Title: [js/client-side-unvalidated-url-redirection] add interpretsValueAsJavaScript predicate by Raz0r · Pull Request #3835 · github/codeql · GitHub
Open Graph Title: [js/client-side-unvalidated-url-redirection] add interpretsValueAsJavaScript predicate by Raz0r · Pull Request #3835 · github/codeql
X Title: [js/client-side-unvalidated-url-redirection] add interpretsValueAsJavaScript predicate by Raz0r · Pull Request #3835 · github/codeql
Description: Hi! The predicate interpretsArgumentsAsHTML catches sinks that use setAttribute(), e.g. var payload = document.location.search.substr(1); var el = document.createElement("input"); el.setAttribute("formaction", payload); document.body.appendChild(el); However it misses direct assignment, e.g. el.formaction = payload. This PR adds a new predicate interpretsValueAsJavaScript and covers the following cases: var payload = document.location.search.substr(1); var el = document.createElement("a"); el.href = payload; document.body.appendChild(el); // XSS var payload = document.location.search.substr(1); var el = document.createElement("button"); el.formaction = payload; document.body.appendChild(el); //