hohn/codeql
1
0
Fork 0
mirror of https://github.com/github/codeql.git synced 2026-04-27 09:45:15 +02:00
Code Issues Packages Projects Releases Wiki Activity

inline value in nodeLeadingToCsrfWrite

Browse Source
This commit is contained in:
Erik Krogh Kristensen
2020-10-16 14:21:49 +02:00
parent 017c73dce3
commit 27a2cd310d
1 changed files with 5 additions and 4 deletions
Download Patch File Download Diff File Expand all files Collapse all files

9
javascript/ql/src/Security/CWE-352/MissingCsrfMiddleware.ql
View File

@@ -103,10 +103,11 @@ DataFlow::CallNode csrfMiddlewareCreation() {
*/
private DataFlow::SourceNode nodeLeadingToCsrfWrite(DataFlow::TypeBackTracker t) {
t.start() and
exists(DataFlow::PropRef value |
value = result.getAPropertyRead(cookieProperty()).getAPropertyWrite() and
value.getPropertyName().regexpMatch("(?i).*(csrf|xsrf).*")
)
result
.getAPropertyRead(cookieProperty())
.getAPropertyWrite()
.getPropertyName()
.regexpMatch("(?i).*(csrf|xsrf).*")
or
exists(DataFlow::TypeBackTracker t2 | result = nodeLeadingToCsrfWrite(t2).backtrack(t2, t))
}