CVE-2018-8974 (Other, published 2018-04-26T06:29Z)
Description: value: Centers for Disease Control and Prevention MicrobeTRACE 0.1.11 allows remote attackers to execute arbitrary code, related to code injection via a crafted CSV file with an initial 'Source<script type="text/javascript" src=' line. Fix released on 2018-03-28.
Severity: HIGH (CVSS v3 base score: 7.8)
Weakness: CWE-94 \u2014 Improper Control of Generation of Code ('Code Injection')
The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.
Repository: https://github.com/CDCgov/MicrobeTrace
Files changed:
components/files.html
scripts/common.js
test/adversarial/README.md
test/adversarial/fastaIDInjection.fasta
test/adversarial/fastaSequenceInjection.fasta
test/adversarial/linksFieldnameInjection.csv
test/adversarial/linksValueInjection.csv
test/adversarial/nodesFieldnameInjection.csv
test/adversarial/nodesValueInjection.csv
test/adversarial/pwn.js
Commit message: Added sanitization for XSS attempts



Vulnerable code:
      var data = output.data;
      var headers = output.meta.fields;
      $('#reference').val(app.parseFASTA(e.target.result)[0].seq);
          var link = results.data.forEach(link => {
              distance: (file.field3 === "None") ? 0 : link[file.field3],
              nodeIDs = row;

Fixed code:
    preview: 1,
      var headers = output.meta.fields.map(app.striptags);
      $('#reference').val(app.striptags(app.parseFASTA(e.target.result)[0].seq));
          node.id = app.striptags(node.id);
          node.seq = app.striptags(node.seq);
          results.data.forEach(link => {
            Object.keys(link).forEach(function(key){
              link[key] = app.striptags(link[key]);
            });
              distance: file.field3 === 'None' ? 0 : link[file.field3],
            key = app.striptags(key);
            node = JSON.parse(app.striptags(JSON.stringify(node)));
            key = app.striptags(key);
              nodeIDs = row.map(app.striptags);
app.striptags = function(inp){
  return ('' + inp)
    .replace(/<[^>]+?>.*?<\/[^>]+?>/g, '') //Closed Tags
    .replace(/<[^>]+?\/\s*>/g, '') //Self-Closing Tags
    .replace(/<[^>]+?>/g, ''); //Unclosed Tags
};

# Adversarial Tests

This directory contains a single script (pwn.js) which alerts the user that
their box has been pwned.

It also contains a variety of files which attempt XSS attacks by injecting
script tags through the various sources of input to the DOM.

To compensate for these, MicrobeTrace scrubs all inputs of anything matching a
set of dumb regexes that browsers will interpret as tags. Accordingly, any files
which contain tag-like syntax (e.g. a CSV with a field populated by HTML or XML
values) will not be loaded completely and correctly.
THIS IS A FEATURE, NOT A BUG.

To test MicrobeTrace's security using these files, launch a webserver on port
8080 in the MicrobeTrace Root directory. Then, with the server running, launch
MicrobeTrace and load any of the files in this directory. If you recieve an
alert that your username has been pwned, it means that somewhere in the program,
