Skip to content

Commit 4337c5a

Browse files
asgerfasgerf
committed
JS: Workaround ascii PR check
1 parent b3d8b95 commit 4337c5a

File tree

2 files changed

+82
-3
lines changed

2 files changed

+82
-3
lines changed

‎javascript/ql/src/semmle/javascript/frameworks/Angular2.qll‎

Lines changed: 10 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -198,13 +198,20 @@ module Angular2 {
198198
}
199199
}
200200

201+
private string getInternalName(string name) {
202+
exists(Identifier id |
203+
result = id.getName() and
204+
name = result.regexpCapture("\\u0275(DomAdapter|getDOM)", 1)
205+
)
206+
}
207+
201208
/** Gets a reference to a `DomAdapter`, which provides acess to raw DOM elements. */
202209
private DataFlow::SourceNode domAdapter() {
203-
// Note: these are internal properties, prefixed with the theta character "ɵ".
210+
// Note: these are internal properties, prefixed with the "latin small letter barred O (U+0275)" character.
204211
// Despite being internal, some codebases do access them.
205-
result.hasUnderlyingType("@angular/common", "ɵDomAdapter")
212+
result.hasUnderlyingType("@angular/common", getInternalName("DomAdapter"))
206213
or
207-
result = DataFlow::moduleImport("@angular/common").getAMemberCall("ɵgetDOM")
214+
result = DataFlow::moduleImport("@angular/common").getAMemberCall(getInternalName("getDOM"))
208215
}
209216

210217
/** A reference to the DOM location obtained through `DomAdapter.getLocation()`. */

‎javascript/ql/test/query-tests/Security/CWE-079/XssWithAdditionalSources.expected‎

