Client-side cross-site scripting
Nobody has claimed this yet.
Assessment
- Difficulty
- 3/5
- Estimated time
- 1-2 days
- Newbie friendliness
- 45/100
- Issue type
- Bug
- Clarity
- Clearly specified
- Activity status
- Stale
- Tech stack
- javascript
- Domain
- security
Research direction
Start with the reported lines in examples/Xss.js and examples/Xss2.js, then inspect how user-provided values reach the DOM. Run the repository's CodeQL scan and consider the issue complete when the js/xss findings for both examples are resolved.
Written by the indexing model from the issue text.
Description
Rules
js/xss (severity: error)
Client-side cross-site scripting
Details
{
"driver": {
"name": "CodeQL command-line toolchain",
"organization": "GitHub",
"semanticVersion": "2.2.4",
"rules": [
{
"id": "js/xss",
"name": "js/xss",
"shortDescription": {
"text": "Client-side cross-site scripting"
},
"fullDescription": {
"text": "Writing user input directly to the DOM allows for a cross-site scripting vulnerability."
},
"defaultConfiguration": {
"level": "error"
},
"properties": {
"tags": [
"security",
"external/cwe/cwe-079",
"external/cwe/cwe-116"
],
"kind": "path-problem",
"precision": "high",
"name": "Client-side cross-site scripting",
"description": "Writing user input directly to the DOM allows for\n a cross-site scripting vulnerability.",
"id": "js/xss",
"problem.severity": "error"
}
}
]
}
}Results
- js/xss: Cross-site scripting vulnerability due to [user-provided value](1).
- js/xss: Cross-site scripting vulnerability due to [user-provided value](1).
- Dominant language
- CodeQL
- Stars
- 1
- Forks
- 0
- PR merge metrics
- No merged PRs in 30d
Contributor guide
No contributing guide indexed for this repository
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
More from azu/codeql-scan-example
-
Issue example Open
Difficulty 5/5 Over a week Newbie friendliness 1/100
azu/codeql-scan-example#1 · 1 comment ·
All issues in azu/codeql-scan-example
Similar issues
-
documentation help wanted
Difficulty 2/5 1-3 hours Newbie friendliness 88/100
-
Difficulty 2/5 1-3 hours Newbie friendliness 76/100
AXERA-TECH/ax-llm#75 ·
-
bug
Difficulty 2/5 1-3 hours Newbie friendliness 68/100
gitbutlerapp/gitbutler#15998 · 1 comment ·
-
Difficulty 2/5 1-3 hours Newbie friendliness 78/100
sympozium-ai/sympozium#627 ·
-
clawsweeper:needs-product-decision clawsweeper:no-new-fix-pr clawsweeper:source-repro impact:security impact:ux-friction issue-rating: 🦞 diamond lobster P2
Difficulty 2/5 1-3 hours Newbie friendliness 84/100