Skip to content

Commit 6208017

Browse files
NapalysNapalys
committed
Added test cases for firebase both client and server sides.
1 parent 53c4b29 commit 6208017

File tree

6 files changed

+152
-0
lines changed

6 files changed

+152
-0
lines changed

‎javascript/ql/test/query-tests/Security/CWE-079/DomBasedXss/Xss.expected‎

Lines changed: 40 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -62,6 +62,17 @@
6262
| dragAndDrop.ts:73:29:73:39 | droppedHtml | dragAndDrop.ts:71:27:71:61 | e.dataT ... /html') | dragAndDrop.ts:73:29:73:39 | droppedHtml | Cross-site scripting vulnerability due to $@. | dragAndDrop.ts:71:27:71:61 | e.dataT ... /html') | user-provided value |
6363
| event-handler-receiver.js:2:31:2:83 | '<h2><a ... ></h2>' | event-handler-receiver.js:2:49:2:61 | location.href | event-handler-receiver.js:2:31:2:83 | '<h2><a ... ></h2>' | Cross-site scripting vulnerability due to $@. | event-handler-receiver.js:2:49:2:61 | location.href | user-provided value |
6464
| express.js:6:15:6:33 | req.param("wobble") | express.js:6:15:6:33 | req.param("wobble") | express.js:6:15:6:33 | req.param("wobble") | Cross-site scripting vulnerability due to $@. | express.js:6:15:6:33 | req.param("wobble") | user-provided value |
65+
| firebase-client.js:7:59:7:65 | x.val() | firebase-client.js:7:59:7:65 | x.val() | firebase-client.js:7:59:7:65 | x.val() | Cross-site scripting vulnerability due to $@. | firebase-client.js:7:59:7:65 | x.val() | user-provided value |
66+
| firebase-client.js:8:59:8:79 | x.expor ... message | firebase-client.js:8:59:8:71 | x.exportVal() | firebase-client.js:8:59:8:79 | x.expor ... message | Cross-site scripting vulnerability due to $@. | firebase-client.js:8:59:8:71 | x.exportVal() | user-provided value |
67+
| firebase-client.js:10:63:10:82 | parentSnapshot.val() | firebase-client.js:10:63:10:82 | parentSnapshot.val() | firebase-client.js:10:63:10:82 | parentSnapshot.val() | Cross-site scripting vulnerability due to $@. | firebase-client.js:10:63:10:82 | parentSnapshot.val() | user-provided value |
68+
| firebase-client.js:14:54:14:70 | bioSnapshot.val() | firebase-client.js:14:54:14:70 | bioSnapshot.val() | firebase-client.js:14:54:14:70 | bioSnapshot.val() | Cross-site scripting vulnerability due to $@. | firebase-client.js:14:54:14:70 | bioSnapshot.val() | user-provided value |
69+
| firebase-client.js:19:56:19:84 | `<div>$ ... </div>` | firebase-client.js:18:20:18:38 | childSnapshot.val() | firebase-client.js:19:56:19:84 | `<div>$ ... </div>` | Cross-site scripting vulnerability due to $@. | firebase-client.js:18:20:18:38 | childSnapshot.val() | user-provided value |
70+
| firebase-client.js:25:59:25:65 | x.val() | firebase-client.js:25:59:25:65 | x.val() | firebase-client.js:25:59:25:65 | x.val() | Cross-site scripting vulnerability due to $@. | firebase-client.js:25:59:25:65 | x.val() | user-provided value |
71+
| firebase-client.js:26:59:26:79 | x.expor ... message | firebase-client.js:26:59:26:71 | x.exportVal() | firebase-client.js:26:59:26:79 | x.expor ... message | Cross-site scripting vulnerability due to $@. | firebase-client.js:26:59:26:71 | x.exportVal() | user-provided value |
72+
| firebase-client.js:28:63:28:82 | parentSnapshot.val() | firebase-client.js:28:63:28:82 | parentSnapshot.val() | firebase-client.js:28:63:28:82 | parentSnapshot.val() | Cross-site scripting vulnerability due to $@. | firebase-client.js:28:63:28:82 | parentSnapshot.val() | user-provided value |
73+
| firebase-client.js:33:52:33:65 | snapshot.val() | firebase-client.js:33:52:33:65 | snapshot.val() | firebase-client.js:33:52:33:65 | snapshot.val() | Cross-site scripting vulnerability due to $@. | firebase-client.js:33:52:33:65 | snapshot.val() | user-provided value |
74+
| firebase-client.js:38:56:38:67 | userData.bio | firebase-client.js:37:22:37:35 | snapshot.val() | firebase-client.js:38:56:38:67 | userData.bio | Cross-site scripting vulnerability due to $@. | firebase-client.js:37:22:37:35 | snapshot.val() | user-provided value |
75+
| firebase-client.js:44:55:44:74 | parentSnapshot.val() | firebase-client.js:44:55:44:74 | parentSnapshot.val() | firebase-client.js:44:55:44:74 | parentSnapshot.val() | Cross-site scripting vulnerability due to $@. | firebase-client.js:44:55:44:74 | parentSnapshot.val() | user-provided value |
6576
| jquery.js:7:5:7:34 | "<div i ... + "\\">" | jquery.js:2:17:2:40 | documen ... .search | jquery.js:7:5:7:34 | "<div i ... + "\\">" | Cross-site scripting vulnerability due to $@. | jquery.js:2:17:2:40 | documen ... .search | user-provided value |
