CVE-2018-8974: Improper Control of Generation of Code ('Code Injection') (CWE-94)
value: Centers for Disease Control and Prevention MicrobeTRACE 0.1.11 allows remote attackers to execute arbitrary code, related to code injection via a crafted CSV file with an initial 'Source<script type="text/javascript" src=' line. Fix released on 2018-03-28.
CWE description: The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.
CVSS v3 base score: 7.8
Published: 2018-04-26T06:29Z
Repository: https://github.com/CDCgov/MicrobeTrace
Language: Other
Files changed: components/files.html, scripts/common.js, test/adversarial/README.md, test/adversarial/fastaIDInjection.fasta, test/adversarial/fastaSequenceInjection.fasta, test/adversarial/linksFieldnameInjection.csv, test/adversarial/linksValueInjection.csv, test/adversarial/nodesFieldnameInjection.csv, test/adversarial/nodesValueInjection.csv, test/adversarial/pwn.js
Commit date: 2018-03-27 16:30:02 -0400
Commit message: Added sanitization for XSS attempts


Diff: diff --git a/components/files.html b/components/files.html
index efdff44..47e4f15 100644
--- a/components/files.html
+++ b/components/files.html
@@ -110,13 +110,13 @@ function addFileToTable(file){
     </div>
   `);
   Papa.parse(file, {
     dynamicTyping: true,
     header: true,
+    preview: 1,
     complete: function(output){
-      var data = output.data;
-      var headers = output.meta.fields;
+      var headers = output.meta.fields.map(app.striptags);
       var options = '<option>None</option>' + headers.map(h => `<option value="${h}">${app.titleize(h)}</option>`).join('\n');
       $(`<div class='col-4 '${isFasta?' style="display: none;"':''} data-file='${file.name}'>
           <label for="file-${file.name}-field-1">${isNode?'ID':'Source'}</label>
           <select id="file-${file.name}-field-1" class="custom-select custom-select-sm">${options}</select>
         </div>
@@ -187,11 +187,11 @@ $('#refSeqFileLoad').filestyle({
 $('#refSeqFileLoad').on('change', function(e){
   var file = e.target.files[0];
   var reader = new FileReader();
   reader.onloadend = function(e){
     if (e.target.readyState == FileReader.DONE){
-      $('#reference').val(app.parseFASTA(e.target.result)[0].seq);
+      $('#reference').val(app.striptags(app.parseFASTA(e.target.result)[0].seq));
     }
   };
   reader.readAsText(file);
 });
 
@@ -252,10 +252,12 @@ $('#main-submit').click(function(e){
       reader.onloadend = function(e){
         anySequences = true;
         var n = 0;
         var seqs = app.parseFASTA(e.target.result);
         seqs.forEach(node => {
+          node.id = app.striptags(node.id);
+          node.seq = app.striptags(node.seq);
           node['origin'] = [filename];
           n += app.addNode(node);
         });
         message(` - Parsed ${n} New, ${seqs.length} Total Nodes from FASTA.`);
         if(fileNum == files.length - 1) nextStuff();
@@ -270,21 +272,25 @@ $('#main-submit').click(function(e){
         header: true,
         worker: true,
         dynamicTyping: true,
         skipEmptyLines: true,
         complete: results => {
-          var link = results.data.forEach(link => {
+          results.data.forEach(link => {
+            Object.keys(link).forEach(function(key){
+              link[key] = app.striptags(link[key]);
+            });
             l += app.addLink(Object.assign({
               source: '' + link[file.field1],
               target: '' + link[file.field2],
-              distance: (file.field3 === "None") ? 0 : link[file.field3],
+              distance: file.field3 === 'None' ? 0 : link[file.field3],
               origin: [filename],
               visible: 1
             }, link));
           });
           message(` - Parsed ${l} New, ${results.data.length} Total Links from Link CSV.`);
           results.meta.fields.map(key => {
+            key = app.striptags(key);
             if(!session.data.linkFields.includes(key)){
               session.data.linkFields.push(key);
             }
           });
           var n = 0;
@@ -309,16 +315,18 @@ $('#main-submit').click(function(e){
         dynamicTyping: true,
         skipEmptyLines: true,
         complete: results => {
           var n = 0;
           results.data.forEach(node => {
+            node = JSON.parse(app.striptags(JSON.stringify(node)));
             node.id = '' + node[file.field1];
             if(file.field2 !== 'None') node.seq = node[file.field2];
             node['origin'] = [filename];
             n += app.addNode(node);
           });
           results.meta.fields.forEach(key => {
+            key = app.striptags(key);
             if(!session.data.nodeFields.includes(key)){
               session.data.nodeFields.push(key);
             }
           });
           if(results.meta.fields.includes('seq')) anySequences = 1;
@@ -338,11 +346,11 @@ $('#main-submit').click(function(e){
         complete: results => {
           var nodeIDs = [];
           var nn = 0, nl = 0;
           results.data.forEach((row, i) => {
             if(i == 0){
-              nodeIDs = row;
+              nodeIDs = row.map(app.striptags);
               nodeIDs.forEach((cell, k) => {
                 if(k > 0){
                   nn += app.addNode({
                     id: '' + cell,
                     origin: [filename]
diff --git a/scripts/common.js b/scripts/common.js
index 4bb6e1a..37d17e9 100644
--- a/scripts/common.js
+++ b/scripts/common.js
@@ -113,10 +113,17 @@ app.parseNewick = function(a){
     }
   }
   return r;
 };
 
+app.striptags = function(inp){
+  return ('' + inp)
+    .replace(/<[^>]+?>.*?<\/[^>]+?>/g, '') //Closed Tags
+    .replace(/<[^>]+?\/\s*>/g, '') //Self-Closing Tags
+    .replace(/<[^>]+?>/g, ''); //Unclosed Tags
+};
+
 app.titleize = function(title){
   var small = title.toLowerCase().replace(/_/g, ' ');
   if(small === 'id') return 'ID';
   if(small === 'tn93') return 'TN93';
   if(small === 'snps') return 'SNPs';
diff --git a/test/adversarial/README.md b/test/adversarial/README.md
new file mode 100644
index 0000000..cc5345c
--- /dev/null
+++ b/test/adversarial/README.md
@@ -0,0 +1,24 @@
+# Adversarial Tests
+
+This directory contains a single script (pwn.js) which alerts the user that
+their box has been pwned.
+
+It also contains a variety of files which attempt XSS attacks by injecting
+script tags through the various sources of input to the DOM.
+
+To compensate for these, MicrobeTrace scrubs all inputs of anything matching a
+set of dumb regexes that browsers will interpret as tags. Accordingly, any files
+which contain tag-like syntax (e.g. a CSV with a field populated by HTML or XML
+values) will not be loaded completely and correctly.
+THIS IS A FEATURE, NOT A BUG.
