hohn/codeql
1
0
Fork 0
mirror of https://github.com/github/codeql.git synced 2025-12-16 16:53:25 +01:00
Code Issues Packages Projects Releases Wiki Activity

JS: Polish taint-tracking section in response to review comment

Browse Source
This commit is contained in:
Asger F
2025-01-08 14:45:31 +01:00
parent ecccc7ce8c
commit 10d5d09ad1
1 changed files with 5 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files

7
docs/codeql/codeql-language-guides/migrating-javascript-dataflow-queries.rst
View File

@@ -97,8 +97,9 @@ Taint tracking
For configuration classes extending ``TaintTracking::Configuration``, the migration is similar but with a few differences:
- The ``TaintTracking::Global`` module should be used instead of ``DataFlow::Global``.
- The ``isSanitizer`` predicate should be renamed to ``isBarrier``.
- The ``isAdditionalTaintStep`` predicate should be renamed to ``isAdditionalFlowStep``.
- Some predicates originating from ``TaintTracking::Configuration`` should be renamed to match the ``DataFlow::ConfigSig`` interface:
- ``isSanitizer`` should be renamed to ``isBarrier``.
- ``isAdditionalTaintStep`` should be renamed to ``isAdditionalFlowStep``.
Note that there is no such thing as ``TaintTracking::ConfigSig``. The ``DataFlow::ConfigSig`` interface is used for both data flow and taint tracking.
@@ -107,6 +108,8 @@ For example:
.. code-block:: ql
class MyConfig extends TaintTracking::Configuration {
MyConfig() { this = "MyConfig" }
predicate isSanitizer(DataFlow::Node node) { ... }
predicate isAdditionalTaintStep(DataFlow::Node node1, DataFlow::Node node2) { ... }
...