Skip to content

Commit 703cad9

Browse files
asgerfasgerf
committed
Expand test case
1 parent 2a2a4d2 commit 703cad9

File tree

2 files changed

+76
-0
lines changed

2 files changed

+76
-0
lines changed

‎javascript/ql/test/query-tests/Security/CWE-601/ClientSideUrlRedirect/ClientSideUrlRedirect.expected

Lines changed: 50 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -11,6 +11,31 @@ nodes
1111
| react.js:37:43:37:74 | documen ... bstr(1) | semmle.label | documen ... bstr(1) |
1212
| react.js:43:19:43:40 | documen ... on.hash | semmle.label | documen ... on.hash |
1313
| react.js:43:19:43:50 | documen ... bstr(1) | semmle.label | documen ... bstr(1) |
14+
| regexp-exec.js:4:11:4:20 | [, group1] | semmle.label | [, group1] |
15+
| regexp-exec.js:4:11:4:57 | group1 | semmle.label | group1 |
16+
| regexp-exec.js:4:24:4:57 | /#(.*)/ ... n.href) | semmle.label | /#(.*)/ ... n.href) |
17+
| regexp-exec.js:4:37:4:56 | window.location.href | semmle.label | window.location.href |
18+
| regexp-exec.js:5:28:5:33 | group1 | semmle.label | group1 |
19+
| regexp-exec.js:9:11:9:20 | [, group1] | semmle.label | [, group1] |
20+
| regexp-exec.js:9:11:9:58 | group1 | semmle.label | group1 |
21+
| regexp-exec.js:9:24:9:58 | /\\?(.*) ... n.href) | semmle.label | /\\?(.*) ... n.href) |
22+
| regexp-exec.js:9:38:9:57 | window.location.href | semmle.label | window.location.href |
23+
| regexp-exec.js:10:28:10:33 | group1 | semmle.label | group1 |
24+
| regexp-exec.js:14:11:14:20 | [, group1] | semmle.label | [, group1] |
25+
| regexp-exec.js:14:11:14:62 | group1 | semmle.label | group1 |
26+
| regexp-exec.js:14:24:14:62 | /^([a-z ... n.href) | semmle.label | /^([a-z ... n.href) |
27+
| regexp-exec.js:14:42:14:61 | window.location.href | semmle.label | window.location.href |
28+
| regexp-exec.js:15:28:15:33 | group1 | semmle.label | group1 |
29+
| regexp-exec.js:19:11:19:20 | [, group1] | semmle.label | [, group1] |
30+
| regexp-exec.js:19:11:19:56 | group1 | semmle.label | group1 |
31+
| regexp-exec.js:19:24:19:56 | /(.*)/. ... n.href) | semmle.label | /(.*)/. ... n.href) |
32+
| regexp-exec.js:19:36:19:55 | window.location.href | semmle.label | window.location.href |
33+
| regexp-exec.js:20:28:20:33 | group1 | semmle.label | group1 |
34+
| regexp-exec.js:24:11:24:20 | [, group1] | semmle.label | [, group1] |
35+
| regexp-exec.js:24:11:24:60 | group1 | semmle.label | group1 |
36+
| regexp-exec.js:24:24:24:60 | /blah#b ... n.href) | semmle.label | /blah#b ... n.href) |
37+
| regexp-exec.js:24:40:24:59 | window.location.href | semmle.label | window.location.href |
38+
| regexp-exec.js:25:28:25:33 | group1 | semmle.label | group1 |
1439
| sanitizer.js:2:9:2:25 | url | semmle.label | url |
1540
| sanitizer.js:2:15:2:25 | window.name | semmle.label | window.name |
1641
| sanitizer.js:4:27:4:29 | url | semmle.label | url |
@@ -168,6 +193,26 @@ edges
168193
| react.js:31:43:31:64 | documen ... on.hash | react.js:31:43:31:74 | documen ... bstr(1) | provenance | Config |
169194
| react.js:37:43:37:64 | documen ... on.hash | react.js:37:43:37:74 | documen ... bstr(1) | provenance | Config |
170195
