Skip to content
This repository has been archived by the owner on Jul 20, 2018. It is now read-only.

Flagging of common XSS vectors #267

Closed
wants to merge 44 commits into from
Closed
Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
44 commits
Select commit Hold shift + click to select a range
310bb51
VIP Scanner: filter_files() now accepts arrays of file types for more…
Mar 26, 2015
ef28701
VIP Scanner: Added preliminary support for XSS checks.
Mar 26, 2015
9581b53
VIP Scanner: Added XSSVectorsCheck to config-vip-scanner.php so it wi…
Mar 26, 2015
fc6d936
VIP Scanner: Added search for -moz-binding in HTML tag style attributes
Mar 26, 2015
b3980b5
VIP Scanner: Created a seperate function sanitize_string() to use ins…
Mar 26, 2015
9373b7f
VIP Scanner: Checks inside XSSVectorsCheck now use the sanitize_strin…
Mar 26, 2015
e2752bf
VIP Scanner: New XSS check for javascript inside of <style> tags.
Mar 26, 2015
99d8a95
VIP Scanner: New XSS check for CSS expression properties.
Mar 26, 2015
84ac45d
VIP Scanner: Moved current XSS checks to array to iterate over them w…
Mar 26, 2015
dc02048
VIP Scanner: Moved the order of sanitizations around.
Mar 26, 2015
9e3a678
VIP Scanner: Added comments to XSS unit tests.
Mar 26, 2015
69c28c4
VIP Scanner: New XSS check for CSS expression properties.
Mar 26, 2015
bcd9dda
VIP Scanner: Fixed some string typos in test-XSSVectorsCheck.php.
Mar 26, 2015
0ca7868
VIP Scanner: sanitizer now pulls whitespace out.
Mar 26, 2015
661a861
VIP Scanner: xss-in-link-tag-href updated to search inside more malfo…
Mar 26, 2015
83bf849
VIP Scanner: New XSS check for javascript in <bgsound> tag src attrib…
Mar 26, 2015
294dad7
VIP Scanner: Will now scan all HTML tags for javascript directives.
Mar 26, 2015
2176dbb
VIP Scanner: Updated other regular expressions to be quote indepenent.
Mar 26, 2015
29a96d6
VIP Scanner: New XSS check for script tag in malformed img tag.
Mar 26, 2015
d15f038
VIP Scanner: Added new filters to sanatize against in sanatize_string().
Mar 26, 2015
56567c5
VIP Scanner: Added unit tests against malformed whitespace and embedd…
Mar 26, 2015
f4d8743
VIP Scanner: New XSS check for javascript declaration in <body> backg…
Mar 26, 2015
27da14d
VIP Scanner: display_theme_review_result_row() was not escaping html …
Mar 26, 2015
867766d
VIP Scanner: New XSS check for javascript declaration in rarely used …
Mar 27, 2015
a335b76
VIP Scanner: renamed slug xss--in-any-tag-src to xss-javascript-in-an…
Mar 27, 2015
05b783d
VIP Scanner: New XSS check for rarely used scripting languages in all…
Mar 27, 2015
dc64116
VIP Scanner: New XSS check for javascript in meta tag content attribute.
Mar 27, 2015
14ffdb8
VIP Scanner: Updated XSS scan for javascript declaration in src attri…
Mar 27, 2015
68ea3e6
VIP Scanner: New XSS check for javascript in base tag href attribute.
Mar 27, 2015
d99be13
VIP Scanner: Updated regex for malformed img tag XSS check.
Mar 27, 2015
643f924
VIP Scanner: When searching for 'match-text' we now use stripos() ins…
Mar 27, 2015
f3432a0
VIP Scanner: New XSS check for x-scriptlet type in object tag.
Mar 27, 2015
31550e4
VIP Scanner: Updated some regular expressions to ungreedy matching wh…
Mar 27, 2015
2db72b3
VIP Scanner: Updated sanitize_string() to sanitize HTML comments.
Mar 27, 2015
1108400
VIP Scanner: Added unit test for comment obfuscated javascript in src…
Mar 27, 2015
9318ff8
VIP Scanner: Added scans for CSS files.
Mar 27, 2015
0a64570
VIP Scanner: Fixing some small typos and whitespace problems.
Mar 27, 2015
c1efcaf
VIP Scanner: Modified CheckTestBase to accept other file checks.
Mar 27, 2015
e84274c
VIP Scanner: Forcing all regex matches to be ungreedy.
Mar 27, 2015
722c494
VIP Scanner: Breaking apart the xss-javascript-in-any-tag-src to chec…
Mar 27, 2015
50dadf0
VIP Scanner: Breaking apart the xss-javascript-in-any-tag-src to chec…
Mar 27, 2015
7464f88
VIP Scanner: Removed 'html' from runCheck() in CheckTestBase.php.
Mar 27, 2015
caa3d9d
VIP Scanner: Moved scan description escaping from display_theme_revie…
Mar 31, 2015
971e0e0
VIP Scanner: Renamed variable in filter_files() to make it more descr…
Apr 2, 2015
File filter

Filter by extension

Filter by extension

Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
5 changes: 4 additions & 1 deletion tests/checks/CheckTestBase.php
Original file line number Diff line number Diff line change
Expand Up @@ -13,7 +13,10 @@ public function setUp() {
}

public function runCheck( $file_contents ) {
$input = array( 'php' => array( 'test.php' => $file_contents ) );
$input = array(
'php' => array('test.php' => $file_contents ),
'css' => array('test.css' => $file_contents ),
);

$result = $this->check->check( $input );
$errors = $this->check->get_errors();
Expand Down
Loading