an unsanitized user input has been leaked into the DOM. This is a security bug.
Please contact nsp3@cdc.gov with a description of how you got the message (which
file you were using and what part of the program you were interacting with).
Please do NOT post this as an issue on Github.

Thank you!
>1922PL-110-1<script type="text/javascript" src="http://localhost:8080/test/adversarial/pwn.js"></script>
GTTACTTTAAATTGTATCAATGCTAATTTGACCAAGGGCCAACCAACCAATGACTCCATAATAATAGGAAATATGACAGATGAAGTAAGAAACTGTTCTTTTAATGTGACCACAGAACTAAGAGATAAAAAGCAGAAGGCCTATTCACTTTTTTATAAGCTTGATTTAGTAGAAATGGGAAATGGAAGTGAGTATAGGTTAATAAATTGTAATACTTCAGTCATTAAGCAGGCATGTCCAAAGGTAACCTTTGATCCAATTCCTATACATTATTGTACTCCAGCTGGTTATGCGATTATAAAATGTAATGATAAGAATTTCAATGGGACAGGGATATGTAAAAATGTCAGCTCAGTACAATGCACACATGGAATTAAGCCAGTGGTATCAACTCAATTGCTGTTAAATGGCAGTCTAGCAGAAGAAGAGATAATAATCAGATCTGAAAATCTCACAGACAATGCCAAAACCATAATAGTGCATCTTAATAAATCTGTAGAAATCAAGTGTATCAGACCCTCCACCAATACAAGAACAAGTATACGTATAGGACCAGGACAAGTATTCTATAGAACAGGAGACATAACAGGAAATATAAGAAAAGCTTATTGTGAGCTTAATGGAACAAAATGGAATGAAACTTTAAAACAGGTAACTAAGAAATTAAAAGAGCATTTTGAAAATAAGACAATAATCTTTCGACCACCCTCAGGAGGAGATTTAGAAATTACAATGCATCATTTTAATTGTAGAGGGGAATTTTTCTATTGCGATACAACACAATTGTTTAATAGTACTTGGGGAGAAAATGAAACCATGAAGGAACACAATGGCACTATCATACTTCTATGCAAGATAAAGCAAATCATAAACATGTGGCAGGGAGTGGGACAAGCAATGTATGCTCCTCCCATCAGGGGAAATATTAGTTGTGTATCAAATATTACAGGAATACTATTGACAAGAGATGGTGGTATTAATAATAATACTACCGAAACTTTCAGACCTGGA
>1922PL-110-2
GTTACTTTAAATTGTATCAATGCTAATTTGACCAAGGGCCAACCAACCAATGACTCCATAATAATAGGAAATATGACAGATGAAGTAAGAAACTGTTCTTTTAATGTGACCACAGAACTAAGAGATAAAAAGCAGAAGGCCTATTCACTTTTTTATAAGCTTGATTTAGTAGAAATGGGAAATGGAAGTGAGTATAGGTTAATAAATTGTAATACTTCAGTCATTAAGCAGGCATGTCCAAAGGTAACCTTTGATCCAATTCCTATACATTATTGTACTCCAGCTGGTTATGCGATTATAAAATGTAATGATAAGAATTTCAATGGGACAGGGATATGTAAAAATGTCAGCTCAGTACAATGCACACATGGAATTAAGCCAGTGGTATCAACTCAATTGCTGTTAAATGGCAGTCTAGCAGAAGAAGAGATAATAATCAGATCTGAAAATCTCACAGACAATGCCAAAACCATAATAGTGCATCTTAATAAATCTGTAGAAATCAAGTGTATCAGACCCTCCACCAATACAAGAACAAGTATACGTATAGGACCAGGACAAGTATTCTATAGAACAGGAGACATAACAGGAAATATAAGAAAAGCTTATTGTGAGCTTAATGGAACAAAATGGAATGAAACTTTAAAACAGGTAACTAAGAAATTAAAAGAGCATTTTGAAAATAAGACAATAATCTTTCGACCACCCTCAGGAGGAGATTTAGAAATTACAATGCATCATTTTAATTGTAGAGGGGAATTTTTCTATTGCGATACAACACAATTGTTTAATAGTACTTGGGGAGAAAATGAAACCATGAAGGAACACAATGGCACTATCATACTTCTATGCAAGATAAAGCAAATCATAAACATGTGGCAGGGAGTGGGACAAGCAATGTATGCTCCTCCCATCAGGGGAAATATTAGTTGTGTATCAAATATTACAGGAATACTATTGACAAGAGATGGTGGTATTAATAATAATACTACCGAAACTTTCAGACCTGGA
>1922PL-110-3
GTTACTTTAAATTGTATCAATGCTAATTTGACCAAGGGCCAACCAACCAATGACTCCATAATAATAGGAAATATGACAGATGAAGTAAGAAACTGTTCTTTTAATGTGACCACAGAACTAAGAGATAAAAAGCAGAAGGCCTATTCACTTTTTTATAAGCTTGATTTAGTAGAAATGGGAAATGGAAGTGAGTATAGGTTAATAAATTGTAATACTTCAGTCATTAAGCAGGCATGTCCAAAGGTAACCTTTGATCCAATTCCTATACATTATTGTACTCCAGCTGGTTATGCGATTATAAAATGTAATGATAAGAATTTCAATGGGACAGGGATATGTAAAAATGTCAGCTCAGTACAATGCACACATGGAATTAAGCCAGTGGTATCAACTCAATTGCTGTTAAATGGCAGTCTAGCAGAAGAAGAGATAATAATCAGATCTGAAAATCTCACAGACAATGCCAAAACCATAATAGTGCATCTTAATAAATCTGTAGAAATCAAGTGTATCAGACCCTCCACCAATACAAGAACAAGTATACGTATAGGACCAGGACAAGTATTCTATAGAACAGGAGACATAACAGGAAATATAAGAAAAGCTTATTGTGAGCTTAATGGAACAAAATGGAATGAAACTTTAAAACAGGTAACTAAGAAATTAAAAGAGCATTTTGAAAATAAGACAATAATCTTTCGACCACCCTCAGGAGGAGATTTAGAAATTACAATGCATCATTTTAATTGTAGAGGGGAATTTTTCTATTGCGATACAACACAATTGTTTAATAGTACTTGGGGAGAAAATGAAACCATGAAGGAACACAATGGCACTATCATACTTCTATGCAAGATAAAGCAAATCATAAACATGTGGCAGGGAGTGGGACAAGCAATGTATGCTCCTCCCATCAGGGGAAATATTAGTTGTGTATCAAATATTACAGGAATACTATTGACAAGAGATGGTGGTATTAATAATAATACTACCGAAACTTTCAGACCTGGA
