JS: Fix a bug in isSafeClientSideUrlProperty

2026-04-24 16:25:15 +02:00 · 2024-09-11 15:09:03 +02:00
parent bc04131c72
commit 2712bf821a
2 changed files with 2 additions and 2 deletions
--- a/javascript/ql/lib/semmle/javascript/dataflow/TaintTracking.qll
+++ b/javascript/ql/lib/semmle/javascript/dataflow/TaintTracking.qll
@@ -255,7 +255,7 @@ module TaintTracking {
    exists(StringSplitCall c |
      c.getBaseString().getALocalSource() =
        [DOM::locationRef(), DOM::locationRef().getAPropertyRead("href")] and
-      c.getSeparator() = "?" and
+      c.getSeparator() = ["?", "#"] and
      read = c.getAPropertyRead("0")
    )
  }