mozilla/scanjs — pull request #66 by pwnetrationguru (2014-03-18 15:15:04+00:00)
Title: ScanJS test cases!

*adding test cases. updated mocha.js. 1 spelling fix in common/rules.js*

# Summary
This adds tests for ScanJS.scan(). This is a VERY IMPORTANT pull review, as we will become more and more dependent on the logic in these tests. We must ensure that the tests cases test what we intend.

That means this PR should be reviewed VERY CAREFULLY and VERY TEDIOUSLY.

Ok... I've used enough caps, I think you get how important it is we get this one right.

Testing caught quite a few 'errors' in our rules. I have summarized them below. We either need to fix the rule definitions to pass the tests OR we need to decide that the behavior defined in the tests is not something we can/will catch with ScanJS.scan(), which will lead to us deleting the rule (or marking pending if we plan to fix in future release).

I NEED THIS FROM YOU, THE REVIEWER (last caps, i promise):
1. Go through EACH test case and verify that the ```good```/```bad``` example is categorized and being used correctly. Yes, there are a lot. Yes, we need to go through them all.
2. Go through EACH failure (summarized below) and decided:
- a) Our rule definition is broken, we need to update and keep this tests
- b) ScanJS will not catch this case, we need to delete this rule
- c) ScanJS *should* catch this case, we will in the future, mark test pending

## Failures we need to address by fixing rules
### ScanJS.scan() flags these SAFE cases
#### rule def errors
* ```var a = 1; div.innerHTML = a```
- type inference branch should fix this
* ```form.data = "mystring";```
- asignment from static string to .data we shouldn't care about
* ```a.href = "http://mozilla.org";```
- we appear to only care about ```javascript:``` and ```data```
* ```function message() { console.log(1); }```
- this is not the 'message' we are looking for
* ```var src = img.src;```
- we don't care about getting from src, we care about assigning to it
* ```var a = document.createElement("script"); a.src = "static string"; document.body.appendChild(a);```
- src assigned from static string, we should ignore

#### variable named same as object
* ```good.CustomEvent = "CustomEvent";```
* ```var addEventListener = "variable with name";```
* ```addIdleObserver = "static string";```
* ```something.addIdleObserver = "static string";```
* ```var escapeHTML = "just a string";```
* ```var localStorage = "asdf";```
* ```var message = "static string";```
* ```var MozActivity = "static MozActivity";```
* ```var mozChromeEvent = "string mozChromeEvent";```
* ```var mozPermissionSettings = "just a string, not mozPermissionSettings";```
* ```var mozPower = "just a string, window.navigator.mozPower;";```
* ```var mozSettings = "window.navigator.mozSettings;";```
* ```var mozSms = "window.navigator.mozSms;";```
* ```somethingNotNavigator.mozWifiManager;```

### ScanJS.scan() misses these DANGEROUS cases
#### ```setAttribute```
* ```var a=document.createElement("form"); a.setAttribute("action", "demo_form.asp"); document.body.appendChild(a);```
* ```var a = document.createElement("a"); a.setAttribute("href", "javascript:alert(0)"); document.body.appendChild(a);```
* ```iframe.setAttribute("mozapp", data.app);```
* ```var a = document.createElement("audio"); a.setAttribute("mozaudiochannel", data.app);```

#### ```window[a]```
* ```var a = "indexedDB"; window[a].open(3);```
* ```var a = "indexedDB"; var b = window[a]; b.open(3);```
* ```var a = "localStorage"; window[a].setItem("name", "user1");```
* ```var a = "localStorage"; var b = window[a]; b.setItem("name", "user1");```
* ```var a = "setInterval"; window[a]("console.log(5)", 300);```
* ```dangerous: var a = "setTimeout"; window[a]("console.log(5)", 300);```

#### ```var a = func; a() ```
* ```var a = window.document; a.b = document.writeln; a.b("

bad

");```
* ```var a = window.document; a.b = document.writeln; a.b("

bad

");```
* ```var a = window.setInterval; a("console.log(4)", 300);```
* ```var a = window.setTimeout; a("console.log(4)", 300);```
* ```var o = window.open; o("http://www.mozilla.org", "name", {});```
* ```var a = eval; a("alert(0);");```
* ```var a = Function; new a("alert(0)")();```
* ```var a = crypto; a.generate = crypto.generateCRMFRequest; a.generate("CN=0", 0, 0, null, "console.log(1)", 384, null, "rsa-dual-use");```

#### just failures - need to update rule defs
* ```var a=document.createElement("div"); a.innerHTML="

"; document.body.appendChild(a);```
* ```var documentFragment = range.createContextualFragment("

bad

");```
* ```window.document.write("Hello World!");```
* ```window.document.writeln("Hello World!");```
* ```doc = parser.parseFromString("

somehtml

", "text/html");```
* ```var intervalID = window.setInterval("console.log(2)", 500);```
* ```something.setInterval("console.log(3)", 500);```
* ```var intervalID = window.setTimeout("console.log(2)", 500);```
* ```something.setTimeout("console.log(3)", 500);```
* ```window["navigator"]["getDeviceStorage"](storageName);```
* ```var stuffs = navigator.mozApps.mgmt;```
* ```var stuffs = navigator.mozApps.mgmt.getAll()```
* ```MozMobileConnection.sendMMI()```