Skip to content

Commit 36b2838

Browse files
semmle-qlcisemmle-qlci
authored
Merge pull request github#3332 from erik-krogh/JGrowl
Approved by esbena
2 parents 801ce89 + d8c498b commit 36b2838

File tree

7 files changed

+41
-1
lines changed

7 files changed

+41
-1
lines changed

‎change-notes/1.25/analysis-javascript.md

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -2,6 +2,8 @@
22

33
## General improvements
44

5+
* Support for the following frameworks and libraries has been improved:
6+
- [jGrowl](https://github.com/stanlemon/jGrowl)
57

68
## New queries
79

‎javascript/ql/src/semmle/javascript/security/dataflow/Xss.qll

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -99,6 +99,8 @@ module DomBasedXss {
9999
this = any(Typeahead::TypeaheadSuggestionFunction f).getAReturn()
100100
or
101101
this = any(Handlebars::SafeString s).getAnArgument()
102+
or
103+
this = any(JQuery::MethodCall call | call.getMethodName() = "jGrowl").getArgument(0)
102104
}
103105
}
104106

‎javascript/ql/test/query-tests/Security/CWE-079/Xss.expected

Lines changed: 12 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -341,6 +341,12 @@ nodes
341341
| tst.js:347:20:347:36 | document.___location |
342342
| tst.js:349:5:349:30 | getUrl( ... ring(1) |
343343
| tst.js:349:5:349:30 | getUrl( ... ring(1) |
344+
| tst.js:354:7:354:39 | target |
345+
| tst.js:354:16:354:32 | document.___location |
346+
| tst.js:354:16:354:32 | document.___location |
347+
| tst.js:354:16:354:39 | documen ... .search |
348+
| tst.js:355:12:355:17 | target |
349+
| tst.js:355:12:355:17 | target |
344350
| typeahead.js:20:13:20:45 | target |
345351
| typeahead.js:20:22:20:38 | document.___location |
346352
| typeahead.js:20:22:20:38 | document.___location |
@@ -659,6 +665,11 @@ edges
659665
| tst.js:347:20:347:36 | document.___location | tst.js:349:5:349:30 | getUrl( ... ring(1) |
660666
| tst.js:347:20:347:36 | document.___location | tst.js:349:5:349:30 | getUrl( ... ring(1) |
661667
| tst.js:347:20:347:36 | document.___location | tst.js:349:5:349:30 | getUrl( ... ring(1) |
668+
| tst.js:354:7:354:39 | target | tst.js:355:12:355:17 | target |
669+
| tst.js:354:7:354:39 | target | tst.js:355:12:355:17 | target |
670+
| tst.js:354:16:354:32 | document.___location | tst.js:354:16:354:39 | documen ... .search |
671+
| tst.js:354:16:354:32 | document.___location | tst.js:354:16:354:39 | documen ... .search |
672+
| tst.js:354:16:354:39 | documen ... .search | tst.js:354:7:354:39 | target |
662673
| typeahead.js:20:13:20:45 | target | typeahead.js:21:12:21:17 | target |
663674
| typeahead.js:20:22:20:38 | document.___location | typeahead.js:20:22:20:45 | documen ... .search |
664675
| typeahead.js:20:22:20:38 | document.___location | typeahead.js:20:22:20:45 | documen ... .search |
@@ -760,6 +771,7 @@ edges
760771
| tst.js:319:35:319:42 | ___location | tst.js:319:35:319:42 | ___location | tst.js:319:35:319:42 | ___location | Cross-site scripting vulnerability due to $@. | tst.js:319:35:319:42 | ___location | user-provided value |
761772
| tst.js:336:18:336:35 | params.get('name') | tst.js:330:18:330:34 | document.___location | tst.js:336:18:336:35 | params.get('name') | Cross-site scripting vulnerability due to $@. | tst.js:330:18:330:34 | document.___location | user-provided value |
762773
| tst.js:349:5:349:30 | getUrl( ... ring(1) | tst.js:347:20:347:36 | document.___location | tst.js:349:5:349:30 | getUrl( ... ring(1) | Cross-site scripting vulnerability due to $@. | tst.js:347:20:347:36 | document.___location | user-provided value |
774+
| tst.js:355:12:355:17 | target | tst.js:354:16:354:32 | document.___location | tst.js:355:12:355:17 | target | Cross-site scripting vulnerability due to $@. | tst.js:354:16:354:32 | document.___location | user-provided value |
763775
| typeahead.js:25:18:25:20 | val | typeahead.js:20:22:20:38 | document.___location | typeahead.js:25:18:25:20 | val | Cross-site scripting vulnerability due to $@. | typeahead.js:20:22:20:38 | document.___location | user-provided value |
764776
| v-html.vue:2:8:2:23 | v-html=tainted | v-html.vue:6:42:6:58 | document.___location | v-html.vue:2:8:2:23 | v-html=tainted | Cross-site scripting vulnerability due to $@. | v-html.vue:6:42:6:58 | document.___location | user-provided value |
765777
| winjs.js:3:43:3:49 | tainted | winjs.js:2:17:2:33 | document.___location | winjs.js:3:43:3:49 | tainted | Cross-site scripting vulnerability due to $@. | winjs.js:2:17:2:33 | document.___location | user-provided value |