6677
| jquery.js:8:18:8:34 | "XSS: " + tainted | jquery.js:2:17:2:40 | documen ... .search | jquery.js:8:18:8:34 | "XSS: " + tainted | Cross-site scripting vulnerability due to $@. | jquery.js:2:17:2:40 | documen ... .search | user-provided value |
6778
| jquery.js:10:5:10:40 | "<b>" + ... "</b>" | jquery.js:10:13:10:20 | location | jquery.js:10:5:10:40 | "<b>" + ... "</b>" | Cross-site scripting vulnerability due to $@. | jquery.js:10:13:10:20 | location | user-provided value |
@@ -352,6 +363,15 @@ edges
352363
| dragAndDrop.ts:71:27:71:61 | e.dataT ... /html') | dragAndDrop.ts:71:13:71:61 | droppedHtml | provenance | |
353364
| event-handler-receiver.js:2:49:2:61 | location.href | event-handler-receiver.js:2:31:2:83 | '<h2><a ... ></h2>' | provenance | |
354365
| event-handler-receiver.js:2:49:2:61 | location.href | event-handler-receiver.js:2:31:2:83 | '<h2><a ... ></h2>' | provenance | Config |
366+
| firebase-client.js:8:59:8:71 | x.exportVal() | firebase-client.js:8:59:8:79 | x.expor ... message | provenance | |
367+
| firebase-client.js:18:13:18:38 | data | firebase-client.js:19:64:19:67 | data | provenance | |
368+
| firebase-client.js:18:20:18:38 | childSnapshot.val() | firebase-client.js:18:13:18:38 | data | provenance | |
369+
| firebase-client.js:19:64:19:67 | data | firebase-client.js:19:64:19:76 | data.username | provenance | |
370+
| firebase-client.js:19:64:19:76 | data.username | firebase-client.js:19:56:19:84 | `<div>$ ... </div>` | provenance | |
371+
| firebase-client.js:26:59:26:71 | x.exportVal() | firebase-client.js:26:59:26:79 | x.expor ... message | provenance | |
372+
| firebase-client.js:37:11:37:35 | userData | firebase-client.js:38:56:38:63 | userData | provenance | |
373+
| firebase-client.js:37:22:37:35 | snapshot.val() | firebase-client.js:37:11:37:35 | userData | provenance | |
374+
| firebase-client.js:38:56:38:63 | userData | firebase-client.js:38:56:38:67 | userData.bio | provenance | |
355375
| jquery.js:2:7:2:40 | tainted | jquery.js:4:5:4:11 | tainted | provenance | |
356376
| jquery.js:2:7:2:40 | tainted | jquery.js:5:13:5:19 | tainted | provenance | |
357377
| jquery.js:2:7:2:40 | tainted | jquery.js:6:11:6:17 | tainted | provenance | |
@@ -954,6 +974,26 @@ nodes
954974
| event-handler-receiver.js:2:31:2:83 | '<h2><a ... ></h2>' | semmle.label | '<h2><a ... ></h2>' |
955975
| event-handler-receiver.js:2:49:2:61 | location.href | semmle.label | location.href |
956976
| express.js:6:15:6:33 | req.param("wobble") | semmle.label | req.param("wobble") |
977+
| firebase-client.js:7:59:7:65 | x.val() | semmle.label | x.val() |
978+
| firebase-client.js:8:59:8:71 | x.exportVal() | semmle.label | x.exportVal() |
979+
| firebase-client.js:8:59:8:79 | x.expor ... message | semmle.label | x.expor ... message |
980+
| firebase-client.js:10:63:10:82 | parentSnapshot.val() | semmle.label | parentSnapshot.val() |
981+
| firebase-client.js:14:54:14:70 | bioSnapshot.val() | semmle.label | bioSnapshot.val() |
982+
| firebase-client.js:18:13:18:38 | data | semmle.label | data |
983+
| firebase-client.js:18:20:18:38 | childSnapshot.val() | semmle.label | childSnapshot.val() |
984+
| firebase-client.js:19:56:19:84 | `<div>$ ... </div>` | semmle.label | `<div>$ ... </div>` |
985+
| firebase-client.js:19:64:19:67 | data | semmle.label | data |
986+
| firebase-client.js:19:64:19:76 | data.username | semmle.label | data.username |
987+
| firebase-client.js:25:59:25:65 | x.val() | semmle.label | x.val() |
988+
| firebase-client.js:26:59:26:71 | x.exportVal() | semmle.label | x.exportVal() |
989+
| firebase-client.js:26:59:26:79 | x.expor ... message | semmle.label | x.expor ... message |
990+
| firebase-client.js:28:63:28:82 | parentSnapshot.val() | semmle.label | parentSnapshot.val() |
991+
| firebase-client.js:33:52:33:65 | snapshot.val() | semmle.label | snapshot.val() |
992+
| firebase-client.js:37:11:37:35 | userData | semmle.label | userData |
993+
| firebase-client.js:37:22:37:35 | snapshot.val() | semmle.label | snapshot.val() |
994+
| firebase-client.js:38:56:38:63 | userData | semmle.label | userData |
995+
| firebase-client.js:38:56:38:67 | userData.bio | semmle.label | userData.bio |
996+
| firebase-client.js:44:55:44:74 | parentSnapshot.val() | semmle.label | parentSnapshot.val() |
957997
| jquery.js:2:7:2:40 | tainted | semmle.label | tainted |
958998
| jquery.js:2:17:2:40 | documen ... .search | semmle.label | documen ... .search |
959999
| jquery.js:4:5:4:11 | tainted | semmle.label | tainted |

