JS: Added test case which is not flagged but should be abusing new RegExp with global flag

Napalys · Napalys · commit 41f21d429ba4 · 2024-11-28T11:26:33.000+01:00
diff --git a/javascript/ql/test/query-tests/Security/CWE-116/IncompleteSanitization/tst.js b/javascript/ql/test/query-tests/Security/CWE-116/IncompleteSanitization/tst.js
@@ -327,4 +327,8 @@ function incompleteComplexSanitizers() {
 		if (str === "\"")
 			return "&quot;";
 	}) + '"';
-}
+}
+
+function typicalBadHtmlSanitizers(s) {
+	s().replace(new RegExp("[<>]", "g"),''); // NOT OK -- should be not okay, but is not flagged
+}