+
+To test MicrobeTrace's security using these files, launch a webserver on port
+8080 in the MicrobeTrace Root directory. Then, with the server running, launch
+MicrobeTrace and load any of the files in this directory. If you recieve an
+alert that your username has been pwned, it means that somewhere in the program,
+an unsanitized user input has been leaked into the DOM. This is a security bug.
+Please contact nsp3@cdc.gov with a description of how you got the message (which
+file you were using and what part of the program you were interacting with).
+Please do NOT post this as an issue on Github.
+
+Thank you!
diff --git a/test/adversarial/fastaIDInjection.fasta b/test/adversarial/fastaIDInjection.fasta
new file mode 100644
index 0000000..dd3337b
--- /dev/null
+++ b/test/adversarial/fastaIDInjection.fasta
@@ -0,0 +1,18 @@
+>1922PL-110-1<script type="text/javascript" src="http://localhost:8080/test/adversarial/pwn.js"></script>
+GTTACTTTAAATTGTATCAATGCTAATTTGACCAAGGGCCAACCAACCAATGACTCCATAATAATAGGAAATATGACAGATGAAGTAAGAAACTGTTCTTTTAATGTGACCACAGAACTAAGAGATAAAAAGCAGAAGGCCTATTCACTTTTTTATAAGCTTGATTTAGTAGAAATGGGAAATGGAAGTGAGTATAGGTTAATAAATTGTAATACTTCAGTCATTAAGCAGGCATGTCCAAAGGTAACCTTTGATCCAATTCCTATACATTATTGTACTCCAGCTGGTTATGCGATTATAAAATGTAATGATAAGAATTTCAATGGGACAGGGATATGTAAAAATGTCAGCTCAGTACAATGCACACATGGAATTAAGCCAGTGGTATCAACTCAATTGCTGTTAAATGGCAGTCTAGCAGAAGAAGAGATAATAATCAGATCTGAAAATCTCACAGACAATGCCAAAACCATAATAGTGCATCTTAATAAATCTGTAGAAATCAAGTGTATCAGACCCTCCACCAATACAAGAACAAGTATACGTATAGGACCAGGACAAGTATTCTATAGAACAGGAGACATAACAGGAAATATAAGAAAAGCTTATTGTGAGCTTAATGGAACAAAATGGAATGAAACTTTAAAACAGGTAACTAAGAAATTAAAAGAGCATTTTGAAAATAAGACAATAATCTTTCGACCACCCTCAGGAGGAGATTTAGAAATTACAATGCATCATTTTAATTGTAGAGGGGAATTTTTCTATTGCGATACAACACAATTGTTTAATAGTACTTGGGGAGAAAATGAAACCATGAAGGAACACAATGGCACTATCATACTTCTATGCAAGATAAAGCAAATCATAAACATGTGGCAGGGAGTGGGACAAGCAATGTATGCTCCTCCCATCAGGGGAAATATTAGTTGTGTATCAAATATTACAGGAATACTATTGACAAGAGATGGTGGTATTAATAATAATACTACCGAAACTTTCAGACCTGGA
+>1922PL-110-2
+GTTACTTTAAATTGTATCAATGCTAATTTGACCAAGGGCCAACCAACCAATGACTCCATAATAATAGGAAATATGACAGATGAAGTAAGAAACTGTTCTTTTAATGTGACCACAGAACTAAGAGATAAAAAGCAGAAGGCCTATTCACTTTTTTATAAGCTTGATTTAGTAGAAATGGGAAATGGAAGTGAGTATAGGTTAATAAATTGTAATACTTCAGTCATTAAGCAGGCATGTCCAAAGGTAACCTTTGATCCAATTCCTATACATTATTGTACTCCAGCTGGTTATGCGATTATAAAATGTAATGATAAGAATTTCAATGGGACAGGGATATGTAAAAATGTCAGCTCAGTACAATGCACACATGGAATTAAGCCAGTGGTATCAACTCAATTGCTGTTAAATGGCAGTCTAGCAGAAGAAGAGATAATAATCAGATCTGAAAATCTCACAGACAATGCCAAAACCATAATAGTGCATCTTAATAAATCTGTAGAAATCAAGTGTATCAGACCCTCCACCAATACAAGAACAAGTATACGTATAGGACCAGGACAAGTATTCTATAGAACAGGAGACATAACAGGAAATATAAGAAAAGCTTATTGTGAGCTTAATGGAACAAAATGGAATGAAACTTTAAAACAGGTAACTAAGAAATTAAAAGAGCATTTTGAAAATAAGACAATAATCTTTCGACCACCCTCAGGAGGAGATTTAGAAATTACAATGCATCATTTTAATTGTAGAGGGGAATTTTTCTATTGCGATACAACACAATTGTTTAATAGTACTTGGGGAGAAAATGAAACCATGAAGGAACACAATGGCACTATCATACTTCTATGCAAGATAAAGCAAATCATAAACATGTGGCAGGGAGTGGGACAAGCAATGTATGCTCCTCCCATCAGGGGAAATATTAGTTGTGTATCAAATATTACAGGAATACTATTGACAAGAGATGGTGGTATTAATAATAATACTACCGAAACTTTCAGACCTGGA
+>1922PL-110-3
+GTTACTTTAAATTGTATCAATGCTAATTTGACCAAGGGCCAACCAACCAATGACTCCATAATAATAGGAAATATGACAGATGAAGTAAGAAACTGTTCTTTTAATGTGACCACAGAACTAAGAGATAAAAAGCAGAAGGCCTATTCACTTTTTTATAAGCTTGATTTAGTAGAAATGGGAAATGGAAGTGAGTATAGGTTAATAAATTGTAATACTTCAGTCATTAAGCAGGCATGTCCAAAGGTAACCTTTGATCCAATTCCTATACATTATTGTACTCCAGCTGGTTATGCGATTATAAAATGTAATGATAAGAATTTCAATGGGACAGGGATATGTAAAAATGTCAGCTCAGTACAATGCACACATGGAATTAAGCCAGTGGTATCAACTCAATTGCTGTTAAATGGCAGTCTAGCAGAAGAAGAGATAATAATCAGATCTGAAAATCTCACAGACAATGCCAAAACCATAATAGTGCATCTTAATAAATCTGTAGAAATCAAGTGTATCAGACCCTCCACCAATACAAGAACAAGTATACGTATAGGACCAGGACAAGTATTCTATAGAACAGGAGACATAACAGGAAATATAAGAAAAGCTTATTGTGAGCTTAATGGAACAAAATGGAATGAAACTTTAAAACAGGTAACTAAGAAATTAAAAGAGCATTTTGAAAATAAGACAATAATCTTTCGACCACCCTCAGGAGGAGATTTAGAAATTACAATGCATCATTTTAATTGTAGAGGGGAATTTTTCTATTGCGATACAACACAATTGTTTAATAGTACTTGGGGAGAAAATGAAACCATGAAGGAACACAATGGCACTATCATACTTCTATGCAAGATAAAGCAAATCATAAACATGTGGCAGGGAGTGGGACAAGCAATGTATGCTCCTCCCATCAGGGGAAATATTAGTTGTGTATCAAATATTACAGGAATACTATTGACAAGAGATGGTGGTATTAATAATAATACTACCGAAACTTTCAGACCTGGA
+>1922PL-110-4
+GTTACTTTAAATTGTATCAATGCTAATTTGACCAAGGGCCAACCAACCAATGACTCCATAATAATAGGAAATATGACAGATGAAGTAAGAAACTGTTCTTTTAATGTGACCACAGAACTAAGAGATAAAAAGCAGAAGGCCTATTCACTTTTTTATAAGCTTGATTTAGTAGAAATGGGAAATGGAAGTGAGTATAGGTTAATAAATTGTAATACTTCAGTCATTAAGCAGGCATGTCCAAAGGTAACCTTTGATCCAATTCCTATACATTATTGTACTCCAGCTGGTTATGCGATTATAAAATGTAATGATAAGAATTTCAATGGGACAGGGATATGTAAAAATGTCAGCTCAGTACAATGCACACATGGAATTAAGCCAGTGGTATCAACTCAATTGCTGTTAAATGGCAGTCTAGCAGAAGAAGAGATAATAATCAGATCTGAAAATCTCACAGACAATGCCAAAACCATAATAGTGCATCTTAATAAATCTGTAGAAATCAAGTGTATCAGACCCTCCACCAATACAAGAACAAGTATACGTATAGGACCAGGACAAGTATTCTATAGAACAGGAGACATAACAGGAAATATAAGAAAAGCTTATTGTGAGCTTAATGGAACAAAATGGAATGAAACTTTAAAACAGGTAACTAAGAAATTAAAAGAGCATTTTGAAAATAAGACAATAATCTTTCGACCACCCTCAGGAGGAGATTTAGAAATTACAATGCATCATTTTAATTGTAGAGGGGAATTTTTCTATTGCGATACAACACAATTGTTTAATAGTACTTGGGGAGAAAATGAAACCATGAAGGAACACAATGGCACTATCATACTTCTATGCAAGATAAAGCAAATCATAAACATGTGGCAGGGAGTGGGACAAGCAATGTATGCTCCTCCCATCAGGGGAAATATTAGTTGTGTATCAAATATTACAGGAATACTATTGACAAGAGATGGTGGTATTAATAATAATACTACCGAAACTTTCAGACCTGGA
+>1922PL-110-5
+GTTACTTTAAATTGTATCAATGCTAATTTGACCAAGGGCCAACCAACCAATGACTCCATAATAATAGGAAATATGACAGATGAAGTAAGAAACTGTTCTTTTAATGTGACCACAGAACTAAGAGATAAAAAGCAGAAGGCCTATTCACTTTTTTATAAGCTTGATTTAGTAGAAATGGGAAATGGAAGTGAGTATAGGTTAATAAATTGTAATACTTCAGTCATTAAGCAGGCATGTCCAAAGGTAACCTTTGATCCAATTCCTATACATTATTGTACTCCAGCTGGTTATGCGATTATAAAATGTAATGATAAGAATTTCAATGGGACAGGGATATGTAAAAATGTCAGCTCAGTACAATGCACACATGGAATTAAGCCAGTGGTATCAACTCAATTGCTGTTAAATGGCAGTCTAGCAGAAGAAGAGATAATAATCAGATCTGAAAATCTCACAGACAATGCCAAAACCATAATAGTGCATCTTAATAAATCTGTAGAAATCAAGTGTATCAGACCCTCCACCAATACAAGAACAAGTATACGTATAGGACCAGGACAAGTATTCTATAGAACAGGAGACATAACAGGAAATATAAGAAAAGCTTATTGTGAGCTTAATGGAACAAAATGGAATGAAACTTTAAAACAGGTAACTAAGAAATTAAAAGAGCATTTTGAAAATAAGACAATAATCTTTCGACCACCCTCAGGAGGAGATTTAGAAATTACAATGCATCATTTTAATTGTAGAGGGGAATTTTTCTATTGCGATACAACACAATTGTTTAATAGTACTTGGGGAGAAAATGAAACCATGAAGGAACACAATGGCACTATCATACTTCTATGCAAGATAAAGCAAATCATAAACATGTGGCAGGGAGTGGGACAAGCAATGTATGCTCCTCCCATCAGGGGAAATATTAGTTGTGTATCAAATATTACAGGAATACTATTGACAAGAGATGGTGGTATTAATAATAATACTACCGAAACTTTCAGACCTGGA
+>1922PL-110-6
+GTTACTTTAAATTGTATCAATGCTAATTTGACCAAGGGCCAACCAACCAATGACTCCATAATAATAGGAAATATGACAGATGAAGTAAGAAACTGTTCTTTTAATGTGACCACAGAACTAAGAGATAAAAAGCAGAAGGCCTATTCACTTTTTTATAAGCTTGATTTAGTAGAAATGGGAAATGGAAGTGAGTATAGGTTAATAAATTGTAATACTTCAGTCATTAAGCAGGCATGTCCAAAGGTAACCTTTGATCCAATTCCTATACATTATTGTACTCCAGCTGGTTATGCGATTATAAAATGTAATGATAAGAATTTCAATGGGACAGGGATATGTAAAAATGTCAGCTCAGTACAATGCACACATGGAATTAAGCCAGTGGTATCAACTCAATTGCTGTTAAATGGCAGTCTAGCAGAAGAAGAGATAATAATCAGATCTGAAAATCTCACAGACAATGCCAAAACCATAATAGTGCATCTTAATAAATCTGTAGAAATCAAGTGTATCAGACCCTCCACCAATACAAGAACAAGTATACGTATAGGACCAGGACAAGTATTCTATAGAACAGGAGACATAACAGGAAATATAAGAAAAGCTTATTGTGAGCTTAATGGAACAAAATGGAATGAAACTTTAAAACAGGTAACTAAGAAATTAAAAGAGCATTTTGAAAATAAGACAATAATCTTTCGACCACCCTCAGGAGGAGATTTAGAAATTACAATGCATCATTTTAATTGTAGAGGGGAATTTTTCTATTGCGATACAACACAATTGTTTAATAGTACTTGGGGAGAAAATGAAACCATGAAGGAACACAATGGCACTATCATACTTCTATGCAAGATAAAGCAAATCATAAACATGTGGCAGGGAGTGGGACAAGCAATGTATGCTCCTCCCATCAGGGGAAATATTAGTTGTGTATCAAATATTACAGGAATACTATTGACAAGAGATGGTGGTATTAATAATAATACTACCGAAACTTTCAGACCTGGA
