mirror of
https://github.com/github/codeql.git
synced 2026-04-28 18:25:24 +02:00
Remove Shellwords sanitizer in ql
Note that some sanitizers had no effect because flow through those functions wasn't modeled.
This commit is contained in:
@@ -42,18 +42,6 @@ module CommandInjection {
|
||||
SystemCommandExecutionSink() { exists(SystemCommandExecution c | c.isShellInterpreted(this)) }
|
||||
}
|
||||
|
||||
/**
|
||||
* A call to `Shellwords.escape` or `Shellwords.shellescape` sanitizes its input.
|
||||
*/
|
||||
class ShellwordsEscapeAsSanitizer extends Sanitizer {
|
||||
ShellwordsEscapeAsSanitizer() {
|
||||
this = API::getTopLevelMember("Shellwords").getAMethodCall(["escape", "shellescape"])
|
||||
or
|
||||
// The method is also added as `String#shellescape`.
|
||||
this.(DataFlow::CallNode).getMethodName() = "shellescape"
|
||||
}
|
||||
}
|
||||
|
||||
private class ExternalCommandInjectionSink extends Sink {
|
||||
ExternalCommandInjectionSink() { ModelOutput::sinkNode(this, "command-injection") }
|
||||
}
|
||||
|
||||
Reference in New Issue
Block a user