hohn/codeql
1
0
Fork 0
mirror of https://github.com/github/codeql.git synced 2026-05-03 12:45:27 +02:00
Code Issues Packages Projects Releases Wiki Activity

JS: ErrorConstructorTaintStep

Browse Source
This commit is contained in:
Asger Feldthaus
2020-03-27 15:32:52 +00:00
parent fa9b3dfff4
commit 462e31c2b4
1 changed files with 7 additions and 8 deletions
Download Patch File Download Diff File Expand all files Collapse all files

15
javascript/ql/src/semmle/javascript/dataflow/TaintTracking.qll
View File

@@ -699,9 +699,13 @@ module TaintTracking {
/**
* A taint step through an exception constructor, such as `x` to `new Error(x)`.
*/
class ErrorConstructorTaintStep extends AdditionalTaintStep, DataFlow::InvokeNode {
ErrorConstructorTaintStep() {
exists(string name | this = DataFlow::globalVarRef(name).getAnInvocation() |
class ErrorConstructorTaintStep extends SharedTaintStep {
override predicate step(DataFlow::Node pred, DataFlow::Node succ) {
exists(DataFlow::NewNode invoke, string name |
invoke = DataFlow::globalVarRef(name).getAnInvocation() and
pred = invoke.getArgument(0) and
succ = invoke
|
name = "Error" or
name = "EvalError" or
name = "RangeError" or
@@ -711,11 +715,6 @@ module TaintTracking {
name = "URIError"
)
}
override predicate step(DataFlow::Node pred, DataFlow::Node succ) {
pred = getArgument(0) and
succ = this
}
}
private module RegExpCaptureSteps {