‎javascript/ql/test/query-tests/Security/CWE-079/XssThroughDom.expected

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -38,6 +38,9 @@ nodes
3838
| xss-through-dom.js:64:30:64:40 | valMethod() |
3939
| xss-through-dom.js:64:30:64:40 | valMethod() |
4040
| xss-through-dom.js:64:30:64:40 | valMethod() |
41+
| xss-through-dom.js:71:11:71:32 | $("inpu ... 0).name |
42+
| xss-through-dom.js:71:11:71:32 | $("inpu ... 0).name |
43+
| xss-through-dom.js:71:11:71:32 | $("inpu ... 0).name |
4144
edges
4245
| xss-through-dom.js:2:16:2:34 | $("textarea").val() | xss-through-dom.js:2:16:2:34 | $("textarea").val() |
4346
| xss-through-dom.js:4:16:4:40 | $(".som ... .text() | xss-through-dom.js:4:16:4:40 | $(".som ... .text() |
@@ -52,6 +55,7 @@ edges
5255
| xss-through-dom.js:57:30:57:67 | $("inpu ... "name") | xss-through-dom.js:57:30:57:67 | $("inpu ... "name") |
5356
| xss-through-dom.js:61:30:61:69 | $(docum ... value") | xss-through-dom.js:61:30:61:69 | $(docum ... value") |
5457
| xss-through-dom.js:64:30:64:40 | valMethod() | xss-through-dom.js:64:30:64:40 | valMethod() |
58+
| xss-through-dom.js:71:11:71:32 | $("inpu ... 0).name | xss-through-dom.js:71:11:71:32 | $("inpu ... 0).name |
5559
#select
5660
| xss-through-dom.js:2:16:2:34 | $("textarea").val() | xss-through-dom.js:2:16:2:34 | $("textarea").val() | xss-through-dom.js:2:16:2:34 | $("textarea").val() | Cross-site scripting vulnerability due to $@. | xss-through-dom.js:2:16:2:34 | $("textarea").val() | DOM text |
5761
| xss-through-dom.js:4:16:4:40 | $(".som ... .text() | xss-through-dom.js:4:16:4:40 | $(".som ... .text() | xss-through-dom.js:4:16:4:40 | $(".som ... .text() | Cross-site scripting vulnerability due to $@. | xss-through-dom.js:4:16:4:40 | $(".som ... .text() | DOM text |
@@ -66,3 +70,4 @@ edges
6670
| xss-through-dom.js:57:30:57:67 | $("inpu ... "name") | xss-through-dom.js:57:30:57:67 | $("inpu ... "name") | xss-through-dom.js:57:30:57:67 | $("inpu ... "name") | Cross-site scripting vulnerability due to $@. | xss-through-dom.js:57:30:57:67 | $("inpu ... "name") | DOM text |
6771
| xss-through-dom.js:61:30:61:69 | $(docum ... value") | xss-through-dom.js:61:30:61:69 | $(docum ... value") | xss-through-dom.js:61:30:61:69 | $(docum ... value") | Cross-site scripting vulnerability due to $@. | xss-through-dom.js:61:30:61:69 | $(docum ... value") | DOM text |
6872
| xss-through-dom.js:64:30:64:40 | valMethod() | xss-through-dom.js:64:30:64:40 | valMethod() | xss-through-dom.js:64:30:64:40 | valMethod() | Cross-site scripting vulnerability due to $@. | xss-through-dom.js:64:30:64:40 | valMethod() | DOM text |
73+
| xss-through-dom.js:71:11:71:32 | $("inpu ... 0).name | xss-through-dom.js:71:11:71:32 | $("inpu ... 0).name | xss-through-dom.js:71:11:71:32 | $("inpu ... 0).name | Cross-site scripting vulnerability due to $@. | xss-through-dom.js:71:11:71:32 | $("inpu ... 0).name | DOM text |

