Skip to content

JS: fix js/double-escaping displaying empty metachar #19840

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Closed
Napalys wants to merge 2 commits into from
Closed

JS: fix js/double-escaping displaying empty metachar #19840

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
742a1e7
JS: update `js/double-escaping` message with escaping of \
Napalys Jun 23, 2025
466eac3
JS: add change note
Napalys Jun 23, 2025
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
6 changes: 4 additions & 2 deletions javascript/ql/src/Security/CWE-116/DoubleEscaping.ql
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -125,9 +125,11 @@ from Replacement primary, Replacement supplementary, string message, string meta
where
primary.escapes(metachar, _) and
supplementary = primary.getAnEarlierEscaping(metachar) and
message = "may double-escape '" + metachar + "' characters from $@"
message = "may double-escape '" + metachar.replaceAll("\\", "\\\\") + "' characters from $@"
or
primary.unescapes(_, metachar) and
supplementary = primary.getALaterUnescaping(metachar) and
message = "may produce '" + metachar + "' characters that are double-unescaped $@"
message =
"may produce '" + metachar.replaceAll("\\", "\\\\") +
"' characters that are double-unescaped $@"
Comment on lines 126 to +134
Copy link

Copilot AI Jun 23, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

[nitpick] Consider extracting the metachar.replaceAll("\\", "\\\\") call into a local variable (e.g. displayMetachar) to improve readability and avoid repeating this expression in both message branches.

Copilot uses AI. Check for mistakes.
select primary, "This replacement " + message + ".", supplementary, "here"
4 changes: 4 additions & 0 deletions javascript/ql/src/change-notes/2025-06-23-double-escaping.md
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,4 @@
---
category: fix
---
* The `js/double-escaping` query now correctly displays backslash metacharacters in alert messages.
2 changes: 1 addition & 1 deletion javascript/ql/test/query-tests/Security/CWE-116/DoubleEscaping/DoubleEscaping.expected
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -2,7 +2,7 @@
| tst.js:20:10:20:33 | s.repla ... g, "&") | This replacement may produce '&' characters that are double-unescaped $@. | tst.js:20:10:21:35 | s.repla ... , "\\"") | here |
| tst.js:30:10:30:33 | s.repla ... g, "&") | This replacement may produce '&' characters that are double-unescaped $@. | tst.js:30:10:32:34 | s.repla ... g, "'") | here |
| tst.js:47:7:47:30 | s.repla ... g, "&") | This replacement may produce '&' characters that are double-unescaped $@. | tst.js:48:7:48:32 | s.repla ... , "\\"") | here |
| tst.js:53:10:53:33 | s.repla ... , '\\\\') | This replacement may produce '\\' characters that are double-unescaped $@. | tst.js:53:10:54:33 | s.repla ... , '\\'') | here |
| tst.js:53:10:53:33 | s.repla ... , '\\\\') | This replacement may produce '\\\\' characters that are double-unescaped $@. | tst.js:53:10:54:33 | s.repla ... , '\\'') | here |
| tst.js:60:7:60:28 | s.repla ... '%25') | This replacement may double-escape '%' characters from $@. | tst.js:59:7:59:28 | s.repla ... '%26') | here |
| tst.js:68:10:70:38 | s.repla ... &") | This replacement may double-escape '&' characters from $@. | tst.js:68:10:69:39 | s.repla ... apos;") | here |
| tst.js:79:10:79:66 | s.repla ... &") | This replacement may double-escape '&' characters from $@. | tst.js:79:10:79:43 | s.repla ... epl[c]) | here |
Expand Down