Thanks to visit codestin.com
Credit goes to github.com

Skip to content

Commit 458dda9

Browse files
erik-krogherik-krogh
committed
add xss-through-dom source from react-final-form
1 parent ff3950c commit 458dda9

3 files changed

Lines changed: 43 additions & 0 deletions

File tree

‎javascript/ql/src/semmle/javascript/security/dataflow/XssThroughDomCustomizations.qll‎

Lines changed: 18 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -136,5 +136,23 @@ module XssThroughDom {
136136
this = formik().getAMemberCall("useFormikContext").getAPropertyRead("values")
137137
}
138138
}
139+
140+
/**
141+
* An object containing input values from a form build with `react-final-form`.
142+
*/
143+
class ReactFinalFormSource extends Source {
144+
ReactFinalFormSource() {
145+
exists(JSXElement elem |
146+
DataFlow::moduleMember("react-final-form", "Form").flowsToExpr(elem.getNameExpr())
147+
|
148+
this =
149+
elem.getAttributeByName("onSubmit")
150+
.getValue()
151+
.flow()
152+
.getAFunctionValue()
153+
.getParameter(0)
154+
)
155+
}
156+
}
139157
}
140158
}

‎javascript/ql/test/query-tests/Security/CWE-079/XssThroughDom/XssThroughDom.expected‎

Lines changed: 10 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -25,6 +25,11 @@ nodes
2525
| forms.js:35:19:35:24 | values |
2626
| forms.js:35:19:35:30 | values.email |
2727
| forms.js:35:19:35:30 | values.email |
28+
| forms.js:44:21:44:26 | values |
29+
| forms.js:44:21:44:26 | values |
30+
| forms.js:45:21:45:26 | values |
31+
| forms.js:45:21:45:33 | values.stooge |
32+
| forms.js:45:21:45:33 | values.stooge |
2833
| xss-through-dom.js:2:16:2:34 | $("textarea").val() |
2934
| xss-through-dom.js:2:16:2:34 | $("textarea").val() |
3035
| xss-through-dom.js:2:16:2:34 | $("textarea").val() |
@@ -97,6 +102,10 @@ edges
97102
| forms.js:34:13:34:18 | values | forms.js:34:11:34:53 | values |
98103
| forms.js:35:19:35:24 | values | forms.js:35:19:35:30 | values.email |
99104
| forms.js:35:19:35:24 | values | forms.js:35:19:35:30 | values.email |
105+
| forms.js:44:21:44:26 | values | forms.js:45:21:45:26 | values |
106+
| forms.js:44:21:44:26 | values | forms.js:45:21:45:26 | values |
107+
| forms.js:45:21:45:26 | values | forms.js:45:21:45:33 | values.stooge |
108+
| forms.js:45:21:45:26 | values | forms.js:45:21:45:33 | values.stooge |
100109
| xss-through-dom.js:2:16:2:34 | $("textarea").val() | xss-through-dom.js:2:16:2:34 | $("textarea").val() |
101110
| xss-through-dom.js:4:16:4:40 | $(".som ... .text() | xss-through-dom.js:4:16:4:40 | $(".som ... .text() |
102111
| xss-through-dom.js:8:16:8:53 | $(".som ... arget") | xss-through-dom.js:8:16:8:53 | $(".som ... arget") |
@@ -122,6 +131,7 @@ edges
122131
| forms.js:25:23:25:34 | values.email | forms.js:24:15:24:20 | values | forms.js:25:23:25:34 | values.email | $@ is reinterpreted as HTML without escaping meta-characters. | forms.js:24:15:24:20 | values | DOM text |
123132
| forms.js:29:23:29:34 | values.email | forms.js:28:20:28:25 | values | forms.js:29:23:29:34 | values.email | $@ is reinterpreted as HTML without escaping meta-characters. | forms.js:28:20:28:25 | values | DOM text |
124133
| forms.js:35:19:35:30 | values.email | forms.js:34:13:34:18 | values | forms.js:35:19:35:30 | values.email | $@ is reinterpreted as HTML without escaping meta-characters. | forms.js:34:13:34:18 | values | DOM text |
134+
| forms.js:45:21:45:33 | values.stooge | forms.js:44:21:44:26 | values | forms.js:45:21:45:33 | values.stooge | $@ is reinterpreted as HTML without escaping meta-characters. | forms.js:44:21:44:26 | values | DOM text |
125135
| xss-through-dom.js:2:16:2:34 | $("textarea").val() | xss-through-dom.js:2:16:2:34 | $("textarea").val() | xss-through-dom.js:2:16:2:34 | $("textarea").val() | $@ is reinterpreted as HTML without escaping meta-characters. | xss-through-dom.js:2:16:2:34 | $("textarea").val() | DOM text |
126136
| xss-through-dom.js:4:16:4:40 | $(".som ... .text() | xss-through-dom.js:4:16:4:40 | $(".som ... .text() | xss-through-dom.js:4:16:4:40 | $(".som ... .text() | $@ is reinterpreted as HTML without escaping meta-characters. | xss-through-dom.js:4:16:4:40 | $(".som ... .text() | DOM text |
127137
| xss-through-dom.js:8:16:8:53 | $(".som ... arget") | xss-through-dom.js:8:16:8:53 | $(".som ... arget") | xss-through-dom.js:8:16:8:53 | $(".som ... arget") | $@ is reinterpreted as HTML without escaping meta-characters. | xss-through-dom.js:8:16:8:53 | $(".som ... arget") | DOM text |

‎javascript/ql/test/query-tests/Security/CWE-079/XssThroughDom/forms.js‎

Lines changed: 15 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -37,3 +37,18 @@ const FormikEnhanced = withFormik({
3737
$("#id").html(submitForm.email); // OK
3838
})
3939

40+
import { Form } from 'react-final-form'
41+
42+
const App = () => (
43+
<Form
44+
onSubmit={async values => {
45+
$("#id").html(values.stooge); // NOT OK
46+
}}
47+
initialValues={{ stooge: 'larry', employed: false }}
48+
render={({ handleSubmit, form, submitting, pristine, values }) => (
49+
<form onSubmit={handleSubmit}>
50+
<input type="text" name="stooge"></input>
51+
</form>
52+
)}
53+
/>
54+
)

0 commit comments

Comments
 (0)