hohn/codeql
1
0
Fork 0
mirror of https://github.com/github/codeql.git synced 2026-04-28 10:15:14 +02:00
Code Issues Packages Projects Releases Wiki Activity

JavaScript: Teach IncompleteSanitization to flag incomplete path sanitizers.

Browse Source
This commit is contained in:
Max Schaefer
2019-11-15 12:25:47 +00:00
parent b39bcde31c
commit 5565be14fc
3 changed files with 8 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

3
javascript/ql/src/Security/CWE-116/IncompleteSanitization.ql
View File

@@ -166,6 +166,9 @@ where
// URL encoder
repl.getArgument(1).getStringValue().regexpMatch(urlEscapePattern)
)
or
// path sanitizer
(m = ".." or m = "/.." or m = "../" or m = "/../")
) and
// don't flag replace operations in a loop
not DataFlow::valueNode(repl.getReceiver()) = DataFlow::valueNode(repl).getASuccessor+() and