Thanks to visit codestin.com
Credit goes to github.com

Skip to content

Commit fcfab52

Browse files
asgerfasgerf
committed
JS: Port CodeInjection
1 parent 17233a6 commit fcfab52

4 files changed

Lines changed: 165 additions & 404 deletions

File tree

‎javascript/ql/lib/semmle/javascript/security/dataflow/CodeInjectionQuery.qll‎

Lines changed: 24 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -13,7 +13,28 @@ import CodeInjectionCustomizations::CodeInjection
1313
/**
1414
* A taint-tracking configuration for reasoning about code injection vulnerabilities.
1515
*/
16-
class Configuration extends TaintTracking::Configuration {
16+
module CodeInjectionConfig implements DataFlow::ConfigSig {
17+
predicate isSource(DataFlow::Node source) { source instanceof Source }
18+
19+
predicate isSink(DataFlow::Node sink) { sink instanceof Sink }
20+
21+
predicate isBarrier(DataFlow::Node node) { node instanceof Sanitizer }
22+
23+
predicate isAdditionalFlowStep(DataFlow::Node node1, DataFlow::Node node2) {
24+
// HTML sanitizers are insufficient protection against code injection
25+
node1 = node2.(HtmlSanitizerCall).getInput()
26+
}
27+
}
28+
29+
/**
30+
* Taint-tracking for reasoning about code injection vulnerabilities.
31+
*/
32+
module CodeInjectionFlow = TaintTracking::Global<CodeInjectionConfig>;
33+
34+
/**
35+
* DEPRRECATED. Use the `CodeInjectionFlow` module instead.
36+
*/
37+
deprecated class Configuration extends TaintTracking::Configuration {
1738
Configuration() { this = "CodeInjection" }
1839

1940
override predicate isSource(DataFlow::Node source) { source instanceof Source }
@@ -25,8 +46,7 @@ class Configuration extends TaintTracking::Configuration {
2546
node instanceof Sanitizer
2647
}
2748

28-
override predicate isAdditionalTaintStep(DataFlow::Node src, DataFlow::Node trg) {
29-
// HTML sanitizers are insufficient protection against code injection
30-
src = trg.(HtmlSanitizerCall).getInput()
49+
override predicate isAdditionalTaintStep(DataFlow::Node node1, DataFlow::Node node2) {
50+
CodeInjectionConfig::isAdditionalFlowStep(node1, node2)
3151
}
3252
}

‎javascript/ql/src/Security/CWE-094/CodeInjection.ql‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -16,9 +16,9 @@
1616

1717
import javascript
1818
import semmle.javascript.security.dataflow.CodeInjectionQuery
19-
import DataFlow::PathGraph
19+
import CodeInjectionFlow::PathGraph
2020

21-
from Configuration cfg, DataFlow::PathNode source, DataFlow::PathNode sink
22-
where cfg.hasFlowPath(source, sink)
21+
from CodeInjectionFlow::PathNode source, CodeInjectionFlow::PathNode sink
22+
where CodeInjectionFlow::flowPath(source, sink)
2323
select sink.getNode(), source, sink, sink.getNode().(Sink).getMessagePrefix() + " depends on a $@.",
2424
source.getNode(), "user-provided value"

