hohn/codeql
1
0
Fork 0
mirror of https://github.com/github/codeql.git synced 2026-04-30 19:26:02 +02:00
Code Issues Packages Projects Releases Wiki Activity

Remove localflow from the source

Browse Source
This commit is contained in:
luchua-bc
2021-03-03 13:54:26 +00:00
parent b366ffa69e
commit 1b1c3f953b
1 changed files with 4 additions and 6 deletions
Download Patch File Download Diff File Expand all files Collapse all files

10
java/ql/src/experimental/Security/CWE/CWE-1004/SensitiveCookieNotHttpOnly.ql
View File

@@ -45,7 +45,7 @@ class SetCookieMethodAccess extends MethodAccess {
class SensitiveCookieNameExpr extends Expr {
SensitiveCookieNameExpr() {
exists(
ClassInstanceExpr cie, Expr e // new Cookie("jwt_token", token)
ClassInstanceExpr cie // new Cookie("jwt_token", token)
|
(
cie.getConstructor().getDeclaringType().hasQualifiedName("javax.servlet.http", "Cookie") or
@@ -55,16 +55,14 @@ class SensitiveCookieNameExpr extends Expr {
.hasQualifiedName(["javax.ws.rs.core", "jakarta.ws.rs.core"], "Cookie")
) and
this = cie and
isSensitiveCookieNameExpr(e) and
DataFlow::localExprFlow(e, cie.getArgument(0))
isSensitiveCookieNameExpr(cie.getArgument(0))
)
or
exists(
SetCookieMethodAccess ma, Expr e // response.addHeader("Set-Cookie: token=" +authId + ";HttpOnly;Secure")
SetCookieMethodAccess ma // response.addHeader("Set-Cookie: token=" +authId + ";HttpOnly;Secure")
|
this = ma.getArgument(1) and
isSensitiveCookieNameExpr(e) and
DataFlow::localExprFlow(e, ma.getArgument(1))
isSensitiveCookieNameExpr(this)
)
}
}