move getACommonTld into a utility module without parameters

This commit is contained in:
erik-krogh
2022-12-17 22:55:49 +01:00
parent ba7321ac5c
commit 35e8d6afd4
5 changed files with 43 additions and 38 deletions

View File

@@ -3,6 +3,7 @@
*/
private import IncompleteUrlSubstringSanitizationSpecific
private import codeql.regex.HostnameRegexp::Utils
/**
* A check on a string for whether it contains a given substring, possibly with restrictions on the location of the substring.
@@ -30,9 +31,7 @@ query predicate problems(
mayHaveStringValue(substring, target) and
(
// target contains a domain on a common TLD, and perhaps some other URL components
target
.regexpMatch("(?i)([a-z]*:?//)?\\.?([a-z0-9-]+\\.)+" + HostnameRegexp::getACommonTld() +
"(:[0-9]+)?/?")
target.regexpMatch("(?i)([a-z]*:?//)?\\.?([a-z0-9-]+\\.)+" + getACommonTld() + "(:[0-9]+)?/?")
or
// target is a HTTP URL to a domain on any TLD
target.regexpMatch("(?i)https?://([a-z0-9-]+\\.)+([a-z]+)(:[0-9]+)?/?")

View File

@@ -5,5 +5,3 @@ import codeql.ruby.StringOps
predicate mayHaveStringValue(DataFlow::Node node, string value) {
node.asExpr().getConstantValue().getString() = value
}
import codeql.ruby.security.regexp.HostnameRegexp as HostnameRegexp