{
String lower = script.toLowerCase();
int column = lower.indexOf("innerhtml");
if (column >= 0)
{
report.message(MessageId.SCP_007, new MessageLocation(fileName, line, column, trimContext(script, column)));
}
column = lower.indexOf("innertext");
if (column >= 0)
{
report.message(MessageId.SCP_008, new MessageLocation(fileName, line, column, trimContext(script, column)));
}
// the exact pattern is very complex and it slows down all script checking.
// what we can do here is use a blunt check (for the word "eval"). if it is not found, keep moving.
// If it is found, look closely using the exact pattern to see if the line truly matches the exact eval() function and report that.
Matcher m = null;
if (script.contains("eval"))
{
m = ScriptTagHandler.evalPattern.matcher(script);
if (m.find())
{
report.message(MessageId.SCP_001, new MessageLocation(fileName, line, m.start(0), trimContext(script, m.start())));
}
}
m = ScriptTagHandler.localStoragePattern.matcher(script);
if (m.find())
{
report.message(MessageId.SCP_003, new MessageLocation(fileName, line, m.start(0), trimContext(script, m.start())));
}
m = ScriptTagHandler.sessionStoragePattern.matcher(script);
if (m.find())
{
report.message(MessageId.SCP_003, new MessageLocation(fileName, line, m.start(0), trimContext(script, m.start())));
}
m = ScriptTagHandler.xmlHttpRequestPattern.matcher(script);
if (m.find())
{
report.message(MessageId.SCP_002, new MessageLocation(fileName, line, m.start(0), trimContext(script, m.start())));
}
m = ScriptTagHandler.microsoftXmlHttpRequestPattern.matcher(script);
if (m.find())
{
report.message(MessageId.SCP_002, new MessageLocation(fileName, line, m.start(0), trimContext(script, m.start())));
}
}