hohn/codeql
1
0
Fork 0
mirror of https://github.com/github/codeql.git synced 2026-04-30 19:26:02 +02:00
Code Issues Packages Projects Releases Wiki Activity

JS: Switch to instanceof base type

Browse Source
This commit is contained in:
Asger Feldthaus
2021-10-28 16:04:18 +02:00
parent 5f4c1dd19b
commit 46bd3e58a3
1 changed files with 8 additions and 14 deletions
Download Patch File Download Diff File Expand all files Collapse all files

22
javascript/ql/lib/semmle/javascript/security/dataflow/TaintedPathCustomizations.qll
View File

@@ -445,17 +445,14 @@ module TaintedPath {
/**
* An expression of form `x.includes("..")` or similar.
*/
class ContainsDotDotSanitizer extends BarrierGuardNode {
StringOps::Includes contains;
class ContainsDotDotSanitizer extends BarrierGuardNode instanceof StringOps::Includes {
ContainsDotDotSanitizer() {
this = contains and
isDotDotSlashPrefix(contains.getSubstring())
isDotDotSlashPrefix(super.getSubstring())
}
override predicate blocks(boolean outcome, Expr e, DataFlow::FlowLabel label) {
e = contains.getBaseString().asExpr() and
outcome = contains.getPolarity().booleanNot() and
e = super.getBaseString().asExpr() and
outcome = super.getPolarity().booleanNot() and
label.(Label::PosixPath).canContainDotDotSlash() // can still be bypassed by normalized absolute path
}
}
@@ -463,17 +460,14 @@ module TaintedPath {
/**
* An expression of form `x.matches(/\.\./)` or similar.
*/
class ContainsDotDotRegExpSanitizer extends BarrierGuardNode {
StringOps::RegExpTest test;
class ContainsDotDotRegExpSanitizer extends BarrierGuardNode instanceof StringOps::RegExpTest {
ContainsDotDotRegExpSanitizer() {
this = test and
test.getRegExp().getConstantValue() = [".", "..", "../"]
super.getRegExp().getConstantValue() = [".", "..", "../"]
}
override predicate blocks(boolean outcome, Expr e, DataFlow::FlowLabel label) {
e = test.getStringOperand().asExpr() and
outcome = test.getPolarity().booleanNot() and
e = super.getStringOperand().asExpr() and
outcome = super.getPolarity().booleanNot() and
label.(Label::PosixPath).canContainDotDotSlash() // can still be bypassed by normalized absolute path
}
}