hohn/codeql
1
0
Fork 0
mirror of https://github.com/github/codeql.git synced 2026-05-01 11:45:14 +02:00
Code Issues Packages Projects Releases Wiki Activity

JavaScript: Move from Node to PathNode.

Browse Source
This commit is contained in:
Max Schaefer
2018-11-08 13:09:54 +00:00
parent 8d87f556e1
commit 11d6259dbf
29 changed files with 93 additions and 93 deletions
Download Patch File Download Diff File Expand all files Collapse all files

6
javascript/ql/src/Security/CWE-079/ReflectedXss.ql
View File

@@ -15,7 +15,7 @@ import javascript
import semmle.javascript.security.dataflow.ReflectedXss::ReflectedXss
import DataFlow::PathGraph
from Configuration cfg, DataFlow::Node source, DataFlow::Node sink
where cfg.hasFlow(source, sink)
select sink, "Cross-site scripting vulnerability due to $@.",
from Configuration cfg, DataFlow::PathNode source, DataFlow::PathNode sink
where cfg.hasPathFlow(source, sink)
select sink.getNode(), "Cross-site scripting vulnerability due to $@.",
source, "user-provided value"

6
javascript/ql/src/Security/CWE-079/StoredXss.ql
View File

@@ -15,7 +15,7 @@ import javascript
import semmle.javascript.security.dataflow.StoredXss::StoredXss
import DataFlow::PathGraph
from Configuration cfg, DataFlow::Node source, DataFlow::Node sink
where cfg.hasFlow(source, sink)
select sink, "Stored cross-site scripting vulnerability due to $@.",
from Configuration cfg, DataFlow::PathNode source, DataFlow::PathNode sink
where cfg.hasPathFlow(source, sink)
select sink.getNode(), "Stored cross-site scripting vulnerability due to $@.",
source, "stored value"

6
javascript/ql/src/Security/CWE-079/Xss.ql
View File

@@ -15,7 +15,7 @@ import javascript
import semmle.javascript.security.dataflow.DomBasedXss::DomBasedXss
import DataFlow::PathGraph
from Configuration cfg, DataFlow::Node source, DataFlow::Node sink
where cfg.hasFlow(source, sink)
select sink, sink.(Sink).getVulnerabilityKind() + " vulnerability due to $@.",
from Configuration cfg, DataFlow::PathNode source, DataFlow::PathNode sink
where cfg.hasPathFlow(source, sink)
select sink.getNode(), sink.getNode().(Sink).getVulnerabilityKind() + " vulnerability due to $@.",
source, "user-provided value"