Module DomBasedXssConfig
A taint-tracking configuration for reasoning about XSS by DOM manipulation.
Both ordinary HTML sinks, URL sinks, and JQuery selector based sinks.
- HTML sinks are sinks for any tainted value
- URL sinks are only sinks when the scheme is user controlled
- JQuery selector sinks are sinks when the tainted value can start with
<.
The above is achieved using three flow states:
- TaintedUrlSuffix: a URL where the attacker only controls a suffix.
- Taint: a tainted value where the attacker controls part of the value.
- PrefixLabel: a tainted value where the attacker controls the prefix
Import path
import semmle.javascript.security.dataflow.DomBasedXssQueryImports
| CommonFlowState | Contains a class with flow states that are used by multiple queries. |
Predicates
| isAdditionalFlowStep | Holds if data may flow from |
| isBarrier | Holds if data flow through |
| isBarrier | Holds if data flow through |
| isBarrierIn | Holds if data flow into |
| isSink | Holds if |
| isSource | Holds if |
| observeDiffInformedIncrementalMode | Holds if sources and sinks should be filtered to only include those that may lead to a flow path with either a source or a sink in the location range given by |