| react.js:43:19:43:40 | documen ... on.hash | react.js:43:19:43:50 | documen ... bstr(1) | provenance | Config |
196+
| regexp-exec.js:4:11:4:20 | [, group1] | regexp-exec.js:4:11:4:57 | group1 | provenance | |
197+
| regexp-exec.js:4:11:4:57 | group1 | regexp-exec.js:5:28:5:33 | group1 | provenance | |
198+
| regexp-exec.js:4:24:4:57 | /#(.*)/ ... n.href) | regexp-exec.js:4:11:4:20 | [, group1] | provenance | |
199+
| regexp-exec.js:4:37:4:56 | window.location.href | regexp-exec.js:4:24:4:57 | /#(.*)/ ... n.href) | provenance | Config |
200+
| regexp-exec.js:9:11:9:20 | [, group1] | regexp-exec.js:9:11:9:58 | group1 | provenance | |
201+
| regexp-exec.js:9:11:9:58 | group1 | regexp-exec.js:10:28:10:33 | group1 | provenance | |
202+
| regexp-exec.js:9:24:9:58 | /\\?(.*) ... n.href) | regexp-exec.js:9:11:9:20 | [, group1] | provenance | |
203+
| regexp-exec.js:9:38:9:57 | window.location.href | regexp-exec.js:9:24:9:58 | /\\?(.*) ... n.href) | provenance | Config |
204+
| regexp-exec.js:14:11:14:20 | [, group1] | regexp-exec.js:14:11:14:62 | group1 | provenance | |
205+
| regexp-exec.js:14:11:14:62 | group1 | regexp-exec.js:15:28:15:33 | group1 | provenance | |
206+
| regexp-exec.js:14:24:14:62 | /^([a-z ... n.href) | regexp-exec.js:14:11:14:20 | [, group1] | provenance | |
207+
| regexp-exec.js:14:42:14:61 | window.location.href | regexp-exec.js:14:24:14:62 | /^([a-z ... n.href) | provenance | Config |
208+
| regexp-exec.js:19:11:19:20 | [, group1] | regexp-exec.js:19:11:19:56 | group1 | provenance | |
209+
| regexp-exec.js:19:11:19:56 | group1 | regexp-exec.js:20:28:20:33 | group1 | provenance | |
210+
| regexp-exec.js:19:24:19:56 | /(.*)/. ... n.href) | regexp-exec.js:19:11:19:20 | [, group1] | provenance | |
211+
| regexp-exec.js:19:36:19:55 | window.location.href | regexp-exec.js:19:24:19:56 | /(.*)/. ... n.href) | provenance | Config |
212+
| regexp-exec.js:24:11:24:20 | [, group1] | regexp-exec.js:24:11:24:60 | group1 | provenance | |
213+
| regexp-exec.js:24:11:24:60 | group1 | regexp-exec.js:25:28:25:33 | group1 | provenance | |
214+
| regexp-exec.js:24:24:24:60 | /blah#b ... n.href) | regexp-exec.js:24:11:24:20 | [, group1] | provenance | |
215+
| regexp-exec.js:24:40:24:59 | window.location.href | regexp-exec.js:24:24:24:60 | /blah#b ... n.href) | provenance | Config |
171216
| sanitizer.js:2:9:2:25 | url | sanitizer.js:4:27:4:29 | url | provenance | |
172217
| sanitizer.js:2:9:2:25 | url | sanitizer.js:16:27:16:29 | url | provenance | |
173218
| sanitizer.js:2:9:2:25 | url | sanitizer.js:19:27:19:29 | url | provenance | |
@@ -294,6 +339,11 @@ subpaths
294339
| react.js:31:43:31:74 | documen ... bstr(1) | react.js:31:43:31:64 | documen ... on.hash | react.js:31:43:31:74 | documen ... bstr(1) | Untrusted URL redirection depends on a $@. | react.js:31:43:31:64 | documen ... on.hash | user-provided value |
295340
| react.js:37:43:37:74 | documen ... bstr(1) | react.js:37:43:37:64 | documen ... on.hash | react.js:37:43:37:74 | documen ... bstr(1) | Untrusted URL redirection depends on a $@. | react.js:37:43:37:64 | documen ... on.hash | user-provided value |
296341
