Skip to content

Commit 4991f3f

Browse files
erik-krogherik-krogh
committed
add client-side-url sinks that may execute JavaScript as XSS sinks
1 parent bddc571 commit 4991f3f

File tree

5 files changed

+203
-13
lines changed

5 files changed

+203
-13
lines changed

‎javascript/ql/lib/semmle/javascript/security/dataflow/Xss.qll

Lines changed: 9 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -250,6 +250,15 @@ module DomBasedXss {
250250
}
251251
}
252252

253+
import ClientSideUrlRedirectCustomizations::ClientSideUrlRedirect as ClientSideUrlRedirect
254+
255+
/**
256+
* A write to a URL which may execute JavaScript code.
257+
*/
258+
class WriteURLSink extends Sink instanceof ClientSideUrlRedirect::Sink {
259+
WriteURLSink() { super.isXSSSink() }
260+
}
261+
253262
/**
254263
* An expression whose value is interpreted as HTML or CSS
255264
* and may be inserted into the DOM.

‎javascript/ql/test/query-tests/Security/CWE-079/DomBasedXss/Xss.expected

Lines changed: 97 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -432,6 +432,26 @@ nodes
432432
| trusted-types.js:2:71:2:71 | x |
433433
| trusted-types.js:3:24:3:34 | window.name |
434434
| trusted-types.js:3:24:3:34 | window.name |
435+
| tst3.js:2:12:2:75 | JSON.pa ... tr(1))) |
436+
| tst3.js:2:23:2:74 | decodeU ... str(1)) |
437+
| tst3.js:2:42:2:63 | window. ... .search |
438+
| tst3.js:2:42:2:63 | window. ... .search |
439+
| tst3.js:2:42:2:73 | window. ... bstr(1) |
440+
| tst3.js:4:25:4:28 | data |
441+
| tst3.js:4:25:4:32 | data.src |
442+
| tst3.js:4:25:4:32 | data.src |
443+
| tst3.js:5:26:5:29 | data |
444+
| tst3.js:5:26:5:31 | data.p |
445+
| tst3.js:5:26:5:31 | data.p |
446+
| tst3.js:7:32:7:35 | data |
447+
| tst3.js:7:32:7:37 | data.p |
448+
| tst3.js:7:32:7:37 | data.p |
449+
| tst3.js:9:37:9:40 | data |
450+
| tst3.js:9:37:9:42 | data.p |
451+
| tst3.js:9:37:9:42 | data.p |
452+
| tst3.js:10:38:10:41 | data |
453+
| tst3.js:10:38:10:43 | data.p |
454+
| tst3.js:10:38:10:43 | data.p |
435455
| tst.js:2:7:2:39 | target |
436456
| tst.js:2:7:2:39 | target |
437457
| tst.js:2:16:2:39 | documen ... .search |
@@ -732,6 +752,29 @@ nodes
732752
| tst.js:465:19:465:24 | source |
733753
| tst.js:467:20:467:25 | source |
734754
| tst.js:467:20:467:25 | source |
755+
| tst.js:471:7:471:46 | url |
756+
| tst.js:471:13:471:36 | documen ... .search |
757+
| tst.js:471:13:471:36 | documen ... .search |
758+
| tst.js:471:13:471:46 | documen ... bstr(1) |
759+
| tst.js:473:19:473:21 | url |
760+
| tst.js:473:19:473:21 | url |
761+
| tst.js:474:26:474:28 | url |
762+
| tst.js:474:26:474:28 | url |
763+
| tst.js:475:25:475:27 | url |
764+
| tst.js:475:25:475:27 | url |
765+
