hohn/codeql
1
0
Fork 0
mirror of https://github.com/github/codeql.git synced 2026-03-05 15:16:47 +01:00
Code Issues Packages Projects Releases Wiki Activity

JS: Port TypeConfusionThroughParameterTampering

Browse Source
This commit is contained in:
Asger F
2023-10-05 09:24:00 +02:00
parent 25962a9ba6
commit 5af608c937
4 changed files with 120 additions and 92 deletions
Download Patch File Download Diff File Expand all files Collapse all files

6
javascript/ql/src/Security/CWE-843/TypeConfusionThroughParameterTampering.ql
View File

@@ -12,10 +12,10 @@
import javascript
import semmle.javascript.security.dataflow.TypeConfusionThroughParameterTamperingQuery
import DataFlow::PathGraph
import TypeConfusionFlow::PathGraph
from Configuration cfg, DataFlow::PathNode source, DataFlow::PathNode sink
where cfg.hasFlowPath(source, sink)
from TypeConfusionFlow::PathNode source, TypeConfusionFlow::PathNode sink
where TypeConfusionFlow::flowPath(source, sink)
select sink.getNode(), source, sink,
"Potential type confusion as $@ may be either an array or a string.", source.getNode(),
"this HTTP request parameter"