Client-side cross-site scripting

## Rules

**js/xss** (severity: **error**)

> Client-side cross-site scripting

Details

{

    "driver": {

        "name": "CodeQL command-line toolchain",

        "organization": "GitHub",

        "semanticVersion": "2.2.4",

        "rules": [

            {

                "id": "js/xss",

                "name": "js/xss",

                "shortDescription": {

                    "text": "Client-side cross-site scripting"

                },

                "fullDescription": {

                    "text": "Writing user input directly to the DOM allows for a cross-site scripting vulnerability."

                },

                "defaultConfiguration": {

                    "level": "error"

                },

                "properties": {

                    "tags": [

                        "security",

                        "external/cwe/cwe-079",

                        "external/cwe/cwe-116"

                    ],

                    "kind": "path-problem",

                    "precision": "high",

                    "name": "Client-side cross-site scripting",

                    "description": "Writing user input directly to the DOM allows for\n              a cross-site scripting vulnerability.",

                    "id": "js/xss",

                    "problem.severity": "error"

                }

            }

        ]

    }

}

## Results

- **js/xss**: Cross-site scripting vulnerability due to \[user-provided value\]\(1\).

https://github.com/azu/codeql-scan-example/blob/356bd49080c765cf1d81c97e20e9c045cad28352/examples/Xss.js#L4

- **js/xss**: Cross-site scripting vulnerability due to \[user-provided value\]\(1\).

https://github.com/azu/codeql-scan-example/blob/356bd49080c765cf1d81c97e20e9c045cad28352/examples/Xss2.js#L4

Beginne mit den gemeldeten Zeilen in examples/Xss.js und examples/Xss2.js und untersuche anschließend, wie von Benutzern bereitgestellte Werte das DOM erreichen. Führe den CodeQL-Scan des Repositorys aus und betrachte das Issue als abgeschlossen, wenn die js/xss findings für beide Beispiele behoben sind.

Vom Indexierungsmodell aus dem Issue-Text verfasst.