hohn/codeql
1
0
Fork 0
mirror of https://github.com/github/codeql.git synced 2026-02-12 05:01:06 +01:00
Code Issues Packages Projects Releases Wiki Activity

Convert xss sanitizer to MaD

Browse Source
This commit is contained in:
Owen Mansel-Chan
2025-12-16 17:16:52 +00:00
parent 1e6410804f
commit 1e18fce300
2 changed files with 5 additions and 8 deletions
Download Patch File Download Diff File Expand all files Collapse all files

5
go/ql/lib/ext/github.com.beego.beego.server.web.model.yml
View File

@@ -50,3 +50,8 @@ extensions:
- ["group:beego", "Controller", True, "GetString", "", "", "ReturnValue[0]", "remote", "manual"]
- ["group:beego", "Controller", True, "GetStrings", "", "", "ReturnValue[0]", "remote", "manual"]
- ["group:beego", "Controller", True, "Input", "", "", "ReturnValue[0]", "remote", "manual"]
- addsTo:
pack: codeql/go-all
extensible: barrierModel
data:
- ["group:beego", "", True, "Htmlquote", "", "", "ReturnValue", "html-injection", "manual"]

8
go/ql/lib/semmle/go/frameworks/Beego.qll
View File

@@ -165,14 +165,6 @@ module Beego {
override string getAContentType() { none() }
}
private class HtmlQuoteSanitizer extends SharedXss::Sanitizer {
HtmlQuoteSanitizer() {
exists(DataFlow::CallNode c | c.getTarget().hasQualifiedName(packagePath(), "Htmlquote") |
this = c.getArgument(0)
)
}
}
private class UtilsTaintPropagators extends TaintTracking::FunctionModel {
UtilsTaintPropagators() { this.hasQualifiedName(utilsPackagePath(), "GetDisplayString") }