Client-side cross-site scripting

## Rules

**js/xss** (severity: **error**)

> Client-side cross-site scripting

Details

{

    "driver": {

        "name": "CodeQL command-line toolchain",

        "organization": "GitHub",

        "semanticVersion": "2.2.4",

        "rules": [

            {

                "id": "js/xss",

                "name": "js/xss",

                "shortDescription": {

                    "text": "Client-side cross-site scripting"

                },

                "fullDescription": {

                    "text": "Writing user input directly to the DOM allows for a cross-site scripting vulnerability."

                },

                "defaultConfiguration": {

                    "level": "error"

                },

                "properties": {

                    "tags": [

                        "security",

                        "external/cwe/cwe-079",

                        "external/cwe/cwe-116"

                    ],

                    "kind": "path-problem",

                    "precision": "high",

                    "name": "Client-side cross-site scripting",

                    "description": "Writing user input directly to the DOM allows for\n              a cross-site scripting vulnerability.",

                    "id": "js/xss",

                    "problem.severity": "error"

                }

            }

        ]

    }

}

## Results

- **js/xss**: Cross-site scripting vulnerability due to \[user-provided value\]\(1\).

https://github.com/azu/codeql-scan-example/blob/356bd49080c765cf1d81c97e20e9c045cad28352/examples/Xss.js#L4

- **js/xss**: Cross-site scripting vulnerability due to \[user-provided value\]\(1\).

https://github.com/azu/codeql-scan-example/blob/356bd49080c765cf1d81c97e20e9c045cad28352/examples/Xss2.js#L4

Commencez par les lignes signalées dans examples/Xss.js et examples/Xss2.js, puis examinez comment les valeurs fournies par l’utilisateur atteignent le DOM. Exécutez l’analyse CodeQL du dépôt et considérez l’issue comme terminée lorsque les js/xss findings des deux exemples sont résolus.

Rédigé par le modèle d'indexation à partir du texte de l'issue.