GV

GeezerVison

The World Wide Web, restored to 800 pixels of glory.

Home|About|Gaming cabinet|Archives|How it works|Starter sites

On this site

  • Sign in
  • ActionsCI/CD and automation
  • CodespacesCloud development environments
  • All Features
  • Documentation
  • Training
  • Certifications
  • Build with Copilot
  • Customize Copilot
  • Integrations
  • Trending repos
  • GitHub Sponsors
  • Developer articles
  • Enterprises

This view

  • Original page
  • New address

GeezerVison is showing github.com — Add tests documenting limitations of multiline detection · github/codeql@a986a00

File tree

Expand file treeCollapse file tree
Open diff view settings
Filter options
  • javascript/ql/test/library-tests/RegExpSanitizer
    • decorators.ts
    • guards.js
Expand file treeCollapse file tree
Open diff view settings
Collapse file

‎javascript/ql/test/library-tests/RegExpSanitizer/decorators.ts‎

Copy file name to clipboardExpand all lines: javascript/ql/test/library-tests/RegExpSanitizer/decorators.ts
+7Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -12,4 +12,11 @@ class Validated {
1212

1313
@Matches(new RegExp("^\\w+$", "m"))
1414
constructedMultiline: string;
15+
16+
@Matches("^\\w+$", "i") // $ sanitizer
17+
stringSingleLine: string;
18+
19+
// Separate flags for string patterns are not currently covered by the sanitizer model.
20+
@Matches("^\\w+$", "m") // $ SPURIOUS: sanitizer
21+
stringMultiline: string;
1522
}
Collapse file

‎javascript/ql/test/library-tests/RegExpSanitizer/guards.js‎

Copy file name to clipboardExpand all lines: javascript/ql/test/library-tests/RegExpSanitizer/guards.js
+11Lines changed: 11 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -80,6 +80,17 @@ function constructors(flags) {
8080
}
8181
}
8282

83+
function overriddenFlags() {
84+
const value = source();
85+
// Explicit overrides removing a literal's `m` flag are not currently covered by the sanitizer model.
86+
if (new RegExp(/^[\w.-]+$/m, "").test(value)) {
87+
sink(value); // $ SPURIOUS: flow
88+
}
89+
if (new RegExp(/^[\w.-]+$/m, "i").test(value)) {
90+
sink(value); // $ SPURIOUS: flow
91+
}
92+
}
93+
8394
function groupsAndAlternatives() {
8495
const value = source();
8596
if (/(^[\w.-]+$)/m.test(value)) {

0 commit comments

Comments
0 (0)
You are visitor 01402520 — GeezerVison does not store the pages you look up.
Best viewed with Netscape Navigator 4.7 or Internet Explorer 6 at 800×600. No cookies required.