‎javascript/ql/test/query-tests/Security/CWE-079/DomBasedXss/XssWithAdditionalSources.expected‎

Lines changed: 29 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -154,6 +154,26 @@ nodes
154154
| event-handler-receiver.js:2:31:2:83 | '<h2><a ... ></h2>' | semmle.label | '<h2><a ... ></h2>' |
155155
| event-handler-receiver.js:2:49:2:61 | location.href | semmle.label | location.href |
156156
| express.js:6:15:6:33 | req.param("wobble") | semmle.label | req.param("wobble") |
157+
| firebase-client.js:7:59:7:65 | x.val() | semmle.label | x.val() |
158+
| firebase-client.js:8:59:8:71 | x.exportVal() | semmle.label | x.exportVal() |
159+
| firebase-client.js:8:59:8:79 | x.expor ... message | semmle.label | x.expor ... message |
160+
| firebase-client.js:10:63:10:82 | parentSnapshot.val() | semmle.label | parentSnapshot.val() |
161+
| firebase-client.js:14:54:14:70 | bioSnapshot.val() | semmle.label | bioSnapshot.val() |
162+
| firebase-client.js:18:13:18:38 | data | semmle.label | data |
163+
| firebase-client.js:18:20:18:38 | childSnapshot.val() | semmle.label | childSnapshot.val() |
164+
| firebase-client.js:19:56:19:84 | `<div>$ ... </div>` | semmle.label | `<div>$ ... </div>` |
165+
| firebase-client.js:19:64:19:67 | data | semmle.label | data |
166+
| firebase-client.js:19:64:19:76 | data.username | semmle.label | data.username |
167+
| firebase-client.js:25:59:25:65 | x.val() | semmle.label | x.val() |
168+
| firebase-client.js:26:59:26:71 | x.exportVal() | semmle.label | x.exportVal() |
169+
| firebase-client.js:26:59:26:79 | x.expor ... message | semmle.label | x.expor ... message |
170+
| firebase-client.js:28:63:28:82 | parentSnapshot.val() | semmle.label | parentSnapshot.val() |
171+
| firebase-client.js:33:52:33:65 | snapshot.val() | semmle.label | snapshot.val() |
172+
| firebase-client.js:37:11:37:35 | userData | semmle.label | userData |
173+
| firebase-client.js:37:22:37:35 | snapshot.val() | semmle.label | snapshot.val() |
174+
| firebase-client.js:38:56:38:63 | userData | semmle.label | userData |
175+
| firebase-client.js:38:56:38:67 | userData.bio | semmle.label | userData.bio |
176+
| firebase-client.js:44:55:44:74 | parentSnapshot.val() | semmle.label | parentSnapshot.val() |
157177
| hana.js:11:37:11:40 | rows | semmle.label | rows |
158178
| hana.js:11:37:11:51 | rows[0].comment | semmle.label | rows[0].comment |
159179
| hana.js:16:37:16:40 | rows | semmle.label | rows |
@@ -820,6 +840,15 @@ edges
820840
| dragAndDrop.ts:71:27:71:61 | e.dataT ... /html') | dragAndDrop.ts:71:13:71:61 | droppedHtml | provenance | |
821841
| event-handler-receiver.js:2:49:2:61 | location.href | event-handler-receiver.js:2:31:2:83 | '<h2><a ... ></h2>' | provenance | |
822842
| event-handler-receiver.js:2:49:2:61 | location.href | event-handler-receiver.js:2:31:2:83 | '<h2><a ... ></h2>' | provenance | Config |
843+
| firebase-client.js:8:59:8:71 | x.exportVal() | firebase-client.js:8:59:8:79 | x.expor ... message | provenance | |
844+
| firebase-client.js:18:13:18:38 | data | firebase-client.js:19:64:19:67 | data | provenance | |
845+
| firebase-client.js:18:20:18:38 | childSnapshot.val() | firebase-client.js:18:13:18:38 | data | provenance | |
846+
| firebase-client.js:19:64:19:67 | data | firebase-client.js:19:64:19:76 | data.username | provenance | |
847+
| firebase-client.js:19:64:19:76 | data.username | firebase-client.js:19:56:19:84 | `<div>$ ... </div>` | provenance | |
848+
| firebase-client.js:26:59:26:71 | x.exportVal() | firebase-client.js:26:59:26:79 | x.expor ... message | provenance | |
849+
| firebase-client.js:37:11:37:35 | userData | firebase-client.js:38:56:38:63 | userData | provenance | |
850+
| firebase-client.js:37:22:37:35 | snapshot.val() | firebase-client.js:37:11:37:35 | userData | provenance | |
851+
| firebase-client.js:38:56:38:63 | userData | firebase-client.js:38:56:38:67 | userData.bio | provenance | |
823852
| hana.js:11:37:11:40 | rows | hana.js:11:37:11:51 | rows[0].comment | provenance | |
824853
| hana.js:16:37:16:40 | rows | hana.js:16:37:16:51 | rows[0].comment | provenance | |
825854
| hana.js:19:37:19:40 | rows | hana.js:19:37:19:51 | rows[0].comment | provenance | |

