hohn/codeql
1
0
Fork 0
mirror of https://github.com/github/codeql.git synced 2025-12-24 04:36:35 +01:00
Code Issues Packages Projects Releases Wiki Activity

stash

Browse Source
This commit is contained in:
amammad
2023-09-23 20:28:34 +10:00
parent bafe357500
commit 0eb0c238f3
2 changed files with 4 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files

3
javascript/ql/lib/semmle/javascript/security/dataflow/SqlInjectionQuery.qll
View File

@@ -9,6 +9,7 @@
import javascript
import SqlInjectionCustomizations::SqlInjection
import semmle.javascript.frameworks.TypeORM
/**
* A taint-tracking configuration for reasoning about string based query injection vulnerabilities.
@@ -18,7 +19,7 @@ class Configuration extends TaintTracking::Configuration {
override predicate isSource(DataFlow::Node source) { source instanceof Source }
override predicate isSink(DataFlow::Node sink) { sink instanceof Sink }
override predicate isSink(DataFlow::Node sink) { sink instanceof TypeOrm::QueryString }
override predicate isSanitizer(DataFlow::Node node) {
super.isSanitizer(node) or

4
javascript/ql/src/Security/CWE-089/SqlInjection.ql
View File

@@ -22,8 +22,8 @@ from DataFlow::Configuration cfg, DataFlow::PathNode source, DataFlow::PathNode
where
(
cfg instanceof SqlInjection::Configuration and type = "string"
or
cfg instanceof NosqlInjection::Configuration and type = "object"
// or
// cfg instanceof NosqlInjection::Configuration and type = "object"
) and
cfg.hasFlowPath(source, sink)
select sink.getNode(), source, sink, "This query " + type + " depends on a $@.", source.getNode(),