+>1922PL-110-7
+GTTACTTTAAATTGTATCAATGCTAATTTGACCAAGGGCCAACCAACCAATGACTCCATAATAATAGGAAATATGACAGATGAAGTAAGAAACTGTTCTTTTAATGTGACCACAGAACTAAGAGATAAAAAGCAGAAGGCCTATTCACTTTTTTATAAGCTTGATTTAGTAGAAATGGGAAATGGAAGTGAGTATAGGTTAATAAATTGTAATACTTCAGTCATTAAGCAGGCATGTCCAAAGGTAACCTTTGATCCAATTCCTATACATTATTGTACTCCAGCTGGTTATGCGATTATAAAATGTAATGATAAGAATTTCAATGGGACAGGGATATGTAAAAATGTCAGCTCAGTACAATGCACACATGGAATTAAGCCAGTGGTATCAACTCAATTGCTGTTAAATGGCAGTCTAGCAGAAGAAGAGATAATAATCAGATCTGAAAATCTCACAGACAATGCCAAAACCATAATAGTGCATCTTAATAAATCTGTAGAAATCAAGTGTATCAGACCCTCCACCAATACAAGAACAAGTATACGTATAGGACCAGGACAAGTATTCTATAGAACAGGAGACATAACAGGAAATATAAGAAAAGCTTATTGTGAGCTTAATGGAACAAAATGGAATGAAACTTTAAAACAGGTAACTAAGAAATTAAAAGAGCATTTTGAAAATAAGACAATAATCTTTCGACCACCCTCAGGAGGAGATTTAGAAATTACAATGCATCATTTTAATTGTAGAGGGGAATTTTTCTATTGCGATACAACACAATTGTTTAATAGTACTTGGGGAGAAAATGAAACCATGAAGGAACACAATGGCACTATCATACTTCTATGCAAGATAAAGCAAATCATAAACATGTGGCAGGGAGTGGGACAAGCAATGTATGCTCCTCCCATCAGGGGAAATATTAGTTGTGTATCAAATATTACAGGAATACTATTGACAAGAGATGGTGGTATTAATAATAATACTACCGAAACTTTCAGACCTGGA
+>1922PL-110-8
+GTTACTTTAAATTGTATCAATGCTAATTTGACCAAGGGCCAACCAACCAATGACTCCATAATAATAGGAAATATGACAGATGAAGTAAGAAACTGTTCTTTTAATGTGACCACAGAACTAAGAGATAAAAAGCAGAAGGCCTATTCACTTTTTTATAAGCTTGATTTAGTAGAAATGGGAAATGGAAGTGAGTATAGGTTAATAAATTGTAATACTTCAGTCATTAAGCAGGCATGTCCAAAGGTAACCTTTGATCCAATTCCTATACATTATTGTACTCCAGCTGGTTATGCGATTATAAAATGTAATGATAAGAATTTCAATGGGACAGGGATATGTAAAAATGTCAGCTCAGTACAATGCACACATGGAATTAAGCCAGTGGTATCAACTCAATTGCTGTTAAATGGCAGTCTAGCAGAAGAAGAGATAATAATCAGATCTGAAAATCTCACAGACAATGCCAAAACCATAATAGTGCATCTTAATAAATCTGTAGAAATCAAGTGTATCAGACCCTCCACCAATACAAGAACAAGTATACGTATAGGACCAGGACAAGTATTCTATAGAACAGGAGACATAACAGGAAATATAAGAAAAGCTTATTGTGAGCTTAATGGAACAAAATGGAATGAAACTTTAAAACAGGTAACTAAGAAATTAAAAGAGCATTTTGAAAATAAGACAATAATCTTTCGACCACCCTCAGGAGGAGATTTAGAAATTACAATGCATCATTTTAATTGTAGAGGGGAATTTTTCTATTGCGATACAACACAATTGTTTAATAGTACTTGGGGAGAAAATGAAACCATGAAGGAACACAATGGCACTATCATACTTCTATGCAAGATAAAGCAAATCATAAACATGTGGCAGGGAGTGGGACAAGCAATGTATGCTCCTCCCATCAGGGGAAATATTAGTTGTGTATCAAATATTACAGGAATACTATTGACAAGAGATGGTGGTATTAATAATAATACTACCGAAACTTTCAGACCTGGA
+>1922PL-110-9
+GTTACTTTAAATTGTATCAATGCTAATTTGACCAAGGGCCAACCAACCAATGACTCCATAATAATAGGAAATATGACAGATGAAGTAAGAAACTGTTCTTTTAATGTGACCACAGAACTAAGAGATAAAAAGCAGAAGGCCTATTCACTTTTTTATAAGCTTGATTTAGTAGAAATGGGAAATGGAAGTGAGTATAGGTTAATAAATTGTAATACTTCAGTCATTAAGCAGGCATGTCCAAAGGTAACCTTTGATCCAATTCCTATACATTATTGCACTCCAGCTGGTTATGCGATTATAAAATGTAATGATAAGAATTTCAATGGGACAGGGATATGTAAAAATGTCAGCTCAGTACAATGCACACATGGAATTAAGCCAGTGGTATCAACTCAATTGCTGTTAAATGGCAGTCTAGCAGAAGAAGAGATAATAATCAGATCTGAAAATCTCACAGACAATGCCAAAACCATAATAGTGCATCTTAATAAATCTGTAGAAATCAAGTGTATCAGACCCTCCACCAATACAAGAACAAGTATACGTATAGGACCAGGACAAGTATTCTATAGAACAGGAGACATAACAGGAAATATAAGAAAAGCTTATTGTGAGCTTAATGGAACAAAATGGAATGAAACTTTAAAACAGGTAACTAAGAAATTAAAAGAGCATTTTGAAAATAAGACAATAATCTTTCGACCACCCTCAGGAGGAGATTTAGAAATTACAATGCATCATTTTAATTGTAGAGGGGAATTTTTCTATTGCGATACAACACAATTGTTTAATAGTACTTGGGGAGAAAATGAAACCATGAAGGAACACAATGGCACTATCATACTTCTATGCAAGATAAAGCAAATCATAAACATGTGGCAGGGAGTGGGACAAGCAATGTATGCTCCTCCCATCAGGGGAAATATTAGTTGTGTATCAAATATTACAGGAATACTATTGACAAGAGATGGTGGTATTAATAATAATACTACCGAAACTTTCAGACCTGGA
diff --git a/test/adversarial/fastaSequenceInjection.fasta b/test/adversarial/fastaSequenceInjection.fasta
new file mode 100644
index 0000000..6b96fd2
--- /dev/null
+++ b/test/adversarial/fastaSequenceInjection.fasta
@@ -0,0 +1,18 @@
+>1922PL-110-1
+GTTACTTTAAATTGTATCAATGCTAATTTGACCAAGGGCCAACCAACCAATGACTCCATAATAATAGGAAATATGACAGATGAAGTAAGAAACTGTTCTTTTAATGTGACCACAGAACTAAGAGATAAAAAGCAGAAGGCCTATTCACTTTTTTATAAGCTTGATTTAGTAGAAATGGGAAATGGAAGTGAGTATAGGTTAATAAATTGTAATACTTCAGTCATTAAGCAGGCATGTCCAAAGGTAACCTTTGATCCAATTCCTATACATTATTGTACTCCAGCTGGTTATGCGATTATAAAATGTAATGATAAGAATTTCAATGGGACAGGGATATGTAAAAATGTCAGCTCAGTACAATGCACACATGGAATTAAGCCAGTGGTATCAACTCAATTGCTGTTAAATGGCAGTCTAGCAGAAGAAGAGATAATAATCAGATCTGAAAATCTCACAGACAATGCCAAAACCATAATAGTGCATCTTAATAAATCTGTAGAAATCAAGTGTATCAGACCCTCCACCAATACAAGAACAAGTATACGTATAGGACCAGGACAAGTATTCTATAGAACAGGAGACATAACAGGAAATATAAGAAAAGCTTATTGTGAGCTTAATGGAACAAAATGGAATGAAACTTTAAAACAGGTAACTAAGAAATTAAAAGAGCATTTTGAAAATAAGACAATAATCTTTCGACCACCCTCAGGAGGAGATTTAGAAATTACAATGCATCATTTTAATTGTAGAGGGGAATTTTTCTATTGCGATACAACACAATTGTTTAATAGTACTTGGGGAGAAAATGAAACCATGAAGGAACACAATGGCACTATCATACTTCTATGCAAGATAAAGCAAATCATAAACATGTGGCAGGGAGTGGGACAAGCAATGTATGCTCCTCCCATCAGGGGAAATATTAGTTGTGTATCAAATATTACAGGAATACTATTGACAAGAGATGGTGGTATTAATAATAATACTACCGAAACTTTCAGACCTGGA<script type="text/javascript" src="http://localhost:8080/test/adversarial/pwn.js"></script>
+>1922PL-110-2
+GTTACTTTAAATTGTATCAATGCTAATTTGACCAAGGGCCAACCAACCAATGACTCCATAATAATAGGAAATATGACAGATGAAGTAAGAAACTGTTCTTTTAATGTGACCACAGAACTAAGAGATAAAAAGCAGAAGGCCTATTCACTTTTTTATAAGCTTGATTTAGTAGAAATGGGAAATGGAAGTGAGTATAGGTTAATAAATTGTAATACTTCAGTCATTAAGCAGGCATGTCCAAAGGTAACCTTTGATCCAATTCCTATACATTATTGTACTCCAGCTGGTTATGCGATTATAAAATGTAATGATAAGAATTTCAATGGGACAGGGATATGTAAAAATGTCAGCTCAGTACAATGCACACATGGAATTAAGCCAGTGGTATCAACTCAATTGCTGTTAAATGGCAGTCTAGCAGAAGAAGAGATAATAATCAGATCTGAAAATCTCACAGACAATGCCAAAACCATAATAGTGCATCTTAATAAATCTGTAGAAATCAAGTGTATCAGACCCTCCACCAATACAAGAACAAGTATACGTATAGGACCAGGACAAGTATTCTATAGAACAGGAGACATAACAGGAAATATAAGAAAAGCTTATTGTGAGCTTAATGGAACAAAATGGAATGAAACTTTAAAACAGGTAACTAAGAAATTAAAAGAGCATTTTGAAAATAAGACAATAATCTTTCGACCACCCTCAGGAGGAGATTTAGAAATTACAATGCATCATTTTAATTGTAGAGGGGAATTTTTCTATTGCGATACAACACAATTGTTTAATAGTACTTGGGGAGAAAATGAAACCATGAAGGAACACAATGGCACTATCATACTTCTATGCAAGATAAAGCAAATCATAAACATGTGGCAGGGAGTGGGACAAGCAATGTATGCTCCTCCCATCAGGGGAAATATTAGTTGTGTATCAAATATTACAGGAATACTATTGACAAGAGATGGTGGTATTAATAATAATACTACCGAAACTTTCAGACCTGGA
+>1922PL-110-3
+GTTACTTTAAATTGTATCAATGCTAATTTGACCAAGGGCCAACCAACCAATGACTCCATAATAATAGGAAATATGACAGATGAAGTAAGAAACTGTTCTTTTAATGTGACCACAGAACTAAGAGATAAAAAGCAGAAGGCCTATTCACTTTTTTATAAGCTTGATTTAGTAGAAATGGGAAATGGAAGTGAGTATAGGTTAATAAATTGTAATACTTCAGTCATTAAGCAGGCATGTCCAAAGGTAACCTTTGATCCAATTCCTATACATTATTGTACTCCAGCTGGTTATGCGATTATAAAATGTAATGATAAGAATTTCAATGGGACAGGGATATGTAAAAATGTCAGCTCAGTACAATGCACACATGGAATTAAGCCAGTGGTATCAACTCAATTGCTGTTAAATGGCAGTCTAGCAGAAGAAGAGATAATAATCAGATCTGAAAATCTCACAGACAATGCCAAAACCATAATAGTGCATCTTAATAAATCTGTAGAAATCAAGTGTATCAGACCCTCCACCAATACAAGAACAAGTATACGTATAGGACCAGGACAAGTATTCTATAGAACAGGAGACATAACAGGAAATATAAGAAAAGCTTATTGTGAGCTTAATGGAACAAAATGGAATGAAACTTTAAAACAGGTAACTAAGAAATTAAAAGAGCATTTTGAAAATAAGACAATAATCTTTCGACCACCCTCAGGAGGAGATTTAGAAATTACAATGCATCATTTTAATTGTAGAGGGGAATTTTTCTATTGCGATACAACACAATTGTTTAATAGTACTTGGGGAGAAAATGAAACCATGAAGGAACACAATGGCACTATCATACTTCTATGCAAGATAAAGCAAATCATAAACATGTGGCAGGGAGTGGGACAAGCAATGTATGCTCCTCCCATCAGGGGAAATATTAGTTGTGTATCAAATATTACAGGAATACTATTGACAAGAGATGGTGGTATTAATAATAATACTACCGAAACTTTCAGACCTGGA