‎javascript/ql/test/query-tests/Security/CWE-079/DomBasedXss/firebase-client.js‎

Lines changed: 46 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,46 @@
1+
import firebase from 'firebase/app';
2+
import 'firebase/database';
3+
4+
5+
firebase.database().ref("/userMessages/message1").once("value")
6+
.then((x) => {
7+
document.getElementById("messageDisplay").innerHTML = x.val(); // $ Alert
8+
document.getElementById("messageDisplay").innerHTML = x.exportVal().message; // $ Alert
9+
x.ref.parent.parent.once('value', parentSnapshot => {
10+
document.getElementById("messageDisplay").innerHTML = parentSnapshot.val(); // $ Alert
11+
});
12+
13+
x.ref.parent.child('bio').once('value', (bioSnapshot) => {
14+
document.getElementById('userBio').innerHTML = bioSnapshot.val(); // $ Alert
15+
});
16+
17+
x.forEach((childSnapshot) => {
18+
const data = childSnapshot.val(); // $ Source
19+
document.getElementById("userList").innerHTML += `<div>${data.username}</div>`; // $ Alert
20+
});
21+
})
22+
.catch();
23+
24+
firebase.database().ref('/users').on('value', (x) => {
25+
document.getElementById("messageDisplay").innerHTML = x.val(); // $ Alert
26+
document.getElementById("messageDisplay").innerHTML = x.exportVal().message; // $ Alert
27+
x.ref.parent.parent.once('value', parentSnapshot => {
28+
document.getElementById("messageDisplay").innerHTML = parentSnapshot.val(); // $ Alert
29+
});
30+
});
31+
32+
firebase.database().refFromURL("https://example.com").once("value", (snapshot) => {
33+
document.getElementById("content").innerHTML = snapshot.val(); // $ Alert
34+
});
35+
36+
firebase.database().ref("users").child("12345").once("value", (snapshot) => {
37+
const userData = snapshot.val(); // $ Source
38+
document.getElementById("userProfile").innerHTML = userData.bio; // $ Alert
39+
});
40+
41+
firebase.database().ref("users/12345/profile").once("value", (snapshot) => {
42+
const rootref = snapshot.ref.root;
43+
rootref.once("value", (parentSnapshot) => {
44+
document.getElementById("userData").innerHTML = parentSnapshot.val(); // $ Alert
45+
});
46+
});

‎javascript/ql/test/query-tests/Security/CWE-094/CodeInjection/CodeInjection.expected‎

Lines changed: 12 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -27,6 +27,12 @@
2727
| express.js:20:34:20:38 | taint | express.js:19:17:19:35 | req.param("wobble") | express.js:20:34:20:38 | taint | This code execution depends on a $@. | express.js:19:17:19:35 | req.param("wobble") | user-provided value |
2828
| express.js:36:15:36:19 | taint | express.js:27:17:27:35 | req.param("wobble") | express.js:36:15:36:19 | taint | This code execution depends on a $@. | express.js:27:17:27:35 | req.param("wobble") | user-provided value |
2929
| express.js:43:10:43:12 | msg | express.js:42:30:42:32 | msg | express.js:43:10:43:12 | msg | This code execution depends on a $@. | express.js:42:30:42:32 | msg | user-provided value |
30+
| firebase-server.js:7:10:7:16 | x.val() | firebase-server.js:7:10:7:16 | x.val() | firebase-server.js:7:10:7:16 | x.val() | This code execution depends on a $@. | firebase-server.js:7:10:7:16 | x.val() | user-provided value |