>1922PL-110-4
GTTACTTTAAATTGTATCAATGCTAATTTGACCAAGGGCCAACCAACCAATGACTCCATAATAATAGGAAATATGACAGATGAAGTAAGAAACTGTTCTTTTAATGTGACCACAGAACTAAGAGATAAAAAGCAGAAGGCCTATTCACTTTTTTATAAGCTTGATTTAGTAGAAATGGGAAATGGAAGTGAGTATAGGTTAATAAATTGTAATACTTCAGTCATTAAGCAGGCATGTCCAAAGGTAACCTTTGATCCAATTCCTATACATTATTGTACTCCAGCTGGTTATGCGATTATAAAATGTAATGATAAGAATTTCAATGGGACAGGGATATGTAAAAATGTCAGCTCAGTACAATGCACACATGGAATTAAGCCAGTGGTATCAACTCAATTGCTGTTAAATGGCAGTCTAGCAGAAGAAGAGATAATAATCAGATCTGAAAATCTCACAGACAATGCCAAAACCATAATAGTGCATCTTAATAAATCTGTAGAAATCAAGTGTATCAGACCCTCCACCAATACAAGAACAAGTATACGTATAGGACCAGGACAAGTATTCTATAGAACAGGAGACATAACAGGAAATATAAGAAAAGCTTATTGTGAGCTTAATGGAACAAAATGGAATGAAACTTTAAAACAGGTAACTAAGAAATTAAAAGAGCATTTTGAAAATAAGACAATAATCTTTCGACCACCCTCAGGAGGAGATTTAGAAATTACAATGCATCATTTTAATTGTAGAGGGGAATTTTTCTATTGCGATACAACACAATTGTTTAATAGTACTTGGGGAGAAAATGAAACCATGAAGGAACACAATGGCACTATCATACTTCTATGCAAGATAAAGCAAATCATAAACATGTGGCAGGGAGTGGGACAAGCAATGTATGCTCCTCCCATCAGGGGAAATATTAGTTGTGTATCAAATATTACAGGAATACTATTGACAAGAGATGGTGGTATTAATAATAATACTACCGAAACTTTCAGACCTGGA
>1922PL-110-5
GTTACTTTAAATTGTATCAATGCTAATTTGACCAAGGGCCAACCAACCAATGACTCCATAATAATAGGAAATATGACAGATGAAGTAAGAAACTGTTCTTTTAATGTGACCACAGAACTAAGAGATAAAAAGCAGAAGGCCTATTCACTTTTTTATAAGCTTGATTTAGTAGAAATGGGAAATGGAAGTGAGTATAGGTTAATAAATTGTAATACTTCAGTCATTAAGCAGGCATGTCCAAAGGTAACCTTTGATCCAATTCCTATACATTATTGTACTCCAGCTGGTTATGCGATTATAAAATGTAATGATAAGAATTTCAATGGGACAGGGATATGTAAAAATGTCAGCTCAGTACAATGCACACATGGAATTAAGCCAGTGGTATCAACTCAATTGCTGTTAAATGGCAGTCTAGCAGAAGAAGAGATAATAATCAGATCTGAAAATCTCACAGACAATGCCAAAACCATAATAGTGCATCTTAATAAATCTGTAGAAATCAAGTGTATCAGACCCTCCACCAATACAAGAACAAGTATACGTATAGGACCAGGACAAGTATTCTATAGAACAGGAGACATAACAGGAAATATAAGAAAAGCTTATTGTGAGCTTAATGGAACAAAATGGAATGAAACTTTAAAACAGGTAACTAAGAAATTAAAAGAGCATTTTGAAAATAAGACAATAATCTTTCGACCACCCTCAGGAGGAGATTTAGAAATTACAATGCATCATTTTAATTGTAGAGGGGAATTTTTCTATTGCGATACAACACAATTGTTTAATAGTACTTGGGGAGAAAATGAAACCATGAAGGAACACAATGGCACTATCATACTTCTATGCAAGATAAAGCAAATCATAAACATGTGGCAGGGAGTGGGACAAGCAATGTATGCTCCTCCCATCAGGGGAAATATTAGTTGTGTATCAAATATTACAGGAATACTATTGACAAGAGATGGTGGTATTAATAATAATACTACCGAAACTTTCAGACCTGGA
>1922PL-110-6
GTTACTTTAAATTGTATCAATGCTAATTTGACCAAGGGCCAACCAACCAATGACTCCATAATAATAGGAAATATGACAGATGAAGTAAGAAACTGTTCTTTTAATGTGACCACAGAACTAAGAGATAAAAAGCAGAAGGCCTATTCACTTTTTTATAAGCTTGATTTAGTAGAAATGGGAAATGGAAGTGAGTATAGGTTAATAAATTGTAATACTTCAGTCATTAAGCAGGCATGTCCAAAGGTAACCTTTGATCCAATTCCTATACATTATTGTACTCCAGCTGGTTATGCGATTATAAAATGTAATGATAAGAATTTCAATGGGACAGGGATATGTAAAAATGTCAGCTCAGTACAATGCACACATGGAATTAAGCCAGTGGTATCAACTCAATTGCTGTTAAATGGCAGTCTAGCAGAAGAAGAGATAATAATCAGATCTGAAAATCTCACAGACAATGCCAAAACCATAATAGTGCATCTTAATAAATCTGTAGAAATCAAGTGTATCAGACCCTCCACCAATACAAGAACAAGTATACGTATAGGACCAGGACAAGTATTCTATAGAACAGGAGACATAACAGGAAATATAAGAAAAGCTTATTGTGAGCTTAATGGAACAAAATGGAATGAAACTTTAAAACAGGTAACTAAGAAATTAAAAGAGCATTTTGAAAATAAGACAATAATCTTTCGACCACCCTCAGGAGGAGATTTAGAAATTACAATGCATCATTTTAATTGTAGAGGGGAATTTTTCTATTGCGATACAACACAATTGTTTAATAGTACTTGGGGAGAAAATGAAACCATGAAGGAACACAATGGCACTATCATACTTCTATGCAAGATAAAGCAAATCATAAACATGTGGCAGGGAGTGGGACAAGCAATGTATGCTCCTCCCATCAGGGGAAATATTAGTTGTGTATCAAATATTACAGGAATACTATTGACAAGAGATGGTGGTATTAATAATAATACTACCGAAACTTTCAGACCTGGA