| tst.js:476:20:476:22 | url |
766+
| tst.js:476:20:476:22 | url |
767+
| tst.js:479:20:479:45 | "http:/ ... " + url |
768+
| tst.js:479:20:479:45 | "http:/ ... " + url |
769+
| tst.js:479:43:479:45 | url |
770+
| tst.js:481:20:481:45 | ["http: ... ", url] |
771+
| tst.js:481:20:481:55 | ["http: ... in("/") |
772+
| tst.js:481:20:481:55 | ["http: ... in("/") |
773+
| tst.js:481:42:481:44 | url |
774+
| tst.js:484:22:484:24 | url |
775+
| tst.js:484:22:484:24 | url |
776+
| tst.js:486:22:486:24 | url |
777+
| tst.js:486:22:486:24 | url |
735778
| typeahead.js:20:13:20:45 | target |
736779
| typeahead.js:20:22:20:45 | documen ... .search |
737780
| typeahead.js:20:22:20:45 | documen ... .search |
@@ -1172,6 +1215,25 @@ edges
11721215
| trusted-types.js:2:66:2:66 | x | trusted-types.js:2:71:2:71 | x |
11731216
| trusted-types.js:3:24:3:34 | window.name | trusted-types.js:2:66:2:66 | x |
11741217
| trusted-types.js:3:24:3:34 | window.name | trusted-types.js:2:66:2:66 | x |
1218+
| tst3.js:2:12:2:75 | JSON.pa ... tr(1))) | tst3.js:4:25:4:28 | data |
1219+
| tst3.js:2:12:2:75 | JSON.pa ... tr(1))) | tst3.js:5:26:5:29 | data |
1220+
| tst3.js:2:12:2:75 | JSON.pa ... tr(1))) | tst3.js:7:32:7:35 | data |
1221+
| tst3.js:2:12:2:75 | JSON.pa ... tr(1))) | tst3.js:9:37:9:40 | data |
1222+
| tst3.js:2:12:2:75 | JSON.pa ... tr(1))) | tst3.js:10:38:10:41 | data |
1223+
| tst3.js:2:23:2:74 | decodeU ... str(1)) | tst3.js:2:12:2:75 | JSON.pa ... tr(1))) |
1224+
| tst3.js:2:42:2:63 | window. ... .search | tst3.js:2:42:2:73 | window. ... bstr(1) |
1225+
| tst3.js:2:42:2:63 | window. ... .search | tst3.js:2:42:2:73 | window. ... bstr(1) |
1226+
| tst3.js:2:42:2:73 | window. ... bstr(1) | tst3.js:2:23:2:74 | decodeU ... str(1)) |
1227+
| tst3.js:4:25:4:28 | data | tst3.js:4:25:4:32 | data.src |
1228+
| tst3.js:4:25:4:28 | data | tst3.js:4:25:4:32 | data.src |
1229+
| tst3.js:5:26:5:29 | data | tst3.js:5:26:5:31 | data.p |
1230+
| tst3.js:5:26:5:29 | data | tst3.js:5:26:5:31 | data.p |
1231+
| tst3.js:7:32:7:35 | data | tst3.js:7:32:7:37 | data.p |
1232+
| tst3.js:7:32:7:35 | data | tst3.js:7:32:7:37 | data.p |
1233+
| tst3.js:9:37:9:40 | data | tst3.js:9:37:9:42 | data.p |
1234+
| tst3.js:9:37:9:40 | data | tst3.js:9:37:9:42 | data.p |
1235+
| tst3.js:10:38:10:41 | data | tst3.js:10:38:10:43 | data.p |
1236+
| tst3.js:10:38:10:41 | data | tst3.js:10:38:10:43 | data.p |
11751237
| tst.js:2:7:2:39 | target | tst.js:5:18:5:23 | target |
11761238
| tst.js:2:7:2:39 | target | tst.js:5:18:5:23 | target |
11771239
| tst.js:2:7:2:39 | target | tst.js:12:28:12:33 | target |
@@ -1426,6 +1488,28 @@ edges
14261488
| tst.js:460:6:460:38 | source | tst.js:467:20:467:25 | source |
14271489
