js:11:15:11:24 | getTaint() |
12131229
| d3.js:4:12:4:22 | window.name | d3.js:11:15:11:24 | getTaint() |

‎javascript/ql/test/query-tests/Security/CWE-079/DomBasedXss/clipboard.ts

Lines changed: 23 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -31,4 +31,26 @@ document.addEventListener('paste', (e) => {
3131

3232
$("#foo").bind('paste', (e) => {
3333
$("#id").html(e.originalEvent.clipboardData.getData('text/html')); // NOT OK
34-
});
34+
});
35+
36+
(function () {
37+
let div = document.createElement("div");
38+
div.onpaste = function (e: ClipboardEvent) {
39+
const { clipboardData } = e;
40+
if (!clipboardData) return;
41+
42+
const text = clipboardData.getData('text/plain');
43+
const html = clipboardData.getData('text/html');
44+
if (!text && !html) return;
45+
46+
e.preventDefault();
47+
48+
const div = document.createElement('div');
49+
if (html) {
50+
div.innerHTML = html; // NOT OK
51+
} else {
52+
div.textContent = text;
53+
}
54+
document.body.append(div);
55+
}
56+
})();

0 commit comments

Comments
 (0)