hohn/codeql
1
0
Fork 0
mirror of https://github.com/github/codeql.git synced 2026-04-29 10:45:15 +02:00
Code Issues Packages Projects Releases Wiki Activity

JS: use StringConcatenation library in ConcatSanitizer

Browse Source
This commit is contained in:
Asger F
2018-11-20 18:12:07 +00:00
parent 1c06f45046
commit 49cd2876c9
4 changed files with 13 additions and 18 deletions
Download Patch File Download Diff File Expand all files Collapse all files

7
javascript/ql/src/semmle/javascript/security/dataflow/MethodNameInjection.qll
View File

@@ -133,16 +133,13 @@ module MethodNameInjection {
}
/**
* A binary expression that sanitzes a value for method name injection. That
* An expression that sanitizes a value for method name injection. That
* is, if a string is prepended or appended to the remote input, an attacker
* cannot access arbitrary properties.
*/
class ConcatSanitizer extends Sanitizer, DataFlow::ValueNode {
override BinaryExpr astNode;
ConcatSanitizer() {
astNode.getAnOperand() instanceof ConstantString
StringConcatenation::getAnOperand(this).asExpr() instanceof ConstantString
}
}
}

9
javascript/ql/src/semmle/javascript/security/dataflow/RemotePropertyInjection.qll
View File

@@ -117,16 +117,13 @@ module RemotePropertyInjection {
}
/**
* A binary expression that sanitzes a value for remote property injection. That
* An expression that sanitizes a value for remote property injection. That
* is, if a string is prepended or appended to the remote input, an attacker
* cannot access arbitrary properties.
*/
class ConcatSanitizer extends Sanitizer, DataFlow::ValueNode {
override BinaryExpr astNode;
class ConcatSanitizer extends Sanitizer {
ConcatSanitizer() {
astNode.getAnOperand() instanceof ConstantString
StringConcatenation::getAnOperand(this).asExpr() instanceof ConstantString
}
}
}