only block flow for dominated reads when the property name is known

This commit is contained in:
Erik Krogh Kristensen
2022-02-28 11:08:13 +01:00
parent a9062cc047
commit 1db6a644a5

View File

@@ -551,7 +551,10 @@ module TaintTracking {
or
// reading from a tainted object yields a tainted result
succ.(DataFlow::PropRead).getBase() = pred and
not AccessPath::DominatingPaths::hasDominatingWrite(succ) and
not (
AccessPath::DominatingPaths::hasDominatingWrite(succ) and
exists(succ.(DataFlow::PropRead).getPropertyName())
) and
not isSafeClientSideUrlProperty(succ) and
not ClassValidator::isAccessToSanitizedField(succ)
or