Skip to content
This repository was archived by the owner on Jan 5, 2023. It is now read-only.

Add CWE-79: HTML template escaping passthrough #493

Merged
smowton merged 20 commits into from
Apr 8, 2021
Merged

Add CWE-79: HTML template escaping passthrough #493

Changes from 1 commit
Commits
Show all changes
20 commits
Select commit Hold shift + click to select a range
4989434
Add CWE-79: HTML template escaping passthrough
gagliardetto Mar 3, 2021
63d5120
Apply suggestions from code review
gagliardetto Mar 4, 2021
ad91e4a
Remove DummySource
gagliardetto Mar 4, 2021
687e556
Fixes from code review
gagliardetto Mar 5, 2021
963631d
Improve naming.
gagliardetto Mar 8, 2021
7e9f23a
Refactor flow logic to ensure `untrusted` flows to `conversion`, and …
gagliardetto Mar 8, 2021
7b4a748
Remove DummySource
gagliardetto Mar 8, 2021
0bb5ef6
Fix test
gagliardetto Mar 8, 2021
cc31cd2
Fix test
gagliardetto Mar 8, 2021
d5355eb
Cleanup
gagliardetto Mar 8, 2021
b42d21f
Improve comments and naming.
gagliardetto Mar 8, 2021
5351a8e
Use TaintTracking an TaintTracking2
gagliardetto Mar 9, 2021
280ffdf
Fix test
gagliardetto Mar 9, 2021
e2b7c03
Use only one instance of TaintTracking.
gagliardetto Mar 11, 2021
8f124f8
Add missing docs
gagliardetto Mar 11, 2021
541c411
Add isSanitizer predicate to FlowConfFromUntrustedToTemplateExecution…
gagliardetto Mar 11, 2021
1a9b09e
Add NumericType sanitizer
gagliardetto Mar 24, 2021
dc95902
Apply suggestions from code review
gagliardetto Apr 1, 2021
7c35902
Use DataFlow::Node as parameters
gagliardetto Apr 1, 2021
68c0073
Use PassthroughTypeName instead of string
gagliardetto Apr 1, 2021
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
Prev Previous commit
Next Next commit
Fix test
  • Loading branch information
@gagliardetto @smowton
gagliardetto authored and smowton committed Apr 8, 2021
commit 0bb5ef6af2a29d103efb94c62f694252324ac0e0
4 changes: 2 additions & 2 deletions ql/test/experimental/CWE-79/HTMLTemplateEscapingPassthrough.go
100755 → 100644
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -71,13 +71,13 @@ func bad(req *http.Request) {
func good(req *http.Request) {
tmpl, _ := template.New("test").Parse(`Hello, {{.}}\n`)
{ // This will be escaped, so it shoud NOT be caught:
var escaped = source(`<a href="example.com">link</a>`)
var escaped = req.UserAgent()
checkError(tmpl.Execute(os.Stdout, escaped))
}
{
// The converted source value does NOT flow to tmpl.Exec,
// so this should NOT be caught.
src := source(`<a href='example.com'>link</a>`)
src := req.UserAgent()
converted := template.HTML(src)
_ = converted
checkError(tmpl.Execute(os.Stdout, src))
Expand Down