Skip to content

Commit c986f3b

Browse files
erik-krogherik-krogh
committed
add consistency checking for CWE-079
1 parent dc8042a commit c986f3b

File tree

13 files changed

+1140
-1137
lines changed

13 files changed

+1140
-1137
lines changed

‎javascript/ql/test/query-tests/Security/CWE-079/Consistency.expected‎

Whitespace-only changes.

‎javascript/ql/test/query-tests/Security/CWE-079/Consistency.ql‎

Lines changed: 9 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,9 @@
1+
import javascript
2+
import testUtilities.ConsistencyChecking
3+
4+
import semmle.javascript.security.dataflow.DomBasedXss as DomXss
5+
import semmle.javascript.security.dataflow.ReflectedXss as ReflectedXss
6+
import semmle.javascript.security.dataflow.StoredXss as StoredXss
7+
import semmle.javascript.security.dataflow.XssThroughDom as ThroughDomXss
8+
import semmle.javascript.security.dataflow.ExceptionXss as ExceptionXss
9+
import semmle.javascript.security.dataflow.UnsafeJQueryPlugin as UnsafeJqueryPlugin

‎javascript/ql/test/query-tests/Security/CWE-079/ExceptionXss.expected‎

Lines changed: 20 additions & 20 deletions
Original file line numberDiff line numberDiff line change
@@ -86,16 +86,16 @@ nodes
8686
| exception-xss.js:180:26:180:30 | error |
8787
| exception-xss.js:182:19:182:23 | error |
8888
| exception-xss.js:182:19:182:23 | error |
89-
| tst.js:304:9:304:16 | location |
90-
| tst.js:304:9:304:16 | location |
91-
| tst.js:305:10:305:10 | e |
92-
| tst.js:306:20:306:20 | e |
93-
| tst.js:306:20:306:20 | e |
94-
| tst.js:311:10:311:17 | location |
95-
| tst.js:311:10:311:17 | location |
96-
| tst.js:313:10:313:10 | e |
97-
| tst.js:314:20:314:20 | e |
98-
| tst.js:314:20:314:20 | e |
89+
| tst.js:301:9:301:16 | location |
90+
| tst.js:301:9:301:16 | location |
91+
| tst.js:302:10:302:10 | e |
92+
| tst.js:303:20:303:20 | e |
93+
| tst.js:303:20:303:20 | e |
94+
| tst.js:308:10:308:17 | location |
95+
| tst.js:308:10:308:17 | location |
96+
| tst.js:310:10:310:10 | e |
97+
| tst.js:311:20:311:20 | e |
98+
| tst.js:311:20:311:20 | e |
9999
edges
100100
| exception-xss.js:2:6:2:28 | foo | exception-xss.js:9:11:9:13 | foo |
101101
| exception-xss.js:2:6:2:28 | foo | exception-xss.js:15:9:15:11 | foo |
@@ -178,14 +178,14 @@ edges
178178
| exception-xss.js:180:10:180:22 | req.params.id | exception-xss.js:180:26:180:30 | error |
179179
| exception-xss.js:180:26:180:30 | error | exception-xss.js:182:19:182:23 | error |
180180
| exception-xss.js:180:26:180:30 | error | exception-xss.js:182:19:182:23 | error |
181-
| tst.js:304:9:304:16 | location | tst.js:305:10:305:10 | e |
182-
| tst.js:304:9:304:16 | location | tst.js:305:10:305:10 | e |
183-
| tst.js:305:10:305:10 | e | tst.js:306:20:306:20 | e |
184-
| tst.js:305:10:305:10 | e | tst.js:306:20:306:20 | e |
185-
| tst.js:311:10:311:17 | location | tst.js:313:10:313:10 | e |
186-
| tst.js:311:10:311:17 | location | tst.js:313:10:313:10 | e |
187-
| tst.js:313:10:313:10 | e | tst.js:314:20:314:20 | e |
188-
| tst.js:313:10:313:10 | e | tst.js:314:20:314:20 | e |
181+
| tst.js:301:9:301:16 | location | tst.js:302:10:302:10 | e |
182+
| tst.js:301:9:301:16 | location | tst.js:302:10:302:10 | e |
183+
| tst.js:302:10:302:10 | e | tst.js:303:20:303:20 | e |
184+
| tst.js:302:10:302:10 | e | tst.js:303:20:303:20 | e |
185+
| tst.js:308:10:308:17 | location | tst.js:310:10:310:10 | e |
186+
| tst.js:308:10:308:17 | location | tst.js:310:10:310:10 | e |
187+
| tst.js:310:10:310:10 | e | tst.js:311:20:311:20 | e |
188+
| tst.js:310:10:310:10 | e | tst.js:311:20:311:20 | e |
189189
#select
190190
| exception-xss.js:11:18:11:18 | e | exception-xss.js:2:12:2:28 | document.location | exception-xss.js:11:18:11:18 | e | $@ is reinterpreted as HTML without escaping meta-characters. | exception-xss.js:2:12:2:28 | document.location | Exception text |
191191
| exception-xss.js:17:18:17:18 | e | exception-xss.js:2:12:2:28 | document.location | exception-xss.js:17:18:17:18 | e | $@ is reinterpreted as HTML without escaping meta-characters. | exception-xss.js:2:12:2:28 | document.location | Exception text |
@@ -203,5 +203,5 @@ edges
203203
| exception-xss.js:155:18:155:18 | e | exception-xss.js:146:12:146:28 | document.location | exception-xss.js:155:18:155:18 | e | $@ is reinterpreted as HTML without escaping meta-characters. | exception-xss.js:146:12:146:28 | document.location | Exception text |
204204
| exception-xss.js:175:18:175:18 | e | exception-xss.js:146:12:146:28 | document.location | exception-xss.js:175:18:175:18 | e | $@ is reinterpreted as HTML without escaping meta-characters. | exception-xss.js:146:12:146:28 | document.location | Exception text |
205205
| exception-xss.js:182:19:182:23 | error | exception-xss.js:180:10:180:22 | req.params.id | exception-xss.js:182:19:182:23 | error | $@ is reinterpreted as HTML without escaping meta-characters. | exception-xss.js:180:10:180:22 | req.params.id | Exception text |
206-
| tst.js:306:20:306:20 | e | tst.js:304:9:304:16 | location | tst.js:306:20:306:20 | e | $@ is reinterpreted as HTML without escaping meta-characters. | tst.js:304:9:304:16 | location | Exception text |
207-
| tst.js:314:20:314:20 | e | tst.js:311:10:311:17 | location | tst.js:314:20:314:20 | e | $@ is reinterpreted as HTML without escaping meta-characters. | tst.js:311:10:311:17 | location | Exception text |
206+
| tst.js:303:20:303:20 | e | tst.js:301:9:301:16 | location | tst.js:303:20:303:20 | e | $@ is reinterpreted as HTML without escaping meta-characters. | tst.js:301:9:301:16 | location | Exception text |
207+
| tst.js:311:20:311:20 | e | tst.js:308:10:308:17 | location | tst.js:311:20:311:20 | e | $@ is reinterpreted as HTML without escaping meta-characters. | tst.js:308:10:308:17 | location | Exception text |

