Skip to content

Commit 5fad828

Browse files
NapalysNapalys
committed
JS:Fix double curly brace issue in incomplete sanitization alerts
1 parent d10002c commit 5fad828

File tree

2 files changed

+42
-40
lines changed

2 files changed

+42
-40
lines changed

‎javascript/ql/src/Security/CWE-116/IncompleteSanitization.ql‎

Lines changed: 5 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -152,12 +152,13 @@ string getPatternOrValueString(DataFlow::Node node) {
152152
else result = node.toString()
153153
}
154154

155-
from StringReplaceCall repl, DataFlow::Node old, string msg
155+
from StringReplaceCall repl, DataFlow::Node old, string msg, string pattern
156156
where
157157
(old = repl.getArgument(0) or old = repl.getRegExp()) and
158158
(
159159
not repl.maybeGlobal() and
160-
msg = "This replaces only the first occurrence of " + getPatternOrValueString(old) + "." and
160+
pattern = getPatternOrValueString(old) and
161+
msg = "This replaces only the first occurrence of $@." and
161162
// only flag if this is likely to be a sanitizer or URL encoder or decoder
162163
exists(string m | m = getAMatchedString(old) |
163164
// sanitizer
@@ -184,6 +185,7 @@ where
184185
or
185186
isBackslashEscape(repl, _) and
186187
not allBackslashesEscaped(repl) and
188+
pattern = "" and
187189
msg = "This does not escape backslash characters in the input."
188190
)
189-
select repl.getCalleeNode(), msg
191+
select repl.getCalleeNode(), msg, old, pattern

‎javascript/ql/test/query-tests/Security/CWE-116/IncompleteSanitization/IncompleteSanitization.expected‎

