use the number guard in existing queries that contained typeof checks

This commit is contained in:
Erik Krogh Kristensen
2022-02-08 19:21:19 +01:00
parent d6721ec574
commit 5340530cb7
10 changed files with 74 additions and 20 deletions

View File

@@ -153,6 +153,16 @@ module UnsafeJQueryPlugin {
}
}
/** A guard that checks whether `x` is a number. */
class NumberGuard extends TaintTracking::SanitizerGuardNode instanceof DataFlow::CallNode {
Expr x;
boolean polarity;
NumberGuard() { TaintTracking::isNumberGuard(this, x, polarity) }
override predicate sanitizes(boolean outcome, Expr e) { e = x and outcome = polarity }
}
/**
* The client-provided options object for a jQuery plugin, considered as a source for unsafe jQuery plugins.
*/