+>1922PL-110-4
+GTTACTTTAAATTGTATCAATGCTAATTTGACCAAGGGCCAACCAACCAATGACTCCATAATAATAGGAAATATGACAGATGAAGTAAGAAACTGTTCTTTTAATGTGACCACAGAACTAAGAGATAAAAAGCAGAAGGCCTATTCACTTTTTTATAAGCTTGATTTAGTAGAAATGGGAAATGGAAGTGAGTATAGGTTAATAAATTGTAATACTTCAGTCATTAAGCAGGCATGTCCAAAGGTAACCTTTGATCCAATTCCTATACATTATTGTACTCCAGCTGGTTATGCGATTATAAAATGTAATGATAAGAATTTCAATGGGACAGGGATATGTAAAAATGTCAGCTCAGTACAATGCACACATGGAATTAAGCCAGTGGTATCAACTCAATTGCTGTTAAATGGCAGTCTAGCAGAAGAAGAGATAATAATCAGATCTGAAAATCTCACAGACAATGCCAAAACCATAATAGTGCATCTTAATAAATCTGTAGAAATCAAGTGTATCAGACCCTCCACCAATACAAGAACAAGTATACGTATAGGACCAGGACAAGTATTCTATAGAACAGGAGACATAACAGGAAATATAAGAAAAGCTTATTGTGAGCTTAATGGAACAAAATGGAATGAAACTTTAAAACAGGTAACTAAGAAATTAAAAGAGCATTTTGAAAATAAGACAATAATCTTTCGACCACCCTCAGGAGGAGATTTAGAAATTACAATGCATCATTTTAATTGTAGAGGGGAATTTTTCTATTGCGATACAACACAATTGTTTAATAGTACTTGGGGAGAAAATGAAACCATGAAGGAACACAATGGCACTATCATACTTCTATGCAAGATAAAGCAAATCATAAACATGTGGCAGGGAGTGGGACAAGCAATGTATGCTCCTCCCATCAGGGGAAATATTAGTTGTGTATCAAATATTACAGGAATACTATTGACAAGAGATGGTGGTATTAATAATAATACTACCGAAACTTTCAGACCTGGA
+>1922PL-110-5
+GTTACTTTAAATTGTATCAATGCTAATTTGACCAAGGGCCAACCAACCAATGACTCCATAATAATAGGAAATATGACAGATGAAGTAAGAAACTGTTCTTTTAATGTGACCACAGAACTAAGAGATAAAAAGCAGAAGGCCTATTCACTTTTTTATAAGCTTGATTTAGTAGAAATGGGAAATGGAAGTGAGTATAGGTTAATAAATTGTAATACTTCAGTCATTAAGCAGGCATGTCCAAAGGTAACCTTTGATCCAATTCCTATACATTATTGTACTCCAGCTGGTTATGCGATTATAAAATGTAATGATAAGAATTTCAATGGGACAGGGATATGTAAAAATGTCAGCTCAGTACAATGCACACATGGAATTAAGCCAGTGGTATCAACTCAATTGCTGTTAAATGGCAGTCTAGCAGAAGAAGAGATAATAATCAGATCTGAAAATCTCACAGACAATGCCAAAACCATAATAGTGCATCTTAATAAATCTGTAGAAATCAAGTGTATCAGACCCTCCACCAATACAAGAACAAGTATACGTATAGGACCAGGACAAGTATTCTATAGAACAGGAGACATAACAGGAAATATAAGAAAAGCTTATTGTGAGCTTAATGGAACAAAATGGAATGAAACTTTAAAACAGGTAACTAAGAAATTAAAAGAGCATTTTGAAAATAAGACAATAATCTTTCGACCACCCTCAGGAGGAGATTTAGAAATTACAATGCATCATTTTAATTGTAGAGGGGAATTTTTCTATTGCGATACAACACAATTGTTTAATAGTACTTGGGGAGAAAATGAAACCATGAAGGAACACAATGGCACTATCATACTTCTATGCAAGATAAAGCAAATCATAAACATGTGGCAGGGAGTGGGACAAGCAATGTATGCTCCTCCCATCAGGGGAAATATTAGTTGTGTATCAAATATTACAGGAATACTATTGACAAGAGATGGTGGTATTAATAATAATACTACCGAAACTTTCAGACCTGGA
+>1922PL-110-6
+GTTACTTTAAATTGTATCAATGCTAATTTGACCAAGGGCCAACCAACCAATGACTCCATAATAATAGGAAATATGACAGATGAAGTAAGAAACTGTTCTTTTAATGTGACCACAGAACTAAGAGATAAAAAGCAGAAGGCCTATTCACTTTTTTATAAGCTTGATTTAGTAGAAATGGGAAATGGAAGTGAGTATAGGTTAATAAATTGTAATACTTCAGTCATTAAGCAGGCATGTCCAAAGGTAACCTTTGATCCAATTCCTATACATTATTGTACTCCAGCTGGTTATGCGATTATAAAATGTAATGATAAGAATTTCAATGGGACAGGGATATGTAAAAATGTCAGCTCAGTACAATGCACACATGGAATTAAGCCAGTGGTATCAACTCAATTGCTGTTAAATGGCAGTCTAGCAGAAGAAGAGATAATAATCAGATCTGAAAATCTCACAGACAATGCCAAAACCATAATAGTGCATCTTAATAAATCTGTAGAAATCAAGTGTATCAGACCCTCCACCAATACAAGAACAAGTATACGTATAGGACCAGGACAAGTATTCTATAGAACAGGAGACATAACAGGAAATATAAGAAAAGCTTATTGTGAGCTTAATGGAACAAAATGGAATGAAACTTTAAAACAGGTAACTAAGAAATTAAAAGAGCATTTTGAAAATAAGACAATAATCTTTCGACCACCCTCAGGAGGAGATTTAGAAATTACAATGCATCATTTTAATTGTAGAGGGGAATTTTTCTATTGCGATACAACACAATTGTTTAATAGTACTTGGGGAGAAAATGAAACCATGAAGGAACACAATGGCACTATCATACTTCTATGCAAGATAAAGCAAATCATAAACATGTGGCAGGGAGTGGGACAAGCAATGTATGCTCCTCCCATCAGGGGAAATATTAGTTGTGTATCAAATATTACAGGAATACTATTGACAAGAGATGGTGGTATTAATAATAATACTACCGAAACTTTCAGACCTGGA
+>1922PL-110-7
+GTTACTTTAAATTGTATCAATGCTAATTTGACCAAGGGCCAACCAACCAATGACTCCATAATAATAGGAAATATGACAGATGAAGTAAGAAACTGTTCTTTTAATGTGACCACAGAACTAAGAGATAAAAAGCAGAAGGCCTATTCACTTTTTTATAAGCTTGATTTAGTAGAAATGGGAAATGGAAGTGAGTATAGGTTAATAAATTGTAATACTTCAGTCATTAAGCAGGCATGTCCAAAGGTAACCTTTGATCCAATTCCTATACATTATTGTACTCCAGCTGGTTATGCGATTATAAAATGTAATGATAAGAATTTCAATGGGACAGGGATATGTAAAAATGTCAGCTCAGTACAATGCACACATGGAATTAAGCCAGTGGTATCAACTCAATTGCTGTTAAATGGCAGTCTAGCAGAAGAAGAGATAATAATCAGATCTGAAAATCTCACAGACAATGCCAAAACCATAATAGTGCATCTTAATAAATCTGTAGAAATCAAGTGTATCAGACCCTCCACCAATACAAGAACAAGTATACGTATAGGACCAGGACAAGTATTCTATAGAACAGGAGACATAACAGGAAATATAAGAAAAGCTTATTGTGAGCTTAATGGAACAAAATGGAATGAAACTTTAAAACAGGTAACTAAGAAATTAAAAGAGCATTTTGAAAATAAGACAATAATCTTTCGACCACCCTCAGGAGGAGATTTAGAAATTACAATGCATCATTTTAATTGTAGAGGGGAATTTTTCTATTGCGATACAACACAATTGTTTAATAGTACTTGGGGAGAAAATGAAACCATGAAGGAACACAATGGCACTATCATACTTCTATGCAAGATAAAGCAAATCATAAACATGTGGCAGGGAGTGGGACAAGCAATGTATGCTCCTCCCATCAGGGGAAATATTAGTTGTGTATCAAATATTACAGGAATACTATTGACAAGAGATGGTGGTATTAATAATAATACTACCGAAACTTTCAGACCTGGA
+>1922PL-110-8
+GTTACTTTAAATTGTATCAATGCTAATTTGACCAAGGGCCAACCAACCAATGACTCCATAATAATAGGAAATATGACAGATGAAGTAAGAAACTGTTCTTTTAATGTGACCACAGAACTAAGAGATAAAAAGCAGAAGGCCTATTCACTTTTTTATAAGCTTGATTTAGTAGAAATGGGAAATGGAAGTGAGTATAGGTTAATAAATTGTAATACTTCAGTCATTAAGCAGGCATGTCCAAAGGTAACCTTTGATCCAATTCCTATACATTATTGTACTCCAGCTGGTTATGCGATTATAAAATGTAATGATAAGAATTTCAATGGGACAGGGATATGTAAAAATGTCAGCTCAGTACAATGCACACATGGAATTAAGCCAGTGGTATCAACTCAATTGCTGTTAAATGGCAGTCTAGCAGAAGAAGAGATAATAATCAGATCTGAAAATCTCACAGACAATGCCAAAACCATAATAGTGCATCTTAATAAATCTGTAGAAATCAAGTGTATCAGACCCTCCACCAATACAAGAACAAGTATACGTATAGGACCAGGACAAGTATTCTATAGAACAGGAGACATAACAGGAAATATAAGAAAAGCTTATTGTGAGCTTAATGGAACAAAATGGAATGAAACTTTAAAACAGGTAACTAAGAAATTAAAAGAGCATTTTGAAAATAAGACAATAATCTTTCGACCACCCTCAGGAGGAGATTTAGAAATTACAATGCATCATTTTAATTGTAGAGGGGAATTTTTCTATTGCGATACAACACAATTGTTTAATAGTACTTGGGGAGAAAATGAAACCATGAAGGAACACAATGGCACTATCATACTTCTATGCAAGATAAAGCAAATCATAAACATGTGGCAGGGAGTGGGACAAGCAATGTATGCTCCTCCCATCAGGGGAAATATTAGTTGTGTATCAAATATTACAGGAATACTATTGACAAGAGATGGTGGTATTAATAATAATACTACCGAAACTTTCAGACCTGGA
+>1922PL-110-9
+GTTACTTTAAATTGTATCAATGCTAATTTGACCAAGGGCCAACCAACCAATGACTCCATAATAATAGGAAATATGACAGATGAAGTAAGAAACTGTTCTTTTAATGTGACCACAGAACTAAGAGATAAAAAGCAGAAGGCCTATTCACTTTTTTATAAGCTTGATTTAGTAGAAATGGGAAATGGAAGTGAGTATAGGTTAATAAATTGTAATACTTCAGTCATTAAGCAGGCATGTCCAAAGGTAACCTTTGATCCAATTCCTATACATTATTGCACTCCAGCTGGTTATGCGATTATAAAATGTAATGATAAGAATTTCAATGGGACAGGGATATGTAAAAATGTCAGCTCAGTACAATGCACACATGGAATTAAGCCAGTGGTATCAACTCAATTGCTGTTAAATGGCAGTCTAGCAGAAGAAGAGATAATAATCAGATCTGAAAATCTCACAGACAATGCCAAAACCATAATAGTGCATCTTAATAAATCTGTAGAAATCAAGTGTATCAGACCCTCCACCAATACAAGAACAAGTATACGTATAGGACCAGGACAAGTATTCTATAGAACAGGAGACATAACAGGAAATATAAGAAAAGCTTATTGTGAGCTTAATGGAACAAAATGGAATGAAACTTTAAAACAGGTAACTAAGAAATTAAAAGAGCATTTTGAAAATAAGACAATAATCTTTCGACCACCCTCAGGAGGAGATTTAGAAATTACAATGCATCATTTTAATTGTAGAGGGGAATTTTTCTATTGCGATACAACACAATTGTTTAATAGTACTTGGGGAGAAAATGAAACCATGAAGGAACACAATGGCACTATCATACTTCTATGCAAGATAAAGCAAATCATAAACATGTGGCAGGGAGTGGGACAAGCAATGTATGCTCCTCCCATCAGGGGAAATATTAGTTGTGTATCAAATATTACAGGAATACTATTGACAAGAGATGGTGGTATTAATAATAATACTACCGAAACTTTCAGACCTGGA
diff --git a/test/adversarial/linksFieldnameInjection.csv b/test/adversarial/linksFieldnameInjection.csv
new file mode 100644
index 0000000..63809c5
--- /dev/null
+++ b/test/adversarial/linksFieldnameInjection.csv
@@ -0,0 +1,6 @@
+Source<script type="text/javascript" src="http://localhost:8080/test/adversarial/pwn.js"></script>,Target,Weight,distance
+1807,1311,1,0.013987
+1518,1311,15,0.013985
+1481,1311,26,0.01398