Lines changed: 37 additions & 37 deletions
Original file line numberDiff line numberDiff line change
@@ -1,37 +1,37 @@
1-
| tst.js:5:10:5:18 | s.replace | This replaces only the first occurrence of "'". |
2-
| tst.js:9:10:9:18 | s.replace | This replaces only the first occurrence of /'/. |
3-
| tst.js:13:10:13:18 | s.replace | This does not escape backslash characters in the input. |
4-
| tst.js:17:10:17:18 | s.replace | This does not escape backslash characters in the input. |
5-
| tst.js:21:10:21:18 | s.replace | This does not escape backslash characters in the input. |
6-
| tst.js:25:10:25:18 | s.replace | This does not escape backslash characters in the input. |
7-
| tst.js:29:10:29:18 | s.replace | This does not escape backslash characters in the input. |
8-
| tst.js:33:10:33:18 | s.replace | This replaces only the first occurrence of '\|'. |
9-
| tst.js:37:10:37:18 | s.replace | This does not escape backslash characters in the input. |
10-
| tst.js:41:10:41:18 | s.replace | This replaces only the first occurrence of "/". |
11-
| tst.js:45:10:45:18 | s.replace | This replaces only the first occurrence of "%25". |
12-
| tst.js:49:10:49:18 | s.replace | This replaces only the first occurrence of `'`. |
13-
| tst.js:53:10:53:18 | s.replace | This replaces only the first occurrence of "'". |
14-
| tst.js:57:10:57:18 | s.replace | This replaces only the first occurrence of `'`. |
15-
| tst.js:61:10:61:18 | s.replace | This replaces only the first occurrence of "'" + "". |
16-
| tst.js:65:10:65:18 | s.replace | This replaces only the first occurrence of "'". |
17-
| tst.js:69:10:69:18 | s.replace | This replaces only the first occurrence of "'" + "". |
18-
| tst.js:133:2:133:10 | s.replace | This replaces only the first occurrence of '<'. |
19-
| tst.js:133:2:133:27 | s.repla ... replace | This replaces only the first occurrence of '>'. |
20-
| tst.js:135:2:135:10 | s.replace | This replaces only the first occurrence of '['. |
21-
| tst.js:135:2:135:30 | s.repla ... replace | This replaces only the first occurrence of ']'. |
22-
| tst.js:136:2:136:10 | s.replace | This replaces only the first occurrence of '{'. |
23-
| tst.js:136:2:136:30 | s.repla ... replace | This replaces only the first occurrence of '}'. |
24-
| tst.js:140:2:140:10 | s.replace | This replaces only the first occurrence of /{/. |
25-
| tst.js:140:2:140:27 | s.repla ... replace | This replaces only the first occurrence of /}/. |
26-
| tst.js:141:2:141:10 | s.replace | This replaces only the first occurrence of ']'. |
27-
| tst.js:141:2:141:27 | s.repla ... replace | This replaces only the first occurrence of '['. |
28-
| tst.js:148:2:148:10 | x.replace | This replaces only the first occurrence of "\\n". |
29-
| tst.js:149:2:149:24 | x.repla ... replace | This replaces only the first occurrence of "\\n". |
30-
| tst.js:193:9:193:17 | s.replace | This replaces only the first occurrence of /'/. |
31-
| tst.js:202:10:202:18 | p.replace | This replaces only the first occurrence of "/../". |
32-
| tst.js:341:9:341:17 | p.replace | This replaces only the first occurrence of /\\.\\.//. |
33-
| tst.js:345:9:345:17 | s.replace | This does not escape backslash characters in the input. |
34-
| tst.js:349:9:349:17 | s.replace | This replaces only the first occurrence of /'/. |
35-
| tst.js:353:9:353:17 | s.replace | This does not escape backslash characters in the input. |
36-
| tst.js:362:2:362:10 | x.replace | This replaces only the first occurrence of /\n/. |
37-
| tst.js:363:2:363:24 | x.repla ... replace | This replaces only the first occurrence of /\n/. |
1+
| tst.js:5:10:5:18 | s.replace | This replaces only the first occurrence of $@. | tst.js:5:20:5:22 | "'" | "'" |
2+
| tst.js:9:10:9:18 | s.replace | This replaces only the first occurrence of $@. | tst.js:9:20:9:22 | /'/ | /'/ |
3+
| tst.js:13:10:13:18 | s.replace | This does not escape backslash characters in the input. | tst.js:13:20:13:23 | /'/g | |
4+
| tst.js:17:10:17:18 | s.replace | This does not escape backslash characters in the input. | tst.js:17:20:17:23 | /'/g | |
5+
| tst.js:21:10:21:18 | s.replace | This does not escape backslash characters in the input. | tst.js:21:20:21:26 | /['"]/g | |
6+
