diff --git a/session/session1.ql b/session/session1.ql index 02be83e..0199245 100644 --- a/session/session1.ql +++ b/session/session1.ql @@ -44,17 +44,10 @@ predicate setValueTaintStep(DataFlow::Node pred, DataFlow::Node succ) { // 1. without sanitizer gr.getASuccessor+() = postgr and succ.asExpr() = postgr - // - // 2. with recursive predicate, no sanitizer - // recursiveSuccessor(gr, postgr) and - // succ.asExpr() = postgr - // 3. with recursive predicate, with sanitizer - // sanitizerCheckedSuccessor(gr, postgr) and - // succ.asExpr() = postgr ) } -// Def-Use special handling: +// Def-Use special handling. Not needed here, but a good example of recursive predicates. // - Include sanitizer check when flagging successive object member calls in taint // step. // - Stop at @@ -153,7 +146,6 @@ class CanWriteGuard extends TaintTracking::SanitizerGuardNode, DataFlow::CallNod // outcome is the result of the conditional (the true or false branch) outcome = true and e = this.getReceiver().asExpr() - // or e.getASuccessor+() = this.getReceiver().asExpr() } } diff --git a/source/sample-utility-0.js b/source/sample-utility-0.js index 0029e89..166e2d4 100644 --- a/source/sample-utility-0.js +++ b/source/sample-utility-0.js @@ -1,30 +1,46 @@ -var SampleUtility = function(){}; +var SampleUtility = function () { }; SampleUtility.prototype = Object.extendsObject(Processor, { - - setUserStatus: function() { + + setUserStatus: function () { var value = this.getParameter('value'); var ua = new GR('users'); ua.query(); - - if(!ua.hasNext()){ + + if (!ua.hasNext()) { ua.initialize(); - ua.setValue('status',value); + ua.setValue('status', value); ua.insert(); } else { ua.next(); - ua.setValue('status',value); // unsafe + ua.setValue('status', value); // unsafe ua.update(); // Nested if() test. if (ua.safeToWrite()) { ua.setValue('status', value); // safe ua.update(); - } + } } + if (ua !== null) { + 1 + } else { + if (ua.safeToWrite()) { + ua.setValue('status', value); + ua.update(); + } + } + if (ua == magicval) { + 1 + } else { + if (ua.safeToWrite()) { + ua.setValue('status', value); + ua.update(); + } + } }, - + type: 'SampleUtility' });