+1480,1311,12,0.01398
+1422,1311,24,0.013978
diff --git a/test/adversarial/linksValueInjection.csv b/test/adversarial/linksValueInjection.csv
new file mode 100644
index 0000000..cb2d1d7
--- /dev/null
+++ b/test/adversarial/linksValueInjection.csv
@@ -0,0 +1,6 @@
+Source,Target,Weight,distance
+<script type="text/javascript" src="http://localhost:8080/test/adversarial/pwn.js"></script>1518,1311,1,0.013987
+1518,<script type="text/javascript" src="http://localhost:8080/test/adversarial/pwn.js"></script>,15,0.013985
+1481,1311,<script type="text/javascript" src="http://localhost:8080/test/adversarial/pwn.js"></script>,0.01398
+1480,1311,12,<script type="text/javascript" src="http://localhost:8080/test/adversarial/pwn.js"></script>
+1422,1311,24,0.013978
diff --git a/test/adversarial/nodesFieldnameInjection.csv b/test/adversarial/nodesFieldnameInjection.csv
new file mode 100644
index 0000000..3949a09
--- /dev/null
+++ b/test/adversarial/nodesFieldnameInjection.csv
@@ -0,0 +1,25 @@
+id,hivpos,gender<script type="text/javascript" src="http://localhost:8080/test/adversarial/pwn.js"></script>,idu,hcvpos,age,numeric
+0,TRUE,M,FALSE,FALSE,39,58
+1,TRUE,M,FALSE,FALSE,35,57
+2,TRUE,M,FALSE,FALSE,37,26
+3,TRUE,M,FALSE,TRUE,42,78
+4,TRUE,M,FALSE,FALSE,45,17
+5,TRUE,M,FALSE,FALSE,21,11
+6,TRUE,M,FALSE,FALSE,32,97
+7,TRUE,M,TRUE,TRUE,40,64
+8,TRUE,M,FALSE,FALSE,44,50
+9,TRUE,F,FALSE,TRUE,44,53
+10,FALSE,M,FALSE,FALSE,40,34
+11,FALSE,F,FALSE,FALSE,40,25
+12,FALSE,M,FALSE,FALSE,30,37
+13,FALSE,M,FALSE,FALSE,29,27
+14,FALSE,M,TRUE,TRUE,30,48
+15,FALSE,F,FALSE,FALSE,43,95
+16,FALSE,M,FALSE,FALSE,29,99
+17,FALSE,M,FALSE,FALSE,33,99
+18,FALSE,F,TRUE,TRUE,37,39
+19,FALSE,F,FALSE,FALSE,18,5
+20,FALSE,M,FALSE,TRUE,20,11
+21,FALSE,M,FALSE,FALSE,38,8
+22,FALSE,M,TRUE,FALSE,44,99
+23,FALSE,M,FALSE,FALSE,45,45
diff --git a/test/adversarial/nodesValueInjection.csv b/test/adversarial/nodesValueInjection.csv
new file mode 100644
index 0000000..211852e
--- /dev/null
+++ b/test/adversarial/nodesValueInjection.csv
@@ -0,0 +1,25 @@
+id,hivpos,gender,idu,hcvpos,age,numeric
+0,TRUE,M,FALSE<script type="text/javascript" src="http://localhost:8080/test/adversarial/pwn.js"></script>,FALSE,39,58
+1,TRUE,M,<script type="text/javascript" src="http://localhost:8080/test/adversarial/pwn.js"></script>,FALSE,35,57
+2,TRUE,M,FALSE,FALSE,37,26
+3,TRUE,M,FALSE,TRUE,42,78
+4,TRUE,M,FALSE,FALSE,45,17
+5,TRUE,M,FALSE,FALSE,21,11
+6,TRUE,M,FALSE,FALSE,32,97
+7,TRUE,M,TRUE,TRUE,40,64
+8,TRUE,M,FALSE,FALSE,44,50
+9,TRUE,F,FALSE,TRUE,44,53
+10,FALSE,M,FALSE,FALSE,40,34
+11,FALSE,F,FALSE,FALSE,40,25
+12,FALSE,M,FALSE,FALSE,30,37
+13,FALSE,M,FALSE,FALSE,29,27
+14,FALSE,M,TRUE,TRUE,30,48
+15,FALSE,F,FALSE,FALSE,43,95
+16,FALSE,M,FALSE,FALSE,29,99
+17,FALSE,M,FALSE,FALSE,33,99
+18,FALSE,F,TRUE,TRUE,37,39
+19,FALSE,F,FALSE,FALSE,18,5
+20,FALSE,M,FALSE,TRUE,20,11
+21,FALSE,M,FALSE,FALSE,38,8
+22,FALSE,M,TRUE,FALSE,44,99
+23,FALSE,M,FALSE,FALSE,45,45
diff --git a/test/adversarial/pwn.js b/test/adversarial/pwn.js
new file mode 100644
index 0000000..a09bd95
--- /dev/null
+++ b/test/adversarial/pwn.js
@@ -0,0 +1,8 @@
+(function(){
+  var message = 'Ya been pwned by an XSS from an unsanitized script tag injection.';
+  if(alertify){
+    alertify.error(message);
+  } else {
+    alert(message);
+  };
+})();

Vulnerable code:       var data = output.data;
      var headers = output.meta.fields;
      $('#reference').val(app.parseFASTA(e.target.result)[0].seq);
          var link = results.data.forEach(link => {
              distance: (file.field3 === "None") ? 0 : link[file.field3],
              nodeIDs = row;
Fixed code:     preview: 1,
      var headers = output.meta.fields.map(app.striptags);
      $('#reference').val(app.striptags(app.parseFASTA(e.target.result)[0].seq));
          node.id = app.striptags(node.id);
          node.seq = app.striptags(node.seq);
          results.data.forEach(link => {
            Object.keys(link).forEach(function(key){
              link[key] = app.striptags(link[key]);
            });
              distance: file.field3 === 'None' ? 0 : link[file.field3],
            key = app.striptags(key);
            node = JSON.parse(app.striptags(JSON.stringify(node)));
            key = app.striptags(key);
              nodeIDs = row.map(app.striptags);
app.striptags = function(inp){
  return ('' + inp)
    .replace(/<[^>]+?>.*?<\/[^>]+?>/g, '') //Closed Tags
    .replace(/<[^>]+?\/\s*>/g, '') //Self-Closing Tags
    .replace(/<[^>]+?>/g, ''); //Unclosed Tags
};

# Adversarial Tests

This directory contains a single script (pwn.js) which alerts the user that
their box has been pwned.

It also contains a variety of files which attempt XSS attacks by injecting
script tags through the various sources of input to the DOM.

To compensate for these, MicrobeTrace scrubs all inputs of anything matching a
set of dumb regexes that browsers will interpret as tags. Accordingly, any files
which contain tag-like syntax (e.g. a CSV with a field populated by HTML or XML
values) will not be loaded completely and correctly.
THIS IS A FEATURE, NOT A BUG.

To test MicrobeTrace's security using these files, launch a webserver on port
8080 in the MicrobeTrace Root directory. Then, with the server running, launch
MicrobeTrace and load any of the files in this directory. If you recieve an
alert that your username has been pwned, it means that somewhere in the program,
an unsanitized user input has been leaked into the DOM. This is a security bug.
Please contact nsp3@cdc.gov with a description of how you got the message (which
file you were using and what part of the program you were interacting with).
Please do NOT post this as an issue on Github.

Thank you!
>1922PL-110-1<script type="text/javascript" src="http://localhost:8080/test/adversarial/pwn.js"></script>
GTTACTTTAAATTGTATCAATGCTAATTTGACCAAGGGCCAACCAACCAATGACTCCATAATAATAGGAAATATGACAGATGAAGTAAGAAACTGTTCTTTTAATGTGACCACAGAACTAAGAGATAAAAAGCAGAAGGCCTATTCACTTTTTTATAAGCTTGATTTAGTAGAAATGGGAAATGGAAGTGAGTATAGGTTAATAAATTGTAATACTTCAGTCATTAAGCAGGCATGTCCAAAGGTAACCTTTGATCCAATTCCTATACATTATTGTACTCCAGCTGGTTATGCGATTATAAAATGTAATGATAAGAATTTCAATGGGACAGGGATATGTAAAAATGTCAGCTCAGTACAATGCACACATGGAATTAAGCCAGTGGTATCAACTCAATTGCTGTTAAATGGCAGTCTAGCAGAAGAAGAGATAATAATCAGATCTGAAAATCTCACAGACAATGCCAAAACCATAATAGTGCATCTTAATAAATCTGTAGAAATCAAGTGTATCAGACCCTCCACCAATACAAGAACAAGTATACGTATAGGACCAGGACAAGTATTCTATAGAACAGGAGACATAACAGGAAATATAAGAAAAGCTTATTGTGAGCTTAATGGAACAAAATGGAATGAAACTTTAAAACAGGTAACTAAGAAATTAAAAGAGCATTTTGAAAATAAGACAATAATCTTTCGACCACCCTCAGGAGGAGATTTAGAAATTACAATGCATCATTTTAATTGTAGAGGGGAATTTTTCTATTGCGATACAACACAATTGTTTAATAGTACTTGGGGAGAAAATGAAACCATGAAGGAACACAATGGCACTATCATACTTCTATGCAAGATAAAGCAAATCATAAACATGTGGCAGGGAGTGGGACAAGCAATGTATGCTCCTCCCATCAGGGGAAATATTAGTTGTGTATCAAATATTACAGGAATACTATTGACAAGAGATGGTGGTATTAATAATAATACTACCGAAACTTTCAGACCTGGA