‎javascript/ql/test/library-tests/frameworks/Templating/CodeInjection.expected‎

Lines changed: 47 additions & 104 deletions
Original file line numberDiff line numberDiff line change
@@ -1,140 +1,83 @@
1-
nodes
2-
| app.js:15:30:15:58 | req.que ... tedCode |
3-
| app.js:15:30:15:58 | req.que ... tedCode |
4-
| app.js:17:25:17:48 | req.que ... shSink1 |
5-
| app.js:17:25:17:48 | req.que ... shSink1 |
6-
| app.js:19:35:19:68 | req.que ... rString |
7-
| app.js:19:35:19:68 | req.que ... rString |
8-
| app.js:34:30:34:58 | req.que ... tedCode |
9-
| app.js:34:30:34:58 | req.que ... tedCode |
10-
| app.js:36:25:36:48 | req.que ... shSink1 |
11-
| app.js:36:25:36:48 | req.que ... shSink1 |
12-
| app.js:38:35:38:68 | req.que ... rString |
13-
| app.js:38:35:38:68 | req.que ... rString |
14-
| app.js:53:30:53:58 | req.que ... tedCode |
15-
| app.js:53:30:53:58 | req.que ... tedCode |
16-
| app.js:54:33:54:64 | req.que ... CodeRaw |
17-
| app.js:54:33:54:64 | req.que ... CodeRaw |
18-
| app.js:56:25:56:48 | req.que ... shSink1 |
19-
| app.js:56:25:56:48 | req.que ... shSink1 |
20-
| app.js:58:35:58:68 | req.que ... rString |
21-
| app.js:58:35:58:68 | req.que ... rString |
22-
| app.js:59:38:59:74 | req.que ... ringRaw |
23-
| app.js:59:38:59:74 | req.que ... ringRaw |
24-
| app.js:65:22:65:42 | req.que ... pedHtml |
25-
| app.js:65:22:65:42 | req.que ... pedHtml |
26-
| app.js:66:18:66:34 | req.query.rawHtml |
27-
| app.js:66:18:66:34 | req.query.rawHtml |
28-
| views/angularjs_include.ejs:2:5:2:22 | <%= escapedHtml %> |
29-
| views/angularjs_include.ejs:2:5:2:22 | <%= escapedHtml %> |
30-
| views/angularjs_include.ejs:2:9:2:19 | escapedHtml |
31-
| views/angularjs_include.ejs:3:5:3:18 | <%- rawHtml %> |
32-
| views/angularjs_include.ejs:3:5:3:18 | <%- rawHtml %> |
33-
| views/angularjs_include.ejs:3:9:3:15 | rawHtml |
34-
| views/angularjs_sinks.ejs:3:9:3:26 | <%= escapedHtml %> |
35-
| views/angularjs_sinks.ejs:3:9:3:26 | <%= escapedHtml %> |
36-
| views/angularjs_sinks.ejs:3:13:3:23 | escapedHtml |
37-
| views/angularjs_sinks.ejs:4:9:4:22 | <%- rawHtml %> |
38-
| views/angularjs_sinks.ejs:4:9:4:22 | <%- rawHtml %> |
39-
| views/angularjs_sinks.ejs:4:13:4:19 | rawHtml |
40-
| views/ejs_sinks.ejs:13:39:13:64 | <%= dataInGeneratedCode %> |
41-
| views/ejs_sinks.ejs:13:39:13:64 | <%= dataInGeneratedCode %> |
42-
| views/ejs_sinks.ejs:13:43:13:61 | dataInGeneratedCode |
43-
| views/ejs_sinks.ejs:16:19:16:39 | <%= backslashSink1 %> |
44-
| views/ejs_sinks.ejs:16:19:16:39 | <%= backslashSink1 %> |
45-
| views/ejs_sinks.ejs:16:23:16:36 | backslashSink1 |
46-
| views/ejs_sinks.ejs:21:39:21:69 | <%= dataInEventHandlerString %> |
47-
| views/ejs_sinks.ejs:21:39:21:69 | <%= dataInEventHandlerString %> |
48-
| views/ejs_sinks.ejs:21:43:21:66 | dataInE ... rString |
