hohn/codeql
1
0
Fork 0
mirror of https://github.com/github/codeql.git synced 2026-04-25 08:45:14 +02:00
Code Issues Packages Projects Releases Wiki Activity

Merge pull request #988 from asger-semmle/spread-taint-step

Browse Source 
JS: add taint step through object/array spread operators
This commit is contained in:
Max Schaefer
2019-02-28 09:58:23 +00:00
committed by GitHub
parent c945b7793c 29d2d620e4
commit 1b5887014b
3 changed files with 19 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

6
javascript/ql/src/semmle/javascript/dataflow/TaintTracking.qll
View File

@@ -185,6 +185,12 @@ module TaintTracking {
or
// awaiting a tainted expression gives a tainted result
e.(AwaitExpr).getOperand() = f
or
// spreading a tainted object into an object literal gives a tainted object
e.(ObjectExpr).getAProperty().(SpreadProperty).getInit().(SpreadElement).getOperand() = f
or
// spreading a tainted value into an array literal gives a tainted array
e.(ArrayExpr).getAnElement().(SpreadElement).getOperand() = f
)
or
// reading from a tainted object yields a tainted result