Thanks to visit codestin.com
Credit goes to github.com

Skip to content

Commit 8aa34e6

Browse files
asger-semmleasger-semmle
committed
JS: Add XSS test case for new PostMessageEventHandler cases
1 parent 0ad9067 commit 8aa34e6

2 files changed

Lines changed: 28 additions & 0 deletions

File tree

‎javascript/ql/test/query-tests/Security/CWE-079/Xss.expected‎

Lines changed: 14 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -2,6 +2,13 @@ nodes
22
| addEventListener.js:1:43:1:47 | event |
33
| addEventListener.js:2:20:2:24 | event |
44
| addEventListener.js:2:20:2:29 | event.data |
5+
| addEventListener.js:5:43:5:48 | data |
6+
| addEventListener.js:5:43:5:48 | {data} |
7+
| addEventListener.js:5:44:5:47 | data |
8+
| addEventListener.js:6:20:6:23 | data |
9+
| addEventListener.js:10:21:10:25 | event |
10+
| addEventListener.js:12:24:12:28 | event |
11+
| addEventListener.js:12:24:12:33 | event.data |
512
| jquery.js:2:7:2:40 | tainted |
613
| jquery.js:2:17:2:33 | document.location |
714
| jquery.js:2:17:2:40 | documen ... .search |
@@ -195,6 +202,11 @@ nodes
195202
edges
196203
| addEventListener.js:1:43:1:47 | event | addEventListener.js:2:20:2:24 | event |
197204
| addEventListener.js:2:20:2:24 | event | addEventListener.js:2:20:2:29 | event.data |
205+
| addEventListener.js:5:43:5:48 | data | addEventListener.js:6:20:6:23 | data |
206+
| addEventListener.js:5:43:5:48 | {data} | addEventListener.js:5:44:5:47 | data |
207+
| addEventListener.js:5:44:5:47 | data | addEventListener.js:5:43:5:48 | data |
208+
| addEventListener.js:10:21:10:25 | event | addEventListener.js:12:24:12:28 | event |
209+
| addEventListener.js:12:24:12:28 | event | addEventListener.js:12:24:12:33 | event.data |
198210
| jquery.js:2:7:2:40 | tainted | jquery.js:4:5:4:11 | tainted |
199211
| jquery.js:2:7:2:40 | tainted | jquery.js:7:20:7:26 | tainted |
200212
| jquery.js:2:7:2:40 | tainted | jquery.js:8:28:8:34 | tainted |
@@ -354,6 +366,8 @@ edges
354366
| winjs.js:2:17:2:53 | documen ... ring(1) | winjs.js:2:7:2:53 | tainted |
355367
#select
356368
| addEventListener.js:2:20:2:29 | event.data | addEventListener.js:1:43:1:47 | event | addEventListener.js:2:20:2:29 | event.data | Cross-site scripting vulnerability due to $@. | addEventListener.js:1:43:1:47 | event | user-provided value |
369+
| addEventListener.js:6:20:6:23 | data | addEventListener.js:5:43:5:48 | {data} | addEventListener.js:6:20:6:23 | data | Cross-site scripting vulnerability due to $@. | addEventListener.js:5:43:5:48 | {data} | user-provided value |
370+
| addEventListener.js:12:24:12:33 | event.data | addEventListener.js:10:21:10:25 | event | addEventListener.js:12:24:12:33 | event.data | Cross-site scripting vulnerability due to $@. | addEventListener.js:10:21:10:25 | event | user-provided value |
357371
| jquery.js:4:5:4:11 | tainted | jquery.js:2:17:2:33 | document.location | jquery.js:4:5:4:11 | tainted | Cross-site scripting vulnerability due to $@. | jquery.js:2:17:2:33 | document.location | user-provided value |
358372
| jquery.js:7:5:7:34 | "<div i ... + "\\">" | jquery.js:2:17:2:33 | document.location | jquery.js:7:5:7:34 | "<div i ... + "\\">" | Cross-site scripting vulnerability due to $@. | jquery.js:2:17:2:33 | document.location | user-provided value |
359373
| jquery.js:8:18:8:34 | "XSS: " + tainted | jquery.js:2:17:2:33 | document.location | jquery.js:8:18:8:34 | "XSS: " + tainted | Cross-site scripting vulnerability due to $@. | jquery.js:2:17:2:33 | document.location | user-provided value |

‎javascript/ql/test/query-tests/Security/CWE-079/addEventListener.js‎

Lines changed: 14 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,3 +1,17 @@
11
this.addEventListener('message', function(event) {
22
document.write(event.data); // NOT OK
33
})
4+
5+
this.addEventListener('message', function({data}) {
6+
document.write(data); // NOT OK
7+
})
8+
9+
function test() {
10+
function foo(x, event, y) {
11+
document.write(x.data); // OK
12+
document.write(event.data); // NOT OK
13+
document.write(y.data); // OK
14+
}
15+
16+
window.addEventListener("message", foo.bind(null, {data: 'items'}));
17+
}

0 commit comments

Comments
 (0)