31+
| firebase-server.js:8:10:8:22 | x.exportVal() | firebase-server.js:8:10:8:22 | x.exportVal() | firebase-server.js:8:10:8:22 | x.exportVal() | This code execution depends on a $@. | firebase-server.js:8:10:8:22 | x.exportVal() | user-provided value |
32+
| firebase-server.js:10:14:10:33 | parentSnapshot.val() | firebase-server.js:10:14:10:33 | parentSnapshot.val() | firebase-server.js:10:14:10:33 | parentSnapshot.val() | This code execution depends on a $@. | firebase-server.js:10:14:10:33 | parentSnapshot.val() | user-provided value |
33+
| firebase-server.js:14:10:14:23 | x.before.val() | firebase-server.js:14:10:14:23 | x.before.val() | firebase-server.js:14:10:14:23 | x.before.val() | This code execution depends on a $@. | firebase-server.js:14:10:14:23 | x.before.val() | user-provided value |
34+
| firebase-server.js:15:10:15:22 | x.after.val() | firebase-server.js:15:10:15:22 | x.after.val() | firebase-server.js:15:10:15:22 | x.after.val() | This code execution depends on a $@. | firebase-server.js:15:10:15:22 | x.after.val() | user-provided value |
35+
| firebase-server.js:17:14:17:38 | grandPa ... t.val() | firebase-server.js:17:14:17:38 | grandPa ... t.val() | firebase-server.js:17:14:17:38 | grandPa ... t.val() | This code execution depends on a $@. | firebase-server.js:17:14:17:38 | grandPa ... t.val() | user-provided value |
3036
| module.js:9:16:9:29 | req.query.code | module.js:9:16:9:29 | req.query.code | module.js:9:16:9:29 | req.query.code | This code execution depends on a $@. | module.js:9:16:9:29 | req.query.code | user-provided value |
3137
| module.js:11:17:11:30 | req.query.code | module.js:11:17:11:30 | req.query.code | module.js:11:17:11:30 | req.query.code | This code execution depends on a $@. | module.js:11:17:11:30 | req.query.code | user-provided value |
3238
| react-native.js:8:32:8:38 | tainted | react-native.js:7:17:7:33 | req.param("code") | react-native.js:8:32:8:38 | tainted | This code execution depends on a $@. | react-native.js:7:17:7:33 | req.param("code") | user-provided value |
@@ -144,6 +150,12 @@ nodes
144150
| express.js:36:15:36:19 | taint | semmle.label | taint |
145151
| express.js:42:30:42:32 | msg | semmle.label | msg |
146152
| express.js:43:10:43:12 | msg | semmle.label | msg |
153+
| firebase-server.js:7:10:7:16 | x.val() | semmle.label | x.val() |
154+
| firebase-server.js:8:10:8:22 | x.exportVal() | semmle.label | x.exportVal() |
155+
| firebase-server.js:10:14:10:33 | parentSnapshot.val() | semmle.label | parentSnapshot.val() |
156+
| firebase-server.js:14:10:14:23 | x.before.val() | semmle.label | x.before.val() |
157+
| firebase-server.js:15:10:15:22 | x.after.val() | semmle.label | x.after.val() |
158+
| firebase-server.js:17:14:17:38 | grandPa ... t.val() | semmle.label | grandPa ... t.val() |
147159
| module.js:9:16:9:29 | req.query.code | semmle.label | req.query.code |
148160
| module.js:11:17:11:30 | req.query.code | semmle.label | req.query.code |
149161
| react-native.js:7:7:7:33 | tainted | semmle.label | tainted |

