JS: preserve document.url label out of .href property

2026-04-30 19:26:02 +02:00 · 2018-10-10 17:05:39 +01:00
parent ea297dd442
commit 03b479114f
1 changed files with 5 additions and 0 deletions
--- a/javascript/ql/src/semmle/javascript/security/dataflow/ClientSideUrlRedirect.qll
+++ b/javascript/ql/src/semmle/javascript/security/dataflow/ClientSideUrlRedirect.qll
@@ -65,6 +65,11 @@ module ClientSideUrlRedirect {
      queryAccess(pred, succ) and
      f instanceof DocumentUrl and
      g = DataFlow::FlowLabel::taint()
+      or
+      // preserve document.url label in step from `location` to `location.href`
+      f instanceof DocumentUrl and
+      g instanceof DocumentUrl and
+      succ.(DataFlow::PropRead).accesses(pred, "href")
    }
  }