49-
| views/hbs_sinks.hbs:25:39:25:63 | {{ dataInGeneratedCode }} |
50-
| views/hbs_sinks.hbs:25:39:25:63 | {{ dataInGeneratedCode }} |
51-
| views/hbs_sinks.hbs:25:42:25:60 | dataInGeneratedCode |
52-
| views/hbs_sinks.hbs:28:19:28:38 | {{ backslashSink1 }} |
53-
| views/hbs_sinks.hbs:28:19:28:38 | {{ backslashSink1 }} |
54-
| views/hbs_sinks.hbs:28:22:28:35 | backslashSink1 |
55-
| views/hbs_sinks.hbs:33:39:33:68 | {{ dataInEventHandlerString }} |
56-
| views/hbs_sinks.hbs:33:39:33:68 | {{ dataInEventHandlerString }} |
57-
| views/hbs_sinks.hbs:33:42:33:65 | dataInE ... rString |
58-
| views/njk_sinks.njk:13:39:13:63 | {{ dataInGeneratedCode }} |
59-
| views/njk_sinks.njk:13:39:13:63 | {{ dataInGeneratedCode }} |
60-
| views/njk_sinks.njk:13:42:13:60 | dataInGeneratedCode |
61-
| views/njk_sinks.njk:14:42:14:76 | {{ dataInGeneratedCodeRaw \| safe }} |
62-
| views/njk_sinks.njk:14:42:14:76 | {{ dataInGeneratedCodeRaw \| safe }} |
63-
| views/njk_sinks.njk:14:45:14:66 | dataInG ... CodeRaw |
64-
| views/njk_sinks.njk:14:45:14:73 | dataInG ... \| safe |
65-
| views/njk_sinks.njk:17:19:17:38 | {{ backslashSink1 }} |
66-
| views/njk_sinks.njk:17:19:17:38 | {{ backslashSink1 }} |
67-
| views/njk_sinks.njk:17:22:17:35 | backslashSink1 |
68-
| views/njk_sinks.njk:22:39:22:68 | {{ dataInEventHandlerString }} |
69-
| views/njk_sinks.njk:22:39:22:68 | {{ dataInEventHandlerString }} |
70-
| views/njk_sinks.njk:22:42:22:65 | dataInE ... rString |
71-
| views/njk_sinks.njk:23:39:23:78 | {{ dataInEventHandlerStringRaw \| safe }} |
72-
| views/njk_sinks.njk:23:39:23:78 | {{ dataInEventHandlerStringRaw \| safe }} |
73-
| views/njk_sinks.njk:23:42:23:68 | dataInE ... ringRaw |
74-
| views/njk_sinks.njk:23:42:23:75 | dataInE ... \| safe |
751
edges
762
| app.js:15:30:15:58 | req.que ... tedCode | views/ejs_sinks.ejs:13:43:13:61 | dataInGeneratedCode |
77-
| app.js:15:30:15:58 | req.que ... tedCode | views/ejs_sinks.ejs:13:43:13:61 | dataInGeneratedCode |
783
| app.js:17:25:17:48 | req.que ... shSink1 | views/ejs_sinks.ejs:16:23:16:36 | backslashSink1 |
79-
| app.js:17:25:17:48 | req.que ... shSink1 | views/ejs_sinks.ejs:16:23:16:36 | backslashSink1 |
80-
| app.js:19:35:19:68 | req.que ... rString | views/ejs_sinks.ejs:21:43:21:66 | dataInE ... rString |
814
| app.js:19:35:19:68 | req.que ... rString | views/ejs_sinks.ejs:21:43:21:66 | dataInE ... rString |
825
| app.js:34:30:34:58 | req.que ... tedCode | views/hbs_sinks.hbs:25:42:25:60 | dataInGeneratedCode |
83-
| app.js:34:30:34:58 | req.que ... tedCode | views/hbs_sinks.hbs:25:42:25:60 | dataInGeneratedCode |
84-
| app.js:36:25:36:48 | req.que ... shSink1 | views/hbs_sinks.hbs:28:22:28:35 | backslashSink1 |
856
| app.js:36:25:36:48 | req.que ... shSink1 | views/hbs_sinks.hbs:28:22:28:35 | backslashSink1 |
