Skip to content

Commit 320cb99

Browse files
tyagetyage
committed
Add replace method test
1 parent 668e1ac commit 320cb99

File tree

3 files changed

+59
-32
lines changed

3 files changed

+59
-32
lines changed

‎javascript/ql/test/query-tests/Security/CWE-079/DomBasedXss/Xss.expected

Lines changed: 29 additions & 16 deletions
Original file line numberDiff line numberDiff line change
@@ -567,13 +567,18 @@ nodes
567567
| react-use-router.js:8:21:8:32 | router.query |
568568
| react-use-router.js:8:21:8:39 | router.query.foobar |
569569
| react-use-router.js:8:21:8:39 | router.query.foobar |
570-
| react-use-router.js:19:15:19:24 | router |
571-
| react-use-router.js:19:17:19:22 | router |
572-
| react-use-router.js:20:43:20:48 | router |
573-
| react-use-router.js:20:43:20:54 | router.query |
574-
| react-use-router.js:20:43:20:54 | router.query |
575-
| react-use-router.js:20:43:20:61 | router.query.foobar |
576-
| react-use-router.js:20:43:20:61 | router.query.foobar |
570+
| react-use-router.js:11:24:11:29 | router |
571+
| react-use-router.js:11:24:11:35 | router.query |
572+
| react-use-router.js:11:24:11:35 | router.query |
573+
| react-use-router.js:11:24:11:42 | router.query.foobar |
574+
| react-use-router.js:11:24:11:42 | router.query.foobar |
575+
| react-use-router.js:22:15:22:24 | router |
576+
| react-use-router.js:22:17:22:22 | router |
577+
| react-use-router.js:23:43:23:48 | router |
578+
| react-use-router.js:23:43:23:54 | router.query |
579+
| react-use-router.js:23:43:23:54 | router.query |
580+
| react-use-router.js:23:43:23:61 | router.query.foobar |
581+
| react-use-router.js:23:43:23:61 | router.query.foobar |
577582
| react-use-state.js:4:9:4:49 | state |
578583
| react-use-state.js:4:9:4:49 | state |
579584
| react-use-state.js:4:10:4:14 | state |
@@ -1715,21 +1720,27 @@ edges
17151720
| react-use-context.js:10:22:10:32 | window.name | react-use-context.js:10:22:10:32 | window.name |
17161721
| react-use-context.js:16:26:16:36 | window.name | react-use-context.js:16:26:16:36 | window.name |
17171722
| react-use-router.js:4:9:4:28 | router | react-use-router.js:8:21:8:26 | router |
1723+
| react-use-router.js:4:9:4:28 | router | react-use-router.js:11:24:11:29 | router |
17181724
| react-use-router.js:4:18:4:28 | useRouter() | react-use-router.js:4:9:4:28 | router |
17191725
| react-use-router.js:8:21:8:26 | router | react-use-router.js:8:21:8:32 | router.query |
17201726
| react-use-router.js:8:21:8:32 | router.query | react-use-router.js:8:21:8:39 | router.query.foobar |
17211727
| react-use-router.js:8:21:8:32 | router.query | react-use-router.js:8:21:8:39 | router.query.foobar |
17221728
| react-use-router.js:8:21:8:32 | router.query | react-use-router.js:8:21:8:39 | router.query.foobar |
17231729
| react-use-router.js:8:21:8:32 | router.query | react-use-router.js:8:21:8:39 | router.query.foobar |
17241730
| react-use-router.js:8:21:8:39 | router.query.foobar | react-use-router.js:4:18:4:28 | useRouter() |
1725-
| react-use-router.js:19:15:19:24 | router | react-use-router.js:20:43:20:48 | router |
1726-
| react-use-router.js:19:17:19:22 | router | react-use-router.js:19:15:19:24 | router |
1727-
| react-use-router.js:20:43:20:48 | router | react-use-router.js:20:43:20:54 | router.query |
1728-
| react-use-router.js:20:43:20:54 | router.query | react-use-router.js:20:43:20:61 | router.query.foobar |
1729-
| react-use-router.js:20:43:20:54 | router.query | react-use-router.js:20:43:20:61 | router.query.foobar |
1730-
| react-use-router.js:20:43:20:54 | router.query | react-use-router.js:20:43:20:61 | router.query.foobar |
1731-
| react-use-router.js:20:43:20:54 | router.query | react-use-router.js:20:43:20:61 | router.query.foobar |
1732-
| react-use-router.js:20:43:20:61 | router.query.foobar | react-use-router.js:19:17:19:22 | router |
1731+
| react-use-router.js:11:24:11:29 | router | react-use-router.js:11:24:11:35 | router.query |
1732+
| react-use-router.js:11:24:11:35 | router.query | react-use-router.js:11:24:11:42 | router.query.foobar |
1733+
| react-use-router.js:11:24:11:35 | router.query | react-use-router.js:11:24:11:42 | router.query.foobar |