| tst.js:460:15:460:38 | documen ... .search | tst.js:460:6:460:38 | source |
14281490
| tst.js:460:15:460:38 | documen ... .search | tst.js:460:6:460:38 | source |
1491+
| tst.js:471:7:471:46 | url | tst.js:473:19:473:21 | url |
1492+
| tst.js:471:7:471:46 | url | tst.js:473:19:473:21 | url |
1493+
| tst.js:471:7:471:46 | url | tst.js:474:26:474:28 | url |
1494+
| tst.js:471:7:471:46 | url | tst.js:474:26:474:28 | url |
1495+
| tst.js:471:7:471:46 | url | tst.js:475:25:475:27 | url |
1496+
| tst.js:471:7:471:46 | url | tst.js:475:25:475:27 | url |
1497+
| tst.js:471:7:471:46 | url | tst.js:476:20:476:22 | url |
1498+
| tst.js:471:7:471:46 | url | tst.js:476:20:476:22 | url |
1499+
| tst.js:471:7:471:46 | url | tst.js:479:43:479:45 | url |
1500+
| tst.js:471:7:471:46 | url | tst.js:481:42:481:44 | url |
1501+
| tst.js:471:7:471:46 | url | tst.js:484:22:484:24 | url |
1502+
| tst.js:471:7:471:46 | url | tst.js:484:22:484:24 | url |
1503+
| tst.js:471:7:471:46 | url | tst.js:486:22:486:24 | url |
1504+
| tst.js:471:7:471:46 | url | tst.js:486:22:486:24 | url |
1505+
| tst.js:471:13:471:36 | documen ... .search | tst.js:471:13:471:46 | documen ... bstr(1) |
1506+
| tst.js:471:13:471:36 | documen ... .search | tst.js:471:13:471:46 | documen ... bstr(1) |
1507+
| tst.js:471:13:471:46 | documen ... bstr(1) | tst.js:471:7:471:46 | url |
1508+
| tst.js:479:43:479:45 | url | tst.js:479:20:479:45 | "http:/ ... " + url |
1509+
| tst.js:479:43:479:45 | url | tst.js:479:20:479:45 | "http:/ ... " + url |
1510+
| tst.js:481:20:481:45 | ["http: ... ", url] | tst.js:481:20:481:55 | ["http: ... in("/") |
1511+
| tst.js:481:20:481:45 | ["http: ... ", url] | tst.js:481:20:481:55 | ["http: ... in("/") |
1512+
| tst.js:481:42:481:44 | url | tst.js:481:20:481:45 | ["http: ... ", url] |
14291513
| typeahead.js:20:13:20:45 | target | typeahead.js:21:12:21:17 | target |
14301514
| typeahead.js:20:22:20:45 | documen ... .search | typeahead.js:20:13:20:45 | target |
14311515
| typeahead.js:20:22:20:45 | documen ... .search | typeahead.js:20:13:20:45 | target |
@@ -1583,6 +1667,11 @@ edges
15831667
| tooltip.jsx:11:25:11:30 | source | tooltip.jsx:6:20:6:30 | window.name | tooltip.jsx:11:25:11:30 | source | Cross-site scripting vulnerability due to $@. | tooltip.jsx:6:20:6:30 | window.name | user-provided value |
15841668
| translate.js:9:27:9:50 | searchP ... 'term') | translate.js:6:16:6:39 | documen ... .search | translate.js:9:27:9:50 | searchP ... 'term') | Cross-site scripting vulnerability due to $@. | translate.js:6:16:6:39 | documen ... .search | user-provided value |
15851669
