hohn/codeql
1
0
Fork 0
mirror of https://github.com/github/codeql.git synced 2026-04-28 18:25:24 +02:00
Code Issues Packages Projects Releases Wiki Activity

Merge pull request #750 from aschackmull/javascript/autoformat

Browse Source 
Approved by xiemaisi
This commit is contained in:
semmle-qlci
2019-01-11 16:35:38 +00:00
committed by GitHub
parent dcdbc00430 db9407bae5
commit 04c15028ab
475 changed files with 1727 additions and 1838 deletions
Download Patch File Download Diff File Expand all files Collapse all files

8
javascript/ql/src/Security/CWE-807/DifferentKindsComparisonBypass.ql
View File

@@ -17,11 +17,9 @@ from DifferentKindsComparison cmp, DataFlow::Node lSource, DataFlow::Node rSourc
where
lSource = cmp.getLSource() and
rSource = cmp.getRSource() and
not (
// Standard names for the double submit cookie pattern (CSRF protection)
exists(DataFlow::PropRead s | s = lSource or s = rSource |
s.getPropertyName().regexpMatch("(?i).*(csrf|state|token).*")
)
// Standard names for the double submit cookie pattern (CSRF protection)
not exists(DataFlow::PropRead s | s = lSource or s = rSource |
s.getPropertyName().regexpMatch("(?i).*(csrf|state|token).*")
)
select cmp,
"This comparison of $@ and $@ is a potential security risk since it is controlled by the user.",