Client-side cross-site scripting

## Rules

**js/xss** (severity: **error**)

> Client-side cross-site scripting

Details

{

    "driver": {

        "name": "CodeQL command-line toolchain",

        "organization": "GitHub",

        "semanticVersion": "2.2.4",

        "rules": [

            {

                "id": "js/xss",

                "name": "js/xss",

                "shortDescription": {

                    "text": "Client-side cross-site scripting"

                },

                "fullDescription": {

                    "text": "Writing user input directly to the DOM allows for a cross-site scripting vulnerability."

                },

                "defaultConfiguration": {

                    "level": "error"

                },

                "properties": {

                    "tags": [

                        "security",

                        "external/cwe/cwe-079",

                        "external/cwe/cwe-116"

                    ],

                    "kind": "path-problem",

                    "precision": "high",

                    "name": "Client-side cross-site scripting",

                    "description": "Writing user input directly to the DOM allows for\n              a cross-site scripting vulnerability.",

                    "id": "js/xss",

                    "problem.severity": "error"

                }

            }

        ]

    }

}

## Results

- **js/xss**: Cross-site scripting vulnerability due to \[user-provided value\]\(1\).

https://github.com/azu/codeql-scan-example/blob/356bd49080c765cf1d81c97e20e9c045cad28352/examples/Xss.js#L4

- **js/xss**: Cross-site scripting vulnerability due to \[user-provided value\]\(1\).

https://github.com/azu/codeql-scan-example/blob/356bd49080c765cf1d81c97e20e9c045cad28352/examples/Xss2.js#L4

从 examples/Xss.js 和 examples/Xss2.js 中报告的行开始，然后检查用户提供的值如何到达 DOM。运行仓库的 CodeQL 扫描，并在两个示例的 js/xss findings 都得到解决后将 issue 视为完成。

由索引模型根据 Issue 内容生成。