| trusted-types.js:2:71:2:71 | x | trusted-types.js:3:24:3:34 | window.name | trusted-types.js:2:71:2:71 | x | Cross-site scripting vulnerability due to $@. | trusted-types.js:3:24:3:34 | window.name | user-provided value |
1670+
| tst3.js:4:25:4:32 | data.src | tst3.js:2:42:2:63 | window. ... .search | tst3.js:4:25:4:32 | data.src | Cross-site scripting vulnerability due to $@. | tst3.js:2:42:2:63 | window. ... .search | user-provided value |
1671+
| tst3.js:5:26:5:31 | data.p | tst3.js:2:42:2:63 | window. ... .search | tst3.js:5:26:5:31 | data.p | Cross-site scripting vulnerability due to $@. | tst3.js:2:42:2:63 | window. ... .search | user-provided value |
1672+
| tst3.js:7:32:7:37 | data.p | tst3.js:2:42:2:63 | window. ... .search | tst3.js:7:32:7:37 | data.p | Cross-site scripting vulnerability due to $@. | tst3.js:2:42:2:63 | window. ... .search | user-provided value |
1673+
| tst3.js:9:37:9:42 | data.p | tst3.js:2:42:2:63 | window. ... .search | tst3.js:9:37:9:42 | data.p | Cross-site scripting vulnerability due to $@. | tst3.js:2:42:2:63 | window. ... .search | user-provided value |
1674+
| tst3.js:10:38:10:43 | data.p | tst3.js:2:42:2:63 | window. ... .search | tst3.js:10:38:10:43 | data.p | Cross-site scripting vulnerability due to $@. | tst3.js:2:42:2:63 | window. ... .search | user-provided value |
15861675
| tst.js:5:18:5:23 | target | tst.js:2:16:2:39 | documen ... .search | tst.js:5:18:5:23 | target | Cross-site scripting vulnerability due to $@. | tst.js:2:16:2:39 | documen ... .search | user-provided value |
15871676
| tst.js:8:18:8:126 | "<OPTIO ... PTION>" | tst.js:8:37:8:58 | documen ... on.href | tst.js:8:18:8:126 | "<OPTIO ... PTION>" | Cross-site scripting vulnerability due to $@. | tst.js:8:37:8:58 | documen ... on.href | user-provided value |
15881677
| tst.js:12:5:12:42 | '<div s ... 'px">' | tst.js:2:16:2:39 | documen ... .search | tst.js:12:5:12:42 | '<div s ... 'px">' | Cross-site scripting vulnerability due to $@. | tst.js:2:16:2:39 | documen ... .search | user-provided value |
@@ -1665,6 +1754,14 @@ edges
16651754
| tst.js:463:21:463:26 | source | tst.js:460:15:460:38 | documen ... .search | tst.js:463:21:463:26 | source | Cross-site scripting vulnerability due to $@. | tst.js:460:15:460:38 | documen ... .search | user-provided value |
16661755
| tst.js:465:19:465:24 | source | tst.js:460:15:460:38 | documen ... .search | tst.js:465:19:465:24 | source | Cross-site scripting vulnerability due to $@. | tst.js:460:15:460:38 | documen ... .search | user-provided value |
16671756
| tst.js:467:20:467:25 | source | tst.js:460:15:460:38 | documen ... .search | tst.js:467:20:467:25 | source | Cross-site scripting vulnerability due to $@. | tst.js:460:15:460:38 | documen ... .search | user-provided value |
1757+
