hohn/codeql
1
0
Fork 0
mirror of https://github.com/github/codeql.git synced 2026-05-02 12:15:17 +02:00
Code Issues Packages Projects Releases Wiki Activity

Merge pull request #11959 from erik-krogh/ssrfSan

Browse Source 
JS: add encodeURIComponent as a sanitizer for request-forgery
This commit is contained in:
Erik Krogh Kristensen
2023-02-14 13:39:53 +01:00
committed by GitHub
parent a498936f16 49f5e89f36
commit 028fcc7edf
5 changed files with 55 additions and 22 deletions
Download Patch File Download Diff File Expand all files Collapse all files

10
javascript/ql/lib/semmle/javascript/security/dataflow/RequestForgeryCustomizations.qll
View File

@@ -81,4 +81,14 @@ module RequestForgery {
override string getKind() { result = "endpoint" }
}
private import Xss as Xss
/**
* A call to `encodeURI` or `encodeURIComponent`, viewed as a sanitizer for request forgery.
* These calls will escape "/" to "%2F", which is not a problem for request forgery.
* The result from calling `encodeURI` or `encodeURIComponent` is not a valid URL, and only makes sense
* as a part of a URL.
*/
class UriEncodingSanitizer extends Sanitizer instanceof Xss::Shared::UriEncodingSanitizer { }
}