hohn/codeql
1
0
Fork 0
mirror of https://github.com/github/codeql.git synced 2025-12-23 04:06:37 +01:00
Code Issues Packages Projects Releases Wiki Activity

Ruby: stop rb/sensitive-get-query from considering ID type data as sensitive

Browse Source
This commit is contained in:
Alex Ford
2022-09-16 15:36:57 +01:00
parent 79ad7d293f
commit 08c8db8937
3 changed files with 4 additions and 4 deletions
Download Patch File Download Diff File Expand all files Collapse all files

3
ruby/ql/src/queries/security/cwe-598/SensitiveGetQuery.ql
View File

@@ -38,6 +38,7 @@ from
where
handler.getAnHttpMethod() = "get" and
input.asExpr().getExpr().getEnclosingMethod() = handler and
localFlowWithElementReference(input, sensitive)
localFlowWithElementReference(input, sensitive) and
not sensitive.getClassification() = SensitiveDataClassification::id()
select input, "$@ for GET requests uses query parameter as sensitive data.", handler,
"Route handler"