| tst.js:473:19:473:21 | url | tst.js:471:13:471:36 | documen ... .search | tst.js:473:19:473:21 | url | Cross-site scripting vulnerability due to $@. | tst.js:471:13:471:36 | documen ... .search | user-provided value |
1758+
| tst.js:474:26:474:28 | url | tst.js:471:13:471:36 | documen ... .search | tst.js:474:26:474:28 | url | Cross-site scripting vulnerability due to $@. | tst.js:471:13:471:36 | documen ... .search | user-provided value |
1759+
| tst.js:475:25:475:27 | url | tst.js:471:13:471:36 | documen ... .search | tst.js:475:25:475:27 | url | Cross-site scripting vulnerability due to $@. | tst.js:471:13:471:36 | documen ... .search | user-provided value |
1760+
| tst.js:476:20:476:22 | url | tst.js:471:13:471:36 | documen ... .search | tst.js:476:20:476:22 | url | Cross-site scripting vulnerability due to $@. | tst.js:471:13:471:36 | documen ... .search | user-provided value |
1761+
| tst.js:479:20:479:45 | "http:/ ... " + url | tst.js:471:13:471:36 | documen ... .search | tst.js:479:20:479:45 | "http:/ ... " + url | Cross-site scripting vulnerability due to $@. | tst.js:471:13:471:36 | documen ... .search | user-provided value |
1762+
| tst.js:481:20:481:55 | ["http: ... in("/") | tst.js:471:13:471:36 | documen ... .search | tst.js:481:20:481:55 | ["http: ... in("/") | Cross-site scripting vulnerability due to $@. | tst.js:471:13:471:36 | documen ... .search | user-provided value |
1763+
| tst.js:484:22:484:24 | url | tst.js:471:13:471:36 | documen ... .search | tst.js:484:22:484:24 | url | Cross-site scripting vulnerability due to $@. | tst.js:471:13:471:36 | documen ... .search | user-provided value |
1764+
| tst.js:486:22:486:24 | url | tst.js:471:13:471:36 | documen ... .search | tst.js:486:22:486:24 | url | Cross-site scripting vulnerability due to $@. | tst.js:471:13:471:36 | documen ... .search | user-provided value |
16681765
| typeahead.js:25:18:25:20 | val | typeahead.js:20:22:20:45 | documen ... .search | typeahead.js:25:18:25:20 | val | Cross-site scripting vulnerability due to $@. | typeahead.js:20:22:20:45 | documen ... .search | user-provided value |
16691766
| v-html.vue:2:8:2:23 | v-html=tainted | v-html.vue:6:42:6:58 | document.location | v-html.vue:2:8:2:23 | v-html=tainted | Cross-site scripting vulnerability due to $@. | v-html.vue:6:42:6:58 | document.location | user-provided value |
16701767
| various-concat-obfuscations.js:4:4:4:31 | "<div>" ... </div>" | various-concat-obfuscations.js:2:16:2:39 | documen ... .search | various-concat-obfuscations.js:4:4:4:31 | "<div>" ... </div>" | Cross-site scripting vulnerability due to $@. | various-concat-obfuscations.js:2:16:2:39 | documen ... .search | user-provided value |