Lines changed: 72 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -15,6 +15,50 @@ nodes
1515
| addEventListener.js:12:24:12:28 | event |
1616
| addEventListener.js:12:24:12:33 | event.data |
1717
| addEventListener.js:12:24:12:33 | event.data |
18+
| angular2-client.ts:21:44:21:66 | \\u0275getDOM ... ation() |
19+
| angular2-client.ts:21:44:21:66 | \\u0275getDOM ... ation() |
20+
| angular2-client.ts:21:44:21:71 | \\u0275getDOM ... ().href |
21+
| angular2-client.ts:21:44:21:71 | \\u0275getDOM ... ().href |
22+
| angular2-client.ts:23:44:23:69 | this.ro ... .params |
23+
| angular2-client.ts:23:44:23:69 | this.ro ... .params |
24+
| angular2-client.ts:23:44:23:73 | this.ro ... ams.foo |
25+
| angular2-client.ts:23:44:23:73 | this.ro ... ams.foo |
26+
| angular2-client.ts:24:44:24:74 | this.ro ... yParams |
27+
| angular2-client.ts:24:44:24:74 | this.ro ... yParams |
28+
| angular2-client.ts:24:44:24:78 | this.ro ... ams.foo |
29+
| angular2-client.ts:24:44:24:78 | this.ro ... ams.foo |
30+
| angular2-client.ts:25:44:25:71 | this.ro ... ragment |
31+
| angular2-client.ts:25:44:25:71 | this.ro ... ragment |
32+
| angular2-client.ts:25:44:25:71 | this.ro ... ragment |
33+
| angular2-client.ts:26:44:26:82 | this.ro ... ('foo') |
34+
| angular2-client.ts:26:44:26:82 | this.ro ... ('foo') |
35+
| angular2-client.ts:26:44:26:82 | this.ro ... ('foo') |
36+
| angular2-client.ts:27:44:27:87 | this.ro ... ('foo') |
37+
| angular2-client.ts:27:44:27:87 | this.ro ... ('foo') |
38+
| angular2-client.ts:27:44:27:87 | this.ro ... ('foo') |
39+
| angular2-client.ts:29:46:29:59 | map.get('foo') |
40+
| angular2-client.ts:29:46:29:59 | map.get('foo') |
41+
| angular2-client.ts:29:46:29:59 | map.get('foo') |
42+
| angular2-client.ts:32:44:32:74 | this.ro ... 1].path |
43+
| angular2-client.ts:32:44:32:74 | this.ro ... 1].path |
44+
| angular2-client.ts:32:44:32:74 | this.ro ... 1].path |
45+
| angular2-client.ts:33:44:33:80 | this.ro ... ameters |
46+
| angular2-client.ts:33:44:33:80 | this.ro ... ameters |
47+
| angular2-client.ts:33:44:33:82 | this.ro ... eters.x |
48+
| angular2-client.ts:33:44:33:82 | this.ro ... eters.x |
49+
| angular2-client.ts:34:44:34:91 | this.ro ... et('x') |
50+
| angular2-client.ts:34:44:34:91 | this.ro ... et('x') |
51+
| angular2-client.ts:34:44:34:91 | this.ro ... et('x') |
52+
| angular2-client.ts:35:44:35:89 | this.ro ... .params |
53+
| angular2-client.ts:35:44:35:89 | this.ro ... .params |
54+
| angular2-client.ts:35:44:35:91 | this.ro ... arams.x |
55+
| angular2-client.ts:35:44:35:91 | this.ro ... arams.x |
56+
| angular2-client.ts:37:44:37:58 | this.router.url |
57+
| angular2-client.ts:37:44:37:58 | this.router.url |
58+
| angular2-client.ts:37:44:37:58 | this.router.url |
59+
| angular2-client.ts:41:44:41:76 | routeSn ... ('foo') |
60+
| angular2-client.ts:41:44:41:76 | routeSn ... ('foo') |
61+
| angular2-client.ts:41:44:41:76 | routeSn ... ('foo') |
1862
| exception-xss.js:2:6:2:28 | foo |
1963
| exception-xss.js:2:12:2:28 | document.location |
2064
| exception-xss.js:2:12:2:28 | document.location |
@@ -509,6 +553,34 @@ edges
509553
| addEventListener.js:10:21:10:25 | event | addEventListener.js:12:24:12:28 | event |
510554
| addEventListener.js:12:24:12:28 | event | addEventListener.js:12:24:12:33 | event.data |
511555
| addEventListener.js:12:24:12:28 | event | addEventListener.js:12:24:12:33 | event.data |
556+
| angular2-client.ts:21:44:21:66 | \\u0275getDOM ... ation() | angular2-client.ts:21:44:21:71 | \\u0275getDOM ... ().href |
557+
| angular2-client.ts:21:44:21:66 | \\u0275getDOM ... ation() | angular2-client.ts:21:44:21:71 | \\u0275getDOM ... ().href |
558+
| angular2-client.ts:21:44:21:66 | \\u0275getDOM ... ation() | angular2-client.ts:21:44:21:71 | \\u0275getDOM ... ().href |
559+
| angular2-client.ts:21:44:21:66 | \\u0275getDOM ... ation() | angular2-client.ts:21:44:21:71 | \\u0275getDOM ... ().href |
560+
| angular2-client.ts:23:44:23:69 | this.ro ... .params | angular2-client.ts:23:44:23:73 | this.ro ... ams.foo |
561+
| angular2-client.ts:23:44:23:69 | this.ro ... .params | angular2-client.ts:23:44:23:73 | this.ro ... ams.foo |
562+
| angular2-client.ts:23:44:23:69 | this.ro ... .params | angular2-client.ts:23:44:23:73 | this.ro ... ams.foo |
563+
| angular2-client.ts:23:44:23:69 | this.ro ... .params | angular2-client.ts:23:44:23:73 | this.ro ... ams.foo |
564+
| angular2-client.ts:24:44:24:74 | this.ro ... yParams | angular2-client.ts:24:44:24:78 | this.ro ... ams.foo |
565+
| angular2-client.ts:24:44:24:74 | this.ro ... yParams | angular2-client.ts:24:44:24:78 | this.ro ... ams.foo |
566+
| angular2-client.ts:24:44:24:74 | this.ro ... yParams | angular2-client.ts:24:44:24:78 | this.ro ... ams.foo |
567+
| angular2-client.ts:24:44:24:74 | this.ro ... yParams | angular2-client.ts:24:44:24:78 | this.ro ... ams.foo |
568+
| angular2-client.ts:25:44:25:71 | this.ro ... ragment | angular2-client.ts:25:44:25:71 | this.ro ... ragment |
569+
| angular2-client.ts:26:44:26:82 | this.ro ... ('foo') | angular2-client.ts:26:44:26:82 | this.ro ... ('foo') |
570+
| angular2-client.ts:27:44:27:87 | this.ro ... ('foo') | angular2-client.ts:27:44:27:87 | this.ro ... ('foo') |
571+
| angular2-client.ts:29:46:29:59 | map.get('foo') | angular2-client.ts:29:46:29:59 | map.get('foo') |
572+
| angular2-client.ts:32:44:32:74 | this.ro ... 1].path | angular2-client.ts:32:44:32:74 | this.ro ... 1].path |
573+
| angular2-client.ts:33:44:33:80 | this.ro ... ameters | angular2-client.ts:33:44:33:82 | this.ro ... eters.x |
574+
| angular2-client.ts:33:44:33:80 | this.ro ... ameters | angular2-client.ts:33:44:33:82 | this.ro ... eters.x |
575+
| angular2-client.ts:33:44:33:80 | this.ro ... ameters | angular2-client.ts:33:44:33:82 | this.ro ... eters.x |
576+
| angular2-client.ts:33:44:33:80 | this.ro ... ameters | angular2-client.ts:33:44:33:82 | this.ro ... eters.x |
577+
| angular2-client.ts:34:44:34:91 | this.ro ... et('x') | angular2-client.ts:34:44:34:91 | this.ro ... et('x') |
578+
| angular2-client.ts:35:44:35:89 | this.ro ... .params | angular2-client.ts:35:44:35:91 | this.ro ... arams.x |
579+
| angular2-client.ts:35:44:35:89 | this.ro ... .params | angular2-client.ts:35:44:35:91 | this.ro ... arams.x |
580+
| angular2-client.ts:35:44:35:89 | this.ro ... .params | angular2-client.ts:35:44:35:91 | this.ro ... arams.x |
581+
| angular2-client.ts:35:44:35:89 | this.ro ... .params | angular2-client.ts:35:44:35:91 | this.ro ... arams.x |
582+
| angular2-client.ts:37:44:37:58 | this.router.url | angular2-client.ts:37:44:37:58 | this.router.url |
583+
| angular2-client.ts:41:44:41:76 | routeSn ... ('foo') | angular2-client.ts:41:44:41:76 | routeSn ... ('foo') |
512584
| exception-xss.js:2:6:2:28 | foo | exception-xss.js:86:17:86:19 | foo |
513585
| exception-xss.js:2:6:2:28 | foo | exception-xss.js:86:17:86:19 | foo |
514586
| exception-xss.js:2:12:2:28 | document.location | exception-xss.js:2:6:2:28 | foo |

0 commit comments

Comments
 (0)