>1922PL-110-7
GTTACTTTAAATTGTATCAATGCTAATTTGACCAAGGGCCAACCAACCAATGACTCCATAATAATAGGAAATATGACAGATGAAGTAAGAAACTGTTCTTTTAATGTGACCACAGAACTAAGAGATAAAAAGCAGAAGGCCTATTCACTTTTTTATAAGCTTGATTTAGTAGAAATGGGAAATGGAAGTGAGTATAGGTTAATAAATTGTAATACTTCAGTCATTAAGCAGGCATGTCCAAAGGTAACCTTTGATCCAATTCCTATACATTATTGTACTCCAGCTGGTTATGCGATTATAAAATGTAATGATAAGAATTTCAATGGGACAGGGATATGTAAAAATGTCAGCTCAGTACAATGCACACATGGAATTAAGCCAGTGGTATCAACTCAATTGCTGTTAAATGGCAGTCTAGCAGAAGAAGAGATAATAATCAGATCTGAAAATCTCACAGACAATGCCAAAACCATAATAGTGCATCTTAATAAATCTGTAGAAATCAAGTGTATCAGACCCTCCACCAATACAAGAACAAGTATACGTATAGGACCAGGACAAGTATTCTATAGAACAGGAGACATAACAGGAAATATAAGAAAAGCTTATTGTGAGCTTAATGGAACAAAATGGAATGAAACTTTAAAACAGGTAACTAAGAAATTAAAAGAGCATTTTGAAAATAAGACAATAATCTTTCGACCACCCTCAGGAGGAGATTTAGAAATTACAATGCATCATTTTAATTGTAGAGGGGAATTTTTCTATTGCGATACAACACAATTGTTTAATAGTACTTGGGGAGAAAATGAAACCATGAAGGAACACAATGGCACTATCATACTTCTATGCAAGATAAAGCAAATCATAAACATGTGGCAGGGAGTGGGACAAGCAATGTATGCTCCTCCCATCAGGGGAAATATTAGTTGTGTATCAAATATTACAGGAATACTATTGACAAGAGATGGTGGTATTAATAATAATACTACCGAAACTTTCAGACCTGGA
>1922PL-110-8
GTTACTTTAAATTGTATCAATGCTAATTTGACCAAGGGCCAACCAACCAATGACTCCATAATAATAGGAAATATGACAGATGAAGTAAGAAACTGTTCTTTTAATGTGACCACAGAACTAAGAGATAAAAAGCAGAAGGCCTATTCACTTTTTTATAAGCTTGATTTAGTAGAAATGGGAAATGGAAGTGAGTATAGGTTAATAAATTGTAATACTTCAGTCATTAAGCAGGCATGTCCAAAGGTAACCTTTGATCCAATTCCTATACATTATTGTACTCCAGCTGGTTATGCGATTATAAAATGTAATGATAAGAATTTCAATGGGACAGGGATATGTAAAAATGTCAGCTCAGTACAATGCACACATGGAATTAAGCCAGTGGTATCAACTCAATTGCTGTTAAATGGCAGTCTAGCAGAAGAAGAGATAATAATCAGATCTGAAAATCTCACAGACAATGCCAAAACCATAATAGTGCATCTTAATAAATCTGTAGAAATCAAGTGTATCAGACCCTCCACCAATACAAGAACAAGTATACGTATAGGACCAGGACAAGTATTCTATAGAACAGGAGACATAACAGGAAATATAAGAAAAGCTTATTGTGAGCTTAATGGAACAAAATGGAATGAAACTTTAAAACAGGTAACTAAGAAATTAAAAGAGCATTTTGAAAATAAGACAATAATCTTTCGACCACCCTCAGGAGGAGATTTAGAAATTACAATGCATCATTTTAATTGTAGAGGGGAATTTTTCTATTGCGATACAACACAATTGTTTAATAGTACTTGGGGAGAAAATGAAACCATGAAGGAACACAATGGCACTATCATACTTCTATGCAAGATAAAGCAAATCATAAACATGTGGCAGGGAGTGGGACAAGCAATGTATGCTCCTCCCATCAGGGGAAATATTAGTTGTGTATCAAATATTACAGGAATACTATTGACAAGAGATGGTGGTATTAATAATAATACTACCGAAACTTTCAGACCTGGA
>1922PL-110-9
GTTACTTTAAATTGTATCAATGCTAATTTGACCAAGGGCCAACCAACCAATGACTCCATAATAATAGGAAATATGACAGATGAAGTAAGAAACTGTTCTTTTAATGTGACCACAGAACTAAGAGATAAAAAGCAGAAGGCCTATTCACTTTTTTATAAGCTTGATTTAGTAGAAATGGGAAATGGAAGTGAGTATAGGTTAATAAATTGTAATACTTCAGTCATTAAGCAGGCATGTCCAAAGGTAACCTTTGATCCAATTCCTATACATTATTGCACTCCAGCTGGTTATGCGATTATAAAATGTAATGATAAGAATTTCAATGGGACAGGGATATGTAAAAATGTCAGCTCAGTACAATGCACACATGGAATTAAGCCAGTGGTATCAACTCAATTGCTGTTAAATGGCAGTCTAGCAGAAGAAGAGATAATAATCAGATCTGAAAATCTCACAGACAATGCCAAAACCATAATAGTGCATCTTAATAAATCTGTAGAAATCAAGTGTATCAGACCCTCCACCAATACAAGAACAAGTATACGTATAGGACCAGGACAAGTATTCTATAGAACAGGAGACATAACAGGAAATATAAGAAAAGCTTATTGTGAGCTTAATGGAACAAAATGGAATGAAACTTTAAAACAGGTAACTAAGAAATTAAAAGAGCATTTTGAAAATAAGACAATAATCTTTCGACCACCCTCAGGAGGAGATTTAGAAATTACAATGCATCATTTTAATTGTAGAGGGGAATTTTTCTATTGCGATACAACACAATTGTTTAATAGTACTTGGGGAGAAAATGAAACCATGAAGGAACACAATGGCACTATCATACTTCTATGCAAGATAAAGCAAATCATAAACATGTGGCAGGGAGTGGGACAAGCAATGTATGCTCCTCCCATCAGGGGAAATATTAGTTGTGTATCAAATATTACAGGAATACTATTGACAAGAGATGGTGGTATTAATAATAATACTACCGAAACTTTCAGACCTGGA
