JS: Add tests

Author: asgerf

javascript/ql/test/library-tests/threat-models/sources/TestSources.ext.yml

@@ -0,0 +1,6 @@
+extensions:
+  - addsTo:
+      pack: codeql/javascript-all
+      extensible: sourceModel
+    data:
+      - ['testlib', 'Member[getBrowserSource].ReturnValue', 'browser']

javascript/ql/test/library-tests/threat-models/sources/sources.js

@@ -118,3 +118,42 @@ rl_stdin.question('<question>', handler);
 rl_stdin.on("line", (line) => { // $ threat-source=stdin
     SINK(line); // $ hasFlow
 });
+
+// ------ browser sources ------
+
+function browserSources() {
+    const loc = window.location; // $ threat-source=browser-url
+
+    // Accessing the browser URL via document.location
+    SINK(loc); // $ hasFlow
+
+    // Accessing the browser URL via location.href
+    var href = loc.href; // $ threat-source=browser-url
+    SINK(href); // $ hasFlow
+
+    // Accessing the query string via location.search
+    var search = loc.search; // $ threat-source=browser-url-query
+    SINK(search); // $ hasFlow
+
+    // Accessing the fragment via location.hash
+    var hash = loc.hash; // $ threat-source=browser-url-fragment
+    SINK(hash); // $ hasFlow
+
+    // Accessing window.name
+    var wname = window.name; // $ threat-source=browser-window-name
+    SINK(wname); // $ hasFlow
+
+    // Accessing message events via window.onmessage
+    window.onmessage = function(event) { // $ threat-source=browser-message-event
+        SINK(event); // $ hasFlow
+    };
+
+    // Accessing message events via addEventListener
+    window.addEventListener("message", function(event) { // $ threat-source=browser-message-event
+        SINK(event); // $ hasFlow
+    });
+
+    // Test custom source
+    const customSource = require('testlib').getBrowserSource(); // $ threat-source=browser
+    SINK(customSource); // $ hasFlow
+}