>1922PL-110-2
GTTACTTTAAATTGTATCAATGCTAATTTGACCAAGGGCCAACCAACCAATGACTCCATAATAATAGGAAATATGACAGATGAAGTAAGAAACTGTTCTTTTAATGTGACCACAGAACTAAGAGATAAAAAGCAGAAGGCCTATTCACTTTTTTATAAGCTTGATTTAGTAGAAATGGGAAATGGAAGTGAGTATAGGTTAATAAATTGTAATACTTCAGTCATTAAGCAGGCATGTCCAAAGGTAACCTTTGATCCAATTCCTATACATTATTGTACTCCAGCTGGTTATGCGATTATAAAATGTAATGATAAGAATTTCAATGGGACAGGGATATGTAAAAATGTCAGCTCAGTACAATGCACACATGGAATTAAGCCAGTGGTATCAACTCAATTGCTGTTAAATGGCAGTCTAGCAGAAGAAGAGATAATAATCAGATCTGAAAATCTCACAGACAATGCCAAAACCATAATAGTGCATCTTAATAAATCTGTAGAAATCAAGTGTATCAGACCCTCCACCAATACAAGAACAAGTATACGTATAGGACCAGGACAAGTATTCTATAGAACAGGAGACATAACAGGAAATATAAGAAAAGCTTATTGTGAGCTTAATGGAACAAAATGGAATGAAACTTTAAAACAGGTAACTAAGAAATTAAAAGAGCATTTTGAAAATAAGACAATAATCTTTCGACCACCCTCAGGAGGAGATTTAGAAATTACAATGCATCATTTTAATTGTAGAGGGGAATTTTTCTATTGCGATACAACACAATTGTTTAATAGTACTTGGGGAGAAAATGAAACCATGAAGGAACACAATGGCACTATCATACTTCTATGCAAGATAAAGCAAATCATAAACATGTGGCAGGGAGTGGGACAAGCAATGTATGCTCCTCCCATCAGGGGAAATATTAGTTGTGTATCAAATATTACAGGAATACTATTGACAAGAGATGGTGGTATTAATAATAATACTACCGAAACTTTCAGACCTGGA
>1922PL-110-3
GTTACTTTAAATTGTATCAATGCTAATTTGACCAAGGGCCAACCAACCAATGACTCCATAATAATAGGAAATATGACAGATGAAGTAAGAAACTGTTCTTTTAATGTGACCACAGAACTAAGAGATAAAAAGCAGAAGGCCTATTCACTTTTTTATAAGCTTGATTTAGTAGAAATGGGAAATGGAAGTGAGTATAGGTTAATAAATTGTAATACTTCAGTCATTAAGCAGGCATGTCCAAAGGTAACCTTTGATCCAATTCCTATACATTATTGTACTCCAGCTGGTTATGCGATTATAAAATGTAATGATAAGAATTTCAATGGGACAGGGATATGTAAAAATGTCAGCTCAGTACAATGCACACATGGAATTAAGCCAGTGGTATCAACTCAATTGCTGTTAAATGGCAGTCTAGCAGAAGAAGAGATAATAATCAGATCTGAAAATCTCACAGACAATGCCAAAACCATAATAGTGCATCTTAATAAATCTGTAGAAATCAAGTGTATCAGACCCTCCACCAATACAAGAACAAGTATACGTATAGGACCAGGACAAGTATTCTATAGAACAGGAGACATAACAGGAAATATAAGAAAAGCTTATTGTGAGCTTAATGGAACAAAATGGAATGAAACTTTAAAACAGGTAACTAAGAAATTAAAAGAGCATTTTGAAAATAAGACAATAATCTTTCGACCACCCTCAGGAGGAGATTTAGAAATTACAATGCATCATTTTAATTGTAGAGGGGAATTTTTCTATTGCGATACAACACAATTGTTTAATAGTACTTGGGGAGAAAATGAAACCATGAAGGAACACAATGGCACTATCATACTTCTATGCAAGATAAAGCAAATCATAAACATGTGGCAGGGAGTGGGACAAGCAATGTATGCTCCTCCCATCAGGGGAAATATTAGTTGTGTATCAAATATTACAGGAATACTATTGACAAGAGATGGTGGTATTAATAATAATACTACCGAAACTTTCAGACCTGGA
>1922PL-110-4
GTTACTTTAAATTGTATCAATGCTAATTTGACCAAGGGCCAACCAACCAATGACTCCATAATAATAGGAAATATGACAGATGAAGTAAGAAACTGTTCTTTTAATGTGACCACAGAACTAAGAGATAAAAAGCAGAAGGCCTATTCACTTTTTTATAAGCTTGATTTAGTAGAAATGGGAAATGGAAGTGAGTATAGGTTAATAAATTGTAATACTTCAGTCATTAAGCAGGCATGTCCAAAGGTAACCTTTGATCCAATTCCTATACATTATTGTACTCCAGCTGGTTATGCGATTATAAAATGTAATGATAAGAATTTCAATGGGACAGGGATATGTAAAAATGTCAGCTCAGTACAATGCACACATGGAATTAAGCCAGTGGTATCAACTCAATTGCTGTTAAATGGCAGTCTAGCAGAAGAAGAGATAATAATCAGATCTGAAAATCTCACAGACAATGCCAAAACCATAATAGTGCATCTTAATAAATCTGTAGAAATCAAGTGTATCAGACCCTCCACCAATACAAGAACAAGTATACGTATAGGACCAGGACAAGTATTCTATAGAACAGGAGACATAACAGGAAATATAAGAAAAGCTTATTGTGAGCTTAATGGAACAAAATGGAATGAAACTTTAAAACAGGTAACTAAGAAATTAAAAGAGCATTTTGAAAATAAGACAATAATCTTTCGACCACCCTCAGGAGGAGATTTAGAAATTACAATGCATCATTTTAATTGTAGAGGGGAATTTTTCTATTGCGATACAACACAATTGTTTAATAGTACTTGGGGAGAAAATGAAACCATGAAGGAACACAATGGCACTATCATACTTCTATGCAAGATAAAGCAAATCATAAACATGTGGCAGGGAGTGGGACAAGCAATGTATGCTCCTCCCATCAGGGGAAATATTAGTTGTGTATCAAATATTACAGGAATACTATTGACAAGAGATGGTGGTATTAATAATAATACTACCGAAACTTTCAGACCTGGA
>1922PL-110-5
GTTACTTTAAATTGTATCAATGCTAATTTGACCAAGGGCCAACCAACCAATGACTCCATAATAATAGGAAATATGACAGATGAAGTAAGAAACTGTTCTTTTAATGTGACCACAGAACTAAGAGATAAAAAGCAGAAGGCCTATTCACTTTTTTATAAGCTTGATTTAGTAGAAATGGGAAATGGAAGTGAGTATAGGTTAATAAATTGTAATACTTCAGTCATTAAGCAGGCATGTCCAAAGGTAACCTTTGATCCAATTCCTATACATTATTGTACTCCAGCTGGTTATGCGATTATAAAATGTAATGATAAGAATTTCAATGGGACAGGGATATGTAAAAATGTCAGCTCAGTACAATGCACACATGGAATTAAGCCAGTGGTATCAACTCAATTGCTGTTAAATGGCAGTCTAGCAGAAGAAGAGATAATAATCAGATCTGAAAATCTCACAGACAATGCCAAAACCATAATAGTGCATCTTAATAAATCTGTAGAAATCAAGTGTATCAGACCCTCCACCAATACAAGAACAAGTATACGTATAGGACCAGGACAAGTATTCTATAGAACAGGAGACATAACAGGAAATATAAGAAAAGCTTATTGTGAGCTTAATGGAACAAAATGGAATGAAACTTTAAAACAGGTAACTAAGAAATTAAAAGAGCATTTTGAAAATAAGACAATAATCTTTCGACCACCCTCAGGAGGAGATTTAGAAATTACAATGCATCATTTTAATTGTAGAGGGGAATTTTTCTATTGCGATACAACACAATTGTTTAATAGTACTTGGGGAGAAAATGAAACCATGAAGGAACACAATGGCACTATCATACTTCTATGCAAGATAAAGCAAATCATAAACATGTGGCAGGGAGTGGGACAAGCAATGTATGCTCCTCCCATCAGGGGAAATATTAGTTGTGTATCAAATATTACAGGAATACTATTGACAAGAGATGGTGGTATTAATAATAATACTACCGAAACTTTCAGACCTGGA
>1922PL-110-6
GTTACTTTAAATTGTATCAATGCTAATTTGACCAAGGGCCAACCAACCAATGACTCCATAATAATAGGAAATATGACAGATGAAGTAAGAAACTGTTCTTTTAATGTGACCACAGAACTAAGAGATAAAAAGCAGAAGGCCTATTCACTTTTTTATAAGCTTGATTTAGTAGAAATGGGAAATGGAAGTGAGTATAGGTTAATAAATTGTAATACTTCAGTCATTAAGCAGGCATGTCCAAAGGTAACCTTTGATCCAATTCCTATACATTATTGTACTCCAGCTGGTTATGCGATTATAAAATGTAATGATAAGAATTTCAATGGGACAGGGATATGTAAAAATGTCAGCTCAGTACAATGCACACATGGAATTAAGCCAGTGGTATCAACTCAATTGCTGTTAAATGGCAGTCTAGCAGAAGAAGAGATAATAATCAGATCTGAAAATCTCACAGACAATGCCAAAACCATAATAGTGCATCTTAATAAATCTGTAGAAATCAAGTGTATCAGACCCTCCACCAATACAAGAACAAGTATACGTATAGGACCAGGACAAGTATTCTATAGAACAGGAGACATAACAGGAAATATAAGAAAAGCTTATTGTGAGCTTAATGGAACAAAATGGAATGAAACTTTAAAACAGGTAACTAAGAAATTAAAAGAGCATTTTGAAAATAAGACAATAATCTTTCGACCACCCTCAGGAGGAGATTTAGAAATTACAATGCATCATTTTAATTGTAGAGGGGAATTTTTCTATTGCGATACAACACAATTGTTTAATAGTACTTGGGGAGAAAATGAAACCATGAAGGAACACAATGGCACTATCATACTTCTATGCAAGATAAAGCAAATCATAAACATGTGGCAGGGAGTGGGACAAGCAATGTATGCTCCTCCCATCAGGGGAAATATTAGTTGTGTATCAAATATTACAGGAATACTATTGACAAGAGATGGTGGTATTAATAATAATACTACCGAAACTTTCAGACCTGGA
>1922PL-110-7
GTTACTTTAAATTGTATCAATGCTAATTTGACCAAGGGCCAACCAACCAATGACTCCATAATAATAGGAAATATGACAGATGAAGTAAGAAACTGTTCTTTTAATGTGACCACAGAACTAAGAGATAAAAAGCAGAAGGCCTATTCACTTTTTTATAAGCTTGATTTAGTAGAAATGGGAAATGGAAGTGAGTATAGGTTAATAAATTGTAATACTTCAGTCATTAAGCAGGCATGTCCAAAGGTAACCTTTGATCCAATTCCTATACATTATTGTACTCCAGCTGGTTATGCGATTATAAAATGTAATGATAAGAATTTCAATGGGACAGGGATATGTAAAAATGTCAGCTCAGTACAATGCACACATGGAATTAAGCCAGTGGTATCAACTCAATTGCTGTTAAATGGCAGTCTAGCAGAAGAAGAGATAATAATCAGATCTGAAAATCTCACAGACAATGCCAAAACCATAATAGTGCATCTTAATAAATCTGTAGAAATCAAGTGTATCAGACCCTCCACCAATACAAGAACAAGTATACGTATAGGACCAGGACAAGTATTCTATAGAACAGGAGACATAACAGGAAATATAAGAAAAGCTTATTGTGAGCTTAATGGAACAAAATGGAATGAAACTTTAAAACAGGTAACTAAGAAATTAAAAGAGCATTTTGAAAATAAGACAATAATCTTTCGACCACCCTCAGGAGGAGATTTAGAAATTACAATGCATCATTTTAATTGTAGAGGGGAATTTTTCTATTGCGATACAACACAATTGTTTAATAGTACTTGGGGAGAAAATGAAACCATGAAGGAACACAATGGCACTATCATACTTCTATGCAAGATAAAGCAAATCATAAACATGTGGCAGGGAGTGGGACAAGCAATGTATGCTCCTCCCATCAGGGGAAATATTAGTTGTGTATCAAATATTACAGGAATACTATTGACAAGAGATGGTGGTATTAATAATAATACTACCGAAACTTTCAGACCTGGA
>1922PL-110-8
