Features/ruleset no backticks in js handlers #292
Conversation
![github-actions[bot]](https://avatars.githubusercontent.com/in/15368?s=60&v=4){kind=small}
| @@ -0,0 +1,6 @@ | |||
| // ruleid: no-backticks-in-js-handlers | |||
| onclick="call('good', `{{var}}`, `{{var}}`)" | |||
There was a problem hiding this comment.
reported by reviewdog 🐶
[semgrep] Backtick in JS handler may cause XSS since they are typically not auto escaped in variables.
Consider using single or double apices, instead of backticks.
Source: https://github.com/brave/security-action
Cc @thypon @bcaller
There was a problem hiding this comment.
TIL
In written Latin, the apex (plural "apices") is a mark with roughly the shape of an acute accent ◌́ which was sometimes placed over vowels to indicate that they are long.
There was a problem hiding this comment.
now you know what they mean by "apex twins" :P
| // ruleid: no-backticks-in-js-handlers | ||
| onclick="call('good', `{{var}}`, `{{var}}`)" | ||
| // ruleid: no-backticks-in-js-handlers | ||
| onclick='call("good", `{{var}}`, `{{var}}`)' |
There was a problem hiding this comment.
reported by reviewdog 🐶
[semgrep] Backtick in JS handler may cause XSS since they are typically not auto escaped in variables.
Consider using single or double apices, instead of backticks.
Source: https://github.com/brave/security-action
Cc @thypon @bcaller
| // ruleid: no-backticks-in-js-handlers | ||
| onclick='call("good", `{{var}}`, `{{var}}`)' | ||
| // ruleid: no-backticks-in-js-handlers | ||
| onclick=call('good', `{{var}}`, `{{var}}`) |
There was a problem hiding this comment.
reported by reviewdog 🐶
[semgrep] Backtick in JS handler may cause XSS since they are typically not auto escaped in variables.
Consider using single or double apices, instead of backticks.
Source: https://github.com/brave/security-action
Cc @thypon @bcaller
| @@ -0,0 +1,6 @@ | |||
| // ruleid: no-backticks-in-js-handlers | |||
| onclick="call('good', `{{var}}`, `{{var}}`)" | |||
There was a problem hiding this comment.
reported by reviewdog 🐶
[semgrep] Backtick in JS handler may cause XSS since they are typically not auto escaped in variables.
Consider using single or double apices, instead of backticks.
Source: https://github.com/brave/security-action
Cc @thypon @bcaller
| // ruleid: no-backticks-in-js-handlers | ||
| onclick="call('good', `{{var}}`, `{{var}}`)" | ||
| // ruleid: no-backticks-in-js-handlers | ||
| onclick='call("good", `{{var}}`, `{{var}}`)' |
There was a problem hiding this comment.
reported by reviewdog 🐶
[semgrep] Backtick in JS handler may cause XSS since they are typically not auto escaped in variables.
Consider using single or double apices, instead of backticks.
Source: https://github.com/brave/security-action
Cc @thypon @bcaller
| // ruleid: no-backticks-in-js-handlers | ||
| onclick='call("good", `{{var}}`, `{{var}}`)' | ||
| // ruleid: no-backticks-in-js-handlers | ||
| onclick=call('good', `{{var}}`, `{{var}}`) |
There was a problem hiding this comment.
reported by reviewdog 🐶
[semgrep] Backtick in JS handler may cause XSS since they are typically not auto escaped in variables.
Consider using single or double apices, instead of backticks.
Source: https://github.com/brave/security-action
Cc @thypon @bcaller
thypon
force-pushed
the
features/ruleset-no-backticks-in-js-handlers
branch
from
54a2e41
to
29ee4de
Compare
No description provided.