hohn/codeql
1
0
Fork 0
mirror of https://github.com/github/codeql.git synced 2026-04-26 17:25:19 +02:00
Code Issues Packages Projects Releases Wiki Activity

changes based on review

Browse Source 
Co-authored-by: Esben Sparre Andreasen <esbena@github.com>
This commit is contained in:
Erik Krogh Kristensen
2021-01-15 13:36:34 +01:00
parent c106b09d49
commit 0c9d46a7f9
4 changed files with 6 additions and 6 deletions
Download Patch File Download Diff File Expand all files Collapse all files

2
javascript/ql/src/semmle/javascript/PackageExports.qll
View File

@@ -9,7 +9,7 @@ import javascript
/**
* Gets a parameter that is a library input to a top-level package.
*/
DataFlow::ParameterNode getAnLibraryInputParameter() {
DataFlow::ParameterNode getALibraryInputParameter() {
exists(int bound, DataFlow::FunctionNode func |
func = getAValueExportedBy(getTopmostPackageJSON()).getABoundFunctionValue(bound) and
result = func.getParameter(any(int arg | arg >= bound))

2
javascript/ql/src/semmle/javascript/security/dataflow/UnsafeShellCommandConstructionCustomizations.qll
View File

@@ -52,7 +52,7 @@ module UnsafeShellCommandConstruction {
*/
class ExternalInputSource extends Source, DataFlow::ParameterNode {
ExternalInputSource() {
this = Exports::getAnLibraryInputParameter() and
this = Exports::getALibraryInputParameter() and
not this.getName() = ["cmd", "command"] // looks to be on purpose.
}
}

6
javascript/ql/src/semmle/javascript/security/performance/PolynomialReDoSCustomizations.qll
View File

@@ -21,7 +21,7 @@ module PolynomialReDoS {
/**
* Gets a string that describes the source.
* For use in the alert message
* For use in the alert message.
*/
string describe() { result = "a user-provided value" }
}
@@ -93,7 +93,7 @@ module PolynomialReDoS {
class StringLengthLimiter extends Sanitizer {
StringLengthLimiter() {
this.(StringReplaceCall).isGlobal() and
// not char classes - they don't remove any repeated pattern.
// not lone char classes - they don't remove any repeated pattern.
not exists(RegExpTerm root | root = this.(StringReplaceCall).getRegExp().getRoot() |
root instanceof RegExpCharacterClass
or
@@ -136,7 +136,7 @@ module PolynomialReDoS {
* A parameter of an exported function, seen as a source for polynomial-redos.
*/
class ExternalInputSource extends Source, DataFlow::ParameterNode {
ExternalInputSource() { this = Exports::getAnLibraryInputParameter() }
ExternalInputSource() { this = Exports::getALibraryInputParameter() }
override string getKind() { result = "library" }

2
javascript/ql/src/semmle/javascript/security/performance/SuperlinearBackTracking.qll
View File

@@ -406,7 +406,7 @@ class PolynomialBackTrackingTerm extends InfiniteRepetitionQuantifier {
PolynomialBackTrackingTerm() {
reason = getReasonString(this, pump, prefixMsg, prev) and
// there might be many reasons for this term to have polynomial backtracking - we pick an arbitary one.
// there might be many reasons for this term to have polynomial backtracking - we pick the shortest one.
reason = min(string msg | msg = getReasonString(this, _, _, _) | msg order by msg.length(), msg)
}