hohn/codeql
1
0
Fork 0
mirror of https://github.com/github/codeql.git synced 2026-05-01 03:35:13 +02:00
Code Issues Packages Projects Releases Wiki Activity

restrict char class matches to alpha-numeric chars

Browse Source
This commit is contained in:
Erik Krogh Kristensen
2021-08-10 19:58:56 +02:00
parent 59f0a41665
commit 5d4c434d34
1 changed files with 2 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files

3
javascript/ql/src/Security/CWE-116/IncompleteMultiCharacterSanitization.ql
View File

@@ -67,7 +67,8 @@ DangerousPrefixSubstring getADangerousMatchedChar(EmptyReplaceRegExpTerm t) {
or
t.getAMatchedString() = result
or
ReDoSUtil::getCanonicalCharClass(t).(ReDoSUtil::CharacterClass).matches(result)
ReDoSUtil::getCanonicalCharClass(t).(ReDoSUtil::CharacterClass).matches(result) and
result.regexpMatch("\\w")
or
t instanceof RegExpDot and
result.length() = 1