GTTACTTTAAATTGTATCAATGCTAATTTGACCAAGGGCCAACCAACCAATGACTCCATAATAATAGGAAATATGACAGATGAAGTAAGAAACTGTTCTTTTAATGTGACCACAGAACTAAGAGATAAAAAGCAGAAGGCCTATTCACTTTTTTATAAGCTTGATTTAGTAGAAATGGGAAATGGAAGTGAGTATAGGTTAATAAATTGTAATACTTCAGTCATTAAGCAGGCATGTCCAAAGGTAACCTTTGATCCAATTCCTATACATTATTGTACTCCAGCTGGTTATGCGATTATAAAATGTAATGATAAGAATTTCAATGGGACAGGGATATGTAAAAATGTCAGCTCAGTACAATGCACACATGGAATTAAGCCAGTGGTATCAACTCAATTGCTGTTAAATGGCAGTCTAGCAGAAGAAGAGATAATAATCAGATCTGAAAATCTCACAGACAATGCCAAAACCATAATAGTGCATCTTAATAAATCTGTAGAAATCAAGTGTATCAGACCCTCCACCAATACAAGAACAAGTATACGTATAGGACCAGGACAAGTATTCTATAGAACAGGAGACATAACAGGAAATATAAGAAAAGCTTATTGTGAGCTTAATGGAACAAAATGGAATGAAACTTTAAAACAGGTAACTAAGAAATTAAAAGAGCATTTTGAAAATAAGACAATAATCTTTCGACCACCCTCAGGAGGAGATTTAGAAATTACAATGCATCATTTTAATTGTAGAGGGGAATTTTTCTATTGCGATACAACACAATTGTTTAATAGTACTTGGGGAGAAAATGAAACCATGAAGGAACACAATGGCACTATCATACTTCTATGCAAGATAAAGCAAATCATAAACATGTGGCAGGGAGTGGGACAAGCAATGTATGCTCCTCCCATCAGGGGAAATATTAGTTGTGTATCAAATATTACAGGAATACTATTGACAAGAGATGGTGGTATTAATAATAATACTACCGAAACTTTCAGACCTGGA
>1922PL-110-9
GTTACTTTAAATTGTATCAATGCTAATTTGACCAAGGGCCAACCAACCAATGACTCCATAATAATAGGAAATATGACAGATGAAGTAAGAAACTGTTCTTTTAATGTGACCACAGAACTAAGAGATAAAAAGCAGAAGGCCTATTCACTTTTTTATAAGCTTGATTTAGTAGAAATGGGAAATGGAAGTGAGTATAGGTTAATAAATTGTAATACTTCAGTCATTAAGCAGGCATGTCCAAAGGTAACCTTTGATCCAATTCCTATACATTATTGCACTCCAGCTGGTTATGCGATTATAAAATGTAATGATAAGAATTTCAATGGGACAGGGATATGTAAAAATGTCAGCTCAGTACAATGCACACATGGAATTAAGCCAGTGGTATCAACTCAATTGCTGTTAAATGGCAGTCTAGCAGAAGAAGAGATAATAATCAGATCTGAAAATCTCACAGACAATGCCAAAACCATAATAGTGCATCTTAATAAATCTGTAGAAATCAAGTGTATCAGACCCTCCACCAATACAAGAACAAGTATACGTATAGGACCAGGACAAGTATTCTATAGAACAGGAGACATAACAGGAAATATAAGAAAAGCTTATTGTGAGCTTAATGGAACAAAATGGAATGAAACTTTAAAACAGGTAACTAAGAAATTAAAAGAGCATTTTGAAAATAAGACAATAATCTTTCGACCACCCTCAGGAGGAGATTTAGAAATTACAATGCATCATTTTAATTGTAGAGGGGAATTTTTCTATTGCGATACAACACAATTGTTTAATAGTACTTGGGGAGAAAATGAAACCATGAAGGAACACAATGGCACTATCATACTTCTATGCAAGATAAAGCAAATCATAAACATGTGGCAGGGAGTGGGACAAGCAATGTATGCTCCTCCCATCAGGGGAAATATTAGTTGTGTATCAAATATTACAGGAATACTATTGACAAGAGATGGTGGTATTAATAATAATACTACCGAAACTTTCAGACCTGGA
>1922PL-110-1
GTTACTTTAAATTGTATCAATGCTAATTTGACCAAGGGCCAACCAACCAATGACTCCATAATAATAGGAAATATGACAGATGAAGTAAGAAACTGTTCTTTTAATGTGACCACAGAACTAAGAGATAAAAAGCAGAAGGCCTATTCACTTTTTTATAAGCTTGATTTAGTAGAAATGGGAAATGGAAGTGAGTATAGGTTAATAAATTGTAATACTTCAGTCATTAAGCAGGCATGTCCAAAGGTAACCTTTGATCCAATTCCTATACATTATTGTACTCCAGCTGGTTATGCGATTATAAAATGTAATGATAAGAATTTCAATGGGACAGGGATATGTAAAAATGTCAGCTCAGTACAATGCACACATGGAATTAAGCCAGTGGTATCAACTCAATTGCTGTTAAATGGCAGTCTAGCAGAAGAAGAGATAATAATCAGATCTGAAAATCTCACAGACAATGCCAAAACCATAATAGTGCATCTTAATAAATCTGTAGAAATCAAGTGTATCAGACCCTCCACCAATACAAGAACAAGTATACGTATAGGACCAGGACAAGTATTCTATAGAACAGGAGACATAACAGGAAATATAAGAAAAGCTTATTGTGAGCTTAATGGAACAAAATGGAATGAAACTTTAAAACAGGTAACTAAGAAATTAAAAGAGCATTTTGAAAATAAGACAATAATCTTTCGACCACCCTCAGGAGGAGATTTAGAAATTACAATGCATCATTTTAATTGTAGAGGGGAATTTTTCTATTGCGATACAACACAATTGTTTAATAGTACTTGGGGAGAAAATGAAACCATGAAGGAACACAATGGCACTATCATACTTCTATGCAAGATAAAGCAAATCATAAACATGTGGCAGGGAGTGGGACAAGCAATGTATGCTCCTCCCATCAGGGGAAATATTAGTTGTGTATCAAATATTACAGGAATACTATTGACAAGAGATGGTGGTATTAATAATAATACTACCGAAACTTTCAGACCTGGA<script type="text/javascript" src="http://localhost:8080/test/adversarial/pwn.js"></script>
>1922PL-110-2
GTTACTTTAAATTGTATCAATGCTAATTTGACCAAGGGCCAACCAACCAATGACTCCATAATAATAGGAAATATGACAGATGAAGTAAGAAACTGTTCTTTTAATGTGACCACAGAACTAAGAGATAAAAAGCAGAAGGCCTATTCACTTTTTTATAAGCTTGATTTAGTAGAAATGGGAAATGGAAGTGAGTATAGGTTAATAAATTGTAATACTTCAGTCATTAAGCAGGCATGTCCAAAGGTAACCTTTGATCCAATTCCTATACATTATTGTACTCCAGCTGGTTATGCGATTATAAAATGTAATGATAAGAATTTCAATGGGACAGGGATATGTAAAAATGTCAGCTCAGTACAATGCACACATGGAATTAAGCCAGTGGTATCAACTCAATTGCTGTTAAATGGCAGTCTAGCAGAAGAAGAGATAATAATCAGATCTGAAAATCTCACAGACAATGCCAAAACCATAATAGTGCATCTTAATAAATCTGTAGAAATCAAGTGTATCAGACCCTCCACCAATACAAGAACAAGTATACGTATAGGACCAGGACAAGTATTCTATAGAACAGGAGACATAACAGGAAATATAAGAAAAGCTTATTGTGAGCTTAATGGAACAAAATGGAATGAAACTTTAAAACAGGTAACTAAGAAATTAAAAGAGCATTTTGAAAATAAGACAATAATCTTTCGACCACCCTCAGGAGGAGATTTAGAAATTACAATGCATCATTTTAATTGTAGAGGGGAATTTTTCTATTGCGATACAACACAATTGTTTAATAGTACTTGGGGAGAAAATGAAACCATGAAGGAACACAATGGCACTATCATACTTCTATGCAAGATAAAGCAAATCATAAACATGTGGCAGGGAGTGGGACAAGCAATGTATGCTCCTCCCATCAGGGGAAATATTAGTTGTGTATCAAATATTACAGGAATACTATTGACAAGAGATGGTGGTATTAATAATAATACTACCGAAACTTTCAGACCTGGA
>1922PL-110-3
GTTACTTTAAATTGTATCAATGCTAATTTGACCAAGGGCCAACCAACCAATGACTCCATAATAATAGGAAATATGACAGATGAAGTAAGAAACTGTTCTTTTAATGTGACCACAGAACTAAGAGATAAAAAGCAGAAGGCCTATTCACTTTTTTATAAGCTTGATTTAGTAGAAATGGGAAATGGAAGTGAGTATAGGTTAATAAATTGTAATACTTCAGTCATTAAGCAGGCATGTCCAAAGGTAACCTTTGATCCAATTCCTATACATTATTGTACTCCAGCTGGTTATGCGATTATAAAATGTAATGATAAGAATTTCAATGGGACAGGGATATGTAAAAATGTCAGCTCAGTACAATGCACACATGGAATTAAGCCAGTGGTATCAACTCAATTGCTGTTAAATGGCAGTCTAGCAGAAGAAGAGATAATAATCAGATCTGAAAATCTCACAGACAATGCCAAAACCATAATAGTGCATCTTAATAAATCTGTAGAAATCAAGTGTATCAGACCCTCCACCAATACAAGAACAAGTATACGTATAGGACCAGGACAAGTATTCTATAGAACAGGAGACATAACAGGAAATATAAGAAAAGCTTATTGTGAGCTTAATGGAACAAAATGGAATGAAACTTTAAAACAGGTAACTAAGAAATTAAAAGAGCATTTTGAAAATAAGACAATAATCTTTCGACCACCCTCAGGAGGAGATTTAGAAATTACAATGCATCATTTTAATTGTAGAGGGGAATTTTTCTATTGCGATACAACACAATTGTTTAATAGTACTTGGGGAGAAAATGAAACCATGAAGGAACACAATGGCACTATCATACTTCTATGCAAGATAAAGCAAATCATAAACATGTGGCAGGGAGTGGGACAAGCAATGTATGCTCCTCCCATCAGGGGAAATATTAGTTGTGTATCAAATATTACAGGAATACTATTGACAAGAGATGGTGGTATTAATAATAATACTACCGAAACTTTCAGACCTGGA
>1922PL-110-4
GTTACTTTAAATTGTATCAATGCTAATTTGACCAAGGGCCAACCAACCAATGACTCCATAATAATAGGAAATATGACAGATGAAGTAAGAAACTGTTCTTTTAATGTGACCACAGAACTAAGAGATAAAAAGCAGAAGGCCTATTCACTTTTTTATAAGCTTGATTTAGTAGAAATGGGAAATGGAAGTGAGTATAGGTTAATAAATTGTAATACTTCAGTCATTAAGCAGGCATGTCCAAAGGTAACCTTTGATCCAATTCCTATACATTATTGTACTCCAGCTGGTTATGCGATTATAAAATGTAATGATAAGAATTTCAATGGGACAGGGATATGTAAAAATGTCAGCTCAGTACAATGCACACATGGAATTAAGCCAGTGGTATCAACTCAATTGCTGTTAAATGGCAGTCTAGCAGAAGAAGAGATAATAATCAGATCTGAAAATCTCACAGACAATGCCAAAACCATAATAGTGCATCTTAATAAATCTGTAGAAATCAAGTGTATCAGACCCTCCACCAATACAAGAACAAGTATACGTATAGGACCAGGACAAGTATTCTATAGAACAGGAGACATAACAGGAAATATAAGAAAAGCTTATTGTGAGCTTAATGGAACAAAATGGAATGAAACTTTAAAACAGGTAACTAAGAAATTAAAAGAGCATTTTGAAAATAAGACAATAATCTTTCGACCACCCTCAGGAGGAGATTTAGAAATTACAATGCATCATTTTAATTGTAGAGGGGAATTTTTCTATTGCGATACAACACAATTGTTTAATAGTACTTGGGGAGAAAATGAAACCATGAAGGAACACAATGGCACTATCATACTTCTATGCAAGATAAAGCAAATCATAAACATGTGGCAGGGAGTGGGACAAGCAATGTATGCTCCTCCCATCAGGGGAAATATTAGTTGTGTATCAAATATTACAGGAATACTATTGACAAGAGATGGTGGTATTAATAATAATACTACCGAAACTTTCAGACCTGGA
>1922PL-110-5
GTTACTTTAAATTGTATCAATGCTAATTTGACCAAGGGCCAACCAACCAATGACTCCATAATAATAGGAAATATGACAGATGAAGTAAGAAACTGTTCTTTTAATGTGACCACAGAACTAAGAGATAAAAAGCAGAAGGCCTATTCACTTTTTTATAAGCTTGATTTAGTAGAAATGGGAAATGGAAGTGAGTATAGGTTAATAAATTGTAATACTTCAGTCATTAAGCAGGCATGTCCAAAGGTAACCTTTGATCCAATTCCTATACATTATTGTACTCCAGCTGGTTATGCGATTATAAAATGTAATGATAAGAATTTCAATGGGACAGGGATATGTAAAAATGTCAGCTCAGTACAATGCACACATGGAATTAAGCCAGTGGTATCAACTCAATTGCTGTTAAATGGCAGTCTAGCAGAAGAAGAGATAATAATCAGATCTGAAAATCTCACAGACAATGCCAAAACCATAATAGTGCATCTTAATAAATCTGTAGAAATCAAGTGTATCAGACCCTCCACCAATACAAGAACAAGTATACGTATAGGACCAGGACAAGTATTCTATAGAACAGGAGACATAACAGGAAATATAAGAAAAGCTTATTGTGAGCTTAATGGAACAAAATGGAATGAAACTTTAAAACAGGTAACTAAGAAATTAAAAGAGCATTTTGAAAATAAGACAATAATCTTTCGACCACCCTCAGGAGGAGATTTAGAAATTACAATGCATCATTTTAATTGTAGAGGGGAATTTTTCTATTGCGATACAACACAATTGTTTAATAGTACTTGGGGAGAAAATGAAACCATGAAGGAACACAATGGCACTATCATACTTCTATGCAAGATAAAGCAAATCATAAACATGTGGCAGGGAGTGGGACAAGCAATGTATGCTCCTCCCATCAGGGGAAATATTAGTTGTGTATCAAATATTACAGGAATACTATTGACAAGAGATGGTGGTATTAATAATAATACTACCGAAACTTTCAGACCTGGA
