hohn/codeql
1
0
Fork 0
mirror of https://github.com/github/codeql.git synced 2026-04-30 11:15:13 +02:00
Code Issues Packages Projects Releases Wiki Activity

Update javascript/ql/src/experimental/Security/CWE-94/ServerSideTemplateInjection.ql

Browse Source 
Co-authored-by: Erik Krogh Kristensen <erik-krogh@github.com>
This commit is contained in:
monkey-junkie
2020-05-06 14:32:55 +03:00
committed by GitHub
parent 122354a81a
commit 5ce9e0d0a2
1 changed files with 3 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files

5
javascript/ql/src/experimental/Security/CWE-94/ServerSideTemplateInjection.ql
View File

@@ -58,5 +58,6 @@ class SSTINunjucksSink extends ServerSideTemplateInjectionSink {
from DataFlow::PathNode source, DataFlow::PathNode sink, ServerSideTemplateInjectionConfiguration c
where c.hasFlowPath(source, sink)
select sink.getNode(), source, sink, "$@ flows to here and unsafely used as part of rendered template",
source.getNode(), "User-provided value"
select sink.getNode(), source, sink,
"$@ flows to here and unsafely used as part of rendered template", source.getNode(),
"User-provided value"