hohn/codeql
1
0
Fork 0
mirror of https://github.com/github/codeql.git synced 2026-04-25 00:35:20 +02:00
Code Issues Packages Projects Releases Wiki Activity

JS: use BarrierGuards

Browse Source
This commit is contained in:
Asger F
2023-10-04 15:17:26 +02:00
parent 277292e3b9
commit 1ed3235639
1 changed files with 9 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

9
javascript/ql/lib/semmle/javascript/dataflow/internal/TaintTrackingPrivate.qll
View File

@@ -2,6 +2,7 @@ private import javascript
private import semmle.javascript.dataflow.internal.DataFlowPrivate
private import semmle.javascript.dataflow.internal.Contents::Public
private import semmle.javascript.dataflow.internal.sharedlib.FlowSummaryImpl as FlowSummaryImpl
private import semmle.javascript.dataflow.internal.BarrierGuards
cached
predicate defaultAdditionalTaintStep(DataFlow::Node node1, DataFlow::Node node2) {
@@ -18,6 +19,12 @@ predicate defaultAdditionalTaintStep(DataFlow::Node node1, DataFlow::Node node2)
ContentSet::arrayElement(), node2.(FlowSummaryNode).getSummaryNode())
}
private class SanitizerGuardAdapter extends DataFlow::Node instanceof TaintTracking::AdditionalSanitizerGuardNode
{
// Note: avoid depending on DataFlow::FlowLabel here as it will cause these barriers to be re-evaluated
predicate blocksExpr(boolean outcome, Expr e) { super.sanitizes(outcome, e) }
}
/**
* Holds if `node` should be a sanitizer in all global taint flow configurations
* but not in local taint.
@@ -25,7 +32,9 @@ predicate defaultAdditionalTaintStep(DataFlow::Node node1, DataFlow::Node node2)
cached
predicate defaultTaintSanitizer(DataFlow::Node node) {
node instanceof DataFlow::VarAccessBarrier or
node = MakeBarrierGuard<SanitizerGuardAdapter>::getABarrierNode()
}
/**
* Holds if default taint-tracking should allow implicit reads
* of `c` at sinks and inputs to additional taint steps.