diff --git a/session/session1.ql b/session/session1.ql index 072f257..0c97167 100644 --- a/session/session1.ql +++ b/session/session1.ql @@ -10,12 +10,13 @@ import javascript import DataFlow::PathGraph // Flow to consider: +// // var value = this.getParameter('value'); //: source 1 // var ua = new GR('status'); //: source 2 // ua.setValue('status',value); //: taint step // ua.update(); //: sink (if from source 2) -// var value = this.getParameter('value'); //: source 1 +// var value = this.getParameter('value'); //: source 1 class ParameterSource extends CallExpr { ParameterSource() { exists(Expr inst | @@ -27,26 +28,19 @@ class ParameterSource extends CallExpr { // ua.setValue('status',value); //: taint step predicate setValueTaintStep(DataFlow::Node pred, DataFlow::Node succ) { - exists(DotExpr temp, MethodCallExpr mce, VarAccess gr, VarAccess postgr| + exists(DotExpr temp, MethodCallExpr mce, VarAccess gr, VarAccess postgr | temp.getPropertyName() = "setValue" and mce.getReceiver() = temp.getBase() and gr = mce.getReceiver() and pred.asExpr() = mce.getArgument(1) and + // // Taint all accesses after setValue call. // Trying data flow, this would be: // succ = gr.flow().getASuccessor+() and // - // Using control flow: + // Using control flow: gr.getASuccessor+() = postgr and succ.asExpr() = postgr - ) - -} - -VarRef methodCalled(string name) { - exists(DotExpr temp | - temp.getPropertyName() = name and - result = temp.getBase() ) } @@ -82,4 +76,5 @@ class FromRequestToGrUpdate extends TaintTracking::Configuration { from FromRequestToGrUpdate dataflow, DataFlow::PathNode source, DataFlow::PathNode sink where dataflow.hasFlowPath(source, sink) -select sink, source, sink, "Data flow from $@ to $@.", source, source.toString(), sink, sink.toString() +select sink, source, sink, "Data flow from $@ to $@.", source, source.toString(), sink, + sink.toString()