1734+
| react-use-router.js:11:24:11:35 | router.query | react-use-router.js:11:24:11:42 | router.query.foobar |
1735+
| react-use-router.js:11:24:11:35 | router.query | react-use-router.js:11:24:11:42 | router.query.foobar |
1736+
| react-use-router.js:22:15:22:24 | router | react-use-router.js:23:43:23:48 | router |
1737+
| react-use-router.js:22:17:22:22 | router | react-use-router.js:22:15:22:24 | router |
1738+
| react-use-router.js:23:43:23:48 | router | react-use-router.js:23:43:23:54 | router.query |
1739+
| react-use-router.js:23:43:23:54 | router.query | react-use-router.js:23:43:23:61 | router.query.foobar |
1740+
| react-use-router.js:23:43:23:54 | router.query | react-use-router.js:23:43:23:61 | router.query.foobar |
1741+
| react-use-router.js:23:43:23:54 | router.query | react-use-router.js:23:43:23:61 | router.query.foobar |
1742+
| react-use-router.js:23:43:23:54 | router.query | react-use-router.js:23:43:23:61 | router.query.foobar |
1743+
| react-use-router.js:23:43:23:61 | router.query.foobar | react-use-router.js:22:17:22:22 | router |
17331744
| react-use-state.js:4:9:4:49 | state | react-use-state.js:5:51:5:55 | state |
17341745
| react-use-state.js:4:9:4:49 | state | react-use-state.js:5:51:5:55 | state |
17351746
| react-use-state.js:4:9:4:49 | state | react-use-state.js:5:51:5:55 | state |
@@ -2417,7 +2428,9 @@ edges
24172428
| react-use-context.js:10:22:10:32 | window.name | react-use-context.js:10:22:10:32 | window.name | react-use-context.js:10:22:10:32 | window.name | Cross-site scripting vulnerability due to $@. | react-use-context.js:10:22:10:32 | window.name | user-provided value |
24182429
| react-use-context.js:16:26:16:36 | window.name | react-use-context.js:16:26:16:36 | window.name | react-use-context.js:16:26:16:36 | window.name | Cross-site scripting vulnerability due to $@. | react-use-context.js:16:26:16:36 | window.name | user-provided value |
24192430
| react-use-router.js:8:21:8:39 | router.query.foobar | react-use-router.js:8:21:8:32 | router.query | react-use-router.js:8:21:8:39 | router.query.foobar | Cross-site scripting vulnerability due to $@. | react-use-router.js:8:21:8:32 | router.query | user-provided value |
2420-
| react-use-router.js:20:43:20:61 | router.query.foobar | react-use-router.js:20:43:20:54 | router.query | react-use-router.js:20:43:20:61 | router.query.foobar | Cross-site scripting vulnerability due to $@. | react-use-router.js:20:43:20:54 | router.query | user-provided value |
2431+
| react-use-router.js:11:24:11:42 | router.query.foobar | react-use-router.js:8:21:8:32 | router.query | react-use-router.js:11:24:11:42 | router.query.foobar | Cross-site scripting vulnerability due to $@. | react-use-router.js:8:21:8:32 | router.query | user-provided value |
2432+
| react-use-router.js:11:24:11:42 | router.query.foobar | react-use-router.js:11:24:11:35 | router.query | react-use-router.js:11:24:11:42 | router.query.foobar | Cross-site scripting vulnerability due to $@. | react-use-router.js:11:24:11:35 | router.query | user-provided value |
2433+
| react-use-router.js:23:43:23:61 | router.query.foobar | react-use-router.js:23:43:23:54 | router.query | react-use-router.js:23:43:23:61 | router.query.foobar | Cross-site scripting vulnerability due to $@. | react-use-router.js:23:43:23:54 | router.query | user-provided value |
24212434
| react-use-state.js:5:51:5:55 | state | react-use-state.js:4:38:4:48 | window.name | react-use-state.js:5:51:5:55 | state | Cross-site scripting vulnerability due to $@. | react-use-state.js:4:38:4:48 | window.name | user-provided value |
24222435
| react-use-state.js:11:51:11:55 | state | react-use-state.js:10:14:10:24 | window.name | react-use-state.js:11:51:11:55 | state | Cross-site scripting vulnerability due to $@. | react-use-state.js:10:14:10:24 | window.name | user-provided value |
24232436
| react-use-state.js:17:51:17:55 | state | react-use-state.js:16:20:16:30 | window.name | react-use-state.js:17:51:17:55 | state | Cross-site scripting vulnerability due to $@. | react-use-state.js:16:20:16:30 | window.name | user-provided value |