867
| app.js:38:35:38:68 | req.que ... rString | views/hbs_sinks.hbs:33:42:33:65 | dataInE ... rString |
87-
| app.js:38:35:38:68 | req.que ... rString | views/hbs_sinks.hbs:33:42:33:65 | dataInE ... rString |
88-
| app.js:53:30:53:58 | req.que ... tedCode | views/njk_sinks.njk:13:42:13:60 | dataInGeneratedCode |
898
| app.js:53:30:53:58 | req.que ... tedCode | views/njk_sinks.njk:13:42:13:60 | dataInGeneratedCode |
909
| app.js:54:33:54:64 | req.que ... CodeRaw | views/njk_sinks.njk:14:45:14:66 | dataInG ... CodeRaw |
91-
| app.js:54:33:54:64 | req.que ... CodeRaw | views/njk_sinks.njk:14:45:14:66 | dataInG ... CodeRaw |
92-
| app.js:56:25:56:48 | req.que ... shSink1 | views/njk_sinks.njk:17:22:17:35 | backslashSink1 |
9310
| app.js:56:25:56:48 | req.que ... shSink1 | views/njk_sinks.njk:17:22:17:35 | backslashSink1 |
9411
| app.js:58:35:58:68 | req.que ... rString | views/njk_sinks.njk:22:42:22:65 | dataInE ... rString |
95-
| app.js:58:35:58:68 | req.que ... rString | views/njk_sinks.njk:22:42:22:65 | dataInE ... rString |
96-
| app.js:59:38:59:74 | req.que ... ringRaw | views/njk_sinks.njk:23:42:23:68 | dataInE ... ringRaw |
9712
| app.js:59:38:59:74 | req.que ... ringRaw | views/njk_sinks.njk:23:42:23:68 | dataInE ... ringRaw |
9813
| app.js:65:22:65:42 | req.que ... pedHtml | views/angularjs_include.ejs:2:9:2:19 | escapedHtml |
99-
| app.js:65:22:65:42 | req.que ... pedHtml | views/angularjs_include.ejs:2:9:2:19 | escapedHtml |
100-
| app.js:65:22:65:42 | req.que ... pedHtml | views/angularjs_sinks.ejs:3:13:3:23 | escapedHtml |
10114
| app.js:65:22:65:42 | req.que ... pedHtml | views/angularjs_sinks.ejs:3:13:3:23 | escapedHtml |
10215
| app.js:66:18:66:34 | req.query.rawHtml | views/angularjs_include.ejs:3:9:3:15 | rawHtml |
103-
| app.js:66:18:66:34 | req.query.rawHtml | views/angularjs_include.ejs:3:9:3:15 | rawHtml |
104-
| app.js:66:18:66:34 | req.query.rawHtml | views/angularjs_sinks.ejs:4:13:4:19 | rawHtml |
10516
| app.js:66:18:66:34 | req.query.rawHtml | views/angularjs_sinks.ejs:4:13:4:19 | rawHtml |
10617
| views/angularjs_include.ejs:2:9:2:19 | escapedHtml | views/angularjs_include.ejs:2:5:2:22 | <%= escapedHtml %> |
107-
| views/angularjs_include.ejs:2:9:2:19 | escapedHtml | views/angularjs_include.ejs:2:5:2:22 | <%= escapedHtml %> |
108-
| views/angularjs_include.ejs:3:9:3:15 | rawHtml | views/angularjs_include.ejs:3:5:3:18 | <%- rawHtml %> |
10918
| views/angularjs_include.ejs:3:9:3:15 | rawHtml | views/angularjs_include.ejs:3:5:3:18 | <%- rawHtml %> |
11019
| views/angularjs_sinks.ejs:3:13:3:23 | escapedHtml | views/angularjs_sinks.ejs:3:9:3:26 | <%= escapedHtml %> |
111-
| views/angularjs_sinks.ejs:3:13:3:23 | escapedHtml | views/angularjs_sinks.ejs:3:9:3:26 | <%= escapedHtml %> |