| react.js:43:19:43:50 | documen ... bstr(1) | react.js:43:19:43:40 | documen ... on.hash | react.js:43:19:43:50 | documen ... bstr(1) | Untrusted URL redirection depends on a $@. | react.js:43:19:43:40 | documen ... on.hash | user-provided value |
342+
| regexp-exec.js:5:28:5:33 | group1 | regexp-exec.js:4:37:4:56 | window.location.href | regexp-exec.js:5:28:5:33 | group1 | Untrusted URL redirection depends on a $@. | regexp-exec.js:4:37:4:56 | window.location.href | user-provided value |
343+
| regexp-exec.js:10:28:10:33 | group1 | regexp-exec.js:9:38:9:57 | window.location.href | regexp-exec.js:10:28:10:33 | group1 | Untrusted URL redirection depends on a $@. | regexp-exec.js:9:38:9:57 | window.location.href | user-provided value |
344+
| regexp-exec.js:15:28:15:33 | group1 | regexp-exec.js:14:42:14:61 | window.location.href | regexp-exec.js:15:28:15:33 | group1 | Untrusted URL redirection depends on a $@. | regexp-exec.js:14:42:14:61 | window.location.href | user-provided value |
345+
| regexp-exec.js:20:28:20:33 | group1 | regexp-exec.js:19:36:19:55 | window.location.href | regexp-exec.js:20:28:20:33 | group1 | Untrusted URL redirection depends on a $@. | regexp-exec.js:19:36:19:55 | window.location.href | user-provided value |
346+
| regexp-exec.js:25:28:25:33 | group1 | regexp-exec.js:24:40:24:59 | window.location.href | regexp-exec.js:25:28:25:33 | group1 | Untrusted URL redirection depends on a $@. | regexp-exec.js:24:40:24:59 | window.location.href | user-provided value |
297347
| sanitizer.js:4:27:4:29 | url | sanitizer.js:2:15:2:25 | window.name | sanitizer.js:4:27:4:29 | url | Untrusted URL redirection depends on a $@. | sanitizer.js:2:15:2:25 | window.name | user-provided value |
298348
| sanitizer.js:16:27:16:29 | url | sanitizer.js:2:15:2:25 | window.name | sanitizer.js:16:27:16:29 | url | Untrusted URL redirection depends on a $@. | sanitizer.js:2:15:2:25 | window.name | user-provided value |
299349
| sanitizer.js:19:27:19:29 | url | sanitizer.js:2:15:2:25 | window.name | sanitizer.js:19:27:19:29 | url | Untrusted URL redirection depends on a $@. | sanitizer.js:2:15:2:25 | window.name | user-provided value |

‎javascript/ql/test/query-tests/Security/CWE-601/ClientSideUrlRedirect/regexp-exec.js

Lines changed: 26 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,26 @@
1+
import 'dummy';
2+
3+
function extractFromHash() {
4+
const [, group1] = /#(.*)/.exec(window.location.href);
5+
window.location.href = group1; // NOT OK
6+
}
7+
8+
function extractFromQuery() {
9+
const [, group1] = /\?(.*)/.exec(window.location.href);
10+
window.location.href = group1; // NOT OK
11+
}
12+
13+
function extractFromProtocol() {
14+
const [, group1] = /^([a-z]+:)/.exec(window.location.href);
15+
window.location.href = group1; // OK [INCONSISTENCY]
16+
}
17+
18+
function extractTooMuch() {
19+
const [, group1] = /(.*)/.exec(window.location.href);
20+
window.location.href = group1; // OK [INCONSISTENCY]
21+
}
22+
23+
function extractNothing() {
24+
const [, group1] = /blah#baz/.exec(window.location.href);
25+
window.location.href = group1; // OK [INCONSISTENCY]
26+
}

0 commit comments

Comments
 (0)