>1922PL-110-6
GTTACTTTAAATTGTATCAATGCTAATTTGACCAAGGGCCAACCAACCAATGACTCCATAATAATAGGAAATATGACAGATGAAGTAAGAAACTGTTCTTTTAATGTGACCACAGAACTAAGAGATAAAAAGCAGAAGGCCTATTCACTTTTTTATAAGCTTGATTTAGTAGAAATGGGAAATGGAAGTGAGTATAGGTTAATAAATTGTAATACTTCAGTCATTAAGCAGGCATGTCCAAAGGTAACCTTTGATCCAATTCCTATACATTATTGTACTCCAGCTGGTTATGCGATTATAAAATGTAATGATAAGAATTTCAATGGGACAGGGATATGTAAAAATGTCAGCTCAGTACAATGCACACATGGAATTAAGCCAGTGGTATCAACTCAATTGCTGTTAAATGGCAGTCTAGCAGAAGAAGAGATAATAATCAGATCTGAAAATCTCACAGACAATGCCAAAACCATAATAGTGCATCTTAATAAATCTGTAGAAATCAAGTGTATCAGACCCTCCACCAATACAAGAACAAGTATACGTATAGGACCAGGACAAGTATTCTATAGAACAGGAGACATAACAGGAAATATAAGAAAAGCTTATTGTGAGCTTAATGGAACAAAATGGAATGAAACTTTAAAACAGGTAACTAAGAAATTAAAAGAGCATTTTGAAAATAAGACAATAATCTTTCGACCACCCTCAGGAGGAGATTTAGAAATTACAATGCATCATTTTAATTGTAGAGGGGAATTTTTCTATTGCGATACAACACAATTGTTTAATAGTACTTGGGGAGAAAATGAAACCATGAAGGAACACAATGGCACTATCATACTTCTATGCAAGATAAAGCAAATCATAAACATGTGGCAGGGAGTGGGACAAGCAATGTATGCTCCTCCCATCAGGGGAAATATTAGTTGTGTATCAAATATTACAGGAATACTATTGACAAGAGATGGTGGTATTAATAATAATACTACCGAAACTTTCAGACCTGGA
>1922PL-110-7
GTTACTTTAAATTGTATCAATGCTAATTTGACCAAGGGCCAACCAACCAATGACTCCATAATAATAGGAAATATGACAGATGAAGTAAGAAACTGTTCTTTTAATGTGACCACAGAACTAAGAGATAAAAAGCAGAAGGCCTATTCACTTTTTTATAAGCTTGATTTAGTAGAAATGGGAAATGGAAGTGAGTATAGGTTAATAAATTGTAATACTTCAGTCATTAAGCAGGCATGTCCAAAGGTAACCTTTGATCCAATTCCTATACATTATTGTACTCCAGCTGGTTATGCGATTATAAAATGTAATGATAAGAATTTCAATGGGACAGGGATATGTAAAAATGTCAGCTCAGTACAATGCACACATGGAATTAAGCCAGTGGTATCAACTCAATTGCTGTTAAATGGCAGTCTAGCAGAAGAAGAGATAATAATCAGATCTGAAAATCTCACAGACAATGCCAAAACCATAATAGTGCATCTTAATAAATCTGTAGAAATCAAGTGTATCAGACCCTCCACCAATACAAGAACAAGTATACGTATAGGACCAGGACAAGTATTCTATAGAACAGGAGACATAACAGGAAATATAAGAAAAGCTTATTGTGAGCTTAATGGAACAAAATGGAATGAAACTTTAAAACAGGTAACTAAGAAATTAAAAGAGCATTTTGAAAATAAGACAATAATCTTTCGACCACCCTCAGGAGGAGATTTAGAAATTACAATGCATCATTTTAATTGTAGAGGGGAATTTTTCTATTGCGATACAACACAATTGTTTAATAGTACTTGGGGAGAAAATGAAACCATGAAGGAACACAATGGCACTATCATACTTCTATGCAAGATAAAGCAAATCATAAACATGTGGCAGGGAGTGGGACAAGCAATGTATGCTCCTCCCATCAGGGGAAATATTAGTTGTGTATCAAATATTACAGGAATACTATTGACAAGAGATGGTGGTATTAATAATAATACTACCGAAACTTTCAGACCTGGA
>1922PL-110-8
GTTACTTTAAATTGTATCAATGCTAATTTGACCAAGGGCCAACCAACCAATGACTCCATAATAATAGGAAATATGACAGATGAAGTAAGAAACTGTTCTTTTAATGTGACCACAGAACTAAGAGATAAAAAGCAGAAGGCCTATTCACTTTTTTATAAGCTTGATTTAGTAGAAATGGGAAATGGAAGTGAGTATAGGTTAATAAATTGTAATACTTCAGTCATTAAGCAGGCATGTCCAAAGGTAACCTTTGATCCAATTCCTATACATTATTGTACTCCAGCTGGTTATGCGATTATAAAATGTAATGATAAGAATTTCAATGGGACAGGGATATGTAAAAATGTCAGCTCAGTACAATGCACACATGGAATTAAGCCAGTGGTATCAACTCAATTGCTGTTAAATGGCAGTCTAGCAGAAGAAGAGATAATAATCAGATCTGAAAATCTCACAGACAATGCCAAAACCATAATAGTGCATCTTAATAAATCTGTAGAAATCAAGTGTATCAGACCCTCCACCAATACAAGAACAAGTATACGTATAGGACCAGGACAAGTATTCTATAGAACAGGAGACATAACAGGAAATATAAGAAAAGCTTATTGTGAGCTTAATGGAACAAAATGGAATGAAACTTTAAAACAGGTAACTAAGAAATTAAAAGAGCATTTTGAAAATAAGACAATAATCTTTCGACCACCCTCAGGAGGAGATTTAGAAATTACAATGCATCATTTTAATTGTAGAGGGGAATTTTTCTATTGCGATACAACACAATTGTTTAATAGTACTTGGGGAGAAAATGAAACCATGAAGGAACACAATGGCACTATCATACTTCTATGCAAGATAAAGCAAATCATAAACATGTGGCAGGGAGTGGGACAAGCAATGTATGCTCCTCCCATCAGGGGAAATATTAGTTGTGTATCAAATATTACAGGAATACTATTGACAAGAGATGGTGGTATTAATAATAATACTACCGAAACTTTCAGACCTGGA
>1922PL-110-9
GTTACTTTAAATTGTATCAATGCTAATTTGACCAAGGGCCAACCAACCAATGACTCCATAATAATAGGAAATATGACAGATGAAGTAAGAAACTGTTCTTTTAATGTGACCACAGAACTAAGAGATAAAAAGCAGAAGGCCTATTCACTTTTTTATAAGCTTGATTTAGTAGAAATGGGAAATGGAAGTGAGTATAGGTTAATAAATTGTAATACTTCAGTCATTAAGCAGGCATGTCCAAAGGTAACCTTTGATCCAATTCCTATACATTATTGCACTCCAGCTGGTTATGCGATTATAAAATGTAATGATAAGAATTTCAATGGGACAGGGATATGTAAAAATGTCAGCTCAGTACAATGCACACATGGAATTAAGCCAGTGGTATCAACTCAATTGCTGTTAAATGGCAGTCTAGCAGAAGAAGAGATAATAATCAGATCTGAAAATCTCACAGACAATGCCAAAACCATAATAGTGCATCTTAATAAATCTGTAGAAATCAAGTGTATCAGACCCTCCACCAATACAAGAACAAGTATACGTATAGGACCAGGACAAGTATTCTATAGAACAGGAGACATAACAGGAAATATAAGAAAAGCTTATTGTGAGCTTAATGGAACAAAATGGAATGAAACTTTAAAACAGGTAACTAAGAAATTAAAAGAGCATTTTGAAAATAAGACAATAATCTTTCGACCACCCTCAGGAGGAGATTTAGAAATTACAATGCATCATTTTAATTGTAGAGGGGAATTTTTCTATTGCGATACAACACAATTGTTTAATAGTACTTGGGGAGAAAATGAAACCATGAAGGAACACAATGGCACTATCATACTTCTATGCAAGATAAAGCAAATCATAAACATGTGGCAGGGAGTGGGACAAGCAATGTATGCTCCTCCCATCAGGGGAAATATTAGTTGTGTATCAAATATTACAGGAATACTATTGACAAGAGATGGTGGTATTAATAATAATACTACCGAAACTTTCAGACCTGGA
Source<script type="text/javascript" src="http://localhost:8080/test/adversarial/pwn.js"></script>,Target,Weight,distance
1807,1311,1,0.013987
1518,1311,15,0.013985
1481,1311,26,0.01398
1480,1311,12,0.01398
1422,1311,24,0.013978
Source,Target,Weight,distance
<script type="text/javascript" src="http://localhost:8080/test/adversarial/pwn.js"></script>1518,1311,1,0.013987
1518,<script type="text/javascript" src="http://localhost:8080/test/adversarial/pwn.js"></script>,15,0.013985
1481,1311,<script type="text/javascript" src="http://localhost:8080/test/adversarial/pwn.js"></script>,0.01398
1480,1311,12,<script type="text/javascript" src="http://localhost:8080/test/adversarial/pwn.js"></script>
1422,1311,24,0.013978
id,hivpos,gender<script type="text/javascript" src="http://localhost:8080/test/adversarial/pwn.js"></script>,idu,hcvpos,age,numeric
0,TRUE,M,FALSE,FALSE,39,58
1,TRUE,M,FALSE,FALSE,35,57
2,TRUE,M,FALSE,FALSE,37,26
3,TRUE,M,FALSE,TRUE,42,78
4,TRUE,M,FALSE,FALSE,45,17
5,TRUE,M,FALSE,FALSE,21,11
6,TRUE,M,FALSE,FALSE,32,97
7,TRUE,M,TRUE,TRUE,40,64
8,TRUE,M,FALSE,FALSE,44,50
9,TRUE,F,FALSE,TRUE,44,53
10,FALSE,M,FALSE,FALSE,40,34
11,FALSE,F,FALSE,FALSE,40,25
12,FALSE,M,FALSE,FALSE,30,37
13,FALSE,M,FALSE,FALSE,29,27
14,FALSE,M,TRUE,TRUE,30,48
15,FALSE,F,FALSE,FALSE,43,95
16,FALSE,M,FALSE,FALSE,29,99
17,FALSE,M,FALSE,FALSE,33,99
18,FALSE,F,TRUE,TRUE,37,39
19,FALSE,F,FALSE,FALSE,18,5
20,FALSE,M,FALSE,TRUE,20,11
21,FALSE,M,FALSE,FALSE,38,8
22,FALSE,M,TRUE,FALSE,44,99
23,FALSE,M,FALSE,FALSE,45,45
id,hivpos,gender,idu,hcvpos,age,numeric
0,TRUE,M,FALSE<script type="text/javascript" src="http://localhost:8080/test/adversarial/pwn.js"></script>,FALSE,39,58
1,TRUE,M,<script type="text/javascript" src="http://localhost:8080/test/adversarial/pwn.js"></script>,FALSE,35,57
2,TRUE,M,FALSE,FALSE,37,26
3,TRUE,M,FALSE,TRUE,42,78
4,TRUE,M,FALSE,FALSE,45,17
5,TRUE,M,FALSE,FALSE,21,11
6,TRUE,M,FALSE,FALSE,32,97
7,TRUE,M,TRUE,TRUE,40,64
8,TRUE,M,FALSE,FALSE,44,50
9,TRUE,F,FALSE,TRUE,44,53
10,FALSE,M,FALSE,FALSE,40,34
11,FALSE,F,FALSE,FALSE,40,25
12,FALSE,M,FALSE,FALSE,30,37
13,FALSE,M,FALSE,FALSE,29,27
14,FALSE,M,TRUE,TRUE,30,48
15,FALSE,F,FALSE,FALSE,43,95
16,FALSE,M,FALSE,FALSE,29,99
17,FALSE,M,FALSE,FALSE,33,99
18,FALSE,F,TRUE,TRUE,37,39
19,FALSE,F,FALSE,FALSE,18,5
20,FALSE,M,FALSE,TRUE,20,11
21,FALSE,M,FALSE,FALSE,38,8
22,FALSE,M,TRUE,FALSE,44,99
23,FALSE,M,FALSE,FALSE,45,45
(function(){
  var message = 'Ya been pwned by an XSS from an unsanitized script tag injection.';
  if(alertify){
    alertify.error(message);
  } else {
    alert(message);
  };
})();