112-
| views/angularjs_sinks.ejs:4:13:4:19 | rawHtml | views/angularjs_sinks.ejs:4:9:4:22 | <%- rawHtml %> |
11320
| views/angularjs_sinks.ejs:4:13:4:19 | rawHtml | views/angularjs_sinks.ejs:4:9:4:22 | <%- rawHtml %> |
11421
| views/ejs_sinks.ejs:13:43:13:61 | dataInGeneratedCode | views/ejs_sinks.ejs:13:39:13:64 | <%= dataInGeneratedCode %> |
115-
| views/ejs_sinks.ejs:13:43:13:61 | dataInGeneratedCode | views/ejs_sinks.ejs:13:39:13:64 | <%= dataInGeneratedCode %> |
116-
| views/ejs_sinks.ejs:16:23:16:36 | backslashSink1 | views/ejs_sinks.ejs:16:19:16:39 | <%= backslashSink1 %> |
11722
| views/ejs_sinks.ejs:16:23:16:36 | backslashSink1 | views/ejs_sinks.ejs:16:19:16:39 | <%= backslashSink1 %> |
11823
| views/ejs_sinks.ejs:21:43:21:66 | dataInE ... rString | views/ejs_sinks.ejs:21:39:21:69 | <%= dataInEventHandlerString %> |
119-
| views/ejs_sinks.ejs:21:43:21:66 | dataInE ... rString | views/ejs_sinks.ejs:21:39:21:69 | <%= dataInEventHandlerString %> |
120-
| views/hbs_sinks.hbs:25:42:25:60 | dataInGeneratedCode | views/hbs_sinks.hbs:25:39:25:63 | {{ dataInGeneratedCode }} |
12124
| views/hbs_sinks.hbs:25:42:25:60 | dataInGeneratedCode | views/hbs_sinks.hbs:25:39:25:63 | {{ dataInGeneratedCode }} |
12225
| views/hbs_sinks.hbs:28:22:28:35 | backslashSink1 | views/hbs_sinks.hbs:28:19:28:38 | {{ backslashSink1 }} |
123-
| views/hbs_sinks.hbs:28:22:28:35 | backslashSink1 | views/hbs_sinks.hbs:28:19:28:38 | {{ backslashSink1 }} |
124-
| views/hbs_sinks.hbs:33:42:33:65 | dataInE ... rString | views/hbs_sinks.hbs:33:39:33:68 | {{ dataInEventHandlerString }} |
12526
| views/hbs_sinks.hbs:33:42:33:65 | dataInE ... rString | views/hbs_sinks.hbs:33:39:33:68 | {{ dataInEventHandlerString }} |
12627
| views/njk_sinks.njk:13:42:13:60 | dataInGeneratedCode | views/njk_sinks.njk:13:39:13:63 | {{ dataInGeneratedCode }} |
127-
| views/njk_sinks.njk:13:42:13:60 | dataInGeneratedCode | views/njk_sinks.njk:13:39:13:63 | {{ dataInGeneratedCode }} |
12828
| views/njk_sinks.njk:14:45:14:66 | dataInG ... CodeRaw | views/njk_sinks.njk:14:45:14:73 | dataInG ... \| safe |
12929
| views/njk_sinks.njk:14:45:14:73 | dataInG ... \| safe | views/njk_sinks.njk:14:42:14:76 | {{ dataInGeneratedCodeRaw \| safe }} |
130-
| views/njk_sinks.njk:14:45:14:73 | dataInG ... \| safe | views/njk_sinks.njk:14:42:14:76 | {{ dataInGeneratedCodeRaw \| safe }} |
13130
| views/njk_sinks.njk:17:22:17:35 | backslashSink1 | views/njk_sinks.njk:17:19:17:38 | {{ backslashSink1 }} |
132-
| views/njk_sinks.njk:17:22:17:35 | backslashSink1 | views/njk_sinks.njk:17:19:17:38 | {{ backslashSink1 }} |
133-
| views/njk_sinks.njk:22:42:22:65 | dataInE ... rString | views/njk_sinks.njk:22:39:22:68 | {{ dataInEventHandlerString }} |
13431