‎javascript/ql/test/query-tests/Security/CWE-079/XssWithAdditionalSources.expected

Lines changed: 11 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -341,6 +341,12 @@ nodes
341341
| tst.js:347:20:347:36 | document.___location |
342342
| tst.js:349:5:349:30 | getUrl( ... ring(1) |
343343
| tst.js:349:5:349:30 | getUrl( ... ring(1) |
344+
| tst.js:354:7:354:39 | target |
345+
| tst.js:354:16:354:32 | document.___location |
346+
| tst.js:354:16:354:32 | document.___location |
347+
| tst.js:354:16:354:39 | documen ... .search |
348+
| tst.js:355:12:355:17 | target |
349+
| tst.js:355:12:355:17 | target |
344350
| typeahead.js:9:28:9:30 | loc |
345351
| typeahead.js:9:28:9:30 | loc |
346352
| typeahead.js:10:16:10:18 | loc |
@@ -663,6 +669,11 @@ edges
663669
| tst.js:347:20:347:36 | document.___location | tst.js:349:5:349:30 | getUrl( ... ring(1) |
664670
| tst.js:347:20:347:36 | document.___location | tst.js:349:5:349:30 | getUrl( ... ring(1) |
665671
| tst.js:347:20:347:36 | document.___location | tst.js:349:5:349:30 | getUrl( ... ring(1) |
672+
| tst.js:354:7:354:39 | target | tst.js:355:12:355:17 | target |
673+
| tst.js:354:7:354:39 | target | tst.js:355:12:355:17 | target |
674+
| tst.js:354:16:354:32 | document.___location | tst.js:354:16:354:39 | documen ... .search |
675+
| tst.js:354:16:354:32 | document.___location | tst.js:354:16:354:39 | documen ... .search |
676+
| tst.js:354:16:354:39 | documen ... .search | tst.js:354:7:354:39 | target |
666677
| typeahead.js:9:28:9:30 | loc | typeahead.js:10:16:10:18 | loc |
667678
| typeahead.js:9:28:9:30 | loc | typeahead.js:10:16:10:18 | loc |
668679
| typeahead.js:9:28:9:30 | loc | typeahead.js:10:16:10:18 | loc |

‎javascript/ql/test/query-tests/Security/CWE-079/tst.js

Lines changed: 7 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -348,4 +348,10 @@ function hash() {
348348
}
349349
$(getUrl().hash.substring(1)); // NOT OK
350350

351-
}
351+
}
352+
353+
function growl() {
354+
var target = document.___location.search
355+
$.jGrowl(target); // NOT OK
356+
}
357+

‎javascript/ql/test/query-tests/Security/CWE-079/xss-through-dom.js

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -67,4 +67,6 @@
6767
if(myValue.property) {
6868
$("#id").get(0).innerHTML = myValue; // OK.
6969
}
70+
71+
$.jGrowl($("input").get(0).name); // NOT OK.
7072
})();

0 commit comments

Comments
 (0)