Skip to content

Commit 4a691b7

Browse files
NapalysNapalys
committed
Added escape as UriEncodingSanitizer 
1 parent 37e02e4 commit 4a691b7

File tree

4 files changed

+3
-25
lines changed

4 files changed

+3
-25
lines changed

‎javascript/ql/lib/semmle/javascript/security/dataflow/Xss.qll‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -53,7 +53,7 @@ module Shared {
5353
class UriEncodingSanitizer extends Sanitizer, DataFlow::CallNode {
5454
UriEncodingSanitizer() {
5555
exists(string name | this = DataFlow::globalVarRef(name).getACall() |
56-
name = "encodeURI" or name = "encodeURIComponent"
56+
name in ["encodeURI", "encodeURIComponent", "escape"]
5757
)
5858
}
5959
}

‎javascript/ql/test/query-tests/Security/CWE-079/DomBasedXss/Xss.expected‎

Lines changed: 0 additions & 12 deletions
Original file line numberDiff line numberDiff line change
@@ -120,8 +120,6 @@
120120
| string-manipulations.js:8:16:8:48 | documen ... mLeft() | string-manipulations.js:8:16:8:37 | documen ... on.href | string-manipulations.js:8:16:8:48 | documen ... mLeft() | Cross-site scripting vulnerability due to $@. | string-manipulations.js:8:16:8:37 | documen ... on.href | user-provided value |
121121
| string-manipulations.js:9:16:9:58 | String. ... n.href) | string-manipulations.js:9:36:9:57 | documen ... on.href | string-manipulations.js:9:16:9:58 | String. ... n.href) | Cross-site scripting vulnerability due to $@. | string-manipulations.js:9:36:9:57 | documen ... on.href | user-provided value |
122122
| string-manipulations.js:10:16:10:45 | String( ... n.href) | string-manipulations.js:10:23:10:44 | documen ... on.href | string-manipulations.js:10:16:10:45 | String( ... n.href) | Cross-site scripting vulnerability due to $@. | string-manipulations.js:10:23:10:44 | documen ... on.href | user-provided value |
123-
| string-manipulations.js:11:16:11:45 | escape( ... n.href) | string-manipulations.js:11:23:11:44 | documen ... on.href | string-manipulations.js:11:16:11:45 | escape( ... n.href) | Cross-site scripting vulnerability due to $@. | string-manipulations.js:11:23:11:44 | documen ... on.href | user-provided value |
124-
| string-manipulations.js:12:16:12:61 | escape( ... href))) | string-manipulations.js:12:37:12:58 | documen ... on.href | string-manipulations.js:12:16:12:61 | escape( ... href))) | Cross-site scripting vulnerability due to $@. | string-manipulations.js:12:37:12:58 | documen ... on.href | user-provided value |
125123
| tainted-url-suffix-arguments.js:6:22:6:22 | y | tainted-url-suffix-arguments.js:11:17:11:36 | window.location.href | tainted-url-suffix-arguments.js:6:22:6:22 | y | Cross-site scripting vulnerability due to $@. | tainted-url-suffix-arguments.js:11:17:11:36 | window.location.href | user-provided value |
126124
| tooltip.jsx:10:25:10:30 | source | tooltip.jsx:6:20:6:30 | window.name | tooltip.jsx:10:25:10:30 | source | Cross-site scripting vulnerability due to $@. | tooltip.jsx:6:20:6:30 | window.name | user-provided value |
127125
| tooltip.jsx:11:25:11:30 | source | tooltip.jsx:6:20:6:30 | window.name | tooltip.jsx:11:25:11:30 | source | Cross-site scripting vulnerability due to $@. | tooltip.jsx:6:20:6:30 | window.name | user-provided value |
@@ -492,10 +490,6 @@ edges
492490
| string-manipulations.js:8:16:8:37 | documen ... on.href | string-manipulations.js:8:16:8:48 | documen ... mLeft() | provenance | |
493491
| string-manipulations.js:9:36:9:57 | documen ... on.href | string-manipulations.js:9:16:9:58 | String. ... n.href) | provenance | |
494492
| string-manipulations.js:10:23:10:44 | documen ... on.href | string-manipulations.js:10:16:10:45 | String( ... n.href) | provenance | |
495-
| string-manipulations.js:11:23:11:44 | documen ... on.href | string-manipulations.js:11:16:11:45 | escape( ... n.href) | provenance | |
496-
| string-manipulations.js:12:23:12:60 | escape( ... .href)) | string-manipulations.js:12:16:12:61 | escape( ... href))) | provenance | |
497-
| string-manipulations.js:12:30:12:59 | escape( ... n.href) | string-manipulations.js:12:23:12:60 | escape( ... .href)) | provenance | |
498-
| string-manipulations.js:12:37:12:58 | documen ... on.href | string-manipulations.js:12:30:12:59 | escape( ... n.href) | provenance | |
499493
| tainted-url-suffix-arguments.js:3:17:3:17 | y | tainted-url-suffix-arguments.js:6:22:6:22 | y | provenance | |
500494
| tainted-url-suffix-arguments.js:11:11:11:36 | url | tainted-url-suffix-arguments.js:12:17:12:19 | url | provenance | |
501495
| tainted-url-suffix-arguments.js:11:17:11:36 | window.location.href | tainted-url-suffix-arguments.js:11:11:11:36 | url | provenance | |
@@ -1122,12 +1116,6 @@ nodes
11221116
| string-manipulations.js:9:36:9:57 | documen ... on.href | semmle.label | documen ... on.href |
11231117
| string-manipulations.js:10:16:10:45 | String( ... n.href) | semmle.label | String( ... n.href) |
11241118
| string-manipulations.js:10:23:10:44 | documen ... on.href | semmle.label | documen ... on.href |
1125-
| string-manipulations.js:11:16:11:45 | escape( ... n.href) | semmle.label | escape( ... n.href) |
1126-
| string-manipulations.js:11:23:11:44 | documen ... on.href | semmle.label | documen ... on.href |
1127-
| string-manipulations.js:12:16:12:61 | escape( ... href))) | semmle.label | escape( ... href))) |
1128-
| string-manipulations.js:12:23:12:60 | escape( ... .href)) | semmle.label | escape( ... .href)) |
1129-
| string-manipulations.js:12:30:12:59 | escape( ... n.href) | semmle.label | escape( ... n.href) |
1130-
| string-manipulations.js:12:37:12:58 | documen ... on.href | semmle.label | documen ... on.href |
11311119
| tainted-url-suffix-arguments.js:3:17:3:17 | y | semmle.label | y |
11321120
| tainted-url-suffix-arguments.js:6:22:6:22 | y | semmle.label | y |
11331121
| tainted-url-suffix-arguments.js:11:11:11:36 | url | semmle.label | url |