| tst.js:25:10:25:18 | s.replace | This does not escape backslash characters in the input. | tst.js:25:20:25:28 | /(['"])/g | |
7+
| tst.js:29:10:29:18 | s.replace | This does not escape backslash characters in the input. | tst.js:29:20:29:27 | /('\|")/g | |
8+
| tst.js:33:10:33:18 | s.replace | This replaces only the first occurrence of $@. | tst.js:33:20:33:22 | '\|' | '\|' |
9+
| tst.js:37:10:37:18 | s.replace | This does not escape backslash characters in the input. | tst.js:37:20:37:23 | /"/g | |
10+
| tst.js:41:10:41:18 | s.replace | This replaces only the first occurrence of $@. | tst.js:41:20:41:22 | "/" | "/" |
11+
| tst.js:45:10:45:18 | s.replace | This replaces only the first occurrence of $@. | tst.js:45:20:45:24 | "%25" | "%25" |
12+
| tst.js:49:10:49:18 | s.replace | This replaces only the first occurrence of $@. | tst.js:49:20:49:22 | `'` | `'` |
13+
| tst.js:53:10:53:18 | s.replace | This replaces only the first occurrence of $@. | tst.js:53:20:53:22 | "'" | "'" |
14+
| tst.js:57:10:57:18 | s.replace | This replaces only the first occurrence of $@. | tst.js:57:20:57:22 | `'` | `'` |
15+
| tst.js:61:10:61:18 | s.replace | This replaces only the first occurrence of $@. | tst.js:61:20:61:27 | "'" + "" | "'" + "" |
16+
| tst.js:65:10:65:18 | s.replace | This replaces only the first occurrence of $@. | tst.js:65:20:65:22 | "'" | "'" |
17+
| tst.js:69:10:69:18 | s.replace | This replaces only the first occurrence of $@. | tst.js:69:20:69:27 | "'" + "" | "'" + "" |
18+
| tst.js:133:2:133:10 | s.replace | This replaces only the first occurrence of $@. | tst.js:133:12:133:14 | '<' | '<' |
19+
| tst.js:133:2:133:27 | s.repla ... replace | This replaces only the first occurrence of $@. | tst.js:133:29:133:31 | '>' | '>' |
20+
| tst.js:135:2:135:10 | s.replace | This replaces only the first occurrence of $@. | tst.js:135:12:135:14 | '[' | '[' |
21+
| tst.js:135:2:135:30 | s.repla ... replace | This replaces only the first occurrence of $@. | tst.js:135:32:135:34 | ']' | ']' |
22+
| tst.js:136:2:136:10 | s.replace | This replaces only the first occurrence of $@. | tst.js:136:12:136:14 | '{' | '{' |
23+
| tst.js:136:2:136:30 | s.repla ... replace | This replaces only the first occurrence of $@. | tst.js:136:32:136:34 | '}' | '}' |
24+
| tst.js:140:2:140:10 | s.replace | This replaces only the first occurrence of $@. | tst.js:140:12:140:14 | /{/ | /{/ |
25+
| tst.js:140:2:140:27 | s.repla ... replace | This replaces only the first occurrence of $@. | tst.js:140:29:140:31 | /}/ | /}/ |
26+
| tst.js:141:2:141:10 | s.replace | This replaces only the first occurrence of $@. | tst.js:141:12:141:14 | ']' | ']' |
27+
| tst.js:141:2:141:27 | s.repla ... replace | This replaces only the first occurrence of $@. | tst.js:141:29:141:31 | '[' | '[' |
28+
| tst.js:148:2:148:10 | x.replace | This replaces only the first occurrence of $@. | tst.js:148:12:148:15 | "\\n" | "\\n" |
29+
| tst.js:149:2:149:24 | x.repla ... replace | This replaces only the first occurrence of $@. | tst.js:149:26:149:29 | "\\n" | "\\n" |
30+
| tst.js:193:9:193:17 | s.replace | This replaces only the first occurrence of $@. | tst.js:192:17:192:19 | /'/ | /'/ |
31+
| tst.js:202:10:202:18 | p.replace | This replaces only the first occurrence of $@. | tst.js:202:20:202:25 | "/../" | "/../" |
32+
| tst.js:341:9:341:17 | p.replace | This replaces only the first occurrence of $@. | tst.js:341:19:341:39 | new Reg ... .\\\\./") | /\\.\\.// |
33+
| tst.js:345:9:345:17 | s.replace | This does not escape backslash characters in the input. | tst.js:345:19:345:38 | new RegExp("\\'","g") | |
34+
| tst.js:349:9:349:17 | s.replace | This replaces only the first occurrence of $@. | tst.js:349:19:349:34 | new RegExp("\\'") | /'/ |
35+
| tst.js:353:9:353:17 | s.replace | This does not escape backslash characters in the input. | tst.js:353:19:353:50 | new Reg ... lags()) | |
36+
| tst.js:362:2:362:10 | x.replace | This replaces only the first occurrence of $@. | tst.js:362:12:362:27 | new RegExp("\\n") | /\n/ |
37+
| tst.js:363:2:363:24 | x.repla ... replace | This replaces only the first occurrence of $@. | tst.js:363:26:363:41 | new RegExp("\\n") | /\n/ |

0 commit comments

Comments
 (0)