hohn/codeql
1
0
Fork 0
mirror of https://github.com/github/codeql.git synced 2026-03-05 15:16:47 +01:00
Code Issues Packages Projects Releases Wiki Activity

JS: Port TemplateObjectInjection

Browse Source
This commit is contained in:
Asger F
2023-10-05 09:23:45 +02:00
parent 51624c02a2
commit 25962a9ba6
3 changed files with 81 additions and 83 deletions
Download Patch File Download Diff File Expand all files Collapse all files

7
javascript/ql/src/Security/CWE-073/TemplateObjectInjection.ql
View File

@@ -12,10 +12,11 @@
*/
import javascript
import DataFlow::PathGraph
import semmle.javascript.security.dataflow.TemplateObjectInjectionQuery
import DataFlow::DeduplicatePathGraph<TemplateObjectInjectionFlow::PathNode, TemplateObjectInjectionFlow::PathGraph>
from DataFlow::Configuration cfg, DataFlow::PathNode source, DataFlow::PathNode sink
where cfg.hasFlowPath(source, sink)
from PathNode source, PathNode sink
where
TemplateObjectInjectionFlow::flowPath(source.getAnOriginalPathNode(), sink.getAnOriginalPathNode())
select sink.getNode(), source, sink, "Template object depends on a $@.", source.getNode(),
"user-provided value"