‎javascript/ql/test/query-tests/Security/CWE-079/DomBasedXss/XssWithAdditionalSources.expected‎

Lines changed: 0 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -322,12 +322,6 @@ nodes
322322
| string-manipulations.js:9:36:9:57 | documen ... on.href | semmle.label | documen ... on.href |
323323
| string-manipulations.js:10:16:10:45 | String( ... n.href) | semmle.label | String( ... n.href) |
324324
| string-manipulations.js:10:23:10:44 | documen ... on.href | semmle.label | documen ... on.href |
325-
| string-manipulations.js:11:16:11:45 | escape( ... n.href) | semmle.label | escape( ... n.href) |
326-
| string-manipulations.js:11:23:11:44 | documen ... on.href | semmle.label | documen ... on.href |
327-
| string-manipulations.js:12:16:12:61 | escape( ... href))) | semmle.label | escape( ... href))) |
328-
| string-manipulations.js:12:23:12:60 | escape( ... .href)) | semmle.label | escape( ... .href)) |
329-
| string-manipulations.js:12:30:12:59 | escape( ... n.href) | semmle.label | escape( ... n.href) |
330-
| string-manipulations.js:12:37:12:58 | documen ... on.href | semmle.label | documen ... on.href |
331325
| tainted-url-suffix-arguments.js:3:17:3:17 | y | semmle.label | y |
332326
| tainted-url-suffix-arguments.js:6:22:6:22 | y | semmle.label | y |
333327
| tainted-url-suffix-arguments.js:11:11:11:36 | url | semmle.label | url |
@@ -940,10 +934,6 @@ edges
940934
| string-manipulations.js:8:16:8:37 | documen ... on.href | string-manipulations.js:8:16:8:48 | documen ... mLeft() | provenance | |
941935
| string-manipulations.js:9:36:9:57 | documen ... on.href | string-manipulations.js:9:16:9:58 | String. ... n.href) | provenance | |
942936
| string-manipulations.js:10:23:10:44 | documen ... on.href | string-manipulations.js:10:16:10:45 | String( ... n.href) | provenance | |
943-
| string-manipulations.js:11:23:11:44 | documen ... on.href | string-manipulations.js:11:16:11:45 | escape( ... n.href) | provenance | |
944-
| string-manipulations.js:12:23:12:60 | escape( ... .href)) | string-manipulations.js:12:16:12:61 | escape( ... href))) | provenance | |
945-
| string-manipulations.js:12:30:12:59 | escape( ... n.href) | string-manipulations.js:12:23:12:60 | escape( ... .href)) | provenance | |
946-
| string-manipulations.js:12:37:12:58 | documen ... on.href | string-manipulations.js:12:30:12:59 | escape( ... n.href) | provenance | |
947937
| tainted-url-suffix-arguments.js:3:17:3:17 | y | tainted-url-suffix-arguments.js:6:22:6:22 | y | provenance | |
948938
| tainted-url-suffix-arguments.js:11:11:11:36 | url | tainted-url-suffix-arguments.js:12:17:12:19 | url | provenance | |
949939
| tainted-url-suffix-arguments.js:11:17:11:36 | window.location.href | tainted-url-suffix-arguments.js:11:11:11:36 | url | provenance | |

‎javascript/ql/test/query-tests/Security/CWE-079/DomBasedXss/string-manipulations.js‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -8,5 +8,5 @@ document.write(document.location.href.toUpperCase()); // $ Alert
88
document.write(document.location.href.trimLeft()); // $ Alert
99
document.write(String.fromCharCode(document.location.href)); // $ Alert
1010
document.write(String(document.location.href)); // $ Alert
11-
document.write(escape(document.location.href)); // $ SPURIOUS: Alert
12-
document.write(escape(escape(escape(document.location.href)))); // $ SPURIOUS: Alert
11+
document.write(escape(document.location.href));
12+
document.write(escape(escape(escape(document.location.href))));

0 commit comments

Comments
 (0)