‎javascript/ql/test/query-tests/Security/CWE-079/DomBasedXss/XssWithAdditionalSources.expected

Lines changed: 84 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -439,6 +439,26 @@ nodes
439439
| trusted-types.js:2:71:2:71 | x |
440440
| trusted-types.js:3:24:3:34 | window.name |
441441
| trusted-types.js:3:24:3:34 | window.name |
442+
| tst3.js:2:12:2:75 | JSON.pa ... tr(1))) |
443+
| tst3.js:2:23:2:74 | decodeU ... str(1)) |
444+
| tst3.js:2:42:2:63 | window. ... .search |
445+
| tst3.js:2:42:2:63 | window. ... .search |
446+
| tst3.js:2:42:2:73 | window. ... bstr(1) |
447+
| tst3.js:4:25:4:28 | data |
448+
| tst3.js:4:25:4:32 | data.src |
449+
| tst3.js:4:25:4:32 | data.src |
450+
| tst3.js:5:26:5:29 | data |
451+
| tst3.js:5:26:5:31 | data.p |
452+
| tst3.js:5:26:5:31 | data.p |
453+
| tst3.js:7:32:7:35 | data |
454+
| tst3.js:7:32:7:37 | data.p |
455+
| tst3.js:7:32:7:37 | data.p |
456+
| tst3.js:9:37:9:40 | data |
457+
| tst3.js:9:37:9:42 | data.p |
458+
| tst3.js:9:37:9:42 | data.p |
459+
| tst3.js:10:38:10:41 | data |
460+
| tst3.js:10:38:10:43 | data.p |
461+
| tst3.js:10:38:10:43 | data.p |
442462
| tst.js:2:7:2:39 | target |
443463
| tst.js:2:7:2:39 | target |
444464
| tst.js:2:16:2:39 | documen ... .search |
@@ -739,6 +759,29 @@ nodes
739759
| tst.js:465:19:465:24 | source |
740760
| tst.js:467:20:467:25 | source |
741761
| tst.js:467:20:467:25 | source |
762+
| tst.js:471:7:471:46 | url |
763+
| tst.js:471:13:471:36 | documen ... .search |
764+
| tst.js:471:13:471:36 | documen ... .search |
765+
| tst.js:471:13:471:46 | documen ... bstr(1) |
766+
| tst.js:473:19:473:21 | url |
767+
| tst.js:473:19:473:21 | url |
768+
| tst.js:474:26:474:28 | url |
769+
| tst.js:474:26:474:28 | url |
770+
| tst.js:475:25:475:27 | url |
771+
| tst.js:475:25:475:27 | url |
772+
| tst.js:476:20:476:22 | url |
773+
| tst.js:476:20:476:22 | url |
774+
| tst.js:479:20:479:45 | "http:/ ... " + url |
775+
| tst.js:479:20:479:45 | "http:/ ... " + url |
776+
| tst.js:479:43:479:45 | url |
777+
| tst.js:481:20:481:45 | ["http: ... ", url] |
778+
| tst.js:481:20:481:55 | ["http: ... in("/") |
779+
| tst.js:481:20:481:55 | ["http: ... in("/") |
780+
| tst.js:481:42:481:44 | url |
781+
| tst.js:484:22:484:24 | url |
782+
| tst.js:484:22:484:24 | url |
783+
| tst.js:486:22:486:24 | url |
784+
| tst.js:486:22:486:24 | url |
742785
| typeahead.js:9:28:9:30 | loc |
743786
| typeahead.js:9:28:9:30 | loc |
744787
| typeahead.js:10:16:10:18 | loc |
@@ -1207,6 +1250,25 @@ edges
12071250
| trusted-types.js:2:66:2:66 | x | trusted-types.js:2:71:2:71 | x |
12081251
| trusted-types.js:3:24:3:34 | window.name | trusted-types.js:2:66:2:66 | x |
12091252
| trusted-types.js:3:24:3:34 | window.name | trusted-types.js:2:66:2:66 | x |
1253+
| tst3.js:2:12:2:75 | JSON.pa ... tr(1))) | tst3.js:4:25:4:28 | data |
1254+
| tst3.js:2:12:2:75 | JSON.pa ... tr(1))) | tst3.js:5:26:5:29 | data |
1255+
| tst3.js:2:12:2:75 | JSON.pa ... tr(1))) | tst3.js:7:32:7:35 | data |
1256+
| tst3.js:2:12:2:75 | JSON.pa ... tr(1))) | tst3.js:9:37:9:40 | data |
1257+
| tst3.js:2:12:2:75 | JSON.pa ... tr(1))) | tst3.js:10:38:10:41 | data |
1258+
| tst3.js:2:23:2:74 | decodeU ... str(1)) | tst3.js:2:12:2:75 | JSON.pa ... tr(1))) |
1259+