>1922PL-110-1
GTTACTTTAAATTGTATCAATGCTAATTTGACCAAGGGCCAACCAACCAATGACTCCATAATAATAGGAAATATGACAGATGAAGTAAGAAACTGTTCTTTTAATGTGACCACAGAACTAAGAGATAAAAAGCAGAAGGCCTATTCACTTTTTTATAAGCTTGATTTAGTAGAAATGGGAAATGGAAGTGAGTATAGGTTAATAAATTGTAATACTTCAGTCATTAAGCAGGCATGTCCAAAGGTAACCTTTGATCCAATTCCTATACATTATTGTACTCCAGCTGGTTATGCGATTATAAAATGTAATGATAAGAATTTCAATGGGACAGGGATATGTAAAAATGTCAGCTCAGTACAATGCACACATGGAATTAAGCCAGTGGTATCAACTCAATTGCTGTTAAATGGCAGTCTAGCAGAAGAAGAGATAATAATCAGATCTGAAAATCTCACAGACAATGCCAAAACCATAATAGTGCATCTTAATAAATCTGTAGAAATCAAGTGTATCAGACCCTCCACCAATACAAGAACAAGTATACGTATAGGACCAGGACAAGTATTCTATAGAACAGGAGACATAACAGGAAATATAAGAAAAGCTTATTGTGAGCTTAATGGAACAAAATGGAATGAAACTTTAAAACAGGTAACTAAGAAATTAAAAGAGCATTTTGAAAATAAGACAATAATCTTTCGACCACCCTCAGGAGGAGATTTAGAAATTACAATGCATCATTTTAATTGTAGAGGGGAATTTTTCTATTGCGATACAACACAATTGTTTAATAGTACTTGGGGAGAAAATGAAACCATGAAGGAACACAATGGCACTATCATACTTCTATGCAAGATAAAGCAAATCATAAACATGTGGCAGGGAGTGGGACAAGCAATGTATGCTCCTCCCATCAGGGGAAATATTAGTTGTGTATCAAATATTACAGGAATACTATTGACAAGAGATGGTGGTATTAATAATAATACTACCGAAACTTTCAGACCTGGA<script type="text/javascript" src="http://localhost:8080/test/adversarial/pwn.js"></script>
>1922PL-110-2
GTTACTTTAAATTGTATCAATGCTAATTTGACCAAGGGCCAACCAACCAATGACTCCATAATAATAGGAAATATGACAGATGAAGTAAGAAACTGTTCTTTTAATGTGACCACAGAACTAAGAGATAAAAAGCAGAAGGCCTATTCACTTTTTTATAAGCTTGATTTAGTAGAAATGGGAAATGGAAGTGAGTATAGGTTAATAAATTGTAATACTTCAGTCATTAAGCAGGCATGTCCAAAGGTAACCTTTGATCCAATTCCTATACATTATTGTACTCCAGCTGGTTATGCGATTATAAAATGTAATGATAAGAATTTCAATGGGACAGGGATATGTAAAAATGTCAGCTCAGTACAATGCACACATGGAATTAAGCCAGTGGTATCAACTCAATTGCTGTTAAATGGCAGTCTAGCAGAAGAAGAGATAATAATCAGATCTGAAAATCTCACAGACAATGCCAAAACCATAATAGTGCATCTTAATAAATCTGTAGAAATCAAGTGTATCAGACCCTCCACCAATACAAGAACAAGTATACGTATAGGACCAGGACAAGTATTCTATAGAACAGGAGACATAACAGGAAATATAAGAAAAGCTTATTGTGAGCTTAATGGAACAAAATGGAATGAAACTTTAAAACAGGTAACTAAGAAATTAAAAGAGCATTTTGAAAATAAGACAATAATCTTTCGACCACCCTCAGGAGGAGATTTAGAAATTACAATGCATCATTTTAATTGTAGAGGGGAATTTTTCTATTGCGATACAACACAATTGTTTAATAGTACTTGGGGAGAAAATGAAACCATGAAGGAACACAATGGCACTATCATACTTCTATGCAAGATAAAGCAAATCATAAACATGTGGCAGGGAGTGGGACAAGCAATGTATGCTCCTCCCATCAGGGGAAATATTAGTTGTGTATCAAATATTACAGGAATACTATTGACAAGAGATGGTGGTATTAATAATAATACTACCGAAACTTTCAGACCTGGA
>1922PL-110-3
GTTACTTTAAATTGTATCAATGCTAATTTGACCAAGGGCCAACCAACCAATGACTCCATAATAATAGGAAATATGACAGATGAAGTAAGAAACTGTTCTTTTAATGTGACCACAGAACTAAGAGATAAAAAGCAGAAGGCCTATTCACTTTTTTATAAGCTTGATTTAGTAGAAATGGGAAATGGAAGTGAGTATAGGTTAATAAATTGTAATACTTCAGTCATTAAGCAGGCATGTCCAAAGGTAACCTTTGATCCAATTCCTATACATTATTGTACTCCAGCTGGTTATGCGATTATAAAATGTAATGATAAGAATTTCAATGGGACAGGGATATGTAAAAATGTCAGCTCAGTACAATGCACACATGGAATTAAGCCAGTGGTATCAACTCAATTGCTGTTAAATGGCAGTCTAGCAGAAGAAGAGATAATAATCAGATCTGAAAATCTCACAGACAATGCCAAAACCATAATAGTGCATCTTAATAAATCTGTAGAAATCAAGTGTATCAGACCCTCCACCAATACAAGAACAAGTATACGTATAGGACCAGGACAAGTATTCTATAGAACAGGAGACATAACAGGAAATATAAGAAAAGCTTATTGTGAGCTTAATGGAACAAAATGGAATGAAACTTTAAAACAGGTAACTAAGAAATTAAAAGAGCATTTTGAAAATAAGACAATAATCTTTCGACCACCCTCAGGAGGAGATTTAGAAATTACAATGCATCATTTTAATTGTAGAGGGGAATTTTTCTATTGCGATACAACACAATTGTTTAATAGTACTTGGGGAGAAAATGAAACCATGAAGGAACACAATGGCACTATCATACTTCTATGCAAGATAAAGCAAATCATAAACATGTGGCAGGGAGTGGGACAAGCAATGTATGCTCCTCCCATCAGGGGAAATATTAGTTGTGTATCAAATATTACAGGAATACTATTGACAAGAGATGGTGGTATTAATAATAATACTACCGAAACTTTCAGACCTGGA
>1922PL-110-4
GTTACTTTAAATTGTATCAATGCTAATTTGACCAAGGGCCAACCAACCAATGACTCCATAATAATAGGAAATATGACAGATGAAGTAAGAAACTGTTCTTTTAATGTGACCACAGAACTAAGAGATAAAAAGCAGAAGGCCTATTCACTTTTTTATAAGCTTGATTTAGTAGAAATGGGAAATGGAAGTGAGTATAGGTTAATAAATTGTAATACTTCAGTCATTAAGCAGGCATGTCCAAAGGTAACCTTTGATCCAATTCCTATACATTATTGTACTCCAGCTGGTTATGCGATTATAAAATGTAATGATAAGAATTTCAATGGGACAGGGATATGTAAAAATGTCAGCTCAGTACAATGCACACATGGAATTAAGCCAGTGGTATCAACTCAATTGCTGTTAAATGGCAGTCTAGCAGAAGAAGAGATAATAATCAGATCTGAAAATCTCACAGACAATGCCAAAACCATAATAGTGCATCTTAATAAATCTGTAGAAATCAAGTGTATCAGACCCTCCACCAATACAAGAACAAGTATACGTATAGGACCAGGACAAGTATTCTATAGAACAGGAGACATAACAGGAAATATAAGAAAAGCTTATTGTGAGCTTAATGGAACAAAATGGAATGAAACTTTAAAACAGGTAACTAAGAAATTAAAAGAGCATTTTGAAAATAAGACAATAATCTTTCGACCACCCTCAGGAGGAGATTTAGAAATTACAATGCATCATTTTAATTGTAGAGGGGAATTTTTCTATTGCGATACAACACAATTGTTTAATAGTACTTGGGGAGAAAATGAAACCATGAAGGAACACAATGGCACTATCATACTTCTATGCAAGATAAAGCAAATCATAAACATGTGGCAGGGAGTGGGACAAGCAATGTATGCTCCTCCCATCAGGGGAAATATTAGTTGTGTATCAAATATTACAGGAATACTATTGACAAGAGATGGTGGTATTAATAATAATACTACCGAAACTTTCAGACCTGGA
>1922PL-110-5
GTTACTTTAAATTGTATCAATGCTAATTTGACCAAGGGCCAACCAACCAATGACTCCATAATAATAGGAAATATGACAGATGAAGTAAGAAACTGTTCTTTTAATGTGACCACAGAACTAAGAGATAAAAAGCAGAAGGCCTATTCACTTTTTTATAAGCTTGATTTAGTAGAAATGGGAAATGGAAGTGAGTATAGGTTAATAAATTGTAATACTTCAGTCATTAAGCAGGCATGTCCAAAGGTAACCTTTGATCCAATTCCTATACATTATTGTACTCCAGCTGGTTATGCGATTATAAAATGTAATGATAAGAATTTCAATGGGACAGGGATATGTAAAAATGTCAGCTCAGTACAATGCACACATGGAATTAAGCCAGTGGTATCAACTCAATTGCTGTTAAATGGCAGTCTAGCAGAAGAAGAGATAATAATCAGATCTGAAAATCTCACAGACAATGCCAAAACCATAATAGTGCATCTTAATAAATCTGTAGAAATCAAGTGTATCAGACCCTCCACCAATACAAGAACAAGTATACGTATAGGACCAGGACAAGTATTCTATAGAACAGGAGACATAACAGGAAATATAAGAAAAGCTTATTGTGAGCTTAATGGAACAAAATGGAATGAAACTTTAAAACAGGTAACTAAGAAATTAAAAGAGCATTTTGAAAATAAGACAATAATCTTTCGACCACCCTCAGGAGGAGATTTAGAAATTACAATGCATCATTTTAATTGTAGAGGGGAATTTTTCTATTGCGATACAACACAATTGTTTAATAGTACTTGGGGAGAAAATGAAACCATGAAGGAACACAATGGCACTATCATACTTCTATGCAAGATAAAGCAAATCATAAACATGTGGCAGGGAGTGGGACAAGCAATGTATGCTCCTCCCATCAGGGGAAATATTAGTTGTGTATCAAATATTACAGGAATACTATTGACAAGAGATGGTGGTATTAATAATAATACTACCGAAACTTTCAGACCTGGA
>1922PL-110-6
GTTACTTTAAATTGTATCAATGCTAATTTGACCAAGGGCCAACCAACCAATGACTCCATAATAATAGGAAATATGACAGATGAAGTAAGAAACTGTTCTTTTAATGTGACCACAGAACTAAGAGATAAAAAGCAGAAGGCCTATTCACTTTTTTATAAGCTTGATTTAGTAGAAATGGGAAATGGAAGTGAGTATAGGTTAATAAATTGTAATACTTCAGTCATTAAGCAGGCATGTCCAAAGGTAACCTTTGATCCAATTCCTATACATTATTGTACTCCAGCTGGTTATGCGATTATAAAATGTAATGATAAGAATTTCAATGGGACAGGGATATGTAAAAATGTCAGCTCAGTACAATGCACACATGGAATTAAGCCAGTGGTATCAACTCAATTGCTGTTAAATGGCAGTCTAGCAGAAGAAGAGATAATAATCAGATCTGAAAATCTCACAGACAATGCCAAAACCATAATAGTGCATCTTAATAAATCTGTAGAAATCAAGTGTATCAGACCCTCCACCAATACAAGAACAAGTATACGTATAGGACCAGGACAAGTATTCTATAGAACAGGAGACATAACAGGAAATATAAGAAAAGCTTATTGTGAGCTTAATGGAACAAAATGGAATGAAACTTTAAAACAGGTAACTAAGAAATTAAAAGAGCATTTTGAAAATAAGACAATAATCTTTCGACCACCCTCAGGAGGAGATTTAGAAATTACAATGCATCATTTTAATTGTAGAGGGGAATTTTTCTATTGCGATACAACACAATTGTTTAATAGTACTTGGGGAGAAAATGAAACCATGAAGGAACACAATGGCACTATCATACTTCTATGCAAGATAAAGCAAATCATAAACATGTGGCAGGGAGTGGGACAAGCAATGTATGCTCCTCCCATCAGGGGAAATATTAGTTGTGTATCAAATATTACAGGAATACTATTGACAAGAGATGGTGGTATTAATAATAATACTACCGAAACTTTCAGACCTGGA
>1922PL-110-7
GTTACTTTAAATTGTATCAATGCTAATTTGACCAAGGGCCAACCAACCAATGACTCCATAATAATAGGAAATATGACAGATGAAGTAAGAAACTGTTCTTTTAATGTGACCACAGAACTAAGAGATAAAAAGCAGAAGGCCTATTCACTTTTTTATAAGCTTGATTTAGTAGAAATGGGAAATGGAAGTGAGTATAGGTTAATAAATTGTAATACTTCAGTCATTAAGCAGGCATGTCCAAAGGTAACCTTTGATCCAATTCCTATACATTATTGTACTCCAGCTGGTTATGCGATTATAAAATGTAATGATAAGAATTTCAATGGGACAGGGATATGTAAAAATGTCAGCTCAGTACAATGCACACATGGAATTAAGCCAGTGGTATCAACTCAATTGCTGTTAAATGGCAGTCTAGCAGAAGAAGAGATAATAATCAGATCTGAAAATCTCACAGACAATGCCAAAACCATAATAGTGCATCTTAATAAATCTGTAGAAATCAAGTGTATCAGACCCTCCACCAATACAAGAACAAGTATACGTATAGGACCAGGACAAGTATTCTATAGAACAGGAGACATAACAGGAAATATAAGAAAAGCTTATTGTGAGCTTAATGGAACAAAATGGAATGAAACTTTAAAACAGGTAACTAAGAAATTAAAAGAGCATTTTGAAAATAAGACAATAATCTTTCGACCACCCTCAGGAGGAGATTTAGAAATTACAATGCATCATTTTAATTGTAGAGGGGAATTTTTCTATTGCGATACAACACAATTGTTTAATAGTACTTGGGGAGAAAATGAAACCATGAAGGAACACAATGGCACTATCATACTTCTATGCAAGATAAAGCAAATCATAAACATGTGGCAGGGAGTGGGACAAGCAATGTATGCTCCTCCCATCAGGGGAAATATTAGTTGTGTATCAAATATTACAGGAATACTATTGACAAGAGATGGTGGTATTAATAATAATACTACCGAAACTTTCAGACCTGGA
>1922PL-110-8
GTTACTTTAAATTGTATCAATGCTAATTTGACCAAGGGCCAACCAACCAATGACTCCATAATAATAGGAAATATGACAGATGAAGTAAGAAACTGTTCTTTTAATGTGACCACAGAACTAAGAGATAAAAAGCAGAAGGCCTATTCACTTTTTTATAAGCTTGATTTAGTAGAAATGGGAAATGGAAGTGAGTATAGGTTAATAAATTGTAATACTTCAGTCATTAAGCAGGCATGTCCAAAGGTAACCTTTGATCCAATTCCTATACATTATTGTACTCCAGCTGGTTATGCGATTATAAAATGTAATGATAAGAATTTCAATGGGACAGGGATATGTAAAAATGTCAGCTCAGTACAATGCACACATGGAATTAAGCCAGTGGTATCAACTCAATTGCTGTTAAATGGCAGTCTAGCAGAAGAAGAGATAATAATCAGATCTGAAAATCTCACAGACAATGCCAAAACCATAATAGTGCATCTTAATAAATCTGTAGAAATCAAGTGTATCAGACCCTCCACCAATACAAGAACAAGTATACGTATAGGACCAGGACAAGTATTCTATAGAACAGGAGACATAACAGGAAATATAAGAAAAGCTTATTGTGAGCTTAATGGAACAAAATGGAATGAAACTTTAAAACAGGTAACTAAGAAATTAAAAGAGCATTTTGAAAATAAGACAATAATCTTTCGACCACCCTCAGGAGGAGATTTAGAAATTACAATGCATCATTTTAATTGTAGAGGGGAATTTTTCTATTGCGATACAACACAATTGTTTAATAGTACTTGGGGAGAAAATGAAACCATGAAGGAACACAATGGCACTATCATACTTCTATGCAAGATAAAGCAAATCATAAACATGTGGCAGGGAGTGGGACAAGCAATGTATGCTCCTCCCATCAGGGGAAATATTAGTTGTGTATCAAATATTACAGGAATACTATTGACAAGAGATGGTGGTATTAATAATAATACTACCGAAACTTTCAGACCTGGA
>1922PL-110-9
GTTACTTTAAATTGTATCAATGCTAATTTGACCAAGGGCCAACCAACCAATGACTCCATAATAATAGGAAATATGACAGATGAAGTAAGAAACTGTTCTTTTAATGTGACCACAGAACTAAGAGATAAAAAGCAGAAGGCCTATTCACTTTTTTATAAGCTTGATTTAGTAGAAATGGGAAATGGAAGTGAGTATAGGTTAATAAATTGTAATACTTCAGTCATTAAGCAGGCATGTCCAAAGGTAACCTTTGATCCAATTCCTATACATTATTGCACTCCAGCTGGTTATGCGATTATAAAATGTAATGATAAGAATTTCAATGGGACAGGGATATGTAAAAATGTCAGCTCAGTACAATGCACACATGGAATTAAGCCAGTGGTATCAACTCAATTGCTGTTAAATGGCAGTCTAGCAGAAGAAGAGATAATAATCAGATCTGAAAATCTCACAGACAATGCCAAAACCATAATAGTGCATCTTAATAAATCTGTAGAAATCAAGTGTATCAGACCCTCCACCAATACAAGAACAAGTATACGTATAGGACCAGGACAAGTATTCTATAGAACAGGAGACATAACAGGAAATATAAGAAAAGCTTATTGTGAGCTTAATGGAACAAAATGGAATGAAACTTTAAAACAGGTAACTAAGAAATTAAAAGAGCATTTTGAAAATAAGACAATAATCTTTCGACCACCCTCAGGAGGAGATTTAGAAATTACAATGCATCATTTTAATTGTAGAGGGGAATTTTTCTATTGCGATACAACACAATTGTTTAATAGTACTTGGGGAGAAAATGAAACCATGAAGGAACACAATGGCACTATCATACTTCTATGCAAGATAAAGCAAATCATAAACATGTGGCAGGGAGTGGGACAAGCAATGTATGCTCCTCCCATCAGGGGAAATATTAGTTGTGTATCAAATATTACAGGAATACTATTGACAAGAGATGGTGGTATTAATAATAATACTACCGAAACTTTCAGACCTGGA
Source<script type="text/javascript" src="http://localhost:8080/test/adversarial/pwn.js"></script>,Target,Weight,distance
1807,1311,1,0.013987
1518,1311,15,0.013985
1481,1311,26,0.01398
1480,1311,12,0.01398
1422,1311,24,0.013978
Source,Target,Weight,distance
<script type="text/javascript" src="http://localhost:8080/test/adversarial/pwn.js"></script>1518,1311,1,0.013987
1518,<script type="text/javascript" src="http://localhost:8080/test/adversarial/pwn.js"></script>,15,0.013985
1481,1311,<script type="text/javascript" src="http://localhost:8080/test/adversarial/pwn.js"></script>,0.01398
1480,1311,12,<script type="text/javascript" src="http://localhost:8080/test/adversarial/pwn.js"></script>
1422,1311,24,0.013978
id,hivpos,gender<script type="text/javascript" src="http://localhost:8080/test/adversarial/pwn.js"></script>,idu,hcvpos,age,numeric
0,TRUE,M,FALSE,FALSE,39,58
1,TRUE,M,FALSE,FALSE,35,57
2,TRUE,M,FALSE,FALSE,37,26
3,TRUE,M,FALSE,TRUE,42,78
4,TRUE,M,FALSE,FALSE,45,17
5,TRUE,M,FALSE,FALSE,21,11
6,TRUE,M,FALSE,FALSE,32,97
7,TRUE,M,TRUE,TRUE,40,64
8,TRUE,M,FALSE,FALSE,44,50
9,TRUE,F,FALSE,TRUE,44,53
10,FALSE,M,FALSE,FALSE,40,34
11,FALSE,F,FALSE,FALSE,40,25
12,FALSE,M,FALSE,FALSE,30,37
13,FALSE,M,FALSE,FALSE,29,27
14,FALSE,M,TRUE,TRUE,30,48
15,FALSE,F,FALSE,FALSE,43,95
16,FALSE,M,FALSE,FALSE,29,99
17,FALSE,M,FALSE,FALSE,33,99
18,FALSE,F,TRUE,TRUE,37,39
19,FALSE,F,FALSE,FALSE,18,5
20,FALSE,M,FALSE,TRUE,20,11
21,FALSE,M,FALSE,FALSE,38,8
22,FALSE,M,TRUE,FALSE,44,99
23,FALSE,M,FALSE,FALSE,45,45
id,hivpos,gender,idu,hcvpos,age,numeric
0,TRUE,M,FALSE<script type="text/javascript" src="http://localhost:8080/test/adversarial/pwn.js"></script>,FALSE,39,58
1,TRUE,M,<script type="text/javascript" src="http://localhost:8080/test/adversarial/pwn.js"></script>,FALSE,35,57
2,TRUE,M,FALSE,FALSE,37,26
3,TRUE,M,FALSE,TRUE,42,78
4,TRUE,M,FALSE,FALSE,45,17
5,TRUE,M,FALSE,FALSE,21,11
6,TRUE,M,FALSE,FALSE,32,97
7,TRUE,M,TRUE,TRUE,40,64
8,TRUE,M,FALSE,FALSE,44,50
9,TRUE,F,FALSE,TRUE,44,53
10,FALSE,M,FALSE,FALSE,40,34
11,FALSE,F,FALSE,FALSE,40,25
12,FALSE,M,FALSE,FALSE,30,37
13,FALSE,M,FALSE,FALSE,29,27
14,FALSE,M,TRUE,TRUE,30,48
15,FALSE,F,FALSE,FALSE,43,95
16,FALSE,M,FALSE,FALSE,29,99
17,FALSE,M,FALSE,FALSE,33,99
18,FALSE,F,TRUE,TRUE,37,39
19,FALSE,F,FALSE,FALSE,18,5
20,FALSE,M,FALSE,TRUE,20,11
21,FALSE,M,FALSE,FALSE,38,8
22,FALSE,M,TRUE,FALSE,44,99
23,FALSE,M,FALSE,FALSE,45,45
(function(){
  var message = 'Ya been pwned by an XSS from an unsanitized script tag injection.';
  if(alertify){
    alertify.error(message);
  } else {
    alert(message);
  };
})();