‎javascript/ql/test/query-tests/Security/CWE-079/ReflectedXssGood3.js‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -136,7 +136,7 @@ app.get('/user/:id', function (req, res) {
136136

137137
res.send(escapeHtml1(url)); // OK
138138
res.send(escapeHtml2(url)); // OK
139-
res.send(escapeHtml3(url)); // OK - but FP
139+
res.send(escapeHtml3(url)); // OK - but FP [INCONSISTENCY]
140140
res.send(escapeHtml4(url)); // OK
141141
});
142142

‎javascript/ql/test/query-tests/Security/CWE-079/UnsafeJQueryPlugin.expected‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -238,6 +238,6 @@ edges
238238
| unsafe-jquery-plugin.js:127:6:127:19 | options.target | unsafe-jquery-plugin.js:126:33:126:39 | options | unsafe-jquery-plugin.js:127:6:127:19 | options.target | Potential XSS vulnerability in the $@. | unsafe-jquery-plugin.js:126:14:128:3 | functio ... OK\\n\\t\\t} | '$.fn.my_plugin' plugin |
239239
| unsafe-jquery-plugin.js:132:5:132:18 | options.target | unsafe-jquery-plugin.js:131:34:131:40 | options | unsafe-jquery-plugin.js:132:5:132:18 | options.target | Potential XSS vulnerability in the $@. | unsafe-jquery-plugin.js:131:15:133:2 | functio ... T OK\\n\\t} | '$.fn.affix' plugin |
240240
| unsafe-jquery-plugin.js:136:5:136:29 | options ... elector | unsafe-jquery-plugin.js:135:36:135:42 | options | unsafe-jquery-plugin.js:136:5:136:29 | options ... elector | Potential XSS vulnerability in the $@. | unsafe-jquery-plugin.js:135:17:137:2 | functio ... T OK\\n\\t} | '$.fn.tooltip' plugin |
241-
| unsafe-jquery-plugin.js:157:44:157:59 | options.target.a | unsafe-jquery-plugin.js:153:38:153:44 | options | unsafe-jquery-plugin.js:157:44:157:59 | options.target.a | Potential XSS vulnerability in the $@. | unsafe-jquery-plugin.js:153:19:158:2 | functio ... gged\\n\\t} | '$.fn.my_plugin' plugin |
241+
| unsafe-jquery-plugin.js:157:44:157:59 | options.target.a | unsafe-jquery-plugin.js:153:38:153:44 | options | unsafe-jquery-plugin.js:157:44:157:59 | options.target.a | Potential XSS vulnerability in the $@. | unsafe-jquery-plugin.js:153:19:158:2 | functio ... NCY]\\n\\t} | '$.fn.my_plugin' plugin |
242242
| unsafe-jquery-plugin.js:170:6:170:11 | target | unsafe-jquery-plugin.js:160:38:160:44 | options | unsafe-jquery-plugin.js:170:6:170:11 | target | Potential XSS vulnerability in the $@. | unsafe-jquery-plugin.js:160:19:173:2 | functio ... \\t\\t}\\n\\n\\t} | '$.fn.my_plugin' plugin |
243243
| unsafe-jquery-plugin.js:179:5:179:18 | options.target | unsafe-jquery-plugin.js:178:27:178:33 | options | unsafe-jquery-plugin.js:179:5:179:18 | options.target | Potential XSS vulnerability in the $@. | unsafe-jquery-plugin.js:178:18:180:2 | functio ... T OK\\n\\t} | '$.fn.my_plugin' plugin |

0 commit comments

Comments
 (0)