| tst3.js:2:42:2:63 | window. ... .search | tst3.js:2:42:2:73 | window. ... bstr(1) |
1260+
| tst3.js:2:42:2:63 | window. ... .search | tst3.js:2:42:2:73 | window. ... bstr(1) |
1261+
| tst3.js:2:42:2:73 | window. ... bstr(1) | tst3.js:2:23:2:74 | decodeU ... str(1)) |
1262+
| tst3.js:4:25:4:28 | data | tst3.js:4:25:4:32 | data.src |
1263+
| tst3.js:4:25:4:28 | data | tst3.js:4:25:4:32 | data.src |
1264+
| tst3.js:5:26:5:29 | data | tst3.js:5:26:5:31 | data.p |
1265+
| tst3.js:5:26:5:29 | data | tst3.js:5:26:5:31 | data.p |
1266+
| tst3.js:7:32:7:35 | data | tst3.js:7:32:7:37 | data.p |
1267+
| tst3.js:7:32:7:35 | data | tst3.js:7:32:7:37 | data.p |
1268+
| tst3.js:9:37:9:40 | data | tst3.js:9:37:9:42 | data.p |
1269+
| tst3.js:9:37:9:40 | data | tst3.js:9:37:9:42 | data.p |
1270+
| tst3.js:10:38:10:41 | data | tst3.js:10:38:10:43 | data.p |
1271+
| tst3.js:10:38:10:41 | data | tst3.js:10:38:10:43 | data.p |
12101272
| tst.js:2:7:2:39 | target | tst.js:5:18:5:23 | target |
12111273
| tst.js:2:7:2:39 | target | tst.js:5:18:5:23 | target |
12121274
| tst.js:2:7:2:39 | target | tst.js:12:28:12:33 | target |
@@ -1461,6 +1523,28 @@ edges
14611523
| tst.js:460:6:460:38 | source | tst.js:467:20:467:25 | source |
14621524
| tst.js:460:15:460:38 | documen ... .search | tst.js:460:6:460:38 | source |
14631525
| tst.js:460:15:460:38 | documen ... .search | tst.js:460:6:460:38 | source |
1526+
| tst.js:471:7:471:46 | url | tst.js:473:19:473:21 | url |
1527+
| tst.js:471:7:471:46 | url | tst.js:473:19:473:21 | url |
1528+
| tst.js:471:7:471:46 | url | tst.js:474:26:474:28 | url |
1529+
| tst.js:471:7:471:46 | url | tst.js:474:26:474:28 | url |
1530+
| tst.js:471:7:471:46 | url | tst.js:475:25:475:27 | url |
1531+
| tst.js:471:7:471:46 | url | tst.js:475:25:475:27 | url |
1532+
| tst.js:471:7:471:46 | url | tst.js:476:20:476:22 | url |
1533+
| tst.js:471:7:471:46 | url | tst.js:476:20:476:22 | url |
1534+
| tst.js:471:7:471:46 | url | tst.js:479:43:479:45 | url |
1535+
| tst.js:471:7:471:46 | url | tst.js:481:42:481:44 | url |
1536+
| tst.js:471:7:471:46 | url | tst.js:484:22:484:24 | url |
1537+
| tst.js:471:7:471:46 | url | tst.js:484:22:484:24 | url |
1538+
| tst.js:471:7:471:46 | url | tst.js:486:22:486:24 | url |
1539+
| tst.js:471:7:471:46 | url | tst.js:486:22:486:24 | url |
1540+
| tst.js:471:13:471:36 | documen ... .search | tst.js:471:13:471:46 | documen ... bstr(1) |
1541+
| tst.js:471:13:471:36 | documen ... .search | tst.js:471:13:471:46 | documen ... bstr(1) |
1542+
| tst.js:471:13:471:46 | documen ... bstr(1) | tst.js:471:7:471:46 | url |
1543+
| tst.js:479:43:479:45 | url | tst.js:479:20:479:45 | "http:/ ... " + url |
1544+
| tst.js:479:43:479:45 | url | tst.js:479:20:479:45 | "http:/ ... " + url |
1545+
| tst.js:481:20:481:45 | ["http: ... ", url] | tst.js:481:20:481:55 | ["http: ... in("/") |
1546+
| tst.js:481:20:481:45 | ["http: ... ", url] | tst.js:481:20:481:55 | ["http: ... in("/") |
1547+
| tst.js:481:42:481:44 | url | tst.js:481:20:481:45 | ["http: ... ", url] |
14641548
| typeahead.js:9:28:9:30 | loc | typeahead.js:10:16:10:18 | loc |
14651549
| typeahead.js:9:28:9:30 | loc | typeahead.js:10:16:10:18 | loc |
14661550
| typeahead.js:9:28:9:30 | loc | typeahead.js:10:16:10:18 | loc |