‎javascript/ql/test/query-tests/Security/CWE-079/DomBasedXss/XssWithAdditionalSources.expected

Lines changed: 26 additions & 15 deletions
Original file line numberDiff line numberDiff line change
@@ -579,13 +579,18 @@ nodes
579579
| react-use-router.js:8:21:8:32 | router.query |
580580
| react-use-router.js:8:21:8:39 | router.query.foobar |
581581
| react-use-router.js:8:21:8:39 | router.query.foobar |
582-
| react-use-router.js:19:15:19:24 | router |
583-
| react-use-router.js:19:17:19:22 | router |
584-
| react-use-router.js:20:43:20:48 | router |
585-
| react-use-router.js:20:43:20:54 | router.query |
586-
| react-use-router.js:20:43:20:54 | router.query |
587-
| react-use-router.js:20:43:20:61 | router.query.foobar |
588-
| react-use-router.js:20:43:20:61 | router.query.foobar |
582+
| react-use-router.js:11:24:11:29 | router |
583+
| react-use-router.js:11:24:11:35 | router.query |
584+
| react-use-router.js:11:24:11:35 | router.query |
585+
| react-use-router.js:11:24:11:42 | router.query.foobar |
586+
| react-use-router.js:11:24:11:42 | router.query.foobar |
587+
| react-use-router.js:22:15:22:24 | router |
588+
| react-use-router.js:22:17:22:22 | router |
589+
| react-use-router.js:23:43:23:48 | router |
590+
| react-use-router.js:23:43:23:54 | router.query |
591+
| react-use-router.js:23:43:23:54 | router.query |
592+
| react-use-router.js:23:43:23:61 | router.query.foobar |
593+
| react-use-router.js:23:43:23:61 | router.query.foobar |
589594
| react-use-state.js:4:9:4:49 | state |
590595
| react-use-state.js:4:9:4:49 | state |
591596
| react-use-state.js:4:10:4:14 | state |
@@ -1777,21 +1782,27 @@ edges
17771782
| react-use-context.js:10:22:10:32 | window.name | react-use-context.js:10:22:10:32 | window.name |
17781783
| react-use-context.js:16:26:16:36 | window.name | react-use-context.js:16:26:16:36 | window.name |
17791784
| react-use-router.js:4:9:4:28 | router | react-use-router.js:8:21:8:26 | router |
1785+
| react-use-router.js:4:9:4:28 | router | react-use-router.js:11:24:11:29 | router |
17801786
| react-use-router.js:4:18:4:28 | useRouter() | react-use-router.js:4:9:4:28 | router |
17811787
| react-use-router.js:8:21:8:26 | router | react-use-router.js:8:21:8:32 | router.query |
17821788
| react-use-router.js:8:21:8:32 | router.query | react-use-router.js:8:21:8:39 | router.query.foobar |
17831789
| react-use-router.js:8:21:8:32 | router.query | react-use-router.js:8:21:8:39 | router.query.foobar |
17841790
| react-use-router.js:8:21:8:32 | router.query | react-use-router.js:8:21:8:39 | router.query.foobar |
17851791
| react-use-router.js:8:21:8:32 | router.query | react-use-router.js:8:21:8:39 | router.query.foobar |
17861792
| react-use-router.js:8:21:8:39 | router.query.foobar | react-use-router.js:4:18:4:28 | useRouter() |
1787-
| react-use-router.js:19:15:19:24 | router | react-use-router.js:20:43:20:48 | router |
1788-
| react-use-router.js:19:17:19:22 | router | react-use-router.js:19:15:19:24 | router |
1789-
| react-use-router.js:20:43:20:48 | router | react-use-router.js:20:43:20:54 | router.query |
1790-
