Extend dataset with add, replaceWith, replaceAll

[mvondracek]

• Extend unsafe_methods with add, replaceWith.
  

  jQuery-XSS/dataset/generate.sh

  Lines 3 to 16 in 6330964

  	unsafe_methods=(
  	'html'
  	'prepend'
  	'prependTo'
  	'append'
  	'appendTo'
  	'before'
  	'after'
  	'insertBefore'
  	'insertAfter'
  	'wrap'
  	'wrapInner'
  	'wrapAll'
  	)

• Add new unsafe_methods_reversed array with replaceAll, see https://api.jquery.com/replaceAll/. Callee and parameter is reversed (switched) in this method compared to others in unsafe_methods.
• Extract following dataset generation into a semarate shell function. Use such function when iterating over unsafe_methods.
  

  jQuery-XSS/dataset/generate.sh

  Lines 23 to 40 in 6330964

  	echo -n "${method}, generate"
  	method_dir="./out/tmp/${method}"
  	mkdir "${method_dir}"
  	for filepath in ./in/*.js; do
  	filename=$(basename "$filepath")
  	cp "$filepath" "${method_dir}/${batch}_${filename}"
  	cp "${filepath%.js}.out" "${method_dir}/${batch}_${filename%.js}.out"
  	echo -n "."
  	done
  	echo ""
  	sed -i "s/__BATCH__/_${batch}_/g" "${method_dir}/"*.js
  	sed -i "s/__METHOD__/${method}/g" "${method_dir}/"*.js
  	echo "${method}, done"
  	mv "${method_dir}/"*.js ./out/tmp/
  	mv "${method_dir}/"*.out ./out/
  	rmdir "${method_dir}"
  	echo "${method}, moved"
  	batch=$((batch+1))

• Use function from previous step to iterate over unsafe_methods_reversed. However, methods from unsafe_methods_reversed need XSS payload in callee and selector in parameter (e.g., $( "<script>" ).replaceAll( "div" );). Adjust dataset input (in folder) so that we can generate both forms ($(xss).method(selector); and $(selector).method(xss);).
• Regenerate the dataset and evaluate the tools. Present confusion matrix similar to those in the paper.

In case of any questions, feel free to contact @mvondracek for details.