‎javascript/ql/test/query-tests/Security/CWE-079/DomBasedXss/tst.js

Lines changed: 8 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -470,20 +470,20 @@ function domMethods() {
470470
function urlStuff() {
471471
var url = document.location.search.substr(1);
472472

473-
$("<a>", {href: url}).appendTo("body"); // NOT OK - but not detected [INCONSISTENCY]
474-
$("#foo").attr("href", url); // NOT OK - but not detected [INCONSISTENCY]
475-
$("#foo").attr({href: url}); // NOT OK - but not detected [INCONSISTENCY]
476-
$("<img>", {src: url}).appendTo("body"); // NOT OK - but not detected [INCONSISTENCY]
473+
$("<a>", {href: url}).appendTo("body"); // NOT OK
474+
$("#foo").attr("href", url); // NOT OK
475+
$("#foo").attr({href: url}); // NOT OK
476+
$("<img>", {src: url}).appendTo("body"); // NOT OK
477477
$("<a>", {href: win.location.href}).appendTo("body"); // OK
478478

479-
$("<img>", {src: "http://google.com/" + url}).appendTo("body"); // OK
479+
$("<img>", {src: "http://google.com/" + url}).appendTo("body"); // OK - but flagged [INCONSISTENCY]
480480

481-
$("<img>", {src: ["http://google.com", url].join("/")}).appendTo("body"); // OK
481+
$("<img>", {src: ["http://google.com", url].join("/")}).appendTo("body"); // OK - but flagged [INCONSISTENCY]
482482

483483
if (url.startsWith("https://")) {
484-
$("<img>", {src: url}).appendTo("body"); // OK
484+
$("<img>", {src: url}).appendTo("body"); // OK - but flagged [INCONSISTENCY]
485485
} else {
486-
$("<img>", {src: url}).appendTo("body"); // NOT OK - but not detected [INCONSISTENCY]
486+
$("<img>", {src: url}).appendTo("body"); // NOT OK
487487
}
488488

489489
window.open(location.hash.substr(1)); // OK - any JavaScript is executed in another context

‎javascript/ql/test/query-tests/Security/CWE-079/DomBasedXss/tst3.js

Lines changed: 5 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -1,13 +1,13 @@
11
var foo = document.getElementById("foo");
22
var data = JSON.parse(decodeURIComponent(window.location.search.substr(1)));
33

4-
foo.setAttribute("src", data.src); // NOT OK - but not detected [INCONSISTENCY]
5-
foo.setAttribute("HREF", data.p); // NOT OK - but not detected [INCONSISTENCY]
4+
foo.setAttribute("src", data.src); // NOT OK
5+
foo.setAttribute("HREF", data.p); // NOT OK
66
foo.setAttribute("width", data.w); // OK
7-
foo.setAttribute("xlink:href", data.p) // NOT OK - but not detected [INCONSISTENCY]
7+
foo.setAttribute("xlink:href", data.p) // NOT OK
88

9-
foo.setAttributeNS('xlink', 'href', data.p); // NOT OK - but not detected [INCONSISTENCY]
10-
foo.setAttributeNS('foobar', 'href', data.p); // NOT OK - but not detected [INCONSISTENCY]
9+
foo.setAttributeNS('xlink', 'href', data.p); // NOT OK
10+
foo.setAttributeNS('foobar', 'href', data.p); // NOT OK
1111
foo.setAttributeNS('baz', 'width', data.w); // OK
1212

1313

0 commit comments

Comments
 (0)