Thanks to visit codestin.com
Credit goes to github.com

Skip to content

Commit 0ddb1c8

Browse files
asgerfasgerf
committed
JS: Test update indicating a problem with .split()
1 parent e0ca1b0 commit 0ddb1c8

3 files changed

Lines changed: 12 additions & 1 deletion

File tree

‎javascript/ql/test/query-tests/Security/CWE-079/DomBasedXss/Xss.expected‎

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -514,6 +514,9 @@ nodes
514514
| tst.js:371:7:371:39 | target | semmle.label | target |
515515
| tst.js:371:16:371:39 | documen ... .search | semmle.label | documen ... .search |
516516
| tst.js:374:18:374:23 | target | semmle.label | target |
517+
| tst.js:377:18:377:39 | documen ... on.href | semmle.label | documen ... on.href |
518+
| tst.js:377:18:377:50 | documen ... it("?") [ArrayElement] | semmle.label | documen ... it("?") [ArrayElement] |
519+
| tst.js:377:18:377:53 | documen ... "?")[0] | semmle.label | documen ... "?")[0] |
517520
| tst.js:381:7:381:39 | target | semmle.label | target |
518521
| tst.js:381:7:381:39 | target [taint3] | semmle.label | target [taint3] |
519522
| tst.js:381:7:381:39 | target [taint8] | semmle.label | target [taint8] |
@@ -1112,6 +1115,8 @@ edges
11121115
| tst.js:355:19:355:42 | documen ... .search | tst.js:355:10:355:42 | target | provenance | |
11131116
| tst.js:371:7:371:39 | target | tst.js:374:18:374:23 | target | provenance | |
11141117
| tst.js:371:16:371:39 | documen ... .search | tst.js:371:7:371:39 | target | provenance | |
1118+
| tst.js:377:18:377:39 | documen ... on.href | tst.js:377:18:377:50 | documen ... it("?") [ArrayElement] | provenance | |
1119+
| tst.js:377:18:377:50 | documen ... it("?") [ArrayElement] | tst.js:377:18:377:53 | documen ... "?")[0] | provenance | |
11151120
| tst.js:381:7:381:39 | target | tst.js:384:18:384:23 | target | provenance | |
11161121
| tst.js:381:7:381:39 | target | tst.js:386:18:386:23 | target | provenance | |
11171122
| tst.js:381:7:381:39 | target | tst.js:397:18:397:23 | target | provenance | |
@@ -1455,6 +1460,7 @@ subpaths
14551460
| tst.js:360:21:360:26 | target | tst.js:355:19:355:42 | documen ... .search | tst.js:360:21:360:26 | target | Cross-site scripting vulnerability due to $@. | tst.js:355:19:355:42 | documen ... .search | user-provided value |
14561461
| tst.js:363:18:363:23 | target | tst.js:355:19:355:42 | documen ... .search | tst.js:363:18:363:23 | target | Cross-site scripting vulnerability due to $@. | tst.js:355:19:355:42 | documen ... .search | user-provided value |
14571462
| tst.js:374:18:374:23 | target | tst.js:371:16:371:39 | documen ... .search | tst.js:374:18:374:23 | target | Cross-site scripting vulnerability due to $@. | tst.js:371:16:371:39 | documen ... .search | user-provided value |
1463+
| tst.js:377:18:377:53 | documen ... "?")[0] | tst.js:377:18:377:39 | documen ... on.href | tst.js:377:18:377:53 | documen ... "?")[0] | Cross-site scripting vulnerability due to $@. | tst.js:377:18:377:39 | documen ... on.href | user-provided value |
14581464
| tst.js:384:18:384:23 | target | tst.js:381:16:381:39 | documen ... .search | tst.js:384:18:384:23 | target | Cross-site scripting vulnerability due to $@. | tst.js:381:16:381:39 | documen ... .search | user-provided value |
14591465
| tst.js:386:18:386:29 | target.taint | tst.js:381:16:381:39 | documen ... .search | tst.js:386:18:386:29 | target.taint | Cross-site scripting vulnerability due to $@. | tst.js:381:16:381:39 | documen ... .search | user-provided value |
14601466
| tst.js:392:18:392:30 | target.taint3 | tst.js:391:19:391:42 | documen ... .search | tst.js:392:18:392:30 | target.taint3 | Cross-site scripting vulnerability due to $@. | tst.js:391:19:391:42 | documen ... .search | user-provided value |

‎javascript/ql/test/query-tests/Security/CWE-079/DomBasedXss/XssWithAdditionalSources.expected‎

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -519,6 +519,9 @@ nodes
519519
| tst.js:371:7:371:39 | target | semmle.label | target |
520520
| tst.js:371:16:371:39 | documen ... .search | semmle.label | documen ... .search |
521521
| tst.js:374:18:374:23 | target | semmle.label | target |
522+
| tst.js:377:18:377:39 | documen ... on.href | semmle.label | documen ... on.href |
523+
| tst.js:377:18:377:50 | documen ... it("?") [ArrayElement] | semmle.label | documen ... it("?") [ArrayElement] |
524+
| tst.js:377:18:377:53 | documen ... "?")[0] | semmle.label | documen ... "?")[0] |
522525
| tst.js:381:7:381:39 | target | semmle.label | target |
523526
| tst.js:381:7:381:39 | target [taint3] | semmle.label | target [taint3] |
524527
| tst.js:381:7:381:39 | target [taint8] | semmle.label | target [taint8] |
@@ -1137,6 +1140,8 @@ edges
11371140
| tst.js:355:19:355:42 | documen ... .search | tst.js:355:10:355:42 | target | provenance | |
11381141
| tst.js:371:7:371:39 | target | tst.js:374:18:374:23 | target | provenance | |
11391142
| tst.js:371:16:371:39 | documen ... .search | tst.js:371:7:371:39 | target | provenance | |
1143+
| tst.js:377:18:377:39 | documen ... on.href | tst.js:377:18:377:50 | documen ... it("?") [ArrayElement] | provenance | |
1144+
| tst.js:377:18:377:50 | documen ... it("?") [ArrayElement] | tst.js:377:18:377:53 | documen ... "?")[0] | provenance | |
11401145
| tst.js:381:7:381:39 | target | tst.js:384:18:384:23 | target | provenance | |
11411146
| tst.js:381:7:381:39 | target | tst.js:386:18:386:23 | target | provenance | |
11421147
| tst.js:381:7:381:39 | target | tst.js:397:18:397:23 | target | provenance | |

‎javascript/ql/test/query-tests/Security/CWE-079/DomBasedXss/tst.js‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -373,7 +373,7 @@ function test() {
373373
// NOT OK
374374
$('myId').html(target)
375375

376-
// OK
376+
// OK [INCONSISTENCY] (TODO: fix)
377377
$('myid').html(document.location.href.split("?")[0]);
378378
}
379379

0 commit comments

Comments
 (0)