| views/njk_sinks.njk:22:42:22:65 | dataInE ... rString | views/njk_sinks.njk:22:39:22:68 | {{ dataInEventHandlerString }} |
13532
| views/njk_sinks.njk:23:42:23:68 | dataInE ... ringRaw | views/njk_sinks.njk:23:42:23:75 | dataInE ... \| safe |
13633
| views/njk_sinks.njk:23:42:23:75 | dataInE ... \| safe | views/njk_sinks.njk:23:39:23:78 | {{ dataInEventHandlerStringRaw \| safe }} |
137-
| views/njk_sinks.njk:23:42:23:75 | dataInE ... \| safe | views/njk_sinks.njk:23:39:23:78 | {{ dataInEventHandlerStringRaw \| safe }} |
34+
nodes
35+
| app.js:15:30:15:58 | req.que ... tedCode | semmle.label | req.que ... tedCode |
36+
| app.js:17:25:17:48 | req.que ... shSink1 | semmle.label | req.que ... shSink1 |
37+
| app.js:19:35:19:68 | req.que ... rString | semmle.label | req.que ... rString |
38+
| app.js:34:30:34:58 | req.que ... tedCode | semmle.label | req.que ... tedCode |
39+
| app.js:36:25:36:48 | req.que ... shSink1 | semmle.label | req.que ... shSink1 |
40+
| app.js:38:35:38:68 | req.que ... rString | semmle.label | req.que ... rString |
41+
| app.js:53:30:53:58 | req.que ... tedCode | semmle.label | req.que ... tedCode |
42+
| app.js:54:33:54:64 | req.que ... CodeRaw | semmle.label | req.que ... CodeRaw |
43+
| app.js:56:25:56:48 | req.que ... shSink1 | semmle.label | req.que ... shSink1 |
44+
| app.js:58:35:58:68 | req.que ... rString | semmle.label | req.que ... rString |
45+
| app.js:59:38:59:74 | req.que ... ringRaw | semmle.label | req.que ... ringRaw |
46+
| app.js:65:22:65:42 | req.que ... pedHtml | semmle.label | req.que ... pedHtml |
47+
| app.js:66:18:66:34 | req.query.rawHtml | semmle.label | req.query.rawHtml |
48+
| views/angularjs_include.ejs:2:5:2:22 | <%= escapedHtml %> | semmle.label | <%= escapedHtml %> |
49+
| views/angularjs_include.ejs:2:9:2:19 | escapedHtml | semmle.label | escapedHtml |
50+
| views/angularjs_include.ejs:3:5:3:18 | <%- rawHtml %> | semmle.label | <%- rawHtml %> |
51+
| views/angularjs_include.ejs:3:9:3:15 | rawHtml | semmle.label | rawHtml |
52+
| views/angularjs_sinks.ejs:3:9:3:26 | <%= escapedHtml %> | semmle.label | <%= escapedHtml %> |
53+
| views/angularjs_sinks.ejs:3:13:3:23 | escapedHtml | semmle.label | escapedHtml |
54+
| views/angularjs_sinks.ejs:4:9:4:22 | <%- rawHtml %> | semmle.label | <%- rawHtml %> |
55+
| views/angularjs_sinks.ejs:4:13:4:19 | rawHtml | semmle.label | rawHtml |
56+
| views/ejs_sinks.ejs:13:39:13:64 | <%= dataInGeneratedCode %> | semmle.label | <%= dataInGeneratedCode %> |
57+
| views/ejs_sinks.ejs:13:43:13:61 | dataInGeneratedCode | semmle.label | dataInGeneratedCode |
58+
| views/ejs_sinks.ejs:16:19:16:39 | <%= backslashSink1 %> | semmle.label | <%= backslashSink1 %> |
59+
| views/ejs_sinks.ejs:16:23:16:36 | backslashSink1 | semmle.label | backslashSink1 |
60+