‎javascript/ql/test/query-tests/Security/CWE-094/CodeInjection/HeuristicSourceCodeInjection.expected‎

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -82,6 +82,12 @@ nodes
8282
| express.js:36:15:36:19 | taint | semmle.label | taint |
8383
| express.js:42:30:42:32 | msg | semmle.label | msg |
8484
| express.js:43:10:43:12 | msg | semmle.label | msg |
85+
| firebase-server.js:7:10:7:16 | x.val() | semmle.label | x.val() |
86+
| firebase-server.js:8:10:8:22 | x.exportVal() | semmle.label | x.exportVal() |
87+
| firebase-server.js:10:14:10:33 | parentSnapshot.val() | semmle.label | parentSnapshot.val() |
88+
| firebase-server.js:14:10:14:23 | x.before.val() | semmle.label | x.before.val() |
89+
| firebase-server.js:15:10:15:22 | x.after.val() | semmle.label | x.after.val() |
90+
| firebase-server.js:17:14:17:38 | grandPa ... t.val() | semmle.label | grandPa ... t.val() |
8591
| module.js:9:16:9:29 | req.query.code | semmle.label | req.query.code |
8692
| module.js:11:17:11:30 | req.query.code | semmle.label | req.query.code |
8793
| react-native.js:7:7:7:33 | tainted | semmle.label | tainted |

‎javascript/ql/test/query-tests/Security/CWE-094/CodeInjection/firebase-server.js‎

Lines changed: 19 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,19 @@
1+
const functions = require('firebase-functions');
2+
const admin = require('firebase-admin');
3+
4+
admin.initializeApp();
5+
6+
functions.database.ref('x').onCreate(x => {
7+
eval(x.val()); // $ Alert[js/code-injection]
8+
eval(x.exportVal()); // $ Alert[js/code-injection]
9+
x.ref.parent.once('value', parentSnapshot => {
10+
eval(parentSnapshot.val()); // $ Alert[js/code-injection]
11+
});
12+
});
13+
functions.database.ref('x').onUpdate(x => {
14+
eval(x.before.val()); // $ Alert[js/code-injection]
15+
eval(x.after.val()); // $ Alert[js/code-injection]
16+
x.ref.parent.parent.once('value', grandParentSnapshot => {
17+
eval(grandParentSnapshot.val()); // $ Alert[js/code-injection]
18+
});
19+
});

0 commit comments

Comments
 (0)