hohn/codeql
1
0
Fork 0
mirror of https://github.com/github/codeql.git synced 2025-12-24 04:36:35 +01:00
Code Issues Packages Projects Releases Wiki Activity

JS: Expose argumentPassing as DataFlow::argumentPassingStep

Browse Source
This commit is contained in:
Asger Feldthaus
2020-02-04 15:04:10 +00:00
parent c185cededf
commit 3ccdaa94ad
2 changed files with 8 additions and 5 deletions
Download Patch File Download Diff File Expand all files Collapse all files

10
javascript/ql/src/Security/CWE-400/PrototypePollutionUtility.ql
View File

@@ -180,8 +180,8 @@ predicate dynamicPropReadStep(Node base, Node key, SourceNode output) {
keyParam.flowsTo(innerKey) and
innerOutput.flowsTo(callee.getAReturnedExpr().flow()) and
call.getACallee() = callee and
argumentPassing(call, base, callee, baseParam) and
argumentPassing(call, key, callee, keyParam) and
argumentPassingStep(call, base, callee, baseParam) and
argumentPassingStep(call, key, callee, keyParam) and
output = call
)
}
@@ -198,12 +198,12 @@ predicate isEnumeratedPropName(Node node) {
|
node = pred.getASuccessor()
or
argumentPassing(_, pred, _, node)
argumentPassingStep(_, pred, _, node)
or
// Handle one level of callbacks
exists(FunctionNode function, ParameterNode callback, int i |
pred = callback.getAnInvocation().getArgument(i) and
argumentPassing(_, function, _, callback) and
argumentPassingStep(_, function, _, callback) and
node = function.getParameter(i)
)
)
@@ -223,7 +223,7 @@ predicate isPotentiallyObjectPrototype(SourceNode node) {
exists(Node use |
isPotentiallyObjectPrototype(use.getALocalSource())
|
argumentPassing(_, use, _, node)
argumentPassingStep(_, use, _, node)
)
}

3
javascript/ql/src/semmle/javascript/dataflow/DataFlow.qll
View File

@@ -20,6 +20,7 @@
import javascript
private import internal.CallGraphs
private import internal.FlowSteps as FlowSteps
module DataFlow {
cached
@@ -1470,6 +1471,8 @@ module DataFlow {
)
}
predicate argumentPassingStep = FlowSteps::argumentPassing/4;
/**
* Gets the data flow node representing the source of definition `def`, taking
* flow through IIFE calls into account.