| views/ejs_sinks.ejs:21:39:21:69 | <%= dataInEventHandlerString %> | semmle.label | <%= dataInEventHandlerString %> |
61+
| views/ejs_sinks.ejs:21:43:21:66 | dataInE ... rString | semmle.label | dataInE ... rString |
62+
| views/hbs_sinks.hbs:25:39:25:63 | {{ dataInGeneratedCode }} | semmle.label | {{ dataInGeneratedCode }} |
63+
| views/hbs_sinks.hbs:25:42:25:60 | dataInGeneratedCode | semmle.label | dataInGeneratedCode |
64+
| views/hbs_sinks.hbs:28:19:28:38 | {{ backslashSink1 }} | semmle.label | {{ backslashSink1 }} |
65+
| views/hbs_sinks.hbs:28:22:28:35 | backslashSink1 | semmle.label | backslashSink1 |
66+
| views/hbs_sinks.hbs:33:39:33:68 | {{ dataInEventHandlerString }} | semmle.label | {{ dataInEventHandlerString }} |
67+
| views/hbs_sinks.hbs:33:42:33:65 | dataInE ... rString | semmle.label | dataInE ... rString |
68+
| views/njk_sinks.njk:13:39:13:63 | {{ dataInGeneratedCode }} | semmle.label | {{ dataInGeneratedCode }} |
69+
| views/njk_sinks.njk:13:42:13:60 | dataInGeneratedCode | semmle.label | dataInGeneratedCode |
70+
| views/njk_sinks.njk:14:42:14:76 | {{ dataInGeneratedCodeRaw \| safe }} | semmle.label | {{ dataInGeneratedCodeRaw \| safe }} |
71+
| views/njk_sinks.njk:14:45:14:66 | dataInG ... CodeRaw | semmle.label | dataInG ... CodeRaw |
72+
| views/njk_sinks.njk:14:45:14:73 | dataInG ... \| safe | semmle.label | dataInG ... \| safe |
73+
| views/njk_sinks.njk:17:19:17:38 | {{ backslashSink1 }} | semmle.label | {{ backslashSink1 }} |
74+
| views/njk_sinks.njk:17:22:17:35 | backslashSink1 | semmle.label | backslashSink1 |
75+
| views/njk_sinks.njk:22:39:22:68 | {{ dataInEventHandlerString }} | semmle.label | {{ dataInEventHandlerString }} |
76+
| views/njk_sinks.njk:22:42:22:65 | dataInE ... rString | semmle.label | dataInE ... rString |
77+
| views/njk_sinks.njk:23:39:23:78 | {{ dataInEventHandlerStringRaw \| safe }} | semmle.label | {{ dataInEventHandlerStringRaw \| safe }} |
78+
| views/njk_sinks.njk:23:42:23:68 | dataInE ... ringRaw | semmle.label | dataInE ... ringRaw |
79+
| views/njk_sinks.njk:23:42:23:75 | dataInE ... \| safe | semmle.label | dataInE ... \| safe |
80+
subpaths
13881
#select
13982
| views/angularjs_include.ejs:2:5:2:22 | <%= escapedHtml %> | app.js:65:22:65:42 | req.que ... pedHtml | views/angularjs_include.ejs:2:5:2:22 | <%= escapedHtml %> | This AngularJS template, which may contain code, depends on a $@. | app.js:65:22:65:42 | req.que ... pedHtml | user-provided value |
14083
| views/angularjs_include.ejs:3:5:3:18 | <%- rawHtml %> | app.js:66:18:66:34 | req.query.rawHtml | views/angularjs_include.ejs:3:5:3:18 | <%- rawHtml %> | This AngularJS template, which may contain code, depends on a $@. | app.js:66:18:66:34 | req.query.rawHtml | user-provided value |

0 commit comments

Comments
 (0)