| react-use-router.js:20:43:20:54 | router.query | react-use-router.js:20:43:20:61 | router.query.foobar |
1791-
| react-use-router.js:20:43:20:54 | router.query | react-use-router.js:20:43:20:61 | router.query.foobar |
1792-
| react-use-router.js:20:43:20:54 | router.query | react-use-router.js:20:43:20:61 | router.query.foobar |
1793-
| react-use-router.js:20:43:20:54 | router.query | react-use-router.js:20:43:20:61 | router.query.foobar |
1794-
| react-use-router.js:20:43:20:61 | router.query.foobar | react-use-router.js:19:17:19:22 | router |
1793+
| react-use-router.js:11:24:11:29 | router | react-use-router.js:11:24:11:35 | router.query |
1794+
| react-use-router.js:11:24:11:35 | router.query | react-use-router.js:11:24:11:42 | router.query.foobar |
1795+
| react-use-router.js:11:24:11:35 | router.query | react-use-router.js:11:24:11:42 | router.query.foobar |
1796+
| react-use-router.js:11:24:11:35 | router.query | react-use-router.js:11:24:11:42 | router.query.foobar |
1797+
| react-use-router.js:11:24:11:35 | router.query | react-use-router.js:11:24:11:42 | router.query.foobar |
1798+
| react-use-router.js:22:15:22:24 | router | react-use-router.js:23:43:23:48 | router |
1799+
| react-use-router.js:22:17:22:22 | router | react-use-router.js:22:15:22:24 | router |
1800+
| react-use-router.js:23:43:23:48 | router | react-use-router.js:23:43:23:54 | router.query |
1801+
| react-use-router.js:23:43:23:54 | router.query | react-use-router.js:23:43:23:61 | router.query.foobar |
1802+
| react-use-router.js:23:43:23:54 | router.query | react-use-router.js:23:43:23:61 | router.query.foobar |
1803+
| react-use-router.js:23:43:23:54 | router.query | react-use-router.js:23:43:23:61 | router.query.foobar |
1804+
| react-use-router.js:23:43:23:54 | router.query | react-use-router.js:23:43:23:61 | router.query.foobar |
1805+
| react-use-router.js:23:43:23:61 | router.query.foobar | react-use-router.js:22:17:22:22 | router |
17951806
| react-use-state.js:4:9:4:49 | state | react-use-state.js:5:51:5:55 | state |
17961807
| react-use-state.js:4:9:4:49 | state | react-use-state.js:5:51:5:55 | state |
17971808
| react-use-state.js:4:9:4:49 | state | react-use-state.js:5:51:5:55 | state |

‎javascript/ql/test/query-tests/Security/CWE-079/DomBasedXss/react-use-router.js

Lines changed: 4 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -7,6 +7,9 @@ export function nextRouter() {
77
<span onClick={() => {
88
router.push(router.query.foobar) // NOT OK
99
}}>Click to XSS 1</span>
10+
<span onClick={() => {
11+
router.replace(router.query.foobar) // NOT OK
12+
}}>Click to XSS 2</span>
1013
<span onClick={() => {
1114
router.push('/?foobar=' + router.query.foobar) // OK
1215
}}>Safe Link</span>
@@ -17,6 +20,6 @@ export function nextRouter() {
1720
import { withRouter } from 'next/router'
1821

1922
function Page({ router }) {
20-
return <span onClick={() => router.push(router.query.foobar)}>Click to XSS 2</span> // NOT OK
23+
return <span onClick={() => router.push(router.query.foobar)}>Click to XSS 3</span> // NOT OK
2124
}
2225
export const pageWithRouter = withRouter(Page);

0 commit comments

Comments
 (0)