Skip to content

Commit dbae553

Browse files
NapalysNapalys
committed
JS: add xss test cases with unknownflags for replace using RegExp
1 parent fe28657 commit dbae553

File tree

4 files changed

+44
-0
lines changed

4 files changed

+44
-0
lines changed

‎javascript/ql/test/query-tests/Security/CWE-079/DomBasedXss/ConsistencyDomBasedXss.expected

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1 @@
1+
| tst.js:510 | did not expect an alert, but found an alert for HtmlInjection | OK -- currently flagged, but might introduce a lot of false positives. | |

‎javascript/ql/test/query-tests/Security/CWE-079/DomBasedXss/Xss.expected

Lines changed: 19 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1148,6 +1148,15 @@ nodes
11481148
| tst.js:501:33:501:63 | decodeU ... n.hash) |
11491149
| tst.js:501:43:501:62 | window.location.hash |
11501150
| tst.js:501:43:501:62 | window.location.hash |
1151+
| tst.js:508:7:508:39 | target |
1152+
| tst.js:508:16:508:39 | documen ... .search |
1153+
| tst.js:508:16:508:39 | documen ... .search |
1154+
| tst.js:509:18:509:23 | target |
1155+
| tst.js:509:18:509:54 | target. ... "), '') |
1156+
| tst.js:509:18:509:54 | target. ... "), '') |
1157+
| tst.js:510:18:510:23 | target |
1158+
| tst.js:510:18:510:70 | target. ... )), '') |
1159+
| tst.js:510:18:510:70 | target. ... )), '') |
11511160
| typeahead.js:20:13:20:45 | target |
11521161
| typeahead.js:20:22:20:45 | documen ... .search |
11531162
| typeahead.js:20:22:20:45 | documen ... .search |
@@ -2331,6 +2340,14 @@ edges
23312340
| tst.js:501:43:501:62 | window.location.hash | tst.js:501:33:501:63 | decodeU ... n.hash) |
23322341
| tst.js:501:43:501:62 | window.location.hash | tst.js:501:33:501:63 | decodeU ... n.hash) |
23332342
| tst.js:501:43:501:62 | window.location.hash | tst.js:501:33:501:63 | decodeU ... n.hash) |
2343+
| tst.js:508:7:508:39 | target | tst.js:509:18:509:23 | target |
2344+
| tst.js:508:7:508:39 | target | tst.js:510:18:510:23 | target |
2345+
| tst.js:508:16:508:39 | documen ... .search | tst.js:508:7:508:39 | target |
2346+
| tst.js:508:16:508:39 | documen ... .search | tst.js:508:7:508:39 | target |
2347+
| tst.js:509:18:509:23 | target | tst.js:509:18:509:54 | target. ... "), '') |
2348+
| tst.js:509:18:509:23 | target | tst.js:509:18:509:54 | target. ... "), '') |
2349+
| tst.js:510:18:510:23 | target | tst.js:510:18:510:70 | target. ... )), '') |
2350+
| tst.js:510:18:510:23 | target | tst.js:510:18:510:70 | target. ... )), '') |
23342351
| typeahead.js:20:13:20:45 | target | typeahead.js:21:12:21:17 | target |
23352352
| typeahead.js:20:22:20:45 | documen ... .search | typeahead.js:20:13:20:45 | target |
23362353
| typeahead.js:20:22:20:45 | documen ... .search | typeahead.js:20:13:20:45 | target |
@@ -2623,6 +2640,8 @@ edges
26232640
| tst.js:491:23:491:45 | locatio ... bstr(1) | tst.js:491:23:491:35 | location.hash | tst.js:491:23:491:45 | locatio ... bstr(1) | Cross-site scripting vulnerability due to $@. | tst.js:491:23:491:35 | location.hash | user-provided value |
26242641
| tst.js:494:18:494:40 | locatio ... bstr(1) | tst.js:494:18:494:30 | location.hash | tst.js:494:18:494:40 | locatio ... bstr(1) | Cross-site scripting vulnerability due to $@. | tst.js:494:18:494:30 | location.hash | user-provided value |
26252642
| tst.js:501:33:501:63 | decodeU ... n.hash) | tst.js:501:43:501:62 | window.location.hash | tst.js:501:33:501:63 | decodeU ... n.hash) | Cross-site scripting vulnerability due to $@. | tst.js:501:43:501:62 | window.location.hash | user-provided value |
2643+
| tst.js:509:18:509:54 | target. ... "), '') | tst.js:508:16:508:39 | documen ... .search | tst.js:509:18:509:54 | target. ... "), '') | Cross-site scripting vulnerability due to $@. | tst.js:508:16:508:39 | documen ... .search | user-provided value |
2644+
| tst.js:510:18:510:70 | target. ... )), '') | tst.js:508:16:508:39 | documen ... .search | tst.js:510:18:510:70 | target. ... )), '') | Cross-site scripting vulnerability due to $@. | tst.js:508:16:508:39 | documen ... .search | user-provided value |
26262645
| typeahead.js:25:18:25:20 | val | typeahead.js:20:22:20:45 | documen ... .search | typeahead.js:25:18:25:20 | val | Cross-site scripting vulnerability due to $@. | typeahead.js:20:22:20:45 | documen ... .search | user-provided value |
26272646
| v-html.vue:2:8:2:23 | v-html=tainted | v-html.vue:6:42:6:58 | document.location | v-html.vue:2:8:2:23 | v-html=tainted | Cross-site scripting vulnerability due to $@. | v-html.vue:6:42:6:58 | document.location | user-provided value |
26282647
| various-concat-obfuscations.js:4:4:4:31 | "<div>" ... </div>" | various-concat-obfuscations.js:2:16:2:39 | documen ... .search | various-concat-obfuscations.js:4:4:4:31 | "<div>" ... </div>" | Cross-site scripting vulnerability due to $@. | various-concat-obfuscations.js:2:16:2:39 | documen ... .search | user-provided value |

‎javascript/ql/test/query-tests/Security/CWE-079/DomBasedXss/XssWithAdditionalSources.expected

Lines changed: 17 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1160,6 +1160,15 @@ nodes
11601160
| tst.js:501:33:501:63 | decodeU ... n.hash) |
11611161
| tst.js:501:43:501:62 | window.location.hash |
11621162
| tst.js:501:43:501:62 | window.location.hash |
1163+
| tst.js:508:7:508:39 | target |
1164+
| tst.js:508:16:508:39 | documen ... .search |
1165+
| tst.js:508:16:508:39 | documen ... .search |
1166+
| tst.js:509:18:509:23 | target |
1167+
| tst.js:509:18:509:54 | target. ... "), '') |
1168+
| tst.js:509:18:509:54 | target. ... "), '') |
1169+
| tst.js:510:18:510:23 | target |
1170+
| tst.js:510:18:510:70 | target. ... )), '') |
1171+
| tst.js:510:18:510:70 | target. ... )), '') |
11631172
| typeahead.js:9:28:9:30 | loc |
11641173
| typeahead.js:9:28:9:30 | loc |
11651174
| typeahead.js:9:28:9:30 | loc |
@@ -2393,6 +2402,14 @@ edges
23932402
| tst.js:501:43:501:62 | window.location.hash | tst.js:501:33:501:63 | decodeU ... n.hash) |
23942403
| tst.js:501:43:501:62 | window.location.hash | tst.js:501:33:501:63 | decodeU ... n.hash) |
23952404
| tst.js:501:43:501:62 | window.location.hash | tst.js:501:33:501:63 | decodeU ... n.hash) |
2405+
| tst.js:508:7:508:39 | target | tst.js:509:18:509:23 | target |
2406+
| tst.js:508:7:508:39 | target | tst.js:510:18:510:23 | target |
2407+
| tst.js:508:16:508:39 | documen ... .search | tst.js:508:7:508:39 | target |
2408+
| tst.js:508:16:508:39 | documen ... .search | tst.js:508:7:508:39 | target |
2409+
| tst.js:509:18:509:23 | target | tst.js:509:18:509:54 | target. ... "), '') |
2410+
| tst.js:509:18:509:23 | target | tst.js:509:18:509:54 | target. ... "), '') |
2411+
| tst.js:510:18:510:23 | target | tst.js:510:18:510:70 | target. ... )), '') |
2412+
| tst.js:510:18:510:23 | target | tst.js:510:18:510:70 | target. ... )), '') |
23962413
| typeahead.js:9:28:9:30 | loc | typeahead.js:10:16:10:18 | loc |
23972414
| typeahead.js:9:28:9:30 | loc | typeahead.js:10:16:10:18 | loc |
23982415
| typeahead.js:9:28:9:30 | loc | typeahead.js:10:16:10:18 | loc |

‎javascript/ql/test/query-tests/Security/CWE-079/DomBasedXss/tst.js

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -503,3 +503,10 @@ function Foo() {
503503
};
504504
Object.assign(this, obj);
505505
}
506+
507+
function nonGlobalSanitizer() {
508+
var target = document.location.search
509+
$("#foo").html(target.replace(new RegExp("<|>"), '')); // NOT OK
510+
$("#foo").html(target.replace(new RegExp("<|>", unknownFlags()), '')); // OK -- currently flagged, but might introduce a lot of false positives.
511+
$("#foo").html(target.replace(new RegExp("<|>", "g"), '')); // OK
512+
}

0 commit comments

Comments
 (0)