[Fall 2021] Step 2: Coverage Improvement - Expand XSS regex to cover javascript: URLs

[onionymous]

Pysa supports string literals as implicit sources/sinks.

We currently look for strings with <> in them to detect potential HTML injection sinks (see https://github.com/facebook/pyre-check/blob/d82759a1f1ce5467aa2250708b226790c046f207/stubs/taint/core_privacy_security/taint.config#L652) and have a rule for UserControlled data going to these implicit sinks.

Sometimes in Python code we also see the javascript: pseudo-protocol URLs which can also be an XSS sink.

The goal is to improve this regex and add detection for javascript: URLs, as well as any other improvements you can think of!

Submitting a PR

We use the following linters internally, so to save everyone's time, please make sure you run the following linters locally and fix errors related to the files you modified before submitting a PR:

black && usort format . && flake8

To install the linters